@strivacity/sdk-core 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
package/dist/flows/BaseFlow.cjs
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
"use strict";var f=Object.defineProperty;var m=(o,e,s)=>e in o?f(o,e,{enumerable:!0,configurable:!0,writable:!0,value:s}):o[e]=s;var i=(o,e,s)=>m(o,typeof e!="symbol"?e+"":e,s);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const _=require("../utils/constants.cjs"),p=require("../utils/jwt.cjs"),g=require("../utils/fetch.cjs"),
|
|
1
|
+
"use strict";var f=Object.defineProperty;var m=(o,e,s)=>e in o?f(o,e,{enumerable:!0,configurable:!0,writable:!0,value:s}):o[e]=s;var i=(o,e,s)=>m(o,typeof e!="symbol"?e+"":e,s);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const _=require("../utils/constants.cjs"),p=require("../utils/jwt.cjs"),g=require("../utils/fetch.cjs"),T=require("../utils/date.cjs"),w=require("../Metadata.cjs"),u=require("../Session.cjs"),y=require("../State.cjs");require("../utils/base64Url.cjs");require("../utils/crypto.cjs");const r={accessTokenExpired:new Set,init:new Set,loggedIn:new Set,loginInitiated:new Set,logoutInitiated:new Set,sessionLoaded:new Set,tokenRefreshed:new Set,tokenRefreshFailed:new Set,tokenRevoked:new Set,tokenRevokeFailed:new Set};class E{constructor(e,s){i(this,"isAuthPromise",null);i(this,"httpClient");i(this,"options");i(this,"storage");i(this,"metadata");i(this,"session",null);if(!e.issuer)throw Error("Missing option: issuer");if(!e.clientId)throw Error("Missing option: clientId");if(!e.redirectUri)throw Error("Missing option: redirectUri");if(e.scopes&&!Array.isArray(e.scopes))throw Error("Invalid option: scopes");e.scopes||(e.scopes=["openid"]),e.responseType||(e.responseType="code"),e.responseMode||(e.responseMode="query"),e.storageTokenName||(e.storageTokenName="sty.session"),this.httpClient=g.fetch.create({retry:0}),this.options=e,this.storage=s,this.metadata=new w.Metadata(`${e.issuer}/.well-known/openid-configuration`),this.session=u.Session.load(this.storage.get(this.options.storageTokenName)),setTimeout(()=>{this.dispatchEvent("init",[]),this.session&&this.accessToken&&this.idTokenClaims&&this.dispatchEvent("sessionLoaded",[{accessToken:this.accessToken,refreshToken:this.refreshToken,claims:this.idTokenClaims}]),this.accessToken&&this.accessTokenExpired&&this.dispatchEvent("accessTokenExpired",[{accessToken:this.accessToken,refreshToken:this.refreshToken}])})}get idTokenClaims(){var e;return(e=this.session)==null?void 0:e.claims}get accessToken(){var e;return(e=this.session)==null?void 0:e.access_token}get refreshToken(){var e;return(e=this.session)==null?void 0:e.refresh_token}get accessTokenExpired(){var e,s;return!((e=this.session)!=null&&e.access_token)||!((s=this.session)!=null&&s.expires_at)||this.session.expires_at<=T.timestamp()}get accessTokenExpirationDate(){var e;return(e=this.session)==null?void 0:e.expires_at}get isAuthenticated(){return this.isAuthPromise?this.isAuthPromise:(this.isAuthPromise=new Promise(async e=>{try{this.refreshToken&&this.accessTokenExpired&&await this.refresh()}catch{}setTimeout(()=>{e(!this.accessTokenExpired),this.isAuthPromise=null})}),this.isAuthPromise)}async logout(e){if(!_.isBrowser)return;const s=this.session;if(this.storage.delete(this.options.storageTokenName),this.session=null,s!=null&&s.id_token){const t=new URL(await this.metadata.endSessionEndpoint);t.searchParams.append("id_token_hint",s==null?void 0:s.id_token),e!=null&&e.postLogoutRedirectUri&&t.searchParams.append("post_logout_redirect_uri",e.postLogoutRedirectUri),this.dispatchEvent("logoutInitiated",[{idToken:s.id_token,claims:s.claims}]);try{await this.urlHandler(t,e)}catch{}}}async refresh(){var s,t;if(typeof((s=this.session)==null?void 0:s.refresh_token)!="string")throw Error("No refresh token available");const e=this.session;try{const n=await this.sendTokenRequest(await this.metadata.tokenEndpoint,{grant_type:"refresh_token",client_id:this.options.clientId,refresh_token:(t=this.session)==null?void 0:t.refresh_token});Object.assign(this.session,await n.json()),this.session.id_token&&(this.session.claims=p.jwt.decode(this.session.id_token)),this.storage.set(this.options.storageTokenName,JSON.stringify(this.session)),this.accessToken&&this.refreshToken&&this.idTokenClaims&&this.dispatchEvent("tokenRefreshed",[{accessToken:this.accessToken,refreshToken:this.refreshToken,claims:this.idTokenClaims}])}catch{this.session=null,this.storage.delete(this.options.storageTokenName),this.dispatchEvent("tokenRefreshFailed",[{refreshToken:e.refresh_token}])}}async revoke(){const e=this.session;let s=!0;try{e!=null&&e.refresh_token?await this.sendTokenRequest(await this.metadata.revocationEndpoint,{client_id:this.options.clientId,token_type_hint:"refresh_token",token:e.refresh_token}):e!=null&&e.access_token&&await this.sendTokenRequest(await this.metadata.revocationEndpoint,{client_id:this.options.clientId,token_type_hint:"access_token",token:e.access_token})}catch{s=!1}finally{this.session=null,this.storage.delete(this.options.storageTokenName),e!=null&&e.refresh_token?this.dispatchEvent(s?"tokenRevoked":"tokenRevokeFailed",[{token:e.refresh_token,tokenTypeHint:"refresh_token"}]):e!=null&&e.access_token&&this.dispatchEvent(s?"tokenRevoked":"tokenRevokeFailed",[{token:e.access_token,tokenTypeHint:"access_token"}])}}async exchangeCodeForTokens(e={}){var n,a,h,c,d,l;if(this.session=new u.Session,Object.assign(this.session,e),this.session.error)throw Error(`${this.session.error}: ${this.session.error_description}`);if(!this.session.code)throw Error("Invalid or missing code");let s;try{const k=this.storage.get(`sty.${this.session.state}`);if(!k)throw Error();s=y.State.fromSerializedData(k),this.storage.delete(`sty.${this.session.state}`)}catch{throw Error("Invalid or missing state")}const t=await this.sendTokenRequest(await this.metadata.tokenEndpoint,{grant_type:"authorization_code",client_id:this.options.clientId,redirect_uri:this.options.redirectUri,code_verifier:s.codeVerifier,code:this.session.code});if(Object.assign(this.session,await t.json()),this.session.id_token&&(this.session.claims=p.jwt.decode(this.session.id_token)),this.session.scope!==((n=this.options.scopes)==null?void 0:n.join(" ")))throw Error("Invalid scope");if(((a=this.session.claims)==null?void 0:a.nonce)!==s.nonce)throw Error("Invalid nonce");if(((h=this.session.claims)==null?void 0:h.iss)!==await this.metadata.issuer)throw Error("Invalid iss");if(Array.isArray((c=this.session.claims)==null?void 0:c.aud)?((d=this.session.claims)==null?void 0:d.aud[0])!==this.options.clientId:((l=this.session.claims)==null?void 0:l.aud)!==this.options.clientId)throw Error("Invalid aud");this.storage.set(this.options.storageTokenName,JSON.stringify(this.session))}subscribeToEvent(e,s){return r[e].add(s),{dispose:()=>{r[e].delete(s)}}}dispatchEvent(e,s){for(const t of r[e])t(...s)}async getAuthorizationUrl(e={}){var t;const s=new URL(await this.metadata.authorizationEndpoint);return s.searchParams.append("client_id",this.options.clientId),s.searchParams.append("redirect_uri",this.options.redirectUri),s.searchParams.append("response_type",this.options.responseType||"code"),s.searchParams.append("response_mode",this.options.responseMode||"fragment"),s.searchParams.append("scope",(t=this.options.scopes)==null?void 0:t.join(" ")),s.searchParams.append("code_challenge_method","S256"),e.prompt&&s.searchParams.append("prompt",e.prompt),e.acrValues&&s.searchParams.append("acr_values",e.acrValues.join(" ")),e.loginHint&&s.searchParams.append("login_hint",e.loginHint),e.uiLocales&&s.searchParams.append("ui_locales",e.uiLocales.join(" ")),s}async sendTokenRequest(e,s={}){return await this.httpClient.post(e,{headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(s)})}}exports.BaseFlow=E;
|
|
2
2
|
//# sourceMappingURL=BaseFlow.cjs.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BaseFlow.cjs","sources":["../../src/flows/BaseFlow.ts"],"sourcesContent":["import type { KyInstance } from 'ky';\nimport type { IdTokenClaims, SDKOptions, SDKStorage, EventFunctions, ExtraRequestArgs, LogoutOptions } from '../types';\nimport { isBrowser } from '../utils/constants';\nimport { jwt } from '../utils/jwt';\nimport { fetch } from '../utils/fetch';\nimport { timestamp } from '../utils/date';\nimport { Metadata } from '../Metadata';\nimport { Session } from '../Session';\nimport { State } from '../State';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst eventCallbacks: Record<keyof EventFunctions, Set<(...args: Array<any>) => Promise<void> | void>> = {\n\taccessTokenExpired: new Set(),\n\tinit: new Set(),\n\tloggedIn: new Set(),\n\tloginInitiated: new Set(),\n\tlogoutInitiated: new Set(),\n\tsessionLoaded: new Set(),\n\ttokenRefreshed: new Set(),\n\ttokenRefreshFailed: new Set(),\n\ttokenRevoked: new Set(),\n\ttokenRevokeFailed: new Set(),\n};\n\n/**\n * An abstract base class that provides common functionality for different OIDC flows.\n *\n * @template Options - The options type extending `SDKOptions` used for configuring the flow.\n * @template URLHandlerOptions - The options type extending `ExtraRequestArgs` used for URL handling.\n */\nexport abstract class BaseFlow<Options extends SDKOptions, URLHandlerOptions extends ExtraRequestArgs> {\n\t/**\n\t * A promise that resolves to indicate whether authentication has been verified.\n\t *\n\t * @type {Promise<boolean> | null}\n\t */\n\tprotected isAuthPromise: Promise<boolean> | null = null;\n\n\t/**\n\t * An instance of the HTTP client used for making requests.\n\t *\n\t * @type {KyInstance}\n\t */\n\tprotected httpClient!: KyInstance;\n\n\t/**\n\t * The configuration options for the flow.\n\t *\n\t * @type {Options}\n\t */\n\tprotected options: Options;\n\n\t/**\n\t * The storage mechanism used to persist session data.\n\t *\n\t * @type {SDKStorage}\n\t */\n\tprotected storage: SDKStorage;\n\n\t/**\n\t * Metadata information about the authorization server.\n\t *\n\t * @type {Metadata}\n\t */\n\tprotected metadata: Metadata;\n\n\t/**\n\t * The current session data.\n\t *\n\t * @type {Session | null}\n\t */\n\tprotected session: Session | null = null;\n\n\t/**\n\t * Retrieves the ID token claims from the current session.\n\t *\n\t * @type {IdTokenClaims | null | undefined}\n\t */\n\tget idTokenClaims(): IdTokenClaims | null | undefined {\n\t\treturn this.session?.claims;\n\t}\n\n\t/**\n\t * Retrieves the access token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget accessToken(): string | null | undefined {\n\t\treturn this.session?.access_token;\n\t}\n\n\t/**\n\t * Retrieves the refresh token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget refreshToken(): string | null | undefined {\n\t\treturn this.session?.refresh_token;\n\t}\n\n\t/**\n\t * Determines if the access token has expired.\n\t *\n\t * @type {boolean}\n\t */\n\tget accessTokenExpired(): boolean {\n\t\treturn !this.session?.expires_at || this.session.expires_at <= timestamp();\n\t}\n\n\t/**\n\t * Retrieves the access token expiration date.\n\t *\n\t * @type {number | null | undefined}\n\t */\n\tget accessTokenExpirationDate(): number | null | undefined {\n\t\treturn this.session?.expires_at;\n\t}\n\n\t/**\n\t * Checks if the user is authenticated by evaluating the presence of access or refresh tokens.\n\t *\n\t * @returns {Promise<boolean>} - A promise that resolves to `true` if the user is authenticated, otherwise `false`.\n\t */\n\tget isAuthenticated(): Promise<boolean> {\n\t\tif (this.isAuthPromise) {\n\t\t\treturn this.isAuthPromise;\n\t\t}\n\n\t\t// eslint-disable-next-line no-async-promise-executor\n\t\tthis.isAuthPromise = new Promise(async (resolve) => {\n\t\t\ttry {\n\t\t\t\tif (this.refreshToken && this.accessTokenExpired) {\n\t\t\t\t\tawait this.refresh();\n\t\t\t\t}\n\t\t\t} catch {}\n\n\t\t\tsetTimeout(() => {\n\t\t\t\tresolve(!!this.session?.access_token || !!this.session?.refresh_token);\n\t\t\t\tthis.isAuthPromise = null;\n\t\t\t});\n\t\t});\n\n\t\treturn this.isAuthPromise;\n\t}\n\n\t/**\n\t * Constructs a new instance of the `BaseFlow` class.\n\t *\n\t * @param {Options} options - Configuration options for the flow.\n\t * @param {SDKStorage} storage - Storage mechanism for session data.\n\t *\n\t * @throws {Error} Throws an error if required options are missing or invalid.\n\t */\n\tconstructor(options: Options, storage: SDKStorage) {\n\t\tif (!options.issuer) {\n\t\t\tthrow Error('Missing option: issuer');\n\t\t}\n\t\tif (!options.clientId) {\n\t\t\tthrow Error('Missing option: clientId');\n\t\t}\n\t\tif (!options.redirectUri) {\n\t\t\tthrow Error('Missing option: redirectUri');\n\t\t}\n\t\tif (options.scopes && !Array.isArray(options.scopes)) {\n\t\t\tthrow Error('Invalid option: scopes');\n\t\t}\n\n\t\tif (!options.scopes) {\n\t\t\toptions.scopes = ['openid'];\n\t\t}\n\t\tif (!options.responseType) {\n\t\t\toptions.responseType = 'code';\n\t\t}\n\t\tif (!options.responseMode) {\n\t\t\toptions.responseMode = 'query';\n\t\t}\n\t\tif (!options.storageTokenName) {\n\t\t\toptions.storageTokenName = 'sty.session';\n\t\t}\n\n\t\tthis.httpClient = fetch.create({ retry: 0 });\n\t\tthis.options = options as Options;\n\t\tthis.storage = storage;\n\t\tthis.metadata = new Metadata(`${options.issuer}/.well-known/openid-configuration`);\n\t\tthis.session = Session.load(this.storage.get(this.options.storageTokenName as string));\n\n\t\tsetTimeout(() => {\n\t\t\tthis.dispatchEvent('init', []);\n\n\t\t\tif (this.session && this.accessToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('sessionLoaded', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\n\t\t\tif (this.accessToken && this.accessTokenExpired) {\n\t\t\t\tthis.dispatchEvent('accessTokenExpired', [{ accessToken: this.accessToken, refreshToken: this.refreshToken }]);\n\t\t\t}\n\t\t});\n\t}\n\n\t/**\n\t * Initiates the login process. Subclasses should implement this method to handle the specific login flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during login.\n\t * @returns {Promise<void>} - A promise that resolves when the login process is complete.\n\t */\n\tabstract login(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Registers a new user. Subclasses should implement this method to handle the specific registration flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during registration.\n\t * @returns {Promise<void>} - A promise that resolves when the registration process is complete.\n\t */\n\tabstract register(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Logs out the current user and optionally redirects to a post-logout URI.\n\t *\n\t * @param {URLHandlerOptions & LogoutOptions} [options] - Additional options for handling URLs during logout.\n\t * @returns {Promise<void>} - A promise that resolves when the logout process is complete.\n\t */\n\tasync logout(options?: URLHandlerOptions & LogoutOptions): Promise<void> {\n\t\tif (!isBrowser) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\tthis.storage.delete(this.options.storageTokenName as string);\n\t\tthis.session = null;\n\n\t\tif (session?.id_token) {\n\t\t\tconst url = new URL(await this.metadata.endSessionEndpoint);\n\n\t\t\turl.searchParams.append('id_token_hint', session?.id_token);\n\n\t\t\tif (options?.postLogoutRedirectUri) {\n\t\t\t\turl.searchParams.append('post_logout_redirect_uri', options.postLogoutRedirectUri);\n\t\t\t}\n\n\t\t\tthis.dispatchEvent('logoutInitiated', [{ idToken: session.id_token, claims: session.claims as IdTokenClaims }]);\n\n\t\t\ttry {\n\t\t\t\tawait this.urlHandler(url, options as URLHandlerOptions);\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t/**\n\t * Refreshes the access token using the refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token refresh is complete.\n\t *\n\t * @throws {Error} Throws an error if no refresh token is available or if the refresh fails.\n\t */\n\tasync refresh(): Promise<void> {\n\t\tif (typeof this.session?.refresh_token !== 'string') {\n\t\t\tthrow Error('No refresh token available');\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\ttry {\n\t\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\trefresh_token: this.session?.refresh_token,\n\t\t\t});\n\n\t\t\tObject.assign(this.session, await request.json());\n\n\t\t\tif (this.session.id_token) {\n\t\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t\t}\n\n\t\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\n\t\t\tif (this.accessToken && this.refreshToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('tokenRefreshed', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\t\t} catch {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tthis.dispatchEvent('tokenRefreshFailed', [{ refreshToken: session.refresh_token as string }]);\n\t\t}\n\t}\n\n\t/**\n\t * Revokes the current access or refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token revocation is complete.\n\t */\n\tasync revoke(): Promise<void> {\n\t\tconst session = this.session;\n\t\tlet success = true;\n\n\t\ttry {\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'refresh_token',\n\t\t\t\t\ttoken: session.refresh_token,\n\t\t\t\t});\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'access_token',\n\t\t\t\t\ttoken: session.access_token,\n\t\t\t\t});\n\t\t\t}\n\t\t} catch {\n\t\t\tsuccess = false;\n\t\t} finally {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.refresh_token as string, tokenTypeHint: 'refresh_token' }]);\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.access_token as string, tokenTypeHint: 'access_token' }]);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Exchanges an authorization code for access and refresh tokens.\n\t *\n\t * @param {Record<string, string>} [params={}] - Parameters containing the authorization code and other required values.\n\t * @returns {Promise<void>} - A promise that resolves when the token exchange is complete.\n\t *\n\t * @throws {Error} Throws an error if the authorization code is invalid or if there are issues with state, nonce, or tokens.\n\t */\n\tasync exchangeCodeForTokens(params: Record<string, string> = {}): Promise<void> {\n\t\tthis.session = new Session();\n\n\t\tObject.assign(this.session, params);\n\n\t\tif (this.session.error) {\n\t\t\tthrow Error(`${this.session.error}: ${this.session.error_description}`);\n\t\t}\n\t\tif (!this.session.code) {\n\t\t\tthrow Error('Invalid or missing code');\n\t\t}\n\n\t\tlet state: State;\n\n\t\ttry {\n\t\t\tconst serializedState = this.storage.get(`sty.${this.session.state}`);\n\n\t\t\tif (!serializedState) {\n\t\t\t\tthrow Error();\n\t\t\t}\n\n\t\t\tstate = State.fromSerializedData(serializedState);\n\n\t\t\tthis.storage.delete(`sty.${this.session.state}`);\n\t\t} catch {\n\t\t\tthrow Error('Invalid or missing state');\n\t\t}\n\n\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\tgrant_type: 'authorization_code',\n\t\t\tclient_id: this.options.clientId,\n\t\t\tredirect_uri: this.options.redirectUri,\n\t\t\tcode_verifier: state.codeVerifier,\n\t\t\tcode: this.session.code,\n\t\t});\n\n\t\tObject.assign(this.session, await request.json());\n\n\t\tif (this.session.id_token) {\n\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t}\n\n\t\tif (this.session.scope !== this.options.scopes?.join(' ')) {\n\t\t\tthrow Error('Invalid scope');\n\t\t}\n\t\tif (this.session.claims?.nonce !== state.nonce) {\n\t\t\tthrow Error('Invalid nonce');\n\t\t}\n\t\tif (this.session.claims?.iss !== (await this.metadata.issuer)) {\n\t\t\tthrow Error('Invalid iss');\n\t\t}\n\t\tif (Array.isArray(this.session.claims?.aud) ? this.session.claims?.aud[0] !== this.options.clientId : this.session.claims?.aud !== this.options.clientId) {\n\t\t\tthrow Error('Invalid aud');\n\t\t}\n\n\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\t}\n\n\t/**\n\t * Subscribes a callback function to an event.\n\t *\n\t * @param {T} eventName - The name of the event to subscribe to.\n\t * @param {(...params: Parameters<EventFunctions[T]>) => Promise<void> | void} callbackFn - The callback function to execute when the event is dispatched.\n\t * @returns {{ dispose: () => void }} - An object with a `dispose` method to remove the subscription.\n\t */\n\tsubscribeToEvent<T extends keyof EventFunctions>(\n\t\teventName: T,\n\t\tcallbackFn: (...params: Parameters<EventFunctions[T]>) => Promise<void> | void,\n\t): { dispose: () => void } {\n\t\teventCallbacks[eventName].add(callbackFn);\n\n\t\treturn {\n\t\t\tdispose: () => {\n\t\t\t\teventCallbacks[eventName].delete(callbackFn);\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Dispatches an event to all subscribed callback functions.\n\t *\n\t * @param {T} eventName - The name of the event to dispatch.\n\t * @param {Parameters<EventFunctions[T]>} args - The arguments to pass to the callback functions.\n\t */\n\tprotected dispatchEvent<T extends keyof EventFunctions>(eventName: T, args: Parameters<EventFunctions[T]>): void {\n\t\tfor (const eventFn of eventCallbacks[eventName]) {\n\t\t\tvoid eventFn(...args);\n\t\t}\n\t}\n\n\t/**\n\t * Constructs the authorization URL for initiating the authorization flow.\n\t *\n\t * @param {ExtraRequestArgs} [options={}] - Additional options to include in the authorization URL.\n\t * @returns {Promise<URL>} - A promise that resolves to the constructed authorization URL.\n\t */\n\tprotected async getAuthorizationUrl(options: ExtraRequestArgs = {}): Promise<URL> {\n\t\tconst url = new URL(await this.metadata.authorizationEndpoint);\n\n\t\turl.searchParams.append('client_id', this.options.clientId);\n\t\turl.searchParams.append('redirect_uri', this.options.redirectUri);\n\t\turl.searchParams.append('response_type', this.options.responseType || 'code');\n\t\turl.searchParams.append('response_mode', this.options.responseMode || 'fragment');\n\t\turl.searchParams.append('scope', this.options.scopes?.join(' ') as string);\n\t\turl.searchParams.append('code_challenge_method', 'S256');\n\n\t\tif (options.prompt) {\n\t\t\turl.searchParams.append('prompt', options.prompt);\n\t\t}\n\t\tif (options.acrValues) {\n\t\t\turl.searchParams.append('acr_values', options.acrValues.join(' '));\n\t\t}\n\t\tif (options.loginHint) {\n\t\t\turl.searchParams.append('login_hint', options.loginHint);\n\t\t}\n\t\tif (options.uiLocales) {\n\t\t\turl.searchParams.append('ui_locales', options.uiLocales.join(' '));\n\t\t}\n\n\t\treturn url;\n\t}\n\n\t/**\n\t * Handles URL redirections for authentication and authorization processes.\n\t *\n\t * @param {string | URL} url - The URL to handle.\n\t * @param {URLHandlerOptions} [options] - Additional options for URL handling.\n\t * @returns {Promise<unknown>} - A promise that resolves when the URL handling is complete.\n\t */\n\tprotected abstract urlHandler(url: string | URL, options?: URLHandlerOptions): Promise<unknown>;\n\n\t/**\n\t * Sends a token request to the specified URL with the given data.\n\t *\n\t * @param {string | URL} url - The URL to send the request to.\n\t * @param {Record<string, string>} [data={}] - The data to include in the request body.\n\t * @returns {Promise<Response>} - A promise that resolves to the response from the request.\n\t */\n\tprotected async sendTokenRequest(url: string | URL, data: Record<string, string> = {}): Promise<Response> {\n\t\treturn await this.httpClient.post(url, {\n\t\t\theaders: { 'Content-Type': 'application/x-www-form-urlencoded' },\n\t\t\tbody: new URLSearchParams(data),\n\t\t});\n\t}\n}\n"],"names":["eventCallbacks","BaseFlow","options","storage","__publicField","fetch","Metadata","Session","_a","timestamp","resolve","_b","isBrowser","session","url","request","jwt","success","params","state","serializedState","State","_c","_d","_e","_f","eventName","callbackFn","args","eventFn","data"],"mappings":"+gBAWA,MAAMA,EAAmG,CACxG,uBAAwB,IACxB,SAAU,IACV,aAAc,IACd,mBAAoB,IACpB,oBAAqB,IACrB,kBAAmB,IACnB,mBAAoB,IACpB,uBAAwB,IACxB,iBAAkB,IAClB,sBAAuB,GACxB,EAQO,MAAeC,CAAiF,CA2HtG,YAAYC,EAAkBC,EAAqB,CArHzCC,EAAA,qBAAyC,MAOzCA,EAAA,mBAOAA,EAAA,gBAOAA,EAAA,gBAOAA,EAAA,iBAOAA,EAAA,eAA0B,MAmF/B,GAAA,CAACF,EAAQ,OACZ,MAAM,MAAM,wBAAwB,EAEjC,GAAA,CAACA,EAAQ,SACZ,MAAM,MAAM,0BAA0B,EAEnC,GAAA,CAACA,EAAQ,YACZ,MAAM,MAAM,6BAA6B,EAE1C,GAAIA,EAAQ,QAAU,CAAC,MAAM,QAAQA,EAAQ,MAAM,EAClD,MAAM,MAAM,wBAAwB,EAGhCA,EAAQ,SACJA,EAAA,OAAS,CAAC,QAAQ,GAEtBA,EAAQ,eACZA,EAAQ,aAAe,QAEnBA,EAAQ,eACZA,EAAQ,aAAe,SAEnBA,EAAQ,mBACZA,EAAQ,iBAAmB,eAG5B,KAAK,WAAaG,QAAM,OAAO,CAAE,MAAO,EAAG,EAC3C,KAAK,QAAUH,EACf,KAAK,QAAUC,EACf,KAAK,SAAW,IAAIG,WAAS,GAAGJ,EAAQ,MAAM,mCAAmC,EAC5E,KAAA,QAAUK,UAAQ,KAAK,KAAK,QAAQ,IAAI,KAAK,QAAQ,gBAA0B,CAAC,EAErF,WAAW,IAAM,CACX,KAAA,cAAc,OAAQ,CAAA,CAAE,EAEzB,KAAK,SAAW,KAAK,aAAe,KAAK,eAC5C,KAAK,cAAc,gBAAiB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,EAGjI,KAAK,aAAe,KAAK,oBACvB,KAAA,cAAc,qBAAsB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,YAAa,CAAC,CAAC,CAC9G,CACA,CACF,CAvHA,IAAI,eAAkD,OACrD,OAAOC,EAAA,KAAK,UAAL,YAAAA,EAAc,MACtB,CAOA,IAAI,aAAyC,OAC5C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,YACtB,CAOA,IAAI,cAA0C,OAC7C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,aACtB,CAOA,IAAI,oBAA8B,OACjC,MAAO,GAACA,EAAA,KAAK,UAAL,MAAAA,EAAc,aAAc,KAAK,QAAQ,YAAcC,EAAAA,WAChE,CAOA,IAAI,2BAAuD,OAC1D,OAAOD,EAAA,KAAK,UAAL,YAAAA,EAAc,UACtB,CAOA,IAAI,iBAAoC,CACvC,OAAI,KAAK,cACD,KAAK,eAIb,KAAK,cAAgB,IAAI,QAAQ,MAAOE,GAAY,CAC/C,GAAA,CACC,KAAK,cAAgB,KAAK,oBAC7B,MAAM,KAAK,SACZ,MACO,CAAC,CAET,WAAW,IAAM,SACRA,EAAA,CAAC,GAACF,EAAA,KAAK,UAAL,MAAAA,EAAc,eAAgB,CAAC,GAACG,EAAA,KAAK,UAAL,MAAAA,EAAc,cAAa,EACrE,KAAK,cAAgB,IAAA,CACrB,CAAA,CACD,EAEM,KAAK,cACb,CA8EA,MAAM,OAAOT,EAA4D,CACxE,GAAI,CAACU,EAAAA,UACJ,OAGD,MAAMC,EAAU,KAAK,QAKrB,GAHA,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAC3D,KAAK,QAAU,KAEXA,GAAA,MAAAA,EAAS,SAAU,CACtB,MAAMC,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,kBAAkB,EAE1DA,EAAI,aAAa,OAAO,gBAAiBD,GAAA,YAAAA,EAAS,QAAQ,EAEtDX,GAAA,MAAAA,EAAS,uBACZY,EAAI,aAAa,OAAO,2BAA4BZ,EAAQ,qBAAqB,EAG7E,KAAA,cAAc,kBAAmB,CAAC,CAAE,QAASW,EAAQ,SAAU,OAAQA,EAAQ,MAAwB,CAAC,CAAC,EAE1G,GAAA,CACG,MAAA,KAAK,WAAWC,EAAKZ,CAA4B,CAAA,MAChD,CAAC,CACV,CACD,CASA,MAAM,SAAyB,SAC9B,GAAI,QAAOM,EAAA,KAAK,UAAL,YAAAA,EAAc,gBAAkB,SAC1C,MAAM,MAAM,4BAA4B,EAGzC,MAAMK,EAAU,KAAK,QAEjB,GAAA,CACH,MAAME,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,gBACZ,UAAW,KAAK,QAAQ,SACxB,eAAeJ,EAAA,KAAK,UAAL,YAAAA,EAAc,aAAA,CAC7B,EAED,OAAO,OAAO,KAAK,QAAS,MAAMI,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAA,IAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGjE,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,EAElF,KAAK,aAAe,KAAK,cAAgB,KAAK,eACjD,KAAK,cAAc,iBAAkB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,CACtI,MACO,CACP,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEtD,KAAA,cAAc,qBAAsB,CAAC,CAAE,aAAcH,EAAQ,aAAyB,CAAA,CAAC,CAC7F,CACD,CAOA,MAAM,QAAwB,CAC7B,MAAMA,EAAU,KAAK,QACrB,IAAII,EAAU,GAEV,GAAA,CACCJ,GAAA,MAAAA,EAAS,cACZ,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,gBACjB,MAAOA,EAAQ,aAAA,CACf,EACSA,GAAA,MAAAA,EAAS,cACnB,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,eACjB,MAAOA,EAAQ,YAAA,CACf,CACF,MACO,CACGI,EAAA,EAAA,QACT,CACD,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEvDJ,GAAA,MAAAA,EAAS,cACZ,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,cAAyB,cAAe,eAAgB,CAAC,CAAC,EACrIA,GAAA,MAAAA,EAAS,cACnB,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,aAAwB,cAAe,cAAe,CAAC,CAAC,CAE/I,CACD,CAUA,MAAM,sBAAsBK,EAAiC,GAAmB,iBAK3E,GAJC,KAAA,QAAU,IAAIX,EAAAA,QAEZ,OAAA,OAAO,KAAK,QAASW,CAAM,EAE9B,KAAK,QAAQ,MACV,MAAA,MAAM,GAAG,KAAK,QAAQ,KAAK,KAAK,KAAK,QAAQ,iBAAiB,EAAE,EAEnE,GAAA,CAAC,KAAK,QAAQ,KACjB,MAAM,MAAM,yBAAyB,EAGlC,IAAAC,EAEA,GAAA,CACG,MAAAC,EAAkB,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,KAAK,EAAE,EAEpE,GAAI,CAACA,EACJ,MAAM,MAAM,EAGLD,EAAAE,EAAA,MAAM,mBAAmBD,CAAe,EAEhD,KAAK,QAAQ,OAAO,OAAO,KAAK,QAAQ,KAAK,EAAE,CAAA,MACxC,CACP,MAAM,MAAM,0BAA0B,CACvC,CAEA,MAAML,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,qBACZ,UAAW,KAAK,QAAQ,SACxB,aAAc,KAAK,QAAQ,YAC3B,cAAeI,EAAM,aACrB,KAAM,KAAK,QAAQ,IAAA,CACnB,EAQG,GANJ,OAAO,OAAO,KAAK,QAAS,MAAMJ,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAA,IAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGlE,KAAK,QAAQ,UAAUR,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,MACpD,MAAM,MAAM,eAAe,EAE5B,KAAIG,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,SAAUQ,EAAM,MACxC,MAAM,MAAM,eAAe,EAE5B,KAAIG,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAS,MAAM,KAAK,SAAS,OACrD,MAAM,MAAM,aAAa,EAEtB,GAAA,MAAM,SAAQC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,GAAG,IAAIC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,IAAI,MAAO,KAAK,QAAQ,WAAWC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAQ,KAAK,QAAQ,SAC/I,MAAM,MAAM,aAAa,EAGrB,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,CACvF,CASA,iBACCC,EACAC,EAC0B,CACX,OAAA3B,EAAA0B,CAAS,EAAE,IAAIC,CAAU,EAEjC,CACN,QAAS,IAAM,CACC3B,EAAA0B,CAAS,EAAE,OAAOC,CAAU,CAC5C,CAAA,CAEF,CAQU,cAA8CD,EAAcE,EAA2C,CACrG,UAAAC,KAAW7B,EAAe0B,CAAS,EACxCG,EAAQ,GAAGD,CAAI,CAEtB,CAQA,MAAgB,oBAAoB1B,EAA4B,GAAkB,OACjF,MAAMY,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,qBAAqB,EAE7D,OAAAA,EAAI,aAAa,OAAO,YAAa,KAAK,QAAQ,QAAQ,EAC1DA,EAAI,aAAa,OAAO,eAAgB,KAAK,QAAQ,WAAW,EAChEA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,MAAM,EAC5EA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,UAAU,EAC5EA,EAAA,aAAa,OAAO,SAASN,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,IAAc,EACrEM,EAAA,aAAa,OAAO,wBAAyB,MAAM,EAEnDZ,EAAQ,QACXY,EAAI,aAAa,OAAO,SAAUZ,EAAQ,MAAM,EAE7CA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAE9DA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,SAAS,EAEpDA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAG3DY,CACR,CAkBA,MAAgB,iBAAiBA,EAAmBgB,EAA+B,GAAuB,CACzG,OAAO,MAAM,KAAK,WAAW,KAAKhB,EAAK,CACtC,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,IAAI,gBAAgBgB,CAAI,CAAA,CAC9B,CACF,CACD"}
|
|
1
|
+
{"version":3,"file":"BaseFlow.cjs","sources":["../../src/flows/BaseFlow.ts"],"sourcesContent":["import type { KyInstance } from 'ky';\nimport type { IdTokenClaims, SDKOptions, SDKStorage, EventFunctions, ExtraRequestArgs, LogoutOptions } from '../types';\nimport { isBrowser } from '../utils/constants';\nimport { jwt } from '../utils/jwt';\nimport { fetch } from '../utils/fetch';\nimport { timestamp } from '../utils/date';\nimport { Metadata } from '../Metadata';\nimport { Session } from '../Session';\nimport { State } from '../State';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst eventCallbacks: Record<keyof EventFunctions, Set<(...args: Array<any>) => Promise<void> | void>> = {\n\taccessTokenExpired: new Set(),\n\tinit: new Set(),\n\tloggedIn: new Set(),\n\tloginInitiated: new Set(),\n\tlogoutInitiated: new Set(),\n\tsessionLoaded: new Set(),\n\ttokenRefreshed: new Set(),\n\ttokenRefreshFailed: new Set(),\n\ttokenRevoked: new Set(),\n\ttokenRevokeFailed: new Set(),\n};\n\n/**\n * An abstract base class that provides common functionality for different OIDC flows.\n *\n * @template Options - The options type extending `SDKOptions` used for configuring the flow.\n * @template URLHandlerOptions - The options type extending `ExtraRequestArgs` used for URL handling.\n */\nexport abstract class BaseFlow<Options extends SDKOptions, URLHandlerOptions extends ExtraRequestArgs> {\n\t/**\n\t * A promise that resolves to indicate whether authentication has been verified.\n\t *\n\t * @type {Promise<boolean> | null}\n\t */\n\tprotected isAuthPromise: Promise<boolean> | null = null;\n\n\t/**\n\t * An instance of the HTTP client used for making requests.\n\t *\n\t * @type {KyInstance}\n\t */\n\tprotected httpClient!: KyInstance;\n\n\t/**\n\t * The configuration options for the flow.\n\t *\n\t * @type {Options}\n\t */\n\tprotected options: Options;\n\n\t/**\n\t * The storage mechanism used to persist session data.\n\t *\n\t * @type {SDKStorage}\n\t */\n\tprotected storage: SDKStorage;\n\n\t/**\n\t * Metadata information about the authorization server.\n\t *\n\t * @type {Metadata}\n\t */\n\tprotected metadata: Metadata;\n\n\t/**\n\t * The current session data.\n\t *\n\t * @type {Session | null}\n\t */\n\tprotected session: Session | null = null;\n\n\t/**\n\t * Retrieves the ID token claims from the current session.\n\t *\n\t * @type {IdTokenClaims | null | undefined}\n\t */\n\tget idTokenClaims(): IdTokenClaims | null | undefined {\n\t\treturn this.session?.claims;\n\t}\n\n\t/**\n\t * Retrieves the access token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget accessToken(): string | null | undefined {\n\t\treturn this.session?.access_token;\n\t}\n\n\t/**\n\t * Retrieves the refresh token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget refreshToken(): string | null | undefined {\n\t\treturn this.session?.refresh_token;\n\t}\n\n\t/**\n\t * Determines if the access token has expired.\n\t *\n\t * @type {boolean}\n\t */\n\tget accessTokenExpired(): boolean {\n\t\treturn !this.session?.access_token || !this.session?.expires_at || this.session.expires_at <= timestamp();\n\t}\n\n\t/**\n\t * Retrieves the access token expiration date.\n\t *\n\t * @type {number | null | undefined}\n\t */\n\tget accessTokenExpirationDate(): number | null | undefined {\n\t\treturn this.session?.expires_at;\n\t}\n\n\t/**\n\t * Checks if the user is authenticated by evaluating the presence of access or refresh tokens.\n\t *\n\t * @returns {Promise<boolean>} - A promise that resolves to `true` if the user is authenticated, otherwise `false`.\n\t */\n\tget isAuthenticated(): Promise<boolean> {\n\t\tif (this.isAuthPromise) {\n\t\t\treturn this.isAuthPromise;\n\t\t}\n\n\t\t// eslint-disable-next-line no-async-promise-executor\n\t\tthis.isAuthPromise = new Promise(async (resolve) => {\n\t\t\ttry {\n\t\t\t\tif (this.refreshToken && this.accessTokenExpired) {\n\t\t\t\t\tawait this.refresh();\n\t\t\t\t}\n\t\t\t} catch {}\n\n\t\t\tsetTimeout(() => {\n\t\t\t\tresolve(!this.accessTokenExpired);\n\t\t\t\tthis.isAuthPromise = null;\n\t\t\t});\n\t\t});\n\n\t\treturn this.isAuthPromise;\n\t}\n\n\t/**\n\t * Constructs a new instance of the `BaseFlow` class.\n\t *\n\t * @param {Options} options - Configuration options for the flow.\n\t * @param {SDKStorage} storage - Storage mechanism for session data.\n\t *\n\t * @throws {Error} Throws an error if required options are missing or invalid.\n\t */\n\tconstructor(options: Options, storage: SDKStorage) {\n\t\tif (!options.issuer) {\n\t\t\tthrow Error('Missing option: issuer');\n\t\t}\n\t\tif (!options.clientId) {\n\t\t\tthrow Error('Missing option: clientId');\n\t\t}\n\t\tif (!options.redirectUri) {\n\t\t\tthrow Error('Missing option: redirectUri');\n\t\t}\n\t\tif (options.scopes && !Array.isArray(options.scopes)) {\n\t\t\tthrow Error('Invalid option: scopes');\n\t\t}\n\n\t\tif (!options.scopes) {\n\t\t\toptions.scopes = ['openid'];\n\t\t}\n\t\tif (!options.responseType) {\n\t\t\toptions.responseType = 'code';\n\t\t}\n\t\tif (!options.responseMode) {\n\t\t\toptions.responseMode = 'query';\n\t\t}\n\t\tif (!options.storageTokenName) {\n\t\t\toptions.storageTokenName = 'sty.session';\n\t\t}\n\n\t\tthis.httpClient = fetch.create({ retry: 0 });\n\t\tthis.options = options as Options;\n\t\tthis.storage = storage;\n\t\tthis.metadata = new Metadata(`${options.issuer}/.well-known/openid-configuration`);\n\t\tthis.session = Session.load(this.storage.get(this.options.storageTokenName as string));\n\n\t\tsetTimeout(() => {\n\t\t\tthis.dispatchEvent('init', []);\n\n\t\t\tif (this.session && this.accessToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('sessionLoaded', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\n\t\t\tif (this.accessToken && this.accessTokenExpired) {\n\t\t\t\tthis.dispatchEvent('accessTokenExpired', [{ accessToken: this.accessToken, refreshToken: this.refreshToken }]);\n\t\t\t}\n\t\t});\n\t}\n\n\t/**\n\t * Initiates the login process. Subclasses should implement this method to handle the specific login flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during login.\n\t * @returns {Promise<void>} - A promise that resolves when the login process is complete.\n\t */\n\tabstract login(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Registers a new user. Subclasses should implement this method to handle the specific registration flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during registration.\n\t * @returns {Promise<void>} - A promise that resolves when the registration process is complete.\n\t */\n\tabstract register(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Logs out the current user and optionally redirects to a post-logout URI.\n\t *\n\t * @param {URLHandlerOptions & LogoutOptions} [options] - Additional options for handling URLs during logout.\n\t * @returns {Promise<void>} - A promise that resolves when the logout process is complete.\n\t */\n\tasync logout(options?: URLHandlerOptions & LogoutOptions): Promise<void> {\n\t\tif (!isBrowser) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\tthis.storage.delete(this.options.storageTokenName as string);\n\t\tthis.session = null;\n\n\t\tif (session?.id_token) {\n\t\t\tconst url = new URL(await this.metadata.endSessionEndpoint);\n\n\t\t\turl.searchParams.append('id_token_hint', session?.id_token);\n\n\t\t\tif (options?.postLogoutRedirectUri) {\n\t\t\t\turl.searchParams.append('post_logout_redirect_uri', options.postLogoutRedirectUri);\n\t\t\t}\n\n\t\t\tthis.dispatchEvent('logoutInitiated', [{ idToken: session.id_token, claims: session.claims as IdTokenClaims }]);\n\n\t\t\ttry {\n\t\t\t\tawait this.urlHandler(url, options as URLHandlerOptions);\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t/**\n\t * Refreshes the access token using the refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token refresh is complete.\n\t *\n\t * @throws {Error} Throws an error if no refresh token is available or if the refresh fails.\n\t */\n\tasync refresh(): Promise<void> {\n\t\tif (typeof this.session?.refresh_token !== 'string') {\n\t\t\tthrow Error('No refresh token available');\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\ttry {\n\t\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\trefresh_token: this.session?.refresh_token,\n\t\t\t});\n\n\t\t\tObject.assign(this.session, await request.json());\n\n\t\t\tif (this.session.id_token) {\n\t\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t\t}\n\n\t\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\n\t\t\tif (this.accessToken && this.refreshToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('tokenRefreshed', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\t\t} catch {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tthis.dispatchEvent('tokenRefreshFailed', [{ refreshToken: session.refresh_token as string }]);\n\t\t}\n\t}\n\n\t/**\n\t * Revokes the current access or refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token revocation is complete.\n\t */\n\tasync revoke(): Promise<void> {\n\t\tconst session = this.session;\n\t\tlet success = true;\n\n\t\ttry {\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'refresh_token',\n\t\t\t\t\ttoken: session.refresh_token,\n\t\t\t\t});\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'access_token',\n\t\t\t\t\ttoken: session.access_token,\n\t\t\t\t});\n\t\t\t}\n\t\t} catch {\n\t\t\tsuccess = false;\n\t\t} finally {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.refresh_token as string, tokenTypeHint: 'refresh_token' }]);\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.access_token as string, tokenTypeHint: 'access_token' }]);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Exchanges an authorization code for access and refresh tokens.\n\t *\n\t * @param {Record<string, string>} [params={}] - Parameters containing the authorization code and other required values.\n\t * @returns {Promise<void>} - A promise that resolves when the token exchange is complete.\n\t *\n\t * @throws {Error} Throws an error if the authorization code is invalid or if there are issues with state, nonce, or tokens.\n\t */\n\tasync exchangeCodeForTokens(params: Record<string, string> = {}): Promise<void> {\n\t\tthis.session = new Session();\n\n\t\tObject.assign(this.session, params);\n\n\t\tif (this.session.error) {\n\t\t\tthrow Error(`${this.session.error}: ${this.session.error_description}`);\n\t\t}\n\t\tif (!this.session.code) {\n\t\t\tthrow Error('Invalid or missing code');\n\t\t}\n\n\t\tlet state: State;\n\n\t\ttry {\n\t\t\tconst serializedState = this.storage.get(`sty.${this.session.state}`);\n\n\t\t\tif (!serializedState) {\n\t\t\t\tthrow Error();\n\t\t\t}\n\n\t\t\tstate = State.fromSerializedData(serializedState);\n\n\t\t\tthis.storage.delete(`sty.${this.session.state}`);\n\t\t} catch {\n\t\t\tthrow Error('Invalid or missing state');\n\t\t}\n\n\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\tgrant_type: 'authorization_code',\n\t\t\tclient_id: this.options.clientId,\n\t\t\tredirect_uri: this.options.redirectUri,\n\t\t\tcode_verifier: state.codeVerifier,\n\t\t\tcode: this.session.code,\n\t\t});\n\n\t\tObject.assign(this.session, await request.json());\n\n\t\tif (this.session.id_token) {\n\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t}\n\n\t\tif (this.session.scope !== this.options.scopes?.join(' ')) {\n\t\t\tthrow Error('Invalid scope');\n\t\t}\n\t\tif (this.session.claims?.nonce !== state.nonce) {\n\t\t\tthrow Error('Invalid nonce');\n\t\t}\n\t\tif (this.session.claims?.iss !== (await this.metadata.issuer)) {\n\t\t\tthrow Error('Invalid iss');\n\t\t}\n\t\tif (Array.isArray(this.session.claims?.aud) ? this.session.claims?.aud[0] !== this.options.clientId : this.session.claims?.aud !== this.options.clientId) {\n\t\t\tthrow Error('Invalid aud');\n\t\t}\n\n\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\t}\n\n\t/**\n\t * Subscribes a callback function to an event.\n\t *\n\t * @param {T} eventName - The name of the event to subscribe to.\n\t * @param {(...params: Parameters<EventFunctions[T]>) => Promise<void> | void} callbackFn - The callback function to execute when the event is dispatched.\n\t * @returns {{ dispose: () => void }} - An object with a `dispose` method to remove the subscription.\n\t */\n\tsubscribeToEvent<T extends keyof EventFunctions>(\n\t\teventName: T,\n\t\tcallbackFn: (...params: Parameters<EventFunctions[T]>) => Promise<void> | void,\n\t): { dispose: () => void } {\n\t\teventCallbacks[eventName].add(callbackFn);\n\n\t\treturn {\n\t\t\tdispose: () => {\n\t\t\t\teventCallbacks[eventName].delete(callbackFn);\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Dispatches an event to all subscribed callback functions.\n\t *\n\t * @param {T} eventName - The name of the event to dispatch.\n\t * @param {Parameters<EventFunctions[T]>} args - The arguments to pass to the callback functions.\n\t */\n\tprotected dispatchEvent<T extends keyof EventFunctions>(eventName: T, args: Parameters<EventFunctions[T]>): void {\n\t\tfor (const eventFn of eventCallbacks[eventName]) {\n\t\t\tvoid eventFn(...args);\n\t\t}\n\t}\n\n\t/**\n\t * Constructs the authorization URL for initiating the authorization flow.\n\t *\n\t * @param {ExtraRequestArgs} [options={}] - Additional options to include in the authorization URL.\n\t * @returns {Promise<URL>} - A promise that resolves to the constructed authorization URL.\n\t */\n\tprotected async getAuthorizationUrl(options: ExtraRequestArgs = {}): Promise<URL> {\n\t\tconst url = new URL(await this.metadata.authorizationEndpoint);\n\n\t\turl.searchParams.append('client_id', this.options.clientId);\n\t\turl.searchParams.append('redirect_uri', this.options.redirectUri);\n\t\turl.searchParams.append('response_type', this.options.responseType || 'code');\n\t\turl.searchParams.append('response_mode', this.options.responseMode || 'fragment');\n\t\turl.searchParams.append('scope', this.options.scopes?.join(' ') as string);\n\t\turl.searchParams.append('code_challenge_method', 'S256');\n\n\t\tif (options.prompt) {\n\t\t\turl.searchParams.append('prompt', options.prompt);\n\t\t}\n\t\tif (options.acrValues) {\n\t\t\turl.searchParams.append('acr_values', options.acrValues.join(' '));\n\t\t}\n\t\tif (options.loginHint) {\n\t\t\turl.searchParams.append('login_hint', options.loginHint);\n\t\t}\n\t\tif (options.uiLocales) {\n\t\t\turl.searchParams.append('ui_locales', options.uiLocales.join(' '));\n\t\t}\n\n\t\treturn url;\n\t}\n\n\t/**\n\t * Handles URL redirections for authentication and authorization processes.\n\t *\n\t * @param {string | URL} url - The URL to handle.\n\t * @param {URLHandlerOptions} [options] - Additional options for URL handling.\n\t * @returns {Promise<unknown>} - A promise that resolves when the URL handling is complete.\n\t */\n\tprotected abstract urlHandler(url: string | URL, options?: URLHandlerOptions): Promise<unknown>;\n\n\t/**\n\t * Sends a token request to the specified URL with the given data.\n\t *\n\t * @param {string | URL} url - The URL to send the request to.\n\t * @param {Record<string, string>} [data={}] - The data to include in the request body.\n\t * @returns {Promise<Response>} - A promise that resolves to the response from the request.\n\t */\n\tprotected async sendTokenRequest(url: string | URL, data: Record<string, string> = {}): Promise<Response> {\n\t\treturn await this.httpClient.post(url, {\n\t\t\theaders: { 'Content-Type': 'application/x-www-form-urlencoded' },\n\t\t\tbody: new URLSearchParams(data),\n\t\t});\n\t}\n}\n"],"names":["eventCallbacks","BaseFlow","options","storage","__publicField","fetch","Metadata","Session","_a","_b","timestamp","resolve","isBrowser","session","url","request","jwt","success","params","state","serializedState","State","_c","_d","_e","_f","eventName","callbackFn","args","eventFn","data"],"mappings":"+gBAWA,MAAMA,EAAmG,CACxG,uBAAwB,IACxB,SAAU,IACV,aAAc,IACd,mBAAoB,IACpB,oBAAqB,IACrB,kBAAmB,IACnB,mBAAoB,IACpB,uBAAwB,IACxB,iBAAkB,IAClB,sBAAuB,GACxB,EAQO,MAAeC,CAAiF,CA2HtG,YAAYC,EAAkBC,EAAqB,CArHzCC,EAAA,qBAAyC,MAOzCA,EAAA,mBAOAA,EAAA,gBAOAA,EAAA,gBAOAA,EAAA,iBAOAA,EAAA,eAA0B,MAmF/B,GAAA,CAACF,EAAQ,OACZ,MAAM,MAAM,wBAAwB,EAEjC,GAAA,CAACA,EAAQ,SACZ,MAAM,MAAM,0BAA0B,EAEnC,GAAA,CAACA,EAAQ,YACZ,MAAM,MAAM,6BAA6B,EAE1C,GAAIA,EAAQ,QAAU,CAAC,MAAM,QAAQA,EAAQ,MAAM,EAClD,MAAM,MAAM,wBAAwB,EAGhCA,EAAQ,SACJA,EAAA,OAAS,CAAC,QAAQ,GAEtBA,EAAQ,eACZA,EAAQ,aAAe,QAEnBA,EAAQ,eACZA,EAAQ,aAAe,SAEnBA,EAAQ,mBACZA,EAAQ,iBAAmB,eAG5B,KAAK,WAAaG,QAAM,OAAO,CAAE,MAAO,EAAG,EAC3C,KAAK,QAAUH,EACf,KAAK,QAAUC,EACf,KAAK,SAAW,IAAIG,WAAS,GAAGJ,EAAQ,MAAM,mCAAmC,EAC5E,KAAA,QAAUK,UAAQ,KAAK,KAAK,QAAQ,IAAI,KAAK,QAAQ,gBAA0B,CAAC,EAErF,WAAW,IAAM,CACX,KAAA,cAAc,OAAQ,CAAA,CAAE,EAEzB,KAAK,SAAW,KAAK,aAAe,KAAK,eAC5C,KAAK,cAAc,gBAAiB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,EAGjI,KAAK,aAAe,KAAK,oBACvB,KAAA,cAAc,qBAAsB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,YAAa,CAAC,CAAC,CAC9G,CACA,CACF,CAvHA,IAAI,eAAkD,OACrD,OAAOC,EAAA,KAAK,UAAL,YAAAA,EAAc,MACtB,CAOA,IAAI,aAAyC,OAC5C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,YACtB,CAOA,IAAI,cAA0C,OAC7C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,aACtB,CAOA,IAAI,oBAA8B,SAC1B,MAAA,GAACA,EAAA,KAAK,UAAL,MAAAA,EAAc,eAAgB,GAACC,EAAA,KAAK,UAAL,MAAAA,EAAc,aAAc,KAAK,QAAQ,YAAcC,EAAU,UAAA,CACzG,CAOA,IAAI,2BAAuD,OAC1D,OAAOF,EAAA,KAAK,UAAL,YAAAA,EAAc,UACtB,CAOA,IAAI,iBAAoC,CACvC,OAAI,KAAK,cACD,KAAK,eAIb,KAAK,cAAgB,IAAI,QAAQ,MAAOG,GAAY,CAC/C,GAAA,CACC,KAAK,cAAgB,KAAK,oBAC7B,MAAM,KAAK,SACZ,MACO,CAAC,CAET,WAAW,IAAM,CACRA,EAAA,CAAC,KAAK,kBAAkB,EAChC,KAAK,cAAgB,IAAA,CACrB,CAAA,CACD,EAEM,KAAK,cACb,CA8EA,MAAM,OAAOT,EAA4D,CACxE,GAAI,CAACU,EAAAA,UACJ,OAGD,MAAMC,EAAU,KAAK,QAKrB,GAHA,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAC3D,KAAK,QAAU,KAEXA,GAAA,MAAAA,EAAS,SAAU,CACtB,MAAMC,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,kBAAkB,EAE1DA,EAAI,aAAa,OAAO,gBAAiBD,GAAA,YAAAA,EAAS,QAAQ,EAEtDX,GAAA,MAAAA,EAAS,uBACZY,EAAI,aAAa,OAAO,2BAA4BZ,EAAQ,qBAAqB,EAG7E,KAAA,cAAc,kBAAmB,CAAC,CAAE,QAASW,EAAQ,SAAU,OAAQA,EAAQ,MAAwB,CAAC,CAAC,EAE1G,GAAA,CACG,MAAA,KAAK,WAAWC,EAAKZ,CAA4B,CAAA,MAChD,CAAC,CACV,CACD,CASA,MAAM,SAAyB,SAC9B,GAAI,QAAOM,EAAA,KAAK,UAAL,YAAAA,EAAc,gBAAkB,SAC1C,MAAM,MAAM,4BAA4B,EAGzC,MAAMK,EAAU,KAAK,QAEjB,GAAA,CACH,MAAME,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,gBACZ,UAAW,KAAK,QAAQ,SACxB,eAAeN,EAAA,KAAK,UAAL,YAAAA,EAAc,aAAA,CAC7B,EAED,OAAO,OAAO,KAAK,QAAS,MAAMM,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAA,IAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGjE,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,EAElF,KAAK,aAAe,KAAK,cAAgB,KAAK,eACjD,KAAK,cAAc,iBAAkB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,CACtI,MACO,CACP,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEtD,KAAA,cAAc,qBAAsB,CAAC,CAAE,aAAcH,EAAQ,aAAyB,CAAA,CAAC,CAC7F,CACD,CAOA,MAAM,QAAwB,CAC7B,MAAMA,EAAU,KAAK,QACrB,IAAII,EAAU,GAEV,GAAA,CACCJ,GAAA,MAAAA,EAAS,cACZ,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,gBACjB,MAAOA,EAAQ,aAAA,CACf,EACSA,GAAA,MAAAA,EAAS,cACnB,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,eACjB,MAAOA,EAAQ,YAAA,CACf,CACF,MACO,CACGI,EAAA,EAAA,QACT,CACD,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEvDJ,GAAA,MAAAA,EAAS,cACZ,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,cAAyB,cAAe,eAAgB,CAAC,CAAC,EACrIA,GAAA,MAAAA,EAAS,cACnB,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,aAAwB,cAAe,cAAe,CAAC,CAAC,CAE/I,CACD,CAUA,MAAM,sBAAsBK,EAAiC,GAAmB,iBAK3E,GAJC,KAAA,QAAU,IAAIX,EAAAA,QAEZ,OAAA,OAAO,KAAK,QAASW,CAAM,EAE9B,KAAK,QAAQ,MACV,MAAA,MAAM,GAAG,KAAK,QAAQ,KAAK,KAAK,KAAK,QAAQ,iBAAiB,EAAE,EAEnE,GAAA,CAAC,KAAK,QAAQ,KACjB,MAAM,MAAM,yBAAyB,EAGlC,IAAAC,EAEA,GAAA,CACG,MAAAC,EAAkB,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,KAAK,EAAE,EAEpE,GAAI,CAACA,EACJ,MAAM,MAAM,EAGLD,EAAAE,EAAA,MAAM,mBAAmBD,CAAe,EAEhD,KAAK,QAAQ,OAAO,OAAO,KAAK,QAAQ,KAAK,EAAE,CAAA,MACxC,CACP,MAAM,MAAM,0BAA0B,CACvC,CAEA,MAAML,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,qBACZ,UAAW,KAAK,QAAQ,SACxB,aAAc,KAAK,QAAQ,YAC3B,cAAeI,EAAM,aACrB,KAAM,KAAK,QAAQ,IAAA,CACnB,EAQG,GANJ,OAAO,OAAO,KAAK,QAAS,MAAMJ,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAA,IAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGlE,KAAK,QAAQ,UAAUR,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,MACpD,MAAM,MAAM,eAAe,EAE5B,KAAIC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,SAAUU,EAAM,MACxC,MAAM,MAAM,eAAe,EAE5B,KAAIG,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAS,MAAM,KAAK,SAAS,OACrD,MAAM,MAAM,aAAa,EAEtB,GAAA,MAAM,SAAQC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,GAAG,IAAIC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,IAAI,MAAO,KAAK,QAAQ,WAAWC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAQ,KAAK,QAAQ,SAC/I,MAAM,MAAM,aAAa,EAGrB,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,CACvF,CASA,iBACCC,EACAC,EAC0B,CACX,OAAA3B,EAAA0B,CAAS,EAAE,IAAIC,CAAU,EAEjC,CACN,QAAS,IAAM,CACC3B,EAAA0B,CAAS,EAAE,OAAOC,CAAU,CAC5C,CAAA,CAEF,CAQU,cAA8CD,EAAcE,EAA2C,CACrG,UAAAC,KAAW7B,EAAe0B,CAAS,EACxCG,EAAQ,GAAGD,CAAI,CAEtB,CAQA,MAAgB,oBAAoB1B,EAA4B,GAAkB,OACjF,MAAMY,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,qBAAqB,EAE7D,OAAAA,EAAI,aAAa,OAAO,YAAa,KAAK,QAAQ,QAAQ,EAC1DA,EAAI,aAAa,OAAO,eAAgB,KAAK,QAAQ,WAAW,EAChEA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,MAAM,EAC5EA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,UAAU,EAC5EA,EAAA,aAAa,OAAO,SAASN,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,IAAc,EACrEM,EAAA,aAAa,OAAO,wBAAyB,MAAM,EAEnDZ,EAAQ,QACXY,EAAI,aAAa,OAAO,SAAUZ,EAAQ,MAAM,EAE7CA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAE9DA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,SAAS,EAEpDA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAG3DY,CACR,CAkBA,MAAgB,iBAAiBA,EAAmBgB,EAA+B,GAAuB,CACzG,OAAO,MAAM,KAAK,WAAW,KAAKhB,EAAK,CACtC,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,IAAI,gBAAgBgB,CAAI,CAAA,CAC9B,CACF,CACD"}
|
package/dist/flows/BaseFlow.mjs
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
var m=Object.defineProperty;var u=(o,e,s)=>e in o?m(o,e,{enumerable:!0,configurable:!0,writable:!0,value:s}):o[e]=s;var i=(o,e,s)=>u(o,typeof e!="symbol"?e+"":e,s);import{isBrowser as _}from"../utils/constants.mjs";import{jwt as l}from"../utils/jwt.mjs";import{fetch as g}from"../utils/fetch.mjs";import{timestamp as T}from"../utils/date.mjs";import{Metadata as w}from"../Metadata.mjs";import{Session as f}from"../Session.mjs";import{State as y}from"../State.mjs";import"../utils/base64Url.mjs";import"../utils/crypto.mjs";const r={accessTokenExpired:new Set,init:new Set,loggedIn:new Set,loginInitiated:new Set,logoutInitiated:new Set,sessionLoaded:new Set,tokenRefreshed:new Set,tokenRefreshFailed:new Set,tokenRevoked:new Set,tokenRevokeFailed:new Set};class N{constructor(e,s){i(this,"isAuthPromise",null);i(this,"httpClient");i(this,"options");i(this,"storage");i(this,"metadata");i(this,"session",null);if(!e.issuer)throw Error("Missing option: issuer");if(!e.clientId)throw Error("Missing option: clientId");if(!e.redirectUri)throw Error("Missing option: redirectUri");if(e.scopes&&!Array.isArray(e.scopes))throw Error("Invalid option: scopes");e.scopes||(e.scopes=["openid"]),e.responseType||(e.responseType="code"),e.responseMode||(e.responseMode="query"),e.storageTokenName||(e.storageTokenName="sty.session"),this.httpClient=g.create({retry:0}),this.options=e,this.storage=s,this.metadata=new w(`${e.issuer}/.well-known/openid-configuration`),this.session=f.load(this.storage.get(this.options.storageTokenName)),setTimeout(()=>{this.dispatchEvent("init",[]),this.session&&this.accessToken&&this.idTokenClaims&&this.dispatchEvent("sessionLoaded",[{accessToken:this.accessToken,refreshToken:this.refreshToken,claims:this.idTokenClaims}]),this.accessToken&&this.accessTokenExpired&&this.dispatchEvent("accessTokenExpired",[{accessToken:this.accessToken,refreshToken:this.refreshToken}])})}get idTokenClaims(){var e;return(e=this.session)==null?void 0:e.claims}get accessToken(){var e;return(e=this.session)==null?void 0:e.access_token}get refreshToken(){var e;return(e=this.session)==null?void 0:e.refresh_token}get accessTokenExpired(){var e;return!((e=this.session)!=null&&e.expires_at)||this.session.expires_at<=T()}get accessTokenExpirationDate(){var e;return(e=this.session)==null?void 0:e.expires_at}get isAuthenticated(){return this.isAuthPromise?this.isAuthPromise:(this.isAuthPromise=new Promise(async e=>{try{this.refreshToken&&this.accessTokenExpired&&await this.refresh()}catch{}setTimeout(()=>{
|
|
1
|
+
var m=Object.defineProperty;var u=(o,e,s)=>e in o?m(o,e,{enumerable:!0,configurable:!0,writable:!0,value:s}):o[e]=s;var i=(o,e,s)=>u(o,typeof e!="symbol"?e+"":e,s);import{isBrowser as _}from"../utils/constants.mjs";import{jwt as l}from"../utils/jwt.mjs";import{fetch as g}from"../utils/fetch.mjs";import{timestamp as T}from"../utils/date.mjs";import{Metadata as w}from"../Metadata.mjs";import{Session as f}from"../Session.mjs";import{State as y}from"../State.mjs";import"../utils/base64Url.mjs";import"../utils/crypto.mjs";const r={accessTokenExpired:new Set,init:new Set,loggedIn:new Set,loginInitiated:new Set,logoutInitiated:new Set,sessionLoaded:new Set,tokenRefreshed:new Set,tokenRefreshFailed:new Set,tokenRevoked:new Set,tokenRevokeFailed:new Set};class N{constructor(e,s){i(this,"isAuthPromise",null);i(this,"httpClient");i(this,"options");i(this,"storage");i(this,"metadata");i(this,"session",null);if(!e.issuer)throw Error("Missing option: issuer");if(!e.clientId)throw Error("Missing option: clientId");if(!e.redirectUri)throw Error("Missing option: redirectUri");if(e.scopes&&!Array.isArray(e.scopes))throw Error("Invalid option: scopes");e.scopes||(e.scopes=["openid"]),e.responseType||(e.responseType="code"),e.responseMode||(e.responseMode="query"),e.storageTokenName||(e.storageTokenName="sty.session"),this.httpClient=g.create({retry:0}),this.options=e,this.storage=s,this.metadata=new w(`${e.issuer}/.well-known/openid-configuration`),this.session=f.load(this.storage.get(this.options.storageTokenName)),setTimeout(()=>{this.dispatchEvent("init",[]),this.session&&this.accessToken&&this.idTokenClaims&&this.dispatchEvent("sessionLoaded",[{accessToken:this.accessToken,refreshToken:this.refreshToken,claims:this.idTokenClaims}]),this.accessToken&&this.accessTokenExpired&&this.dispatchEvent("accessTokenExpired",[{accessToken:this.accessToken,refreshToken:this.refreshToken}])})}get idTokenClaims(){var e;return(e=this.session)==null?void 0:e.claims}get accessToken(){var e;return(e=this.session)==null?void 0:e.access_token}get refreshToken(){var e;return(e=this.session)==null?void 0:e.refresh_token}get accessTokenExpired(){var e,s;return!((e=this.session)!=null&&e.access_token)||!((s=this.session)!=null&&s.expires_at)||this.session.expires_at<=T()}get accessTokenExpirationDate(){var e;return(e=this.session)==null?void 0:e.expires_at}get isAuthenticated(){return this.isAuthPromise?this.isAuthPromise:(this.isAuthPromise=new Promise(async e=>{try{this.refreshToken&&this.accessTokenExpired&&await this.refresh()}catch{}setTimeout(()=>{e(!this.accessTokenExpired),this.isAuthPromise=null})}),this.isAuthPromise)}async logout(e){if(!_)return;const s=this.session;if(this.storage.delete(this.options.storageTokenName),this.session=null,s!=null&&s.id_token){const t=new URL(await this.metadata.endSessionEndpoint);t.searchParams.append("id_token_hint",s==null?void 0:s.id_token),e!=null&&e.postLogoutRedirectUri&&t.searchParams.append("post_logout_redirect_uri",e.postLogoutRedirectUri),this.dispatchEvent("logoutInitiated",[{idToken:s.id_token,claims:s.claims}]);try{await this.urlHandler(t,e)}catch{}}}async refresh(){var s,t;if(typeof((s=this.session)==null?void 0:s.refresh_token)!="string")throw Error("No refresh token available");const e=this.session;try{const n=await this.sendTokenRequest(await this.metadata.tokenEndpoint,{grant_type:"refresh_token",client_id:this.options.clientId,refresh_token:(t=this.session)==null?void 0:t.refresh_token});Object.assign(this.session,await n.json()),this.session.id_token&&(this.session.claims=l.decode(this.session.id_token)),this.storage.set(this.options.storageTokenName,JSON.stringify(this.session)),this.accessToken&&this.refreshToken&&this.idTokenClaims&&this.dispatchEvent("tokenRefreshed",[{accessToken:this.accessToken,refreshToken:this.refreshToken,claims:this.idTokenClaims}])}catch{this.session=null,this.storage.delete(this.options.storageTokenName),this.dispatchEvent("tokenRefreshFailed",[{refreshToken:e.refresh_token}])}}async revoke(){const e=this.session;let s=!0;try{e!=null&&e.refresh_token?await this.sendTokenRequest(await this.metadata.revocationEndpoint,{client_id:this.options.clientId,token_type_hint:"refresh_token",token:e.refresh_token}):e!=null&&e.access_token&&await this.sendTokenRequest(await this.metadata.revocationEndpoint,{client_id:this.options.clientId,token_type_hint:"access_token",token:e.access_token})}catch{s=!1}finally{this.session=null,this.storage.delete(this.options.storageTokenName),e!=null&&e.refresh_token?this.dispatchEvent(s?"tokenRevoked":"tokenRevokeFailed",[{token:e.refresh_token,tokenTypeHint:"refresh_token"}]):e!=null&&e.access_token&&this.dispatchEvent(s?"tokenRevoked":"tokenRevokeFailed",[{token:e.access_token,tokenTypeHint:"access_token"}])}}async exchangeCodeForTokens(e={}){var n,a,h,c,d,p;if(this.session=new f,Object.assign(this.session,e),this.session.error)throw Error(`${this.session.error}: ${this.session.error_description}`);if(!this.session.code)throw Error("Invalid or missing code");let s;try{const k=this.storage.get(`sty.${this.session.state}`);if(!k)throw Error();s=y.fromSerializedData(k),this.storage.delete(`sty.${this.session.state}`)}catch{throw Error("Invalid or missing state")}const t=await this.sendTokenRequest(await this.metadata.tokenEndpoint,{grant_type:"authorization_code",client_id:this.options.clientId,redirect_uri:this.options.redirectUri,code_verifier:s.codeVerifier,code:this.session.code});if(Object.assign(this.session,await t.json()),this.session.id_token&&(this.session.claims=l.decode(this.session.id_token)),this.session.scope!==((n=this.options.scopes)==null?void 0:n.join(" ")))throw Error("Invalid scope");if(((a=this.session.claims)==null?void 0:a.nonce)!==s.nonce)throw Error("Invalid nonce");if(((h=this.session.claims)==null?void 0:h.iss)!==await this.metadata.issuer)throw Error("Invalid iss");if(Array.isArray((c=this.session.claims)==null?void 0:c.aud)?((d=this.session.claims)==null?void 0:d.aud[0])!==this.options.clientId:((p=this.session.claims)==null?void 0:p.aud)!==this.options.clientId)throw Error("Invalid aud");this.storage.set(this.options.storageTokenName,JSON.stringify(this.session))}subscribeToEvent(e,s){return r[e].add(s),{dispose:()=>{r[e].delete(s)}}}dispatchEvent(e,s){for(const t of r[e])t(...s)}async getAuthorizationUrl(e={}){var t;const s=new URL(await this.metadata.authorizationEndpoint);return s.searchParams.append("client_id",this.options.clientId),s.searchParams.append("redirect_uri",this.options.redirectUri),s.searchParams.append("response_type",this.options.responseType||"code"),s.searchParams.append("response_mode",this.options.responseMode||"fragment"),s.searchParams.append("scope",(t=this.options.scopes)==null?void 0:t.join(" ")),s.searchParams.append("code_challenge_method","S256"),e.prompt&&s.searchParams.append("prompt",e.prompt),e.acrValues&&s.searchParams.append("acr_values",e.acrValues.join(" ")),e.loginHint&&s.searchParams.append("login_hint",e.loginHint),e.uiLocales&&s.searchParams.append("ui_locales",e.uiLocales.join(" ")),s}async sendTokenRequest(e,s={}){return await this.httpClient.post(e,{headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(s)})}}export{N as BaseFlow};
|
|
2
2
|
//# sourceMappingURL=BaseFlow.mjs.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BaseFlow.mjs","sources":["../../src/flows/BaseFlow.ts"],"sourcesContent":["import type { KyInstance } from 'ky';\nimport type { IdTokenClaims, SDKOptions, SDKStorage, EventFunctions, ExtraRequestArgs, LogoutOptions } from '../types';\nimport { isBrowser } from '../utils/constants';\nimport { jwt } from '../utils/jwt';\nimport { fetch } from '../utils/fetch';\nimport { timestamp } from '../utils/date';\nimport { Metadata } from '../Metadata';\nimport { Session } from '../Session';\nimport { State } from '../State';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst eventCallbacks: Record<keyof EventFunctions, Set<(...args: Array<any>) => Promise<void> | void>> = {\n\taccessTokenExpired: new Set(),\n\tinit: new Set(),\n\tloggedIn: new Set(),\n\tloginInitiated: new Set(),\n\tlogoutInitiated: new Set(),\n\tsessionLoaded: new Set(),\n\ttokenRefreshed: new Set(),\n\ttokenRefreshFailed: new Set(),\n\ttokenRevoked: new Set(),\n\ttokenRevokeFailed: new Set(),\n};\n\n/**\n * An abstract base class that provides common functionality for different OIDC flows.\n *\n * @template Options - The options type extending `SDKOptions` used for configuring the flow.\n * @template URLHandlerOptions - The options type extending `ExtraRequestArgs` used for URL handling.\n */\nexport abstract class BaseFlow<Options extends SDKOptions, URLHandlerOptions extends ExtraRequestArgs> {\n\t/**\n\t * A promise that resolves to indicate whether authentication has been verified.\n\t *\n\t * @type {Promise<boolean> | null}\n\t */\n\tprotected isAuthPromise: Promise<boolean> | null = null;\n\n\t/**\n\t * An instance of the HTTP client used for making requests.\n\t *\n\t * @type {KyInstance}\n\t */\n\tprotected httpClient!: KyInstance;\n\n\t/**\n\t * The configuration options for the flow.\n\t *\n\t * @type {Options}\n\t */\n\tprotected options: Options;\n\n\t/**\n\t * The storage mechanism used to persist session data.\n\t *\n\t * @type {SDKStorage}\n\t */\n\tprotected storage: SDKStorage;\n\n\t/**\n\t * Metadata information about the authorization server.\n\t *\n\t * @type {Metadata}\n\t */\n\tprotected metadata: Metadata;\n\n\t/**\n\t * The current session data.\n\t *\n\t * @type {Session | null}\n\t */\n\tprotected session: Session | null = null;\n\n\t/**\n\t * Retrieves the ID token claims from the current session.\n\t *\n\t * @type {IdTokenClaims | null | undefined}\n\t */\n\tget idTokenClaims(): IdTokenClaims | null | undefined {\n\t\treturn this.session?.claims;\n\t}\n\n\t/**\n\t * Retrieves the access token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget accessToken(): string | null | undefined {\n\t\treturn this.session?.access_token;\n\t}\n\n\t/**\n\t * Retrieves the refresh token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget refreshToken(): string | null | undefined {\n\t\treturn this.session?.refresh_token;\n\t}\n\n\t/**\n\t * Determines if the access token has expired.\n\t *\n\t * @type {boolean}\n\t */\n\tget accessTokenExpired(): boolean {\n\t\treturn !this.session?.expires_at || this.session.expires_at <= timestamp();\n\t}\n\n\t/**\n\t * Retrieves the access token expiration date.\n\t *\n\t * @type {number | null | undefined}\n\t */\n\tget accessTokenExpirationDate(): number | null | undefined {\n\t\treturn this.session?.expires_at;\n\t}\n\n\t/**\n\t * Checks if the user is authenticated by evaluating the presence of access or refresh tokens.\n\t *\n\t * @returns {Promise<boolean>} - A promise that resolves to `true` if the user is authenticated, otherwise `false`.\n\t */\n\tget isAuthenticated(): Promise<boolean> {\n\t\tif (this.isAuthPromise) {\n\t\t\treturn this.isAuthPromise;\n\t\t}\n\n\t\t// eslint-disable-next-line no-async-promise-executor\n\t\tthis.isAuthPromise = new Promise(async (resolve) => {\n\t\t\ttry {\n\t\t\t\tif (this.refreshToken && this.accessTokenExpired) {\n\t\t\t\t\tawait this.refresh();\n\t\t\t\t}\n\t\t\t} catch {}\n\n\t\t\tsetTimeout(() => {\n\t\t\t\tresolve(!!this.session?.access_token || !!this.session?.refresh_token);\n\t\t\t\tthis.isAuthPromise = null;\n\t\t\t});\n\t\t});\n\n\t\treturn this.isAuthPromise;\n\t}\n\n\t/**\n\t * Constructs a new instance of the `BaseFlow` class.\n\t *\n\t * @param {Options} options - Configuration options for the flow.\n\t * @param {SDKStorage} storage - Storage mechanism for session data.\n\t *\n\t * @throws {Error} Throws an error if required options are missing or invalid.\n\t */\n\tconstructor(options: Options, storage: SDKStorage) {\n\t\tif (!options.issuer) {\n\t\t\tthrow Error('Missing option: issuer');\n\t\t}\n\t\tif (!options.clientId) {\n\t\t\tthrow Error('Missing option: clientId');\n\t\t}\n\t\tif (!options.redirectUri) {\n\t\t\tthrow Error('Missing option: redirectUri');\n\t\t}\n\t\tif (options.scopes && !Array.isArray(options.scopes)) {\n\t\t\tthrow Error('Invalid option: scopes');\n\t\t}\n\n\t\tif (!options.scopes) {\n\t\t\toptions.scopes = ['openid'];\n\t\t}\n\t\tif (!options.responseType) {\n\t\t\toptions.responseType = 'code';\n\t\t}\n\t\tif (!options.responseMode) {\n\t\t\toptions.responseMode = 'query';\n\t\t}\n\t\tif (!options.storageTokenName) {\n\t\t\toptions.storageTokenName = 'sty.session';\n\t\t}\n\n\t\tthis.httpClient = fetch.create({ retry: 0 });\n\t\tthis.options = options as Options;\n\t\tthis.storage = storage;\n\t\tthis.metadata = new Metadata(`${options.issuer}/.well-known/openid-configuration`);\n\t\tthis.session = Session.load(this.storage.get(this.options.storageTokenName as string));\n\n\t\tsetTimeout(() => {\n\t\t\tthis.dispatchEvent('init', []);\n\n\t\t\tif (this.session && this.accessToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('sessionLoaded', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\n\t\t\tif (this.accessToken && this.accessTokenExpired) {\n\t\t\t\tthis.dispatchEvent('accessTokenExpired', [{ accessToken: this.accessToken, refreshToken: this.refreshToken }]);\n\t\t\t}\n\t\t});\n\t}\n\n\t/**\n\t * Initiates the login process. Subclasses should implement this method to handle the specific login flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during login.\n\t * @returns {Promise<void>} - A promise that resolves when the login process is complete.\n\t */\n\tabstract login(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Registers a new user. Subclasses should implement this method to handle the specific registration flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during registration.\n\t * @returns {Promise<void>} - A promise that resolves when the registration process is complete.\n\t */\n\tabstract register(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Logs out the current user and optionally redirects to a post-logout URI.\n\t *\n\t * @param {URLHandlerOptions & LogoutOptions} [options] - Additional options for handling URLs during logout.\n\t * @returns {Promise<void>} - A promise that resolves when the logout process is complete.\n\t */\n\tasync logout(options?: URLHandlerOptions & LogoutOptions): Promise<void> {\n\t\tif (!isBrowser) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\tthis.storage.delete(this.options.storageTokenName as string);\n\t\tthis.session = null;\n\n\t\tif (session?.id_token) {\n\t\t\tconst url = new URL(await this.metadata.endSessionEndpoint);\n\n\t\t\turl.searchParams.append('id_token_hint', session?.id_token);\n\n\t\t\tif (options?.postLogoutRedirectUri) {\n\t\t\t\turl.searchParams.append('post_logout_redirect_uri', options.postLogoutRedirectUri);\n\t\t\t}\n\n\t\t\tthis.dispatchEvent('logoutInitiated', [{ idToken: session.id_token, claims: session.claims as IdTokenClaims }]);\n\n\t\t\ttry {\n\t\t\t\tawait this.urlHandler(url, options as URLHandlerOptions);\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t/**\n\t * Refreshes the access token using the refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token refresh is complete.\n\t *\n\t * @throws {Error} Throws an error if no refresh token is available or if the refresh fails.\n\t */\n\tasync refresh(): Promise<void> {\n\t\tif (typeof this.session?.refresh_token !== 'string') {\n\t\t\tthrow Error('No refresh token available');\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\ttry {\n\t\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\trefresh_token: this.session?.refresh_token,\n\t\t\t});\n\n\t\t\tObject.assign(this.session, await request.json());\n\n\t\t\tif (this.session.id_token) {\n\t\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t\t}\n\n\t\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\n\t\t\tif (this.accessToken && this.refreshToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('tokenRefreshed', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\t\t} catch {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tthis.dispatchEvent('tokenRefreshFailed', [{ refreshToken: session.refresh_token as string }]);\n\t\t}\n\t}\n\n\t/**\n\t * Revokes the current access or refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token revocation is complete.\n\t */\n\tasync revoke(): Promise<void> {\n\t\tconst session = this.session;\n\t\tlet success = true;\n\n\t\ttry {\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'refresh_token',\n\t\t\t\t\ttoken: session.refresh_token,\n\t\t\t\t});\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'access_token',\n\t\t\t\t\ttoken: session.access_token,\n\t\t\t\t});\n\t\t\t}\n\t\t} catch {\n\t\t\tsuccess = false;\n\t\t} finally {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.refresh_token as string, tokenTypeHint: 'refresh_token' }]);\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.access_token as string, tokenTypeHint: 'access_token' }]);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Exchanges an authorization code for access and refresh tokens.\n\t *\n\t * @param {Record<string, string>} [params={}] - Parameters containing the authorization code and other required values.\n\t * @returns {Promise<void>} - A promise that resolves when the token exchange is complete.\n\t *\n\t * @throws {Error} Throws an error if the authorization code is invalid or if there are issues with state, nonce, or tokens.\n\t */\n\tasync exchangeCodeForTokens(params: Record<string, string> = {}): Promise<void> {\n\t\tthis.session = new Session();\n\n\t\tObject.assign(this.session, params);\n\n\t\tif (this.session.error) {\n\t\t\tthrow Error(`${this.session.error}: ${this.session.error_description}`);\n\t\t}\n\t\tif (!this.session.code) {\n\t\t\tthrow Error('Invalid or missing code');\n\t\t}\n\n\t\tlet state: State;\n\n\t\ttry {\n\t\t\tconst serializedState = this.storage.get(`sty.${this.session.state}`);\n\n\t\t\tif (!serializedState) {\n\t\t\t\tthrow Error();\n\t\t\t}\n\n\t\t\tstate = State.fromSerializedData(serializedState);\n\n\t\t\tthis.storage.delete(`sty.${this.session.state}`);\n\t\t} catch {\n\t\t\tthrow Error('Invalid or missing state');\n\t\t}\n\n\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\tgrant_type: 'authorization_code',\n\t\t\tclient_id: this.options.clientId,\n\t\t\tredirect_uri: this.options.redirectUri,\n\t\t\tcode_verifier: state.codeVerifier,\n\t\t\tcode: this.session.code,\n\t\t});\n\n\t\tObject.assign(this.session, await request.json());\n\n\t\tif (this.session.id_token) {\n\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t}\n\n\t\tif (this.session.scope !== this.options.scopes?.join(' ')) {\n\t\t\tthrow Error('Invalid scope');\n\t\t}\n\t\tif (this.session.claims?.nonce !== state.nonce) {\n\t\t\tthrow Error('Invalid nonce');\n\t\t}\n\t\tif (this.session.claims?.iss !== (await this.metadata.issuer)) {\n\t\t\tthrow Error('Invalid iss');\n\t\t}\n\t\tif (Array.isArray(this.session.claims?.aud) ? this.session.claims?.aud[0] !== this.options.clientId : this.session.claims?.aud !== this.options.clientId) {\n\t\t\tthrow Error('Invalid aud');\n\t\t}\n\n\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\t}\n\n\t/**\n\t * Subscribes a callback function to an event.\n\t *\n\t * @param {T} eventName - The name of the event to subscribe to.\n\t * @param {(...params: Parameters<EventFunctions[T]>) => Promise<void> | void} callbackFn - The callback function to execute when the event is dispatched.\n\t * @returns {{ dispose: () => void }} - An object with a `dispose` method to remove the subscription.\n\t */\n\tsubscribeToEvent<T extends keyof EventFunctions>(\n\t\teventName: T,\n\t\tcallbackFn: (...params: Parameters<EventFunctions[T]>) => Promise<void> | void,\n\t): { dispose: () => void } {\n\t\teventCallbacks[eventName].add(callbackFn);\n\n\t\treturn {\n\t\t\tdispose: () => {\n\t\t\t\teventCallbacks[eventName].delete(callbackFn);\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Dispatches an event to all subscribed callback functions.\n\t *\n\t * @param {T} eventName - The name of the event to dispatch.\n\t * @param {Parameters<EventFunctions[T]>} args - The arguments to pass to the callback functions.\n\t */\n\tprotected dispatchEvent<T extends keyof EventFunctions>(eventName: T, args: Parameters<EventFunctions[T]>): void {\n\t\tfor (const eventFn of eventCallbacks[eventName]) {\n\t\t\tvoid eventFn(...args);\n\t\t}\n\t}\n\n\t/**\n\t * Constructs the authorization URL for initiating the authorization flow.\n\t *\n\t * @param {ExtraRequestArgs} [options={}] - Additional options to include in the authorization URL.\n\t * @returns {Promise<URL>} - A promise that resolves to the constructed authorization URL.\n\t */\n\tprotected async getAuthorizationUrl(options: ExtraRequestArgs = {}): Promise<URL> {\n\t\tconst url = new URL(await this.metadata.authorizationEndpoint);\n\n\t\turl.searchParams.append('client_id', this.options.clientId);\n\t\turl.searchParams.append('redirect_uri', this.options.redirectUri);\n\t\turl.searchParams.append('response_type', this.options.responseType || 'code');\n\t\turl.searchParams.append('response_mode', this.options.responseMode || 'fragment');\n\t\turl.searchParams.append('scope', this.options.scopes?.join(' ') as string);\n\t\turl.searchParams.append('code_challenge_method', 'S256');\n\n\t\tif (options.prompt) {\n\t\t\turl.searchParams.append('prompt', options.prompt);\n\t\t}\n\t\tif (options.acrValues) {\n\t\t\turl.searchParams.append('acr_values', options.acrValues.join(' '));\n\t\t}\n\t\tif (options.loginHint) {\n\t\t\turl.searchParams.append('login_hint', options.loginHint);\n\t\t}\n\t\tif (options.uiLocales) {\n\t\t\turl.searchParams.append('ui_locales', options.uiLocales.join(' '));\n\t\t}\n\n\t\treturn url;\n\t}\n\n\t/**\n\t * Handles URL redirections for authentication and authorization processes.\n\t *\n\t * @param {string | URL} url - The URL to handle.\n\t * @param {URLHandlerOptions} [options] - Additional options for URL handling.\n\t * @returns {Promise<unknown>} - A promise that resolves when the URL handling is complete.\n\t */\n\tprotected abstract urlHandler(url: string | URL, options?: URLHandlerOptions): Promise<unknown>;\n\n\t/**\n\t * Sends a token request to the specified URL with the given data.\n\t *\n\t * @param {string | URL} url - The URL to send the request to.\n\t * @param {Record<string, string>} [data={}] - The data to include in the request body.\n\t * @returns {Promise<Response>} - A promise that resolves to the response from the request.\n\t */\n\tprotected async sendTokenRequest(url: string | URL, data: Record<string, string> = {}): Promise<Response> {\n\t\treturn await this.httpClient.post(url, {\n\t\t\theaders: { 'Content-Type': 'application/x-www-form-urlencoded' },\n\t\t\tbody: new URLSearchParams(data),\n\t\t});\n\t}\n}\n"],"names":["eventCallbacks","BaseFlow","options","storage","__publicField","fetch","Metadata","Session","_a","timestamp","resolve","_b","isBrowser","session","url","request","jwt","success","params","state","serializedState","State","_c","_d","_e","_f","eventName","callbackFn","args","eventFn","data"],"mappings":"2gBAWA,MAAMA,EAAmG,CACxG,uBAAwB,IACxB,SAAU,IACV,aAAc,IACd,mBAAoB,IACpB,oBAAqB,IACrB,kBAAmB,IACnB,mBAAoB,IACpB,uBAAwB,IACxB,iBAAkB,IAClB,sBAAuB,GACxB,EAQO,MAAeC,CAAiF,CA2HtG,YAAYC,EAAkBC,EAAqB,CArHzCC,EAAA,qBAAyC,MAOzCA,EAAA,mBAOAA,EAAA,gBAOAA,EAAA,gBAOAA,EAAA,iBAOAA,EAAA,eAA0B,MAmF/B,GAAA,CAACF,EAAQ,OACZ,MAAM,MAAM,wBAAwB,EAEjC,GAAA,CAACA,EAAQ,SACZ,MAAM,MAAM,0BAA0B,EAEnC,GAAA,CAACA,EAAQ,YACZ,MAAM,MAAM,6BAA6B,EAE1C,GAAIA,EAAQ,QAAU,CAAC,MAAM,QAAQA,EAAQ,MAAM,EAClD,MAAM,MAAM,wBAAwB,EAGhCA,EAAQ,SACJA,EAAA,OAAS,CAAC,QAAQ,GAEtBA,EAAQ,eACZA,EAAQ,aAAe,QAEnBA,EAAQ,eACZA,EAAQ,aAAe,SAEnBA,EAAQ,mBACZA,EAAQ,iBAAmB,eAG5B,KAAK,WAAaG,EAAM,OAAO,CAAE,MAAO,EAAG,EAC3C,KAAK,QAAUH,EACf,KAAK,QAAUC,EACf,KAAK,SAAW,IAAIG,EAAS,GAAGJ,EAAQ,MAAM,mCAAmC,EAC5E,KAAA,QAAUK,EAAQ,KAAK,KAAK,QAAQ,IAAI,KAAK,QAAQ,gBAA0B,CAAC,EAErF,WAAW,IAAM,CACX,KAAA,cAAc,OAAQ,CAAA,CAAE,EAEzB,KAAK,SAAW,KAAK,aAAe,KAAK,eAC5C,KAAK,cAAc,gBAAiB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,EAGjI,KAAK,aAAe,KAAK,oBACvB,KAAA,cAAc,qBAAsB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,YAAa,CAAC,CAAC,CAC9G,CACA,CACF,CAvHA,IAAI,eAAkD,OACrD,OAAOC,EAAA,KAAK,UAAL,YAAAA,EAAc,MACtB,CAOA,IAAI,aAAyC,OAC5C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,YACtB,CAOA,IAAI,cAA0C,OAC7C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,aACtB,CAOA,IAAI,oBAA8B,OACjC,MAAO,GAACA,EAAA,KAAK,UAAL,MAAAA,EAAc,aAAc,KAAK,QAAQ,YAAcC,GAChE,CAOA,IAAI,2BAAuD,OAC1D,OAAOD,EAAA,KAAK,UAAL,YAAAA,EAAc,UACtB,CAOA,IAAI,iBAAoC,CACvC,OAAI,KAAK,cACD,KAAK,eAIb,KAAK,cAAgB,IAAI,QAAQ,MAAOE,GAAY,CAC/C,GAAA,CACC,KAAK,cAAgB,KAAK,oBAC7B,MAAM,KAAK,SACZ,MACO,CAAC,CAET,WAAW,IAAM,SACRA,EAAA,CAAC,GAACF,EAAA,KAAK,UAAL,MAAAA,EAAc,eAAgB,CAAC,GAACG,EAAA,KAAK,UAAL,MAAAA,EAAc,cAAa,EACrE,KAAK,cAAgB,IAAA,CACrB,CAAA,CACD,EAEM,KAAK,cACb,CA8EA,MAAM,OAAOT,EAA4D,CACxE,GAAI,CAACU,EACJ,OAGD,MAAMC,EAAU,KAAK,QAKrB,GAHA,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAC3D,KAAK,QAAU,KAEXA,GAAA,MAAAA,EAAS,SAAU,CACtB,MAAMC,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,kBAAkB,EAE1DA,EAAI,aAAa,OAAO,gBAAiBD,GAAA,YAAAA,EAAS,QAAQ,EAEtDX,GAAA,MAAAA,EAAS,uBACZY,EAAI,aAAa,OAAO,2BAA4BZ,EAAQ,qBAAqB,EAG7E,KAAA,cAAc,kBAAmB,CAAC,CAAE,QAASW,EAAQ,SAAU,OAAQA,EAAQ,MAAwB,CAAC,CAAC,EAE1G,GAAA,CACG,MAAA,KAAK,WAAWC,EAAKZ,CAA4B,CAAA,MAChD,CAAC,CACV,CACD,CASA,MAAM,SAAyB,SAC9B,GAAI,QAAOM,EAAA,KAAK,UAAL,YAAAA,EAAc,gBAAkB,SAC1C,MAAM,MAAM,4BAA4B,EAGzC,MAAMK,EAAU,KAAK,QAEjB,GAAA,CACH,MAAME,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,gBACZ,UAAW,KAAK,QAAQ,SACxB,eAAeJ,EAAA,KAAK,UAAL,YAAAA,EAAc,aAAA,CAC7B,EAED,OAAO,OAAO,KAAK,QAAS,MAAMI,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGjE,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,EAElF,KAAK,aAAe,KAAK,cAAgB,KAAK,eACjD,KAAK,cAAc,iBAAkB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,CACtI,MACO,CACP,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEtD,KAAA,cAAc,qBAAsB,CAAC,CAAE,aAAcH,EAAQ,aAAyB,CAAA,CAAC,CAC7F,CACD,CAOA,MAAM,QAAwB,CAC7B,MAAMA,EAAU,KAAK,QACrB,IAAII,EAAU,GAEV,GAAA,CACCJ,GAAA,MAAAA,EAAS,cACZ,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,gBACjB,MAAOA,EAAQ,aAAA,CACf,EACSA,GAAA,MAAAA,EAAS,cACnB,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,eACjB,MAAOA,EAAQ,YAAA,CACf,CACF,MACO,CACGI,EAAA,EAAA,QACT,CACD,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEvDJ,GAAA,MAAAA,EAAS,cACZ,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,cAAyB,cAAe,eAAgB,CAAC,CAAC,EACrIA,GAAA,MAAAA,EAAS,cACnB,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,aAAwB,cAAe,cAAe,CAAC,CAAC,CAE/I,CACD,CAUA,MAAM,sBAAsBK,EAAiC,GAAmB,iBAK3E,GAJC,KAAA,QAAU,IAAIX,EAEZ,OAAA,OAAO,KAAK,QAASW,CAAM,EAE9B,KAAK,QAAQ,MACV,MAAA,MAAM,GAAG,KAAK,QAAQ,KAAK,KAAK,KAAK,QAAQ,iBAAiB,EAAE,EAEnE,GAAA,CAAC,KAAK,QAAQ,KACjB,MAAM,MAAM,yBAAyB,EAGlC,IAAAC,EAEA,GAAA,CACG,MAAAC,EAAkB,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,KAAK,EAAE,EAEpE,GAAI,CAACA,EACJ,MAAM,MAAM,EAGLD,EAAAE,EAAM,mBAAmBD,CAAe,EAEhD,KAAK,QAAQ,OAAO,OAAO,KAAK,QAAQ,KAAK,EAAE,CAAA,MACxC,CACP,MAAM,MAAM,0BAA0B,CACvC,CAEA,MAAML,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,qBACZ,UAAW,KAAK,QAAQ,SACxB,aAAc,KAAK,QAAQ,YAC3B,cAAeI,EAAM,aACrB,KAAM,KAAK,QAAQ,IAAA,CACnB,EAQG,GANJ,OAAO,OAAO,KAAK,QAAS,MAAMJ,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGlE,KAAK,QAAQ,UAAUR,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,MACpD,MAAM,MAAM,eAAe,EAE5B,KAAIG,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,SAAUQ,EAAM,MACxC,MAAM,MAAM,eAAe,EAE5B,KAAIG,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAS,MAAM,KAAK,SAAS,OACrD,MAAM,MAAM,aAAa,EAEtB,GAAA,MAAM,SAAQC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,GAAG,IAAIC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,IAAI,MAAO,KAAK,QAAQ,WAAWC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAQ,KAAK,QAAQ,SAC/I,MAAM,MAAM,aAAa,EAGrB,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,CACvF,CASA,iBACCC,EACAC,EAC0B,CACX,OAAA3B,EAAA0B,CAAS,EAAE,IAAIC,CAAU,EAEjC,CACN,QAAS,IAAM,CACC3B,EAAA0B,CAAS,EAAE,OAAOC,CAAU,CAC5C,CAAA,CAEF,CAQU,cAA8CD,EAAcE,EAA2C,CACrG,UAAAC,KAAW7B,EAAe0B,CAAS,EACxCG,EAAQ,GAAGD,CAAI,CAEtB,CAQA,MAAgB,oBAAoB1B,EAA4B,GAAkB,OACjF,MAAMY,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,qBAAqB,EAE7D,OAAAA,EAAI,aAAa,OAAO,YAAa,KAAK,QAAQ,QAAQ,EAC1DA,EAAI,aAAa,OAAO,eAAgB,KAAK,QAAQ,WAAW,EAChEA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,MAAM,EAC5EA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,UAAU,EAC5EA,EAAA,aAAa,OAAO,SAASN,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,IAAc,EACrEM,EAAA,aAAa,OAAO,wBAAyB,MAAM,EAEnDZ,EAAQ,QACXY,EAAI,aAAa,OAAO,SAAUZ,EAAQ,MAAM,EAE7CA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAE9DA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,SAAS,EAEpDA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAG3DY,CACR,CAkBA,MAAgB,iBAAiBA,EAAmBgB,EAA+B,GAAuB,CACzG,OAAO,MAAM,KAAK,WAAW,KAAKhB,EAAK,CACtC,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,IAAI,gBAAgBgB,CAAI,CAAA,CAC9B,CACF,CACD"}
|
|
1
|
+
{"version":3,"file":"BaseFlow.mjs","sources":["../../src/flows/BaseFlow.ts"],"sourcesContent":["import type { KyInstance } from 'ky';\nimport type { IdTokenClaims, SDKOptions, SDKStorage, EventFunctions, ExtraRequestArgs, LogoutOptions } from '../types';\nimport { isBrowser } from '../utils/constants';\nimport { jwt } from '../utils/jwt';\nimport { fetch } from '../utils/fetch';\nimport { timestamp } from '../utils/date';\nimport { Metadata } from '../Metadata';\nimport { Session } from '../Session';\nimport { State } from '../State';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst eventCallbacks: Record<keyof EventFunctions, Set<(...args: Array<any>) => Promise<void> | void>> = {\n\taccessTokenExpired: new Set(),\n\tinit: new Set(),\n\tloggedIn: new Set(),\n\tloginInitiated: new Set(),\n\tlogoutInitiated: new Set(),\n\tsessionLoaded: new Set(),\n\ttokenRefreshed: new Set(),\n\ttokenRefreshFailed: new Set(),\n\ttokenRevoked: new Set(),\n\ttokenRevokeFailed: new Set(),\n};\n\n/**\n * An abstract base class that provides common functionality for different OIDC flows.\n *\n * @template Options - The options type extending `SDKOptions` used for configuring the flow.\n * @template URLHandlerOptions - The options type extending `ExtraRequestArgs` used for URL handling.\n */\nexport abstract class BaseFlow<Options extends SDKOptions, URLHandlerOptions extends ExtraRequestArgs> {\n\t/**\n\t * A promise that resolves to indicate whether authentication has been verified.\n\t *\n\t * @type {Promise<boolean> | null}\n\t */\n\tprotected isAuthPromise: Promise<boolean> | null = null;\n\n\t/**\n\t * An instance of the HTTP client used for making requests.\n\t *\n\t * @type {KyInstance}\n\t */\n\tprotected httpClient!: KyInstance;\n\n\t/**\n\t * The configuration options for the flow.\n\t *\n\t * @type {Options}\n\t */\n\tprotected options: Options;\n\n\t/**\n\t * The storage mechanism used to persist session data.\n\t *\n\t * @type {SDKStorage}\n\t */\n\tprotected storage: SDKStorage;\n\n\t/**\n\t * Metadata information about the authorization server.\n\t *\n\t * @type {Metadata}\n\t */\n\tprotected metadata: Metadata;\n\n\t/**\n\t * The current session data.\n\t *\n\t * @type {Session | null}\n\t */\n\tprotected session: Session | null = null;\n\n\t/**\n\t * Retrieves the ID token claims from the current session.\n\t *\n\t * @type {IdTokenClaims | null | undefined}\n\t */\n\tget idTokenClaims(): IdTokenClaims | null | undefined {\n\t\treturn this.session?.claims;\n\t}\n\n\t/**\n\t * Retrieves the access token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget accessToken(): string | null | undefined {\n\t\treturn this.session?.access_token;\n\t}\n\n\t/**\n\t * Retrieves the refresh token from the current session.\n\t *\n\t * @type {string | null | undefined}\n\t */\n\tget refreshToken(): string | null | undefined {\n\t\treturn this.session?.refresh_token;\n\t}\n\n\t/**\n\t * Determines if the access token has expired.\n\t *\n\t * @type {boolean}\n\t */\n\tget accessTokenExpired(): boolean {\n\t\treturn !this.session?.access_token || !this.session?.expires_at || this.session.expires_at <= timestamp();\n\t}\n\n\t/**\n\t * Retrieves the access token expiration date.\n\t *\n\t * @type {number | null | undefined}\n\t */\n\tget accessTokenExpirationDate(): number | null | undefined {\n\t\treturn this.session?.expires_at;\n\t}\n\n\t/**\n\t * Checks if the user is authenticated by evaluating the presence of access or refresh tokens.\n\t *\n\t * @returns {Promise<boolean>} - A promise that resolves to `true` if the user is authenticated, otherwise `false`.\n\t */\n\tget isAuthenticated(): Promise<boolean> {\n\t\tif (this.isAuthPromise) {\n\t\t\treturn this.isAuthPromise;\n\t\t}\n\n\t\t// eslint-disable-next-line no-async-promise-executor\n\t\tthis.isAuthPromise = new Promise(async (resolve) => {\n\t\t\ttry {\n\t\t\t\tif (this.refreshToken && this.accessTokenExpired) {\n\t\t\t\t\tawait this.refresh();\n\t\t\t\t}\n\t\t\t} catch {}\n\n\t\t\tsetTimeout(() => {\n\t\t\t\tresolve(!this.accessTokenExpired);\n\t\t\t\tthis.isAuthPromise = null;\n\t\t\t});\n\t\t});\n\n\t\treturn this.isAuthPromise;\n\t}\n\n\t/**\n\t * Constructs a new instance of the `BaseFlow` class.\n\t *\n\t * @param {Options} options - Configuration options for the flow.\n\t * @param {SDKStorage} storage - Storage mechanism for session data.\n\t *\n\t * @throws {Error} Throws an error if required options are missing or invalid.\n\t */\n\tconstructor(options: Options, storage: SDKStorage) {\n\t\tif (!options.issuer) {\n\t\t\tthrow Error('Missing option: issuer');\n\t\t}\n\t\tif (!options.clientId) {\n\t\t\tthrow Error('Missing option: clientId');\n\t\t}\n\t\tif (!options.redirectUri) {\n\t\t\tthrow Error('Missing option: redirectUri');\n\t\t}\n\t\tif (options.scopes && !Array.isArray(options.scopes)) {\n\t\t\tthrow Error('Invalid option: scopes');\n\t\t}\n\n\t\tif (!options.scopes) {\n\t\t\toptions.scopes = ['openid'];\n\t\t}\n\t\tif (!options.responseType) {\n\t\t\toptions.responseType = 'code';\n\t\t}\n\t\tif (!options.responseMode) {\n\t\t\toptions.responseMode = 'query';\n\t\t}\n\t\tif (!options.storageTokenName) {\n\t\t\toptions.storageTokenName = 'sty.session';\n\t\t}\n\n\t\tthis.httpClient = fetch.create({ retry: 0 });\n\t\tthis.options = options as Options;\n\t\tthis.storage = storage;\n\t\tthis.metadata = new Metadata(`${options.issuer}/.well-known/openid-configuration`);\n\t\tthis.session = Session.load(this.storage.get(this.options.storageTokenName as string));\n\n\t\tsetTimeout(() => {\n\t\t\tthis.dispatchEvent('init', []);\n\n\t\t\tif (this.session && this.accessToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('sessionLoaded', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\n\t\t\tif (this.accessToken && this.accessTokenExpired) {\n\t\t\t\tthis.dispatchEvent('accessTokenExpired', [{ accessToken: this.accessToken, refreshToken: this.refreshToken }]);\n\t\t\t}\n\t\t});\n\t}\n\n\t/**\n\t * Initiates the login process. Subclasses should implement this method to handle the specific login flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during login.\n\t * @returns {Promise<void>} - A promise that resolves when the login process is complete.\n\t */\n\tabstract login(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Registers a new user. Subclasses should implement this method to handle the specific registration flow.\n\t *\n\t * @param {URLHandlerOptions} [options] - Additional options for handling URLs during registration.\n\t * @returns {Promise<void>} - A promise that resolves when the registration process is complete.\n\t */\n\tabstract register(options?: URLHandlerOptions): Promise<void>;\n\n\t/**\n\t * Logs out the current user and optionally redirects to a post-logout URI.\n\t *\n\t * @param {URLHandlerOptions & LogoutOptions} [options] - Additional options for handling URLs during logout.\n\t * @returns {Promise<void>} - A promise that resolves when the logout process is complete.\n\t */\n\tasync logout(options?: URLHandlerOptions & LogoutOptions): Promise<void> {\n\t\tif (!isBrowser) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\tthis.storage.delete(this.options.storageTokenName as string);\n\t\tthis.session = null;\n\n\t\tif (session?.id_token) {\n\t\t\tconst url = new URL(await this.metadata.endSessionEndpoint);\n\n\t\t\turl.searchParams.append('id_token_hint', session?.id_token);\n\n\t\t\tif (options?.postLogoutRedirectUri) {\n\t\t\t\turl.searchParams.append('post_logout_redirect_uri', options.postLogoutRedirectUri);\n\t\t\t}\n\n\t\t\tthis.dispatchEvent('logoutInitiated', [{ idToken: session.id_token, claims: session.claims as IdTokenClaims }]);\n\n\t\t\ttry {\n\t\t\t\tawait this.urlHandler(url, options as URLHandlerOptions);\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t/**\n\t * Refreshes the access token using the refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token refresh is complete.\n\t *\n\t * @throws {Error} Throws an error if no refresh token is available or if the refresh fails.\n\t */\n\tasync refresh(): Promise<void> {\n\t\tif (typeof this.session?.refresh_token !== 'string') {\n\t\t\tthrow Error('No refresh token available');\n\t\t}\n\n\t\tconst session = this.session;\n\n\t\ttry {\n\t\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\t\tgrant_type: 'refresh_token',\n\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\trefresh_token: this.session?.refresh_token,\n\t\t\t});\n\n\t\t\tObject.assign(this.session, await request.json());\n\n\t\t\tif (this.session.id_token) {\n\t\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t\t}\n\n\t\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\n\t\t\tif (this.accessToken && this.refreshToken && this.idTokenClaims) {\n\t\t\t\tthis.dispatchEvent('tokenRefreshed', [{ accessToken: this.accessToken, refreshToken: this.refreshToken, claims: this.idTokenClaims }]);\n\t\t\t}\n\t\t} catch {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tthis.dispatchEvent('tokenRefreshFailed', [{ refreshToken: session.refresh_token as string }]);\n\t\t}\n\t}\n\n\t/**\n\t * Revokes the current access or refresh token.\n\t *\n\t * @returns {Promise<void>} - A promise that resolves when the token revocation is complete.\n\t */\n\tasync revoke(): Promise<void> {\n\t\tconst session = this.session;\n\t\tlet success = true;\n\n\t\ttry {\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'refresh_token',\n\t\t\t\t\ttoken: session.refresh_token,\n\t\t\t\t});\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tawait this.sendTokenRequest(await this.metadata.revocationEndpoint, {\n\t\t\t\t\tclient_id: this.options.clientId,\n\t\t\t\t\ttoken_type_hint: 'access_token',\n\t\t\t\t\ttoken: session.access_token,\n\t\t\t\t});\n\t\t\t}\n\t\t} catch {\n\t\t\tsuccess = false;\n\t\t} finally {\n\t\t\tthis.session = null;\n\t\t\tthis.storage.delete(this.options.storageTokenName as string);\n\n\t\t\tif (session?.refresh_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.refresh_token as string, tokenTypeHint: 'refresh_token' }]);\n\t\t\t} else if (session?.access_token) {\n\t\t\t\tthis.dispatchEvent(success ? 'tokenRevoked' : 'tokenRevokeFailed', [{ token: session.access_token as string, tokenTypeHint: 'access_token' }]);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Exchanges an authorization code for access and refresh tokens.\n\t *\n\t * @param {Record<string, string>} [params={}] - Parameters containing the authorization code and other required values.\n\t * @returns {Promise<void>} - A promise that resolves when the token exchange is complete.\n\t *\n\t * @throws {Error} Throws an error if the authorization code is invalid or if there are issues with state, nonce, or tokens.\n\t */\n\tasync exchangeCodeForTokens(params: Record<string, string> = {}): Promise<void> {\n\t\tthis.session = new Session();\n\n\t\tObject.assign(this.session, params);\n\n\t\tif (this.session.error) {\n\t\t\tthrow Error(`${this.session.error}: ${this.session.error_description}`);\n\t\t}\n\t\tif (!this.session.code) {\n\t\t\tthrow Error('Invalid or missing code');\n\t\t}\n\n\t\tlet state: State;\n\n\t\ttry {\n\t\t\tconst serializedState = this.storage.get(`sty.${this.session.state}`);\n\n\t\t\tif (!serializedState) {\n\t\t\t\tthrow Error();\n\t\t\t}\n\n\t\t\tstate = State.fromSerializedData(serializedState);\n\n\t\t\tthis.storage.delete(`sty.${this.session.state}`);\n\t\t} catch {\n\t\t\tthrow Error('Invalid or missing state');\n\t\t}\n\n\t\tconst request = await this.sendTokenRequest(await this.metadata.tokenEndpoint, {\n\t\t\tgrant_type: 'authorization_code',\n\t\t\tclient_id: this.options.clientId,\n\t\t\tredirect_uri: this.options.redirectUri,\n\t\t\tcode_verifier: state.codeVerifier,\n\t\t\tcode: this.session.code,\n\t\t});\n\n\t\tObject.assign(this.session, await request.json());\n\n\t\tif (this.session.id_token) {\n\t\t\tthis.session.claims = jwt.decode<IdTokenClaims>(this.session.id_token);\n\t\t}\n\n\t\tif (this.session.scope !== this.options.scopes?.join(' ')) {\n\t\t\tthrow Error('Invalid scope');\n\t\t}\n\t\tif (this.session.claims?.nonce !== state.nonce) {\n\t\t\tthrow Error('Invalid nonce');\n\t\t}\n\t\tif (this.session.claims?.iss !== (await this.metadata.issuer)) {\n\t\t\tthrow Error('Invalid iss');\n\t\t}\n\t\tif (Array.isArray(this.session.claims?.aud) ? this.session.claims?.aud[0] !== this.options.clientId : this.session.claims?.aud !== this.options.clientId) {\n\t\t\tthrow Error('Invalid aud');\n\t\t}\n\n\t\tthis.storage.set(this.options.storageTokenName as string, JSON.stringify(this.session));\n\t}\n\n\t/**\n\t * Subscribes a callback function to an event.\n\t *\n\t * @param {T} eventName - The name of the event to subscribe to.\n\t * @param {(...params: Parameters<EventFunctions[T]>) => Promise<void> | void} callbackFn - The callback function to execute when the event is dispatched.\n\t * @returns {{ dispose: () => void }} - An object with a `dispose` method to remove the subscription.\n\t */\n\tsubscribeToEvent<T extends keyof EventFunctions>(\n\t\teventName: T,\n\t\tcallbackFn: (...params: Parameters<EventFunctions[T]>) => Promise<void> | void,\n\t): { dispose: () => void } {\n\t\teventCallbacks[eventName].add(callbackFn);\n\n\t\treturn {\n\t\t\tdispose: () => {\n\t\t\t\teventCallbacks[eventName].delete(callbackFn);\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Dispatches an event to all subscribed callback functions.\n\t *\n\t * @param {T} eventName - The name of the event to dispatch.\n\t * @param {Parameters<EventFunctions[T]>} args - The arguments to pass to the callback functions.\n\t */\n\tprotected dispatchEvent<T extends keyof EventFunctions>(eventName: T, args: Parameters<EventFunctions[T]>): void {\n\t\tfor (const eventFn of eventCallbacks[eventName]) {\n\t\t\tvoid eventFn(...args);\n\t\t}\n\t}\n\n\t/**\n\t * Constructs the authorization URL for initiating the authorization flow.\n\t *\n\t * @param {ExtraRequestArgs} [options={}] - Additional options to include in the authorization URL.\n\t * @returns {Promise<URL>} - A promise that resolves to the constructed authorization URL.\n\t */\n\tprotected async getAuthorizationUrl(options: ExtraRequestArgs = {}): Promise<URL> {\n\t\tconst url = new URL(await this.metadata.authorizationEndpoint);\n\n\t\turl.searchParams.append('client_id', this.options.clientId);\n\t\turl.searchParams.append('redirect_uri', this.options.redirectUri);\n\t\turl.searchParams.append('response_type', this.options.responseType || 'code');\n\t\turl.searchParams.append('response_mode', this.options.responseMode || 'fragment');\n\t\turl.searchParams.append('scope', this.options.scopes?.join(' ') as string);\n\t\turl.searchParams.append('code_challenge_method', 'S256');\n\n\t\tif (options.prompt) {\n\t\t\turl.searchParams.append('prompt', options.prompt);\n\t\t}\n\t\tif (options.acrValues) {\n\t\t\turl.searchParams.append('acr_values', options.acrValues.join(' '));\n\t\t}\n\t\tif (options.loginHint) {\n\t\t\turl.searchParams.append('login_hint', options.loginHint);\n\t\t}\n\t\tif (options.uiLocales) {\n\t\t\turl.searchParams.append('ui_locales', options.uiLocales.join(' '));\n\t\t}\n\n\t\treturn url;\n\t}\n\n\t/**\n\t * Handles URL redirections for authentication and authorization processes.\n\t *\n\t * @param {string | URL} url - The URL to handle.\n\t * @param {URLHandlerOptions} [options] - Additional options for URL handling.\n\t * @returns {Promise<unknown>} - A promise that resolves when the URL handling is complete.\n\t */\n\tprotected abstract urlHandler(url: string | URL, options?: URLHandlerOptions): Promise<unknown>;\n\n\t/**\n\t * Sends a token request to the specified URL with the given data.\n\t *\n\t * @param {string | URL} url - The URL to send the request to.\n\t * @param {Record<string, string>} [data={}] - The data to include in the request body.\n\t * @returns {Promise<Response>} - A promise that resolves to the response from the request.\n\t */\n\tprotected async sendTokenRequest(url: string | URL, data: Record<string, string> = {}): Promise<Response> {\n\t\treturn await this.httpClient.post(url, {\n\t\t\theaders: { 'Content-Type': 'application/x-www-form-urlencoded' },\n\t\t\tbody: new URLSearchParams(data),\n\t\t});\n\t}\n}\n"],"names":["eventCallbacks","BaseFlow","options","storage","__publicField","fetch","Metadata","Session","_a","_b","timestamp","resolve","isBrowser","session","url","request","jwt","success","params","state","serializedState","State","_c","_d","_e","_f","eventName","callbackFn","args","eventFn","data"],"mappings":"2gBAWA,MAAMA,EAAmG,CACxG,uBAAwB,IACxB,SAAU,IACV,aAAc,IACd,mBAAoB,IACpB,oBAAqB,IACrB,kBAAmB,IACnB,mBAAoB,IACpB,uBAAwB,IACxB,iBAAkB,IAClB,sBAAuB,GACxB,EAQO,MAAeC,CAAiF,CA2HtG,YAAYC,EAAkBC,EAAqB,CArHzCC,EAAA,qBAAyC,MAOzCA,EAAA,mBAOAA,EAAA,gBAOAA,EAAA,gBAOAA,EAAA,iBAOAA,EAAA,eAA0B,MAmF/B,GAAA,CAACF,EAAQ,OACZ,MAAM,MAAM,wBAAwB,EAEjC,GAAA,CAACA,EAAQ,SACZ,MAAM,MAAM,0BAA0B,EAEnC,GAAA,CAACA,EAAQ,YACZ,MAAM,MAAM,6BAA6B,EAE1C,GAAIA,EAAQ,QAAU,CAAC,MAAM,QAAQA,EAAQ,MAAM,EAClD,MAAM,MAAM,wBAAwB,EAGhCA,EAAQ,SACJA,EAAA,OAAS,CAAC,QAAQ,GAEtBA,EAAQ,eACZA,EAAQ,aAAe,QAEnBA,EAAQ,eACZA,EAAQ,aAAe,SAEnBA,EAAQ,mBACZA,EAAQ,iBAAmB,eAG5B,KAAK,WAAaG,EAAM,OAAO,CAAE,MAAO,EAAG,EAC3C,KAAK,QAAUH,EACf,KAAK,QAAUC,EACf,KAAK,SAAW,IAAIG,EAAS,GAAGJ,EAAQ,MAAM,mCAAmC,EAC5E,KAAA,QAAUK,EAAQ,KAAK,KAAK,QAAQ,IAAI,KAAK,QAAQ,gBAA0B,CAAC,EAErF,WAAW,IAAM,CACX,KAAA,cAAc,OAAQ,CAAA,CAAE,EAEzB,KAAK,SAAW,KAAK,aAAe,KAAK,eAC5C,KAAK,cAAc,gBAAiB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,EAGjI,KAAK,aAAe,KAAK,oBACvB,KAAA,cAAc,qBAAsB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,YAAa,CAAC,CAAC,CAC9G,CACA,CACF,CAvHA,IAAI,eAAkD,OACrD,OAAOC,EAAA,KAAK,UAAL,YAAAA,EAAc,MACtB,CAOA,IAAI,aAAyC,OAC5C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,YACtB,CAOA,IAAI,cAA0C,OAC7C,OAAOA,EAAA,KAAK,UAAL,YAAAA,EAAc,aACtB,CAOA,IAAI,oBAA8B,SAC1B,MAAA,GAACA,EAAA,KAAK,UAAL,MAAAA,EAAc,eAAgB,GAACC,EAAA,KAAK,UAAL,MAAAA,EAAc,aAAc,KAAK,QAAQ,YAAcC,EAAU,CACzG,CAOA,IAAI,2BAAuD,OAC1D,OAAOF,EAAA,KAAK,UAAL,YAAAA,EAAc,UACtB,CAOA,IAAI,iBAAoC,CACvC,OAAI,KAAK,cACD,KAAK,eAIb,KAAK,cAAgB,IAAI,QAAQ,MAAOG,GAAY,CAC/C,GAAA,CACC,KAAK,cAAgB,KAAK,oBAC7B,MAAM,KAAK,SACZ,MACO,CAAC,CAET,WAAW,IAAM,CACRA,EAAA,CAAC,KAAK,kBAAkB,EAChC,KAAK,cAAgB,IAAA,CACrB,CAAA,CACD,EAEM,KAAK,cACb,CA8EA,MAAM,OAAOT,EAA4D,CACxE,GAAI,CAACU,EACJ,OAGD,MAAMC,EAAU,KAAK,QAKrB,GAHA,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAC3D,KAAK,QAAU,KAEXA,GAAA,MAAAA,EAAS,SAAU,CACtB,MAAMC,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,kBAAkB,EAE1DA,EAAI,aAAa,OAAO,gBAAiBD,GAAA,YAAAA,EAAS,QAAQ,EAEtDX,GAAA,MAAAA,EAAS,uBACZY,EAAI,aAAa,OAAO,2BAA4BZ,EAAQ,qBAAqB,EAG7E,KAAA,cAAc,kBAAmB,CAAC,CAAE,QAASW,EAAQ,SAAU,OAAQA,EAAQ,MAAwB,CAAC,CAAC,EAE1G,GAAA,CACG,MAAA,KAAK,WAAWC,EAAKZ,CAA4B,CAAA,MAChD,CAAC,CACV,CACD,CASA,MAAM,SAAyB,SAC9B,GAAI,QAAOM,EAAA,KAAK,UAAL,YAAAA,EAAc,gBAAkB,SAC1C,MAAM,MAAM,4BAA4B,EAGzC,MAAMK,EAAU,KAAK,QAEjB,GAAA,CACH,MAAME,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,gBACZ,UAAW,KAAK,QAAQ,SACxB,eAAeN,EAAA,KAAK,UAAL,YAAAA,EAAc,aAAA,CAC7B,EAED,OAAO,OAAO,KAAK,QAAS,MAAMM,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGjE,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,EAElF,KAAK,aAAe,KAAK,cAAgB,KAAK,eACjD,KAAK,cAAc,iBAAkB,CAAC,CAAE,YAAa,KAAK,YAAa,aAAc,KAAK,aAAc,OAAQ,KAAK,aAAA,CAAe,CAAC,CACtI,MACO,CACP,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEtD,KAAA,cAAc,qBAAsB,CAAC,CAAE,aAAcH,EAAQ,aAAyB,CAAA,CAAC,CAC7F,CACD,CAOA,MAAM,QAAwB,CAC7B,MAAMA,EAAU,KAAK,QACrB,IAAII,EAAU,GAEV,GAAA,CACCJ,GAAA,MAAAA,EAAS,cACZ,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,gBACjB,MAAOA,EAAQ,aAAA,CACf,EACSA,GAAA,MAAAA,EAAS,cACnB,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,mBAAoB,CACnE,UAAW,KAAK,QAAQ,SACxB,gBAAiB,eACjB,MAAOA,EAAQ,YAAA,CACf,CACF,MACO,CACGI,EAAA,EAAA,QACT,CACD,KAAK,QAAU,KACf,KAAK,QAAQ,OAAO,KAAK,QAAQ,gBAA0B,EAEvDJ,GAAA,MAAAA,EAAS,cACZ,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,cAAyB,cAAe,eAAgB,CAAC,CAAC,EACrIA,GAAA,MAAAA,EAAS,cACnB,KAAK,cAAcI,EAAU,eAAiB,oBAAqB,CAAC,CAAE,MAAOJ,EAAQ,aAAwB,cAAe,cAAe,CAAC,CAAC,CAE/I,CACD,CAUA,MAAM,sBAAsBK,EAAiC,GAAmB,iBAK3E,GAJC,KAAA,QAAU,IAAIX,EAEZ,OAAA,OAAO,KAAK,QAASW,CAAM,EAE9B,KAAK,QAAQ,MACV,MAAA,MAAM,GAAG,KAAK,QAAQ,KAAK,KAAK,KAAK,QAAQ,iBAAiB,EAAE,EAEnE,GAAA,CAAC,KAAK,QAAQ,KACjB,MAAM,MAAM,yBAAyB,EAGlC,IAAAC,EAEA,GAAA,CACG,MAAAC,EAAkB,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,KAAK,EAAE,EAEpE,GAAI,CAACA,EACJ,MAAM,MAAM,EAGLD,EAAAE,EAAM,mBAAmBD,CAAe,EAEhD,KAAK,QAAQ,OAAO,OAAO,KAAK,QAAQ,KAAK,EAAE,CAAA,MACxC,CACP,MAAM,MAAM,0BAA0B,CACvC,CAEA,MAAML,EAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK,SAAS,cAAe,CAC9E,WAAY,qBACZ,UAAW,KAAK,QAAQ,SACxB,aAAc,KAAK,QAAQ,YAC3B,cAAeI,EAAM,aACrB,KAAM,KAAK,QAAQ,IAAA,CACnB,EAQG,GANJ,OAAO,OAAO,KAAK,QAAS,MAAMJ,EAAQ,MAAM,EAE5C,KAAK,QAAQ,WAChB,KAAK,QAAQ,OAASC,EAAI,OAAsB,KAAK,QAAQ,QAAQ,GAGlE,KAAK,QAAQ,UAAUR,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,MACpD,MAAM,MAAM,eAAe,EAE5B,KAAIC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,SAAUU,EAAM,MACxC,MAAM,MAAM,eAAe,EAE5B,KAAIG,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAS,MAAM,KAAK,SAAS,OACrD,MAAM,MAAM,aAAa,EAEtB,GAAA,MAAM,SAAQC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,GAAG,IAAIC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,IAAI,MAAO,KAAK,QAAQ,WAAWC,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,OAAQ,KAAK,QAAQ,SAC/I,MAAM,MAAM,aAAa,EAGrB,KAAA,QAAQ,IAAI,KAAK,QAAQ,iBAA4B,KAAK,UAAU,KAAK,OAAO,CAAC,CACvF,CASA,iBACCC,EACAC,EAC0B,CACX,OAAA3B,EAAA0B,CAAS,EAAE,IAAIC,CAAU,EAEjC,CACN,QAAS,IAAM,CACC3B,EAAA0B,CAAS,EAAE,OAAOC,CAAU,CAC5C,CAAA,CAEF,CAQU,cAA8CD,EAAcE,EAA2C,CACrG,UAAAC,KAAW7B,EAAe0B,CAAS,EACxCG,EAAQ,GAAGD,CAAI,CAEtB,CAQA,MAAgB,oBAAoB1B,EAA4B,GAAkB,OACjF,MAAMY,EAAM,IAAI,IAAI,MAAM,KAAK,SAAS,qBAAqB,EAE7D,OAAAA,EAAI,aAAa,OAAO,YAAa,KAAK,QAAQ,QAAQ,EAC1DA,EAAI,aAAa,OAAO,eAAgB,KAAK,QAAQ,WAAW,EAChEA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,MAAM,EAC5EA,EAAI,aAAa,OAAO,gBAAiB,KAAK,QAAQ,cAAgB,UAAU,EAC5EA,EAAA,aAAa,OAAO,SAASN,EAAA,KAAK,QAAQ,SAAb,YAAAA,EAAqB,KAAK,IAAc,EACrEM,EAAA,aAAa,OAAO,wBAAyB,MAAM,EAEnDZ,EAAQ,QACXY,EAAI,aAAa,OAAO,SAAUZ,EAAQ,MAAM,EAE7CA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAE9DA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,SAAS,EAEpDA,EAAQ,WACXY,EAAI,aAAa,OAAO,aAAcZ,EAAQ,UAAU,KAAK,GAAG,CAAC,EAG3DY,CACR,CAkBA,MAAgB,iBAAiBA,EAAmBgB,EAA+B,GAAuB,CACzG,OAAO,MAAM,KAAK,WAAW,KAAKhB,EAAK,CACtC,QAAS,CAAE,eAAgB,mCAAoC,EAC/D,KAAM,IAAI,gBAAgBgB,CAAI,CAAA,CAC9B,CACF,CACD"}
|