@thunderid/javascript 1.4.0 → 1.4.1

package/dist/edge/index.js

@@ -1,4 +1,6 @@
-import * as jose from "jose";
+import * as base64url from "jose/base64url";
+import { importJWK } from "jose/key/import";
+import { jwtVerify } from "jose/jwt/verify";
 
 //#region rolldown:runtime
 var __defProp = Object.defineProperty;
@@ -87,6 +89,16 @@ var IsomorphicCrypto = class {
 		return this.cryptoUtils.base64URLEncode(this.cryptoUtils.generateRandomBytes(32));
 	}
 	/**
+	* Generates the random part of an authorization request `state` from 32 random bytes. Only
+	* letters and digits are kept, so the value never contains the `_` that separates the parts of
+	* the state.
+	*
+	* @returns A random string of about 42 characters.
+	*/
+	generateState() {
+		return this.cryptoUtils.base64URLEncode(this.cryptoUtils.generateRandomBytes(32)).replace(/[^A-Za-z0-9]/g, "");
+	}
+	/**
 	* Derive code challenge from the code verifier.
 	*
 	* @param verifier - Code verifier.
@@ -2225,7 +2237,10 @@ const OIDCRequestConstants = {
 		SIGN_OUT_SUCCESS: "sign_out_success",
 		STATE: "state"
 	},
-	SignIn: { Payload: { DEFAULT_SCOPES: [ScopeConstants_default.OPENID, ScopeConstants_default.PROFILE] } },
+	SignIn: {
+		Payload: { DEFAULT_SCOPES: [ScopeConstants_default.OPENID, ScopeConstants_default.PROFILE] },
+		Storage: { StorageKeys: { STATE: "authorization_state" } }
+	},
 	SignOut: { Storage: { StorageKeys: { SIGN_OUT_URL: "sign_out_url" } } }
 };
 var OIDCRequestConstants_default = OIDCRequestConstants;
@@ -2682,11 +2697,11 @@ var DefaultCacheStore = class {
 */
 var DefaultCrypto = class {
 	base64URLDecode(value) {
-		const decodedArray = jose.base64url.decode(value);
+		const decodedArray = base64url.decode(value);
 		return new TextDecoder().decode(decodedArray);
 	}
 	base64URLEncode(value) {
-		return jose.base64url.encode(value);
+		return base64url.encode(value);
 	}
 	generateRandomBytes(length) {
 		return crypto.getRandomValues(new Uint8Array(length));
@@ -2697,8 +2712,7 @@ var DefaultCrypto = class {
 		return new Uint8Array(hashBuffer);
 	}
 	async verifyJwt(idToken, jwk, algorithms, clientId, issuer, subject, clockTolerance, validateJwtIssuer = true) {
-		const key = await jose.importJWK(jwk);
-		await jose.jwtVerify(idToken, key, {
+		await jwtVerify(idToken, await importJWK(jwk), {
 			algorithms,
 			audience: [clientId],
 			clockTolerance,
@@ -2785,6 +2799,7 @@ var StorageManager = class StorageManager {
 		return `${store}-${this.id}`;
 	}
 	static isLocalStorageAvailable() {
+		if (typeof window === "undefined") return false;
 		try {
 			const testValue = "__AUTH_SDK_STORAGE_TEST__";
 			localStorage.setItem(testValue, testValue);
@@ -3424,7 +3439,7 @@ var AuthenticationHelper = class {
 		} else sessionData = await this.storageManager.getSessionData(userId);
 		const scope = processOpenIDScopes_default(configData.scopes);
 		if (typeof text !== "string") return text;
-		return text.replace(TokenExchangeConstants_default.Placeholders.ACCESS_TOKEN, sessionData.access_token).replace(TokenExchangeConstants_default.Placeholders.USERNAME, this.getAuthenticatedUserInfo(sessionData.id_token).username ?? "").replace(TokenExchangeConstants_default.Placeholders.SCOPES, scope).replace(TokenExchangeConstants_default.Placeholders.CLIENT_ID, configData.clientId ?? "").replace(TokenExchangeConstants_default.Placeholders.CLIENT_SECRET, configData.clientSecret ?? "");
+		return text.replace(TokenExchangeConstants_default.Placeholders.ACCESS_TOKEN, () => sessionData?.access_token ?? "").replace(TokenExchangeConstants_default.Placeholders.USERNAME, () => sessionData?.id_token ? this.getAuthenticatedUserInfo(sessionData.id_token).username ?? "" : "").replace(TokenExchangeConstants_default.Placeholders.SCOPES, scope).replace(TokenExchangeConstants_default.Placeholders.CLIENT_ID, configData.clientId ?? "").replace(TokenExchangeConstants_default.Placeholders.CLIENT_SECRET, configData.clientSecret ?? "");
 	}
 	/**
 	* Clears all temporary and session data for the given user.
@@ -3479,7 +3494,7 @@ var AuthenticationHelper_default = AuthenticationHelper;
 /**
 * Encodes a string to standard base64 using `jose` (already a package dependency).
 *
-* `jose.base64url.encode` is environment-agnostic (browser, Node.js, Deno, Bun,
+* jose's `base64url.encode` is environment-agnostic (browser, Node.js, Deno, Bun,
 * edge/service-worker runtimes). It produces base64url output, which is then
 * converted to standard base64 by restoring the `+`/`/` characters and adding
 * `=` padding.
@@ -3493,7 +3508,7 @@ var AuthenticationHelper_default = AuthenticationHelper;
 * ```
 */
 const base64Encode = (value) => {
-	const b64url = jose.base64url.encode(new TextEncoder().encode(value));
+	const b64url = base64url.encode(new TextEncoder().encode(value));
 	const rem = b64url.length % 4;
 	return (rem === 0 ? b64url : b64url + "=".repeat(4 - rem)).replace(/-/g, "+").replace(/_/g, "/");
 };
@@ -3628,7 +3643,7 @@ var generateStateParamForRequestCorrelation_default = generateStateParamForReque
 * This utility ensures the `openid` scope is always included, handles both string and array forms of the `scope` parameter,
 * and supports PKCE and custom parameters. Throws if a code challenge is provided without a code challenge method.
 *
-* @param options - The main options for the authorization request, including redirectUri, clientId, scope, responseMode, codeChallenge, codeChallengeMethod, and prompt.
+* @param options - The main options for the authorization request, including redirectUri, clientId, scope, responseMode, codeChallenge, codeChallengeMethod, prompt, and randomState (a value generated from random bytes that makes the `state` unique to this request).
 * @param pkceOptions - PKCE options, including the PKCE key for state correlation.
 * @param customParams - Optional custom parameters to include in the request (excluding the `state` param, which is handled separately).
 * @returns A Map of key-value pairs representing the authorization request URL parameters.
@@ -3673,14 +3688,67 @@ const getAuthorizeRequestUrlParams = (options, pkceOptions, customParams) => {
 	const customState = customParams?.[OIDCRequestConstants_default.Params.STATE]?.toString() ?? "";
 	let customStateValue = customState;
 	if (options.instanceId) customStateValue = AUTH_INSTANCE_PREFIX + options.instanceId + (customState ? `_${customState}` : "");
+	if (options.randomState) customStateValue = customStateValue ? `${customStateValue}_${options.randomState}` : options.randomState;
 	authorizeRequestParams.set(OIDCRequestConstants_default.Params.STATE, generateStateParamForRequestCorrelation_default(pkceKey, customStateValue));
 	return authorizeRequestParams;
 };
 var getAuthorizeRequestUrlParams_default = getAuthorizeRequestUrlParams;
 
+//#endregion
+//#region src/utils/getOAuthErrorMessage.ts
+/**
+* Builds a readable message from the body of an OAuth 2.0 error response (RFC 6749 section 5.2).
+*
+* Only the `error` and `error_description` members are read, so nothing else in the body, such as
+* a token, can end up in the message.
+*
+* @param body - The parsed response body, or its raw text.
+* @param fallback - The message to use when the body carries neither member.
+* @returns `"<error>: <error_description>"`, whichever of the two is present, or `fallback`.
+*
+* @example
+* getOAuthErrorMessage({error: 'invalid_grant', error_description: 'The code has expired.'}, 'Failed');
+* // Returns: "invalid_grant: The code has expired."
+*/
+const getOAuthErrorMessage = (body, fallback) => {
+	let parsed = body;
+	if (typeof body === "string") try {
+		parsed = JSON.parse(body);
+	} catch {
+		return fallback;
+	}
+	if (!parsed || typeof parsed !== "object") return fallback;
+	const { error: error$1, error_description: description } = parsed;
+	const parts = [error$1, description].filter((part) => typeof part === "string" && part.trim().length > 0);
+	return parts.length > 0 ? parts.join(": ") : fallback;
+};
+var getOAuthErrorMessage_default = getOAuthErrorMessage;
+
 //#endregion
 //#region src/ThunderIDJavaScriptClient.ts
 const WELL_KNOWN_PATH = "/.well-known/openid-configuration";
+/**
+* The issuer a discovery document must name: the configured `endpoints.issuer`, else the URL the
+* well-known path was appended to (OpenID Connect Discovery 1.0, section 4.3).
+*/
+const getExpectedIssuer = (configuredIssuer, wellKnownOverride, baseUrl) => {
+	if (configuredIssuer) return configuredIssuer;
+	if (wellKnownOverride) return wellKnownOverride.endsWith(WELL_KNOWN_PATH) ? wellKnownOverride.slice(0, -33) : void 0;
+	return baseUrl || void 0;
+};
+/**
+* Compares two issuers exactly, apart from a trailing slash on either side.
+*/
+const issuersMatch = (discovered, expected) => typeof discovered === "string" && discovered.replace(/\/+$/, "") === expected.replace(/\/+$/, "");
+/**
+* Reads a readable message from the body of a failed token, revocation, or custom grant response.
+*/
+const readErrorMessage = async (response, fallback) => getOAuthErrorMessage_default(await response.json().catch(() => void 0), fallback);
+/**
+* The storage key of the `state` sent with the authorization request whose PKCE key is given. Both
+* share the request index, so the callback finds the state from the index at the end of `state`.
+*/
+const getStateStorageKey = (pkceKey) => pkceKey.replace(PKCEConstants_default.Storage.StorageKeys.CODE_VERIFIER, OIDCRequestConstants_default.SignIn.Storage.StorageKeys.STATE);
 const REVOKE_ACCESS_TOKEN_REQUEST_TIMEOUT_MS = 1e4;
 const DEFAULT_CONFIG = {
 	enablePKCE: true,
@@ -3738,12 +3806,19 @@ var ThunderIDJavaScriptClient = class {
 		await this.loadOpenIDProviderConfiguration(true);
 		return true;
 	}
-	getConfiguration() {
-		return this.storageManager.getConfigData();
+	async getConfiguration() {
+		return await this.storageManager.getConfigData();
 	}
+	/**
+	* Returns the signed-in user, read from the claims of the session's ID token.
+	*
+	* @param userId - The session to read, on a server.
+	* @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GU-NF01` when the session holds no ID token.
+	*/
 	async getUser(userId) {
 		const sessionData = await this.storageManager.getSessionData(userId);
-		const authenticatedUser = this.authHelper.getAuthenticatedUserInfo(sessionData?.id_token);
+		if (!sessionData?.id_token) throw new ThunderIDRuntimeError("No signed-in session was found.", "JS-AUTH_CORE-GU-NF01", "javascript");
+		const authenticatedUser = this.authHelper.getAuthenticatedUserInfo(sessionData.id_token);
 		Object.keys(authenticatedUser).forEach((key) => {
 			if (authenticatedUser[key] === void 0 || authenticatedUser[key] === "" || authenticatedUser[key] === null) delete authenticatedUser[key];
 		});
@@ -3812,7 +3887,7 @@ var ThunderIDJavaScriptClient = class {
 		};
 		if (config.attachToken) requestHeaders = {
 			...requestHeaders,
-			Authorization: `Bearer ${(await this.storageManager.getSessionData(sessionId)).access_token}`
+			Authorization: `Bearer ${(await this.storageManager.getSessionData(sessionId))?.access_token}`
 		};
 		const requestConfig = {
 			body: data.join("&"),
@@ -3826,7 +3901,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-NE02", "The custom grant request failed.", error$1 ?? "The request sent to get the custom grant failed.");
 		}
-		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-HE03", `Invalid response status received for the custom grant request. (${response.statusText})`, await response.json());
+		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCG-HE03", `Invalid response status received for the custom grant request. (${response.statusText})`, await readErrorMessage(response, "The custom grant request was rejected."));
 		if (config.returnsSession) return this.authHelper.handleTokenResponse(response, sessionId);
 		return await response.json();
 	}
@@ -3858,7 +3933,8 @@ var ThunderIDJavaScriptClient = class {
 		const configData = await this.configProvider();
 		if (!forceInit && await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) return;
 		const { discovery, baseUrl, endpoints } = configData;
-		const resolvedWellKnownEndpoint = endpoints?.wellKnown || (discovery?.wellKnown?.enabled !== false && baseUrl ? `${baseUrl}${WELL_KNOWN_PATH}` : void 0);
+		const wellKnownOverride = endpoints?.wellKnown;
+		const resolvedWellKnownEndpoint = wellKnownOverride || (discovery?.wellKnown?.enabled !== false && baseUrl ? `${baseUrl}${WELL_KNOWN_PATH}` : void 0);
 		if (resolvedWellKnownEndpoint) {
 			let response;
 			try {
@@ -3873,8 +3949,19 @@ var ThunderIDJavaScriptClient = class {
 			}
 			if (response) {
 				let discoveryResolved = false;
+				let discovered;
+				try {
+					discovered = await response.json();
+				} catch {
+					discovered = void 0;
+				}
+				if (discovered && typeof discovered === "object") {
+					const expectedIssuer = getExpectedIssuer(endpoints?.issuer, wellKnownOverride, baseUrl);
+					if (expectedIssuer !== void 0 && !issuersMatch(discovered.issuer, expectedIssuer)) throw new ThunderIDRuntimeError("The discovered issuer does not match the expected issuer. Set endpoints.issuer if your server uses a custom issuer.", "JS-AUTH_CORE-GOPMD-IV03", "javascript");
+				}
 				try {
-					await this.storageManager.setOIDCProviderMetaData(await this.authHelper.resolveEndpoints(await response.json()));
+					if (!discovered || typeof discovered !== "object") throw new Error("The discovery response is not a JSON object.");
+					await this.storageManager.setOIDCProviderMetaData(await this.authHelper.resolveEndpoints(discovered));
 					discoveryResolved = true;
 				} catch (error$1) {
 					logger_default.warn(`ThunderIDJavaScriptClient: Could not resolve endpoints from the discovery response of ${resolvedWellKnownEndpoint}; falling back to endpoints derived from the base URL.`, error$1);
@@ -3922,10 +4009,12 @@ var ThunderIDJavaScriptClient = class {
 				codeChallengeMethod: PKCEConstants_default.DEFAULT_CODE_CHALLENGE_METHOD,
 				instanceId: this.getInstanceId().toString(),
 				prompt: configData.prompt,
+				randomState: this.cryptoHelper.generateState(),
 				redirectUri: configData.afterSignInUrl ?? "",
 				responseMode: configData.responseMode,
 				scopes: processOpenIDScopes_default(configData.scopes)
 			}).filter(([, v]) => v !== void 0)), { key: pkceKey }, authRequestConfig);
+			await this.storageManager.setHybridDataParameter(getStateStorageKey(pkceKey), authorizeRequestParams.get(OIDCRequestConstants_default.Params.STATE) ?? "", userId);
 			Array.from(authorizeRequestParams.entries()).forEach(([paramKey, paramValue]) => {
 				authorizeRequest.searchParams.append(paramKey, paramValue);
 			});
@@ -3936,6 +4025,10 @@ var ThunderIDJavaScriptClient = class {
 	}
 	async requestAccessToken(authorizationCode, state, userId, tokenRequestConfig) {
 		if (!await this.storageManager.getTemporaryDataParameter(OIDCDiscoveryConstants_default.Storage.StorageKeys.OPENID_PROVIDER_CONFIG_INITIATED)) await this.loadOpenIDProviderConfiguration(false);
+		const stateStorageKey = getStateStorageKey(extractPkceStorageKeyFromState_default(state ?? ""));
+		const expectedState = await this.storageManager.getHybridDataParameter(stateStorageKey, userId);
+		if (!state || typeof expectedState !== "string" || !expectedState || state !== expectedState) throw new ThunderIDRuntimeError("The state returned to the callback does not match the state of the authorization request.", "JS-AUTH_CORE-RAT1-IV04", "javascript");
+		await this.storageManager.removeHybridDataParameter(stateStorageKey, userId);
 		const tokenEndpoint = (await this.oidcProviderMetaDataProvider()).token_endpoint;
 		const configData = await this.configProvider();
 		if (!tokenEndpoint || tokenEndpoint.trim().length === 0) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-NF01", "Token endpoint not found.", "No token endpoint was found in the OIDC provider meta data returned by the well-known endpoint or the token endpoint passed to the SDK is empty.");
@@ -3970,7 +4063,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-NE02", "Requesting access token failed", error$1 ?? "The request to get the access token from the server failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-HE03", `Requesting access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT1-HE03", `Requesting access token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The token request was rejected."));
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
 	async getSignOutUrl(userId) {
@@ -3987,7 +4080,11 @@ var ThunderIDJavaScriptClient = class {
 		queryParams.set("state", OIDCRequestConstants_default.Params.SIGN_OUT_SUCCESS);
 		return `${logoutEndpoint}?${queryParams.toString()}`;
 	}
+	/**
+	* Returns the endpoints the SDK calls. Loads the discovery document first when no other call has.
+	*/
 	async getOpenIDProviderEndpoints() {
+		await this.loadOpenIDProviderConfiguration(false);
 		const meta = await this.oidcProviderMetaDataProvider();
 		return {
 			authorizationEndpoint: meta.authorization_endpoint ?? "",
@@ -4001,16 +4098,27 @@ var ThunderIDJavaScriptClient = class {
 			userinfoEndpoint: meta.userinfo_endpoint ?? ""
 		};
 	}
+	/**
+	* Returns the discovery document. Loads it first when no other call has. Resolves to `null`
+	* before `initialize()`.
+	*/
 	async getDiscoveryResponse() {
 		if (!this.storageManager) return null;
+		await this.loadOpenIDProviderConfiguration(false);
 		return this.storageManager.loadOpenIDProviderConfiguration();
 	}
+	/**
+	* Returns the claims of the session's ID token, or of `idToken` when the session holds none.
+	*
+	* @throws {ThunderIDRuntimeError} With code `JS-AUTH_CORE-GDIT-NF01` when there is no ID token to decode.
+	*/
 	async getDecodedIdToken(userId, idToken) {
-		const storedIdToken = (await this.storageManager.getSessionData(userId)).id_token;
-		return this.cryptoHelper.decodeJwtToken(storedIdToken ?? idToken);
+		const token = (await this.storageManager.getSessionData(userId))?.id_token ?? idToken;
+		if (!token) throw new ThunderIDRuntimeError("No signed-in session was found.", "JS-AUTH_CORE-GDIT-NF01", "javascript");
+		return this.cryptoHelper.decodeJwtToken(token);
 	}
 	async getIdToken(userId) {
-		return (await this.storageManager.getSessionData(userId)).id_token;
+		return (await this.storageManager.getSessionData(userId))?.id_token;
 	}
 	async getUserSession(userId) {
 		return { scopes: (await this.storageManager.getSessionData(userId))?.scope?.split(" ") };
@@ -4041,7 +4149,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-NR03", "Refresh access token request failed.", error$1 ?? "The request to refresh the access token failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT2-HE04", `Refreshing access token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The refresh token request was rejected."));
 		return this.authHelper.handleTokenResponse(tokenResponse, userId);
 	}
 	/**
@@ -4080,7 +4188,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-NE02", "Requesting client credentials token failed.", error$1 ?? "The request to get the client credentials access token failed.");
 		}
-		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await tokenResponse.json());
+		if (!tokenResponse.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RCCT-HE03", `Requesting client credentials token failed with ${tokenResponse.statusText}`, await readErrorMessage(tokenResponse, "The client credentials token request was rejected."));
 		const parsedResponse = await tokenResponse.json();
 		parsedResponse.created_at = (/* @__PURE__ */ new Date()).getTime();
 		await this.storageManager.setSessionData(parsedResponse, sessionId);
@@ -4124,7 +4232,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch (error$1) {
 			throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-NE02", "The request to revoke access token failed.", error$1 ?? "The request sent to revoke the access token failed.");
 		}
-		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-HE03", `Invalid response status received for revoke access token request (${response.statusText}).`, await response.json());
+		if (response.status !== 200 || !response.ok) throw new ThunderIDAuthException("JS-AUTH_CORE-RAT3-HE03", `Invalid response status received for revoke access token request (${response.statusText}).`, await readErrorMessage(response, "The revocation request was rejected."));
 		return response;
 	}
 	async revokeAccessToken(userId) {
@@ -4180,7 +4288,7 @@ var ThunderIDJavaScriptClient = class {
 		} catch {
 			parsedBody = rawBody;
 		}
-		if (!response.ok) throw new ThunderIDAPIError(parsedBody, "JS-AUTH_CORE-CIBA1-HE03", "javascript", response.status, response.statusText, "CIBA backchannel authentication request failed");
+		if (!response.ok) throw new ThunderIDAPIError(getOAuthErrorMessage_default(parsedBody, "The backchannel authentication request was rejected."), "JS-AUTH_CORE-CIBA1-HE03", "javascript", response.status, response.statusText, "CIBA backchannel authentication request failed");
 		const payload = parsedBody;
 		if (!payload.auth_req_id) throw new ThunderIDAPIError("The server response did not include an auth_req_id.", "JS-AUTH_CORE-CIBA1-PR04", "javascript");
 		return {
@@ -4812,9 +4920,9 @@ var arrayBufferToBase64url_default = arrayBufferToBase64url;
 *
 * @see {@link arrayBufferToBase64url} - The inverse function for encoding ArrayBuffer to base64url
 */
-const base64urlToArrayBuffer = (base64url) => {
-	const padding = "=".repeat((4 - base64url.length % 4) % 4);
-	const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/") + padding;
+const base64urlToArrayBuffer = (base64url$1) => {
+	const padding = "=".repeat((4 - base64url$1.length % 4) % 4);
+	const base64 = base64url$1.replace(/-/g, "+").replace(/_/g, "/") + padding;
 	const binaryString = atob(base64);
 	const bytes = new Uint8Array(binaryString.length);
 	for (let i = 0; i < binaryString.length; i += 1) bytes[i] = binaryString.charCodeAt(i);