@webex/plugin-authorization-browser 3.8.0 → 3.8.1-next.2

package/README.md

@@ -1,14 +1,38 @@
 # @webex/plugin-authorization-browser
 
-[![standard-readme compliant](https://img.shields.io/badge/readme%20style-standard-brightgreen.svg?style=flat-square)](https://github.com/RichardLitt/standard-readme)
+> OAuth2 authorization plugin for browser environments in the Cisco Webex JS SDK. Handles OAuth2 flows including Implicit Grant and Authorization Code Grant for web applications.
 
-> Authorization plugin loaded when the Cisco Webex JS SDK is used in a web browser.
+## Table of Contents
 
-- [Install](#install)
-- [Usage](#usage)
-- [Contribute](#contribute)
-- [Maintainers](#maintainers)
-- [License](#license)
+- [@webex/plugin-authorization-browser](#webexplugin-authorization-browser)
+  - [Table of Contents](#table-of-contents)
+  - [Install](#install)
+  - [What it Does](#what-it-does)
+  - [Usage](#usage)
+    - [Basic OAuth2 Login](#basic-oauth2-login)
+    - [Implicit Grant Flow](#implicit-grant-flow)
+    - [Authorization Code Grant Flow](#authorization-code-grant-flow)
+    - [Login with Popup Window](#login-with-popup-window)
+    - [JWT Authentication](#jwt-authentication)
+    - [Guest JWT Creation](#guest-jwt-creation)
+    - [Logout](#logout)
+    - [Checking Authentication Status](#checking-authentication-status)
+    - [Error Handling](#error-handling)
+  - [API Reference](#api-reference)
+    - [Methods](#methods)
+      - [`initiateLogin(options)`](#initiateloginoptions)
+      - [`initiateImplicitGrant(options)`](#initiateimplicitgrantoptions)
+      - [`initiateAuthorizationCodeGrant(options)`](#initiateauthorizationcodegrantoptions)
+      - [`requestAccessTokenFromJwt({ jwt })`](#requestaccesstokenfromjwt-jwt-)
+      - [`createJwt(options)`](#createjwtoptions)
+      - [`logout(options)`](#logoutoptions)
+    - [Properties](#properties)
+      - [`isAuthorizing` (boolean)](#isauthorizing-boolean)
+      - [`isAuthenticating` (boolean)](#isauthenticating-boolean)
+      - [`ready` (boolean)](#ready-boolean)
+  - [Maintainers](#maintainers)
+  - [Contribute](#contribute)
+  - [License](#license)
 
 ## Install
 
@@ -16,38 +40,301 @@
 npm install --save @webex/plugin-authorization-browser
 ```
 
+## What it Does
+
+The `@webex/plugin-authorization-browser` plugin provides OAuth2 authentication capabilities specifically for browser environments. It:
+
+- **Automatically handles OAuth2 flows**: Supports both Implicit Grant and Authorization Code Grant flows
+- **Manages authentication state**: Tracks authorization status and handles token parsing from URL
+- **Provides CSRF protection**: Generates and validates CSRF tokens for security
+- **Supports popup authentication**: Can open login in a separate window
+- **JWT token support**: Create and use JWT tokens for guest authentication
+- **URL cleanup**: Automatically removes sensitive tokens from browser URL after authentication
+- **Cross-browser compatibility**: Works across different browser environments
+
 ## Usage
 
-This is a plugin for the Cisco Webex JS SDK . Please see our [developer portal](https://developer.webex.com/) and the [API docs](https://webex.github.io/webex-js-sdk/api/) for full details.
+### Basic OAuth2 Login
 
-## Install
+The simplest way to authenticate users:
 
-```bash
-npm install --save @webex/plugin-authorization-browser
+```javascript
+const Webex = require('webex');
+
+// Initialize Webex SDK
+const webex = Webex.init({
+  credentials: {
+    client_id: 'your-client-id',
+    redirect_uri: 'https://your-app.com/callback',
+    scope: 'spark:all'
+  }
+});
+
+// Start the login process
+webex.authorization.initiateLogin()
+  .then(() => {
+    console.log('Login initiated');
+    // User will be redirected to Webex login page
+  });
+
+// After redirect, check if user is authenticated
+if (webex.canAuthorize) {
+  console.log('User is authenticated');
+  // Make API calls
+}
 ```
 
-## Usage
+### Implicit Grant Flow
 
-```js
+For public clients (single-page applications):
 
-const Webex = require('webex');
+```javascript
+const webex = Webex.init({
+  credentials: {
+    client_id: 'your-client-id',
+    redirect_uri: 'https://your-app.com/callback',
+    scope: 'spark:all'
+    // No client_secret for public clients
+  }
+});
+
+// Initiate implicit grant flow
+webex.authorization.initiateImplicitGrant({
+  state: { customData: 'value' } // Optional state data
+})
+.then(() => {
+  console.log('Implicit grant flow started');
+});
+```
+
+### Authorization Code Grant Flow  
+
+For confidential clients with client secret:
+
+```javascript
+const webex = Webex.init({
+  credentials: {
+    client_id: 'your-client-id',
+    client_secret: 'your-client-secret',
+    redirect_uri: 'https://your-app.com/callback',
+    scope: 'spark:all',
+    clientType: 'confidential' // This triggers authorization code flow
+  }
+});
+
+// Initiate authorization code grant flow
+webex.authorization.initiateAuthorizationCodeGrant({
+  state: { customData: 'value' }
+})
+.then(() => {
+  console.log('Authorization code flow started');
+});
+```
+
+### Login with Popup Window
+
+Open login in a separate popup window instead of redirecting:
+
+```javascript
+// Basic popup with default dimensions (600x800)
+webex.authorization.initiateLogin({
+  separateWindow: true
+});
+
+// Custom popup dimensions
+webex.authorization.initiateLogin({
+  separateWindow: {
+    width: 800,
+    height: 600
+  }
+});
+
+// With custom state and popup
+webex.authorization.initiateLogin({
+  state: { 
+    returnUrl: '/dashboard',
+    userId: 'user123'
+  },
+  separateWindow: {
+    width: 900,
+    height: 700
+  }
+});
+```
+
+### JWT Authentication
+
+Authenticate using a JWT token (useful for guest users):
+
+```javascript
+// Assuming you have a JWT from your backend
+const jwtToken = '<YOUR_JWT_TOKEN_HERE>';
+
+webex.authorization.requestAccessTokenFromJwt({
+  jwt: jwtToken
+})
+.then(() => {
+  console.log('Authenticated with JWT');
+  // User is now authenticated and can make API calls
+})
+.catch(error => {
+  console.error('JWT authentication failed:', error);
+});
+```
+
+### Guest JWT Creation
+
+Create JWT tokens for guest users:
+
+```javascript
+// Create a guest JWT token
+webex.authorization.createJwt({
+  issuer: 'your-guest-issuer-id',
+  secretId: 'your-base64-encoded-secret',
+  displayName: 'Guest User Name', // Optional
+  expiresIn: '12h' // Token expiration
+})
+.then(({ jwt }) => {
+  console.log('Created guest JWT:', jwt);
+  
+  // Use the JWT to authenticate
+  return webex.authorization.requestAccessTokenFromJwt({ jwt });
+})
+.then(() => {
+  console.log('Guest user authenticated');
+})
+.catch(error => {
+  console.error('Guest JWT creation failed:', error);
+});
+```
+
+### Logout
+
+Log out the current user:
+
+```javascript
+// Logout and redirect to Webex logout page
+webex.authorization.logout();
 
-const webex = Webex.init();
-webex.authorization-browser.get(id)
-  .then((authorization-browser) => {
-    console.log(authorization-browser);
-  })
+// Logout without redirect (clean up local session only)  
+webex.authorization.logout({ noRedirect: true });
 
+// Logout with custom logout URL
+webex.authorization.logout({ 
+  goto: 'https://your-app.com/goodbye' 
+});
 ```
 
+### Checking Authentication Status
+
+```javascript
+// Check if SDK can authorize (has valid token)
+if (webex.canAuthorize) {
+  console.log('User is authenticated');
+}
+
+// Check if authorization is in progress
+if (webex.authorization.isAuthorizing) {
+  console.log('Authorization in progress...');
+}
+
+// Listen for authentication events
+webex.on('ready', () => {
+  console.log('SDK is ready and authenticated');
+});
+
+webex.on('unauthorized', () => {
+  console.log('User is not authenticated');
+});
+```
+
+### Error Handling
+
+```javascript
+// Handle authentication errors from URL
+try {
+  const webex = Webex.init({
+    credentials: { /* your config */ }
+  });
+} catch (error) {
+  if (error.name === 'OAuthError') {
+    console.error('OAuth error:', error.message);
+    // Handle specific OAuth errors like access_denied
+  }
+}
+
+// Handle JWT authentication errors
+webex.authorization.requestAccessTokenFromJwt({ jwt: 'invalid-jwt' })
+.catch(error => {
+  console.error('JWT authentication failed:', error);
+});
+```
+
+## API Reference
+
+### Methods
+
+#### `initiateLogin(options)`
+
+Initiates the appropriate OAuth flow based on client configuration.
+
+- `options.state` - Optional state object for custom data
+- `options.separateWindow` - Boolean or object for popup window settings
+
+#### `initiateImplicitGrant(options)`
+
+Starts the Implicit Grant flow for public clients.
+
+#### `initiateAuthorizationCodeGrant(options)`
+
+Starts the Authorization Code Grant flow for confidential clients.
+
+#### `requestAccessTokenFromJwt({ jwt })`
+
+Exchanges a JWT for an access token.
+
+#### `createJwt(options)`
+
+Creates a JWT token for guest authentication.
+
+- `options.issuer` - Guest issuer ID
+- `options.secretId` - Base64 encoded secret
+- `options.displayName` - Optional display name
+- `options.expiresIn` - Token expiration time
+
+#### `logout(options)`
+
+Logs out the current user.
+
+- `options.noRedirect` - Skip redirect to logout page
+- `options.goto` - Custom redirect URL after logout
+
+### Properties
+
+#### `isAuthorizing` (boolean)
+
+Indicates if an authorization flow is currently in progress.
+
+#### `isAuthenticating` (boolean)  
+
+Alias for `isAuthorizing`.
+
+#### `ready` (boolean)
+
+Indicates if the authorization plugin has finished initialization.
+
+---
+
 ## Maintainers
 
-This package is maintained by [Cisco Webex for Developers](https://developer.webex.com/).
+This package is maintained by Cisco Webex for Developers.
 
 ## Contribute
 
-Pull requests welcome. Please see [CONTRIBUTING.md](https://github.com/webex/webex-js-sdk/blob/master/CONTRIBUTING.md) for more details.
+Pull requests welcome. Please see CONTRIBUTING.md for more details.
 
 ## License
 
-© 2016-2020 Cisco and/or its affiliates. All Rights Reserved.
+This project is licensed under the Cisco General Terms - see the LICENSE for details.
+
+© 2016-2025 Cisco and/or its affiliates. All Rights Reserved.

package/dist/authorization.js

@@ -8,10 +8,13 @@ _Object$defineProperty(exports, "__esModule", {
 exports.default = void 0;
 var _regenerator = _interopRequireDefault(require("@babel/runtime-corejs2/regenerator"));
 var _asyncToGenerator2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/asyncToGenerator"));
+var _slicedToArray2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/slicedToArray"));
+var _typeof2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/typeof"));
 var _applyDecoratedDescriptor2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/applyDecoratedDescriptor"));
 var _stringify = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/json/stringify"));
 var _apply = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/reflect/apply"));
 var _assign = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/object/assign"));
+var _entries = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/object/entries"));
 var _promise = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/promise"));
 var _deleteProperty = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/reflect/delete-property"));
 var _parseInt2 = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/parse-int"));
@@ -121,11 +124,24 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
     return ret;
   },
   /**
-   * Kicks off an oauth flow
+   * Initiates the OAuth flow for user authentication.
+   * This function determines the type of OAuth flow to use based on the client type configuration.
+   * If the client is configured as "confidential", it will initiate the Authorization Code Grant flow;
+   * otherwise, it will initiate the Implicit Grant flow.
+   *
    * @instance
    * @memberof AuthorizationBrowser
-   * @param {Object} options
-   * @returns {Promise}
+   * @param {Object} options - The options to configure the OAuth flow.
+   * @param {Object} [options.state] - An optional state object that can be used to include additional
+   * information such as security tokens. A CSRF token will be automatically generated and added to
+   * this state object.
+   * @param {boolean|Object} [options.separateWindow] - Determines if the login should open in a separate window.
+   * This can be a boolean or an object specifying window features:
+   *   - If `true`, a new window with default dimensions is opened.
+   *   - If an object, custom window features can be specified (e.g., `{width: 800, height: 600}`).
+   * @returns {Promise<void>} - A promise that resolves when the appropriate OAuth flow has been initiated.
+   * The promise does not necessarily indicate the completion of the login process.
+   * @throws {Error} - Throws an error if there are issues initiating the OAuth flow.
    */
   initiateLogin: function initiateLogin() {
     var options = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
@@ -140,18 +156,48 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
     return this.initiateImplicitGrant(options);
   },
   /**
-   * Kicks off the Authorization Code grant flow. Typically called via
-   * {@link AuthorizationBrowser#initiateLogin}
+   * Initiates the Implicit Grant flow for authorization.
+   * This function constructs the login URL and either opens it in a new
+   * window or in the current window based on the provided options.
+   * Typically called via {@link AuthorizationBrowser#initiateLogin}.
+   *
    * @instance
    * @memberof AuthorizationBrowser
-   * @param {Object} options
-   * @returns {Promise}
+   * @param {Object} options - The options to configure the login flow.
+   * @param {Object} [options.separateWindow] - Determines if the login should open in a separate window.
+   * This can be a boolean or an object specifying window features:
+   *   - If `true`, a new window with default dimensions is opened.
+   *   - If an object, custom window features can be specified (e.g., `{width: 800, height: 600}`).
+   * @returns {Promise<void>} - A promise that resolves immediately after initiating the login flow.
+   * This promise does not indicate the completion of the login process.
+   * @throws {Error} - Throws an error if the login URL cannot be constructed or if window opening fails.
    */
   initiateImplicitGrant: function initiateImplicitGrant(options) {
     this.logger.info('authorization: initiating implicit grant flow');
-    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl((0, _assign.default)({
+    var loginUrl = this.webex.credentials.buildLoginUrl((0, _assign.default)({
       response_type: 'token'
     }, options));
+    if (options !== null && options !== void 0 && options.separateWindow) {
+      // Default window settings
+      var defaultWindowSettings = {
+        width: 600,
+        height: 800
+      };
+
+      // Merge user provided settings with defaults
+      var windowSettings = (0, _assign.default)(defaultWindowSettings, (0, _typeof2.default)(options.separateWindow) === 'object' ? options.separateWindow : {});
+      // Convert settings object to window.open features string
+      var windowFeatures = (0, _entries.default)(windowSettings).map(function (_ref) {
+        var _ref2 = (0, _slicedToArray2.default)(_ref, 2),
+          key = _ref2[0],
+          value = _ref2[1];
+        return "".concat(key, "=").concat(value);
+      }).join(',');
+      this.webex.getWindow().open(loginUrl, '_blank', windowFeatures);
+    } else {
+      // Default behavior - open in same window
+      this.webex.getWindow().location = loginUrl;
+    }
     return _promise.default.resolve();
   },
   /**
@@ -184,9 +230,9 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
    * identifies a user in your system
    * @returns {Promise}
    */
-  requestAccessTokenFromJwt: function requestAccessTokenFromJwt(_ref) {
+  requestAccessTokenFromJwt: function requestAccessTokenFromJwt(_ref3) {
     var _this2 = this;
-    var jwt = _ref.jwt;
+    var jwt = _ref3.jwt;
     var hydraUri = this.webex.internal.services.get('hydra', true);
     if (hydraUri && hydraUri.slice(-1) !== '/') {
       // add a `/` to hydra's uri from the services catalog so that
@@ -200,8 +246,8 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
       headers: {
         authorization: jwt
       }
-    }).then(function (_ref2) {
-      var body = _ref2.body;
+    }).then(function (_ref4) {
+      var body = _ref4.body;
       return {
         access_token: body.token,
         token_type: 'Bearer',
@@ -238,13 +284,13 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
    * @param {String} options.expiresIn
    * @returns {Promise<object>}
    */
-  createJwt: function createJwt(_ref3) {
+  createJwt: function createJwt(_ref5) {
     return (0, _asyncToGenerator2.default)( /*#__PURE__*/_regenerator.default.mark(function _callee() {
       var issuer, secretId, displayName, expiresIn, secret, payload, alg, jwtToken;
       return _regenerator.default.wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            issuer = _ref3.issuer, secretId = _ref3.secretId, displayName = _ref3.displayName, expiresIn = _ref3.expiresIn;
+            issuer = _ref5.issuer, secretId = _ref5.secretId, displayName = _ref5.displayName, expiresIn = _ref5.expiresIn;
             secret = Buffer.from(secretId, 'base64');
             payload = {
               "sub": "guest-user-".concat((0, _uuid.default)()),
@@ -375,7 +421,7 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
       throw new Error("CSRF token ".concat(token, " does not match stored token ").concat(sessionToken));
     }
   },
-  version: "3.8.0"
+  version: "3.8.1-next.2"
 }, ((0, _applyDecoratedDescriptor2.default)(_obj, "initiateImplicitGrant", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "initiateImplicitGrant"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "initiateAuthorizationCodeGrant", [_dec2], (0, _getOwnPropertyDescriptor.default)(_obj, "initiateAuthorizationCodeGrant"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "requestAccessTokenFromJwt", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "requestAccessTokenFromJwt"), _obj)), _obj)));
 var _default = exports.default = Authorization;
 //# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["_querystring","_interopRequireDefault","require","_url","_common","_webexCore","_lodash","_uuid","_dec","_dec2","_obj","jwt","OAUTH2_CSRF_TOKEN","EMPTY_OBJECT_STRING","base64","encode","_stringify","default","Authorization","WebexPlugin","extend","whileInFlight","derived","isAuthenticating","deps","fn","isAuthorizing","session","type","ready","namespace","initialize","attrs","options","_this","ret","_apply","prototype","parse","location","url","webex","getWindow","href","_checkForErrors","hash","includes","substr","querystring","state","JSON","decode","tokenData","_parseHash","_cleanUrl","process","nextTick","credentials","set","supertoken","initiateLogin","arguments","length","undefined","csrf_token","_generateSecurityToken","config","clientType","initiateAuthorizationCodeGrant","initiateImplicitGrant","logger","info","buildLoginUrl","_assign","response_type","_promise","resolve","requestAccessTokenFromJwt","_ref","_this2","hydraUri","internal","services","get","slice","env","HYDRA_SERVICE_URL","request","method","uri","concat","headers","authorization","then","_ref2","body","access_token","token","token_type","expires_in","expiresIn","initServiceCatalogs","logout","noRedirect","buildLogoutUrl","createJwt","_ref3","_asyncToGenerator2","_regenerator","mark","_callee","issuer","secretId","displayName","secret","payload","alg","jwtToken","wrap","_callee$","_context","prev","next","Buffer","from","uuid","sign","abrupt","t0","reject","stop","query","error","ErrorConstructor","grantErrors","select","cloneDeep","history","replaceState","forEach","key","_deleteProperty","isEmpty","omit","stringify","format","v4","sessionStorage","setItem","_verifySecurityToken","_parseInt2","refresh_token_expires_in","sessionToken","getItem","removeItem","Error","version","_applyDecoratedDescriptor2","_getOwnPropertyDescriptor","oneFlight","_default","exports"],"sources":["authorization.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport {base64, oneFlight, whileInFlight} from '@webex/common';\nimport {grantErrors, WebexPlugin} from '@webex/webex-core';\nimport {cloneDeep, isEmpty, omit} from 'lodash';\nimport uuid from 'uuid';\nconst jwt = require('jsonwebtoken');\n\nconst OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';\nconst EMPTY_OBJECT_STRING = base64.encode(JSON.stringify({}));\n\n/**\n * Browser support for OAuth2. Automatically parses the URL hash for an access\n * token\n * @class\n * @name AuthorizationBrowser\n */\nconst Authorization = WebexPlugin.extend({\n  derived: {\n    /**\n     * Alias of {@link AuthorizationBrowser#isAuthorizing}\n     * @instance\n     * @memberof AuthorizationBrowser\n     * @type {boolean}\n     */\n    isAuthenticating: {\n      deps: ['isAuthorizing'],\n      fn() {\n        return this.isAuthorizing;\n      },\n    },\n  },\n\n  session: {\n    /**\n     * Indicates if an Authorization Code exchange is inflight\n     * @instance\n     * @memberof AuthorizationBrowser\n     * @type {boolean}\n     */\n    isAuthorizing: {\n      default: false,\n      type: 'boolean',\n    },\n    ready: {\n      default: false,\n      type: 'boolean',\n    },\n  },\n\n  namespace: 'Credentials',\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} attrs {@link AmpersandState}\n   * @param {boolean} attrs.parse Controls whether or not the the url should get\n   * parsed for an access token\n   * @private\n   * @returns {Authorization}\n   */\n  // eslint-disable-next-line complexity\n  initialize(attrs, options) {\n    const ret = Reflect.apply(WebexPlugin.prototype.initialize, this, [attrs, options]);\n\n    // Reminder, we can't do parse based on config, because config is not\n    // available until nextTick and we want to be able to throw errors found in\n    // the url.\n    if (attrs.parse === false) {\n      this.ready = true;\n\n      return ret;\n    }\n    const location = url.parse(this.webex.getWindow().location.href, true);\n\n    this._checkForErrors(location);\n\n    let {hash} = location;\n\n    if (!hash) {\n      this.ready = true;\n\n      return ret;\n    }\n    if (hash.includes('#')) {\n      hash = hash.substr(1);\n    }\n    location.hash = querystring.parse(hash);\n    if (location.hash.state) {\n      location.hash.state = JSON.parse(base64.decode(location.hash.state));\n    }\n    const tokenData = this._parseHash(location);\n\n    if (!tokenData) {\n      return ret;\n    }\n    this._cleanUrl(location);\n\n    // Wait until nextTick in case `credentials` hasn't initialized yet\n    process.nextTick(() => {\n      this.webex.credentials.set({supertoken: tokenData});\n      this.ready = true;\n    });\n\n    return ret;\n  },\n\n  /**\n   * Kicks off an oauth flow\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateLogin(options = {}) {\n    options.state = options.state || {};\n    options.state.csrf_token = this._generateSecurityToken();\n\n    // If we're not explicitly a confidential client, assume we're a public\n    // client\n    if (this.config.clientType === 'confidential') {\n      return this.initiateAuthorizationCodeGrant(options);\n    }\n\n    return this.initiateImplicitGrant(options);\n  },\n\n  @whileInFlight('isAuthorizing')\n  /**\n   * Kicks off the Authorization Code grant flow. Typically called via\n   * {@link AuthorizationBrowser#initiateLogin}\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateImplicitGrant(options) {\n    this.logger.info('authorization: initiating implicit grant flow');\n    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(\n      Object.assign({response_type: 'token'}, options)\n    );\n\n    return Promise.resolve();\n  },\n\n  @whileInFlight('isAuthorizing')\n  /**\n   * Kicks off the Implicit Code grant flow. Typically called via\n   * {@link AuthorizationBrowser#initiateLogin}\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateAuthorizationCodeGrant(options) {\n    this.logger.info('authorization: initiating authorization code grant flow');\n    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(\n      Object.assign({response_type: 'code'}, options)\n    );\n\n    return Promise.resolve();\n  },\n\n  @oneFlight\n  /**\n   * Requests a Webex access token for a user already authenticated into\n   * your product.\n   *\n   * Note: You'll need to supply a jwtRefreshCallback of the form\n   * `Promise<jwt> = jwtRefreshCallback(webex)` for automatic token refresh to\n   * work.\n   *\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @param {Object} options.jwt This is a jwt generated by your backend that\n   * identifies a user in your system\n   * @returns {Promise}\n   */\n  requestAccessTokenFromJwt({jwt}) {\n    let hydraUri = this.webex.internal.services.get('hydra', true);\n\n    if (hydraUri && hydraUri.slice(-1) !== '/') {\n      // add a `/` to hydra's uri from the services catalog so that\n      // it matches the current env service format.\n      hydraUri += '/';\n    }\n\n    hydraUri = hydraUri || process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1/';\n\n    return this.webex\n      .request({\n        method: 'POST',\n        uri: `${hydraUri}jwt/login`,\n        headers: {\n          authorization: jwt,\n        },\n      })\n      .then(({body}) => ({\n        access_token: body.token,\n        token_type: 'Bearer',\n        expires_in: body.expiresIn,\n      }))\n      .then((token) => {\n        this.webex.credentials.set({\n          supertoken: token,\n        });\n      })\n      .then(() => this.webex.internal.services.initServiceCatalogs());\n  },\n\n  /**\n   * Called by {@link WebexCore#logout()}. Redirects to the logout page\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @param {boolean} options.noRedirect if true, does not redirect\n   * @returns {Promise}\n   */\n  logout(options = {}) {\n    if (!options.noRedirect) {\n      this.webex.getWindow().location = this.webex.credentials.buildLogoutUrl(options);\n    }\n  },\n\n  /**\n   * Creates a jwt user token\n   * @param {object} options\n   * @param {String} options.issuer Guest Issuer ID\n   * @param {String} options.secretId Guest Secret ID\n   * @param {String} options.displayName Guest Display Name | optional\n   * @param {String} options.expiresIn\n   * @returns {Promise<object>}\n   */\n  async createJwt({issuer, secretId, displayName, expiresIn}) {\n    const secret = Buffer.from(secretId, 'base64');\n    const payload = {\n      \"sub\": `guest-user-${uuid()}`,\n      \"iss\": issuer,\n      \"name\": displayName || `Guest User - ${uuid()}`\n    };\n    const alg = 'HS256';\n\n    try {\n\n      const jwtToken = jwt.sign(payload, secret, { expiresIn });\n\n      return Promise.resolve({jwt: jwtToken});\n    } catch (e) {\n      return Promise.reject(e);\n    }\n  },\n\n  /**\n   * Checks if the result of the login redirect contains an error string\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _checkForErrors(location) {\n    const {query} = location;\n\n    if (query && query.error) {\n      const ErrorConstructor = grantErrors.select(query.error);\n\n      throw new ErrorConstructor(query);\n    }\n  },\n\n  /**\n   * Removes no-longer needed values from the url (access token, csrf token, etc)\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _cleanUrl(location) {\n    location = cloneDeep(location);\n    if (this.webex.getWindow().history && this.webex.getWindow().history.replaceState) {\n      [\n        'access_token',\n        'token_type',\n        'expires_in',\n        'refresh_token',\n        'refresh_token_expires_in',\n      ].forEach((key) => Reflect.deleteProperty(location.hash, key));\n      if (!isEmpty(location.hash.state)) {\n        location.hash.state = base64.encode(\n          JSON.stringify(omit(location.hash.state, 'csrf_token'))\n        );\n        if (location.hash.state === EMPTY_OBJECT_STRING) {\n          Reflect.deleteProperty(location.hash, 'state');\n        }\n      } else {\n        Reflect.deleteProperty(location.hash, 'state');\n      }\n      location.hash = querystring.stringify(location.hash);\n      this.webex.getWindow().history.replaceState({}, null, url.format(location));\n    }\n  },\n\n  /**\n   * Generates a CSRF token and sticks in in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @private\n   * @returns {Promise}\n   */\n  _generateSecurityToken() {\n    this.logger.info('authorization: generating csrf token');\n\n    const token = uuid.v4();\n\n    this.webex.getWindow().sessionStorage.setItem('oauth2-csrf-token', token);\n\n    return token;\n  },\n\n  /**\n   * Parses the url hash into an access token object\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} location\n   * @private\n   * @returns {Object}\n   */\n  _parseHash(location) {\n    const hash = cloneDeep(location.hash);\n\n    if (hash) {\n      this._verifySecurityToken(hash);\n    }\n    if (!hash.access_token) {\n      this.ready = true;\n\n      return undefined;\n    }\n    if (hash.expires_in) {\n      hash.expires_in = parseInt(hash.expires_in, 10);\n    }\n    if (hash.refresh_token_expires_in) {\n      hash.refresh_token_expires_in = parseInt(hash.refresh_token_expires_in, 10);\n    }\n\n    return hash;\n  },\n\n  /**\n   * Checks if the CSRF token in sessionStorage is the same as the one returned\n   * in the url.\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} hash\n   * @private\n   * @returns {Promise}\n   */\n  _verifySecurityToken(hash) {\n    const sessionToken = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CSRF_TOKEN);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CSRF_TOKEN);\n    if (!sessionToken) {\n      return;\n    }\n\n    if (!hash.state) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect hash`);\n    }\n\n    if (!hash.state.csrf_token) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect hash`);\n    }\n\n    const token = hash.state.csrf_token;\n\n    if (token !== sessionToken) {\n      throw new Error(`CSRF token ${token} does not match stored token ${sessionToken}`);\n    }\n  },\n});\n\nexport default Authorization;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAMA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,IAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAN,sBAAA,CAAAC,OAAA;AAAwB,IAAAM,IAAA,EAAAC,KAAA,EAAAC,IAAA;AAZxB;AACA;AACA;AAEA;AASA,IAAMC,GAAG,GAAGT,OAAO,CAAC,cAAc,CAAC;AAEnC,IAAMU,iBAAiB,GAAG,mBAAmB;AAC7C,IAAMC,mBAAmB,GAAGC,cAAM,CAACC,MAAM,CAAC,IAAAC,UAAA,CAAAC,OAAA,EAAe,CAAC,CAAC,CAAC,CAAC;;AAE7D;AACA;AACA;AACA;AACA;AACA;AACA,IAAMC,aAAa,GAAGC,sBAAW,CAACC,MAAM,EAAAZ,IAAA,GA+GrC,IAAAa,qBAAa,EAAC,eAAe,CAAC,EAAAZ,KAAA,GAkB9B,IAAAY,qBAAa,EAAC,eAAe,CAAC,GAAAX,IAAA,GAjIQ;EACvCY,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACIC,gBAAgB,EAAE;MAChBC,IAAI,EAAE,CAAC,eAAe,CAAC;MACvBC,EAAE,WAAAA,GAAA,EAAG;QACH,OAAO,IAAI,CAACC,aAAa;MAC3B;IACF;EACF,CAAC;EAEDC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACID,aAAa,EAAE;MACbT,OAAO,EAAE,KAAK;MACdW,IAAI,EAAE;IACR,CAAC;IACDC,KAAK,EAAE;MACLZ,OAAO,EAAE,KAAK;MACdW,IAAI,EAAE;IACR;EACF,CAAC;EAEDE,SAAS,EAAE,aAAa;EAExB;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE;EACAC,UAAU,WAAAA,WAACC,KAAK,EAAEC,OAAO,EAAE;IAAA,IAAAC,KAAA;IACzB,IAAMC,GAAG,GAAG,IAAAC,MAAA,CAAAnB,OAAA,EAAcE,sBAAW,CAACkB,SAAS,CAACN,UAAU,EAAE,IAAI,EAAE,CAACC,KAAK,EAAEC,OAAO,CAAC,CAAC;;IAEnF;IACA;IACA;IACA,IAAID,KAAK,CAACM,KAAK,KAAK,KAAK,EAAE;MACzB,IAAI,CAACT,KAAK,GAAG,IAAI;MAEjB,OAAOM,GAAG;IACZ;IACA,IAAMI,QAAQ,GAAGC,YAAG,CAACF,KAAK,CAAC,IAAI,CAACG,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,CAACI,IAAI,EAAE,IAAI,CAAC;IAEtE,IAAI,CAACC,eAAe,CAACL,QAAQ,CAAC;IAE9B,IAAKM,IAAI,GAAIN,QAAQ,CAAhBM,IAAI;IAET,IAAI,CAACA,IAAI,EAAE;MACT,IAAI,CAAChB,KAAK,GAAG,IAAI;MAEjB,OAAOM,GAAG;IACZ;IACA,IAAIU,IAAI,CAACC,QAAQ,CAAC,GAAG,CAAC,EAAE;MACtBD,IAAI,GAAGA,IAAI,CAACE,MAAM,CAAC,CAAC,CAAC;IACvB;IACAR,QAAQ,CAACM,IAAI,GAAGG,oBAAW,CAACV,KAAK,CAACO,IAAI,CAAC;IACvC,IAAIN,QAAQ,CAACM,IAAI,CAACI,KAAK,EAAE;MACvBV,QAAQ,CAACM,IAAI,CAACI,KAAK,GAAGC,IAAI,CAACZ,KAAK,CAACxB,cAAM,CAACqC,MAAM,CAACZ,QAAQ,CAACM,IAAI,CAACI,KAAK,CAAC,CAAC;IACtE;IACA,IAAMG,SAAS,GAAG,IAAI,CAACC,UAAU,CAACd,QAAQ,CAAC;IAE3C,IAAI,CAACa,SAAS,EAAE;MACd,OAAOjB,GAAG;IACZ;IACA,IAAI,CAACmB,SAAS,CAACf,QAAQ,CAAC;;IAExB;IACAgB,OAAO,CAACC,QAAQ,CAAC,YAAM;MACrBtB,KAAI,CAACO,KAAK,CAACgB,WAAW,CAACC,GAAG,CAAC;QAACC,UAAU,EAAEP;MAAS,CAAC,CAAC;MACnDlB,KAAI,CAACL,KAAK,GAAG,IAAI;IACnB,CAAC,CAAC;IAEF,OAAOM,GAAG;EACZ,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACEyB,aAAa,WAAAA,cAAA,EAAe;IAAA,IAAd3B,OAAO,GAAA4B,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;IACxB5B,OAAO,CAACgB,KAAK,GAAGhB,OAAO,CAACgB,KAAK,IAAI,CAAC,CAAC;IACnChB,OAAO,CAACgB,KAAK,CAACe,UAAU,GAAG,IAAI,CAACC,sBAAsB,CAAC,CAAC;;IAExD;IACA;IACA,IAAI,IAAI,CAACC,MAAM,CAACC,UAAU,KAAK,cAAc,EAAE;MAC7C,OAAO,IAAI,CAACC,8BAA8B,CAACnC,OAAO,CAAC;IACrD;IAEA,OAAO,IAAI,CAACoC,qBAAqB,CAACpC,OAAO,CAAC;EAC5C,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEoC,qBAAqB,WAAAA,sBAACpC,OAAO,EAAE;IAC7B,IAAI,CAACqC,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;IACjE,IAAI,CAAC9B,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,GAAG,IAAI,CAACE,KAAK,CAACgB,WAAW,CAACe,aAAa,CACpE,IAAAC,OAAA,CAAAxD,OAAA,EAAc;MAACyD,aAAa,EAAE;IAAO,CAAC,EAAEzC,OAAO,CACjD,CAAC;IAED,OAAO0C,QAAA,CAAA1D,OAAA,CAAQ2D,OAAO,CAAC,CAAC;EAC1B,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACER,8BAA8B,WAAAA,+BAACnC,OAAO,EAAE;IACtC,IAAI,CAACqC,MAAM,CAACC,IAAI,CAAC,yDAAyD,CAAC;IAC3E,IAAI,CAAC9B,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,GAAG,IAAI,CAACE,KAAK,CAACgB,WAAW,CAACe,aAAa,CACpE,IAAAC,OAAA,CAAAxD,OAAA,EAAc;MAACyD,aAAa,EAAE;IAAM,CAAC,EAAEzC,OAAO,CAChD,CAAC;IAED,OAAO0C,QAAA,CAAA1D,OAAA,CAAQ2D,OAAO,CAAC,CAAC;EAC1B,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,yBAAyB,WAAAA,0BAAAC,IAAA,EAAQ;IAAA,IAAAC,MAAA;IAAA,IAANpE,GAAG,GAAAmE,IAAA,CAAHnE,GAAG;IAC5B,IAAIqE,QAAQ,GAAG,IAAI,CAACvC,KAAK,CAACwC,QAAQ,CAACC,QAAQ,CAACC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IAE9D,IAAIH,QAAQ,IAAIA,QAAQ,CAACI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;MAC1C;MACA;MACAJ,QAAQ,IAAI,GAAG;IACjB;IAEAA,QAAQ,GAAGA,QAAQ,IAAIzB,OAAO,CAAC8B,GAAG,CAACC,iBAAiB,IAAI,gCAAgC;IAExF,OAAO,IAAI,CAAC7C,KAAK,CACd8C,OAAO,CAAC;MACPC,MAAM,EAAE,MAAM;MACdC,GAAG,KAAAC,MAAA,CAAKV,QAAQ,cAAW;MAC3BW,OAAO,EAAE;QACPC,aAAa,EAAEjF;MACjB;IACF,CAAC,CAAC,CACDkF,IAAI,CAAC,UAAAC,KAAA;MAAA,IAAEC,IAAI,GAAAD,KAAA,CAAJC,IAAI;MAAA,OAAO;QACjBC,YAAY,EAAED,IAAI,CAACE,KAAK;QACxBC,UAAU,EAAE,QAAQ;QACpBC,UAAU,EAAEJ,IAAI,CAACK;MACnB,CAAC;IAAA,CAAC,CAAC,CACFP,IAAI,CAAC,UAACI,KAAK,EAAK;MACflB,MAAI,CAACtC,KAAK,CAACgB,WAAW,CAACC,GAAG,CAAC;QACzBC,UAAU,EAAEsC;MACd,CAAC,CAAC;IACJ,CAAC,CAAC,CACDJ,IAAI,CAAC;MAAA,OAAMd,MAAI,CAACtC,KAAK,CAACwC,QAAQ,CAACC,QAAQ,CAACmB,mBAAmB,CAAC,CAAC;IAAA,EAAC;EACnE,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,MAAM,WAAAA,OAAA,EAAe;IAAA,IAAdrE,OAAO,GAAA4B,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;IACjB,IAAI,CAAC5B,OAAO,CAACsE,UAAU,EAAE;MACvB,IAAI,CAAC9D,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,GAAG,IAAI,CAACE,KAAK,CAACgB,WAAW,CAAC+C,cAAc,CAACvE,OAAO,CAAC;IAClF;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACQwE,SAAS,WAAAA,UAAAC,KAAA,EAA6C;IAAA,WAAAC,kBAAA,CAAA1F,OAAA,gBAAA2F,YAAA,CAAA3F,OAAA,CAAA4F,IAAA,UAAAC,QAAA;MAAA,IAAAC,MAAA,EAAAC,QAAA,EAAAC,WAAA,EAAAb,SAAA,EAAAc,MAAA,EAAAC,OAAA,EAAAC,GAAA,EAAAC,QAAA;MAAA,OAAAT,YAAA,CAAA3F,OAAA,CAAAqG,IAAA,UAAAC,SAAAC,QAAA;QAAA,kBAAAA,QAAA,CAAAC,IAAA,GAAAD,QAAA,CAAAE,IAAA;UAAA;YAA3CX,MAAM,GAAAL,KAAA,CAANK,MAAM,EAAEC,QAAQ,GAAAN,KAAA,CAARM,QAAQ,EAAEC,WAAW,GAAAP,KAAA,CAAXO,WAAW,EAAEb,SAAS,GAAAM,KAAA,CAATN,SAAS;YACjDc,MAAM,GAAGS,MAAM,CAACC,IAAI,CAACZ,QAAQ,EAAE,QAAQ,CAAC;YACxCG,OAAO,GAAG;cACd,KAAK,gBAAAzB,MAAA,CAAgB,IAAAmC,aAAI,EAAC,CAAC,CAAE;cAC7B,KAAK,EAAEd,MAAM;cACb,MAAM,EAAEE,WAAW,oBAAAvB,MAAA,CAAoB,IAAAmC,aAAI,EAAC,CAAC;YAC/C,CAAC;YACKT,GAAG,GAAG,OAAO;YAAAI,QAAA,CAAAC,IAAA;YAIXJ,QAAQ,GAAG1G,GAAG,CAACmH,IAAI,CAACX,OAAO,EAAED,MAAM,EAAE;cAAEd,SAAS,EAATA;YAAU,CAAC,CAAC;YAAA,OAAAoB,QAAA,CAAAO,MAAA,WAElDpD,QAAA,CAAA1D,OAAA,CAAQ2D,OAAO,CAAC;cAACjE,GAAG,EAAE0G;YAAQ,CAAC,CAAC;UAAA;YAAAG,QAAA,CAAAC,IAAA;YAAAD,QAAA,CAAAQ,EAAA,GAAAR,QAAA;YAAA,OAAAA,QAAA,CAAAO,MAAA,WAEhCpD,QAAA,CAAA1D,OAAA,CAAQgH,MAAM,CAAAT,QAAA,CAAAQ,EAAE,CAAC;UAAA;UAAA;YAAA,OAAAR,QAAA,CAAAU,IAAA;QAAA;MAAA,GAAApB,OAAA;IAAA;EAE5B,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACElE,eAAe,WAAAA,gBAACL,QAAQ,EAAE;IACxB,IAAO4F,KAAK,GAAI5F,QAAQ,CAAjB4F,KAAK;IAEZ,IAAIA,KAAK,IAAIA,KAAK,CAACC,KAAK,EAAE;MACxB,IAAMC,gBAAgB,GAAGC,sBAAW,CAACC,MAAM,CAACJ,KAAK,CAACC,KAAK,CAAC;MAExD,MAAM,IAAIC,gBAAgB,CAACF,KAAK,CAAC;IACnC;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE7E,SAAS,WAAAA,UAACf,QAAQ,EAAE;IAClBA,QAAQ,GAAG,IAAAiG,iBAAS,EAACjG,QAAQ,CAAC;IAC9B,IAAI,IAAI,CAACE,KAAK,CAACC,SAAS,CAAC,CAAC,CAAC+F,OAAO,IAAI,IAAI,CAAChG,KAAK,CAACC,SAAS,CAAC,CAAC,CAAC+F,OAAO,CAACC,YAAY,EAAE;MACjF,CACE,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,0BAA0B,CAC3B,CAACC,OAAO,CAAC,UAACC,GAAG;QAAA,OAAK,IAAAC,eAAA,CAAA5H,OAAA,EAAuBsB,QAAQ,CAACM,IAAI,EAAE+F,GAAG,CAAC;MAAA,EAAC;MAC9D,IAAI,CAAC,IAAAE,eAAO,EAACvG,QAAQ,CAACM,IAAI,CAACI,KAAK,CAAC,EAAE;QACjCV,QAAQ,CAACM,IAAI,CAACI,KAAK,GAAGnC,cAAM,CAACC,MAAM,CACjC,IAAAC,UAAA,CAAAC,OAAA,EAAe,IAAA8H,YAAI,EAACxG,QAAQ,CAACM,IAAI,CAACI,KAAK,EAAE,YAAY,CAAC,CACxD,CAAC;QACD,IAAIV,QAAQ,CAACM,IAAI,CAACI,KAAK,KAAKpC,mBAAmB,EAAE;UAC/C,IAAAgI,eAAA,CAAA5H,OAAA,EAAuBsB,QAAQ,CAACM,IAAI,EAAE,OAAO,CAAC;QAChD;MACF,CAAC,MAAM;QACL,IAAAgG,eAAA,CAAA5H,OAAA,EAAuBsB,QAAQ,CAACM,IAAI,EAAE,OAAO,CAAC;MAChD;MACAN,QAAQ,CAACM,IAAI,GAAGG,oBAAW,CAACgG,SAAS,CAACzG,QAAQ,CAACM,IAAI,CAAC;MACpD,IAAI,CAACJ,KAAK,CAACC,SAAS,CAAC,CAAC,CAAC+F,OAAO,CAACC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAElG,YAAG,CAACyG,MAAM,CAAC1G,QAAQ,CAAC,CAAC;IAC7E;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE0B,sBAAsB,WAAAA,uBAAA,EAAG;IACvB,IAAI,CAACK,MAAM,CAACC,IAAI,CAAC,sCAAsC,CAAC;IAExD,IAAM0B,KAAK,GAAG4B,aAAI,CAACqB,EAAE,CAAC,CAAC;IAEvB,IAAI,CAACzG,KAAK,CAACC,SAAS,CAAC,CAAC,CAACyG,cAAc,CAACC,OAAO,CAAC,mBAAmB,EAAEnD,KAAK,CAAC;IAEzE,OAAOA,KAAK;EACd,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE5C,UAAU,WAAAA,WAACd,QAAQ,EAAE;IACnB,IAAMM,IAAI,GAAG,IAAA2F,iBAAS,EAACjG,QAAQ,CAACM,IAAI,CAAC;IAErC,IAAIA,IAAI,EAAE;MACR,IAAI,CAACwG,oBAAoB,CAACxG,IAAI,CAAC;IACjC;IACA,IAAI,CAACA,IAAI,CAACmD,YAAY,EAAE;MACtB,IAAI,CAACnE,KAAK,GAAG,IAAI;MAEjB,OAAOkC,SAAS;IAClB;IACA,IAAIlB,IAAI,CAACsD,UAAU,EAAE;MACnBtD,IAAI,CAACsD,UAAU,GAAG,IAAAmD,UAAA,CAAArI,OAAA,EAAS4B,IAAI,CAACsD,UAAU,EAAE,EAAE,CAAC;IACjD;IACA,IAAItD,IAAI,CAAC0G,wBAAwB,EAAE;MACjC1G,IAAI,CAAC0G,wBAAwB,GAAG,IAAAD,UAAA,CAAArI,OAAA,EAAS4B,IAAI,CAAC0G,wBAAwB,EAAE,EAAE,CAAC;IAC7E;IAEA,OAAO1G,IAAI;EACb,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEwG,oBAAoB,WAAAA,qBAACxG,IAAI,EAAE;IACzB,IAAM2G,YAAY,GAAG,IAAI,CAAC/G,KAAK,CAACC,SAAS,CAAC,CAAC,CAACyG,cAAc,CAACM,OAAO,CAAC7I,iBAAiB,CAAC;IAErF,IAAI,CAAC6B,KAAK,CAACC,SAAS,CAAC,CAAC,CAACyG,cAAc,CAACO,UAAU,CAAC9I,iBAAiB,CAAC;IACnE,IAAI,CAAC4I,YAAY,EAAE;MACjB;IACF;IAEA,IAAI,CAAC3G,IAAI,CAACI,KAAK,EAAE;MACf,MAAM,IAAI0G,KAAK,wBAAAjE,MAAA,CAAwB8D,YAAY,qCAAkC,CAAC;IACxF;IAEA,IAAI,CAAC3G,IAAI,CAACI,KAAK,CAACe,UAAU,EAAE;MAC1B,MAAM,IAAI2F,KAAK,wBAAAjE,MAAA,CAAwB8D,YAAY,qCAAkC,CAAC;IACxF;IAEA,IAAMvD,KAAK,GAAGpD,IAAI,CAACI,KAAK,CAACe,UAAU;IAEnC,IAAIiC,KAAK,KAAKuD,YAAY,EAAE;MAC1B,MAAM,IAAIG,KAAK,eAAAjE,MAAA,CAAeO,KAAK,mCAAAP,MAAA,CAAgC8D,YAAY,CAAE,CAAC;IACpF;EACF,CAAC;EAAAI,OAAA;AACH,CAAC,OAAAC,0BAAA,CAAA5I,OAAA,EAAAP,IAAA,4BAAAF,IAAA,OAAAsJ,yBAAA,CAAA7I,OAAA,EAAAP,IAAA,4BAAAA,IAAA,OAAAmJ,0BAAA,CAAA5I,OAAA,EAAAP,IAAA,qCAAAD,KAAA,OAAAqJ,yBAAA,CAAA7I,OAAA,EAAAP,IAAA,qCAAAA,IAAA,OAAAmJ,0BAAA,CAAA5I,OAAA,EAAAP,IAAA,gCA1NEqJ,iBAAS,OAAAD,yBAAA,CAAA7I,OAAA,EAAAP,IAAA,gCAAAA,IAAA,IAAAA,IAAA,EA0NX,CAAC;AAAC,IAAAsJ,QAAA,GAAAC,OAAA,CAAAhJ,OAAA,GAEYC,aAAa"}
+{"version":3,"names":["_querystring","_interopRequireDefault","require","_url","_common","_webexCore","_lodash","_uuid","_dec","_dec2","_obj","jwt","OAUTH2_CSRF_TOKEN","EMPTY_OBJECT_STRING","base64","encode","_stringify","default","Authorization","WebexPlugin","extend","whileInFlight","derived","isAuthenticating","deps","fn","isAuthorizing","session","type","ready","namespace","initialize","attrs","options","_this","ret","_apply","prototype","parse","location","url","webex","getWindow","href","_checkForErrors","hash","includes","substr","querystring","state","JSON","decode","tokenData","_parseHash","_cleanUrl","process","nextTick","credentials","set","supertoken","initiateLogin","arguments","length","undefined","csrf_token","_generateSecurityToken","config","clientType","initiateAuthorizationCodeGrant","initiateImplicitGrant","logger","info","loginUrl","buildLoginUrl","_assign","response_type","separateWindow","defaultWindowSettings","width","height","windowSettings","_typeof2","windowFeatures","_entries","map","_ref","_ref2","_slicedToArray2","key","value","concat","join","open","_promise","resolve","requestAccessTokenFromJwt","_ref3","_this2","hydraUri","internal","services","get","slice","env","HYDRA_SERVICE_URL","request","method","uri","headers","authorization","then","_ref4","body","access_token","token","token_type","expires_in","expiresIn","initServiceCatalogs","logout","noRedirect","buildLogoutUrl","createJwt","_ref5","_asyncToGenerator2","_regenerator","mark","_callee","issuer","secretId","displayName","secret","payload","alg","jwtToken","wrap","_callee$","_context","prev","next","Buffer","from","uuid","sign","abrupt","t0","reject","stop","query","error","ErrorConstructor","grantErrors","select","cloneDeep","history","replaceState","forEach","_deleteProperty","isEmpty","omit","stringify","format","v4","sessionStorage","setItem","_verifySecurityToken","_parseInt2","refresh_token_expires_in","sessionToken","getItem","removeItem","Error","version","_applyDecoratedDescriptor2","_getOwnPropertyDescriptor","oneFlight","_default","exports"],"sources":["authorization.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport {base64, oneFlight, whileInFlight} from '@webex/common';\nimport {grantErrors, WebexPlugin} from '@webex/webex-core';\nimport {cloneDeep, isEmpty, omit} from 'lodash';\nimport uuid from 'uuid';\nconst jwt = require('jsonwebtoken');\n\nconst OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';\nconst EMPTY_OBJECT_STRING = base64.encode(JSON.stringify({}));\n\n/**\n * Browser support for OAuth2. Automatically parses the URL hash for an access\n * token\n * @class\n * @name AuthorizationBrowser\n */\nconst Authorization = WebexPlugin.extend({\n  derived: {\n    /**\n     * Alias of {@link AuthorizationBrowser#isAuthorizing}\n     * @instance\n     * @memberof AuthorizationBrowser\n     * @type {boolean}\n     */\n    isAuthenticating: {\n      deps: ['isAuthorizing'],\n      fn() {\n        return this.isAuthorizing;\n      },\n    },\n  },\n\n  session: {\n    /**\n     * Indicates if an Authorization Code exchange is inflight\n     * @instance\n     * @memberof AuthorizationBrowser\n     * @type {boolean}\n     */\n    isAuthorizing: {\n      default: false,\n      type: 'boolean',\n    },\n    ready: {\n      default: false,\n      type: 'boolean',\n    },\n  },\n\n  namespace: 'Credentials',\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} attrs {@link AmpersandState}\n   * @param {boolean} attrs.parse Controls whether or not the the url should get\n   * parsed for an access token\n   * @private\n   * @returns {Authorization}\n   */\n  // eslint-disable-next-line complexity\n  initialize(attrs, options) {\n    const ret = Reflect.apply(WebexPlugin.prototype.initialize, this, [attrs, options]);\n\n    // Reminder, we can't do parse based on config, because config is not\n    // available until nextTick and we want to be able to throw errors found in\n    // the url.\n    if (attrs.parse === false) {\n      this.ready = true;\n\n      return ret;\n    }\n    const location = url.parse(this.webex.getWindow().location.href, true);\n\n    this._checkForErrors(location);\n\n    let {hash} = location;\n\n    if (!hash) {\n      this.ready = true;\n\n      return ret;\n    }\n    if (hash.includes('#')) {\n      hash = hash.substr(1);\n    }\n    location.hash = querystring.parse(hash);\n    if (location.hash.state) {\n      location.hash.state = JSON.parse(base64.decode(location.hash.state));\n    }\n    const tokenData = this._parseHash(location);\n\n    if (!tokenData) {\n      return ret;\n    }\n    this._cleanUrl(location);\n\n    // Wait until nextTick in case `credentials` hasn't initialized yet\n    process.nextTick(() => {\n      this.webex.credentials.set({supertoken: tokenData});\n      this.ready = true;\n    });\n\n    return ret;\n  },\n\n/**\n * Initiates the OAuth flow for user authentication.\n * This function determines the type of OAuth flow to use based on the client type configuration.\n * If the client is configured as \"confidential\", it will initiate the Authorization Code Grant flow;\n * otherwise, it will initiate the Implicit Grant flow.\n *\n * @instance\n * @memberof AuthorizationBrowser\n * @param {Object} options - The options to configure the OAuth flow.\n * @param {Object} [options.state] - An optional state object that can be used to include additional\n * information such as security tokens. A CSRF token will be automatically generated and added to\n * this state object.\n * @param {boolean|Object} [options.separateWindow] - Determines if the login should open in a separate window.\n * This can be a boolean or an object specifying window features:\n *   - If `true`, a new window with default dimensions is opened.\n *   - If an object, custom window features can be specified (e.g., `{width: 800, height: 600}`).\n * @returns {Promise<void>} - A promise that resolves when the appropriate OAuth flow has been initiated.\n * The promise does not necessarily indicate the completion of the login process.\n * @throws {Error} - Throws an error if there are issues initiating the OAuth flow.\n */\n  initiateLogin(options = {}) {\n    options.state = options.state || {};\n    options.state.csrf_token = this._generateSecurityToken();\n\n    // If we're not explicitly a confidential client, assume we're a public\n    // client\n    if (this.config.clientType === 'confidential') {\n      return this.initiateAuthorizationCodeGrant(options);\n    }\n\n    return this.initiateImplicitGrant(options);\n  },\n\n  @whileInFlight('isAuthorizing')\n/**\n * Initiates the Implicit Grant flow for authorization.\n * This function constructs the login URL and either opens it in a new\n * window or in the current window based on the provided options.\n * Typically called via {@link AuthorizationBrowser#initiateLogin}.\n *\n * @instance\n * @memberof AuthorizationBrowser\n * @param {Object} options - The options to configure the login flow.\n * @param {Object} [options.separateWindow] - Determines if the login should open in a separate window.\n * This can be a boolean or an object specifying window features:\n *   - If `true`, a new window with default dimensions is opened.\n *   - If an object, custom window features can be specified (e.g., `{width: 800, height: 600}`).\n * @returns {Promise<void>} - A promise that resolves immediately after initiating the login flow.\n * This promise does not indicate the completion of the login process.\n * @throws {Error} - Throws an error if the login URL cannot be constructed or if window opening fails.\n */\n  initiateImplicitGrant(options) {\n\n    this.logger.info('authorization: initiating implicit grant flow');\n    const loginUrl = this.webex.credentials.buildLoginUrl(\n      Object.assign({response_type: 'token'}, options)\n    );\n\n    if (options?.separateWindow) {\n      // Default window settings\n      const defaultWindowSettings = {\n        width: 600,\n        height: 800\n      };\n\n      // Merge user provided settings with defaults\n      const windowSettings = Object.assign(\n        defaultWindowSettings, \n        typeof options.separateWindow === 'object' ? options.separateWindow : {}\n      );\n      // Convert settings object to window.open features string\n      const windowFeatures = Object.entries(windowSettings)\n        .map(([key, value]) => `${key}=${value}`)\n        .join(',');\n      this.webex.getWindow().open(loginUrl, '_blank', windowFeatures);\n    } else {\n      // Default behavior - open in same window\n      this.webex.getWindow().location = loginUrl;\n    }\n\n    return Promise.resolve();\n  },\n\n  @whileInFlight('isAuthorizing')\n  /**\n   * Kicks off the Implicit Code grant flow. Typically called via\n   * {@link AuthorizationBrowser#initiateLogin}\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateAuthorizationCodeGrant(options) {\n    this.logger.info('authorization: initiating authorization code grant flow');\n    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(\n      Object.assign({response_type: 'code'}, options)\n    );\n\n    return Promise.resolve();\n  },\n\n  @oneFlight\n  /**\n   * Requests a Webex access token for a user already authenticated into\n   * your product.\n   *\n   * Note: You'll need to supply a jwtRefreshCallback of the form\n   * `Promise<jwt> = jwtRefreshCallback(webex)` for automatic token refresh to\n   * work.\n   *\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @param {Object} options.jwt This is a jwt generated by your backend that\n   * identifies a user in your system\n   * @returns {Promise}\n   */\n  requestAccessTokenFromJwt({jwt}) {\n    let hydraUri = this.webex.internal.services.get('hydra', true);\n\n    if (hydraUri && hydraUri.slice(-1) !== '/') {\n      // add a `/` to hydra's uri from the services catalog so that\n      // it matches the current env service format.\n      hydraUri += '/';\n    }\n\n    hydraUri = hydraUri || process.env.HYDRA_SERVICE_URL || 'https://api.ciscospark.com/v1/';\n\n    return this.webex\n      .request({\n        method: 'POST',\n        uri: `${hydraUri}jwt/login`,\n        headers: {\n          authorization: jwt,\n        },\n      })\n      .then(({body}) => ({\n        access_token: body.token,\n        token_type: 'Bearer',\n        expires_in: body.expiresIn,\n      }))\n      .then((token) => {\n        this.webex.credentials.set({\n          supertoken: token,\n        });\n      })\n      .then(() => this.webex.internal.services.initServiceCatalogs());\n  },\n\n  /**\n   * Called by {@link WebexCore#logout()}. Redirects to the logout page\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} options\n   * @param {boolean} options.noRedirect if true, does not redirect\n   * @returns {Promise}\n   */\n  logout(options = {}) {\n    if (!options.noRedirect) {\n      this.webex.getWindow().location = this.webex.credentials.buildLogoutUrl(options);\n    }\n  },\n\n  /**\n   * Creates a jwt user token\n   * @param {object} options\n   * @param {String} options.issuer Guest Issuer ID\n   * @param {String} options.secretId Guest Secret ID\n   * @param {String} options.displayName Guest Display Name | optional\n   * @param {String} options.expiresIn\n   * @returns {Promise<object>}\n   */\n  async createJwt({issuer, secretId, displayName, expiresIn}) {\n    const secret = Buffer.from(secretId, 'base64');\n    const payload = {\n      \"sub\": `guest-user-${uuid()}`,\n      \"iss\": issuer,\n      \"name\": displayName || `Guest User - ${uuid()}`\n    };\n    const alg = 'HS256';\n\n    try {\n\n      const jwtToken = jwt.sign(payload, secret, { expiresIn });\n\n      return Promise.resolve({jwt: jwtToken});\n    } catch (e) {\n      return Promise.reject(e);\n    }\n  },\n\n  /**\n   * Checks if the result of the login redirect contains an error string\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _checkForErrors(location) {\n    const {query} = location;\n\n    if (query && query.error) {\n      const ErrorConstructor = grantErrors.select(query.error);\n\n      throw new ErrorConstructor(query);\n    }\n  },\n\n  /**\n   * Removes no-longer needed values from the url (access token, csrf token, etc)\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _cleanUrl(location) {\n    location = cloneDeep(location);\n    if (this.webex.getWindow().history && this.webex.getWindow().history.replaceState) {\n      [\n        'access_token',\n        'token_type',\n        'expires_in',\n        'refresh_token',\n        'refresh_token_expires_in',\n      ].forEach((key) => Reflect.deleteProperty(location.hash, key));\n      if (!isEmpty(location.hash.state)) {\n        location.hash.state = base64.encode(\n          JSON.stringify(omit(location.hash.state, 'csrf_token'))\n        );\n        if (location.hash.state === EMPTY_OBJECT_STRING) {\n          Reflect.deleteProperty(location.hash, 'state');\n        }\n      } else {\n        Reflect.deleteProperty(location.hash, 'state');\n      }\n      location.hash = querystring.stringify(location.hash);\n      this.webex.getWindow().history.replaceState({}, null, url.format(location));\n    }\n  },\n\n  /**\n   * Generates a CSRF token and sticks in in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @private\n   * @returns {Promise}\n   */\n  _generateSecurityToken() {\n    this.logger.info('authorization: generating csrf token');\n\n    const token = uuid.v4();\n\n    this.webex.getWindow().sessionStorage.setItem('oauth2-csrf-token', token);\n\n    return token;\n  },\n\n  /**\n   * Parses the url hash into an access token object\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} location\n   * @private\n   * @returns {Object}\n   */\n  _parseHash(location) {\n    const hash = cloneDeep(location.hash);\n\n    if (hash) {\n      this._verifySecurityToken(hash);\n    }\n    if (!hash.access_token) {\n      this.ready = true;\n\n      return undefined;\n    }\n    if (hash.expires_in) {\n      hash.expires_in = parseInt(hash.expires_in, 10);\n    }\n    if (hash.refresh_token_expires_in) {\n      hash.refresh_token_expires_in = parseInt(hash.refresh_token_expires_in, 10);\n    }\n\n    return hash;\n  },\n\n  /**\n   * Checks if the CSRF token in sessionStorage is the same as the one returned\n   * in the url.\n   * @instance\n   * @memberof AuthorizationBrowser\n   * @param {Object} hash\n   * @private\n   * @returns {Promise}\n   */\n  _verifySecurityToken(hash) {\n    const sessionToken = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CSRF_TOKEN);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CSRF_TOKEN);\n    if (!sessionToken) {\n      return;\n    }\n\n    if (!hash.state) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect hash`);\n    }\n\n    if (!hash.state.csrf_token) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect hash`);\n    }\n\n    const token = hash.state.csrf_token;\n\n    if (token !== sessionToken) {\n      throw new Error(`CSRF token ${token} does not match stored token ${sessionToken}`);\n    }\n  },\n});\n\nexport default Authorization;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,IAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAN,sBAAA,CAAAC,OAAA;AAAwB,IAAAM,IAAA,EAAAC,KAAA,EAAAC,IAAA;AAZxB;AACA;AACA;AAEA;AASA,IAAMC,GAAG,GAAGT,OAAO,CAAC,cAAc,CAAC;AAEnC,IAAMU,iBAAiB,GAAG,mBAAmB;AAC7C,IAAMC,mBAAmB,GAAGC,cAAM,CAACC,MAAM,CAAC,IAAAC,UAAA,CAAAC,OAAA,EAAe,CAAC,CAAC,CAAC,CAAC;;AAE7D;AACA;AACA;AACA;AACA;AACA;AACA,IAAMC,aAAa,GAAGC,sBAAW,CAACC,MAAM,EAAAZ,IAAA,GA4HrC,IAAAa,qBAAa,EAAC,eAAe,CAAC,EAAAZ,KAAA,GAkD9B,IAAAY,qBAAa,EAAC,eAAe,CAAC,GAAAX,IAAA,GA9KQ;EACvCY,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACIC,gBAAgB,EAAE;MAChBC,IAAI,EAAE,CAAC,eAAe,CAAC;MACvBC,EAAE,WAAAA,GAAA,EAAG;QACH,OAAO,IAAI,CAACC,aAAa;MAC3B;IACF;EACF,CAAC;EAEDC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACID,aAAa,EAAE;MACbT,OAAO,EAAE,KAAK;MACdW,IAAI,EAAE;IACR,CAAC;IACDC,KAAK,EAAE;MACLZ,OAAO,EAAE,KAAK;MACdW,IAAI,EAAE;IACR;EACF,CAAC;EAEDE,SAAS,EAAE,aAAa;EAExB;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE;EACAC,UAAU,WAAAA,WAACC,KAAK,EAAEC,OAAO,EAAE;IAAA,IAAAC,KAAA;IACzB,IAAMC,GAAG,GAAG,IAAAC,MAAA,CAAAnB,OAAA,EAAcE,sBAAW,CAACkB,SAAS,CAACN,UAAU,EAAE,IAAI,EAAE,CAACC,KAAK,EAAEC,OAAO,CAAC,CAAC;;IAEnF;IACA;IACA;IACA,IAAID,KAAK,CAACM,KAAK,KAAK,KAAK,EAAE;MACzB,IAAI,CAACT,KAAK,GAAG,IAAI;MAEjB,OAAOM,GAAG;IACZ;IACA,IAAMI,QAAQ,GAAGC,YAAG,CAACF,KAAK,CAAC,IAAI,CAACG,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,CAACI,IAAI,EAAE,IAAI,CAAC;IAEtE,IAAI,CAACC,eAAe,CAACL,QAAQ,CAAC;IAE9B,IAAKM,IAAI,GAAIN,QAAQ,CAAhBM,IAAI;IAET,IAAI,CAACA,IAAI,EAAE;MACT,IAAI,CAAChB,KAAK,GAAG,IAAI;MAEjB,OAAOM,GAAG;IACZ;IACA,IAAIU,IAAI,CAACC,QAAQ,CAAC,GAAG,CAAC,EAAE;MACtBD,IAAI,GAAGA,IAAI,CAACE,MAAM,CAAC,CAAC,CAAC;IACvB;IACAR,QAAQ,CAACM,IAAI,GAAGG,oBAAW,CAACV,KAAK,CAACO,IAAI,CAAC;IACvC,IAAIN,QAAQ,CAACM,IAAI,CAACI,KAAK,EAAE;MACvBV,QAAQ,CAACM,IAAI,CAACI,KAAK,GAAGC,IAAI,CAACZ,KAAK,CAACxB,cAAM,CAACqC,MAAM,CAACZ,QAAQ,CAACM,IAAI,CAACI,KAAK,CAAC,CAAC;IACtE;IACA,IAAMG,SAAS,GAAG,IAAI,CAACC,UAAU,CAACd,QAAQ,CAAC;IAE3C,IAAI,CAACa,SAAS,EAAE;MACd,OAAOjB,GAAG;IACZ;IACA,IAAI,CAACmB,SAAS,CAACf,QAAQ,CAAC;;IAExB;IACAgB,OAAO,CAACC,QAAQ,CAAC,YAAM;MACrBtB,KAAI,CAACO,KAAK,CAACgB,WAAW,CAACC,GAAG,CAAC;QAACC,UAAU,EAAEP;MAAS,CAAC,CAAC;MACnDlB,KAAI,CAACL,KAAK,GAAG,IAAI;IACnB,CAAC,CAAC;IAEF,OAAOM,GAAG;EACZ,CAAC;EAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEyB,aAAa,WAAAA,cAAA,EAAe;IAAA,IAAd3B,OAAO,GAAA4B,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;IACxB5B,OAAO,CAACgB,KAAK,GAAGhB,OAAO,CAACgB,KAAK,IAAI,CAAC,CAAC;IACnChB,OAAO,CAACgB,KAAK,CAACe,UAAU,GAAG,IAAI,CAACC,sBAAsB,CAAC,CAAC;;IAExD;IACA;IACA,IAAI,IAAI,CAACC,MAAM,CAACC,UAAU,KAAK,cAAc,EAAE;MAC7C,OAAO,IAAI,CAACC,8BAA8B,CAACnC,OAAO,CAAC;IACrD;IAEA,OAAO,IAAI,CAACoC,qBAAqB,CAACpC,OAAO,CAAC;EAC5C,CAAC;EAGH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEoC,qBAAqB,WAAAA,sBAACpC,OAAO,EAAE;IAE7B,IAAI,CAACqC,MAAM,CAACC,IAAI,CAAC,+CAA+C,CAAC;IACjE,IAAMC,QAAQ,GAAG,IAAI,CAAC/B,KAAK,CAACgB,WAAW,CAACgB,aAAa,CACnD,IAAAC,OAAA,CAAAzD,OAAA,EAAc;MAAC0D,aAAa,EAAE;IAAO,CAAC,EAAE1C,OAAO,CACjD,CAAC;IAED,IAAIA,OAAO,aAAPA,OAAO,eAAPA,OAAO,CAAE2C,cAAc,EAAE;MAC3B;MACA,IAAMC,qBAAqB,GAAG;QAC5BC,KAAK,EAAE,GAAG;QACVC,MAAM,EAAE;MACV,CAAC;;MAED;MACA,IAAMC,cAAc,GAAG,IAAAN,OAAA,CAAAzD,OAAA,EACrB4D,qBAAqB,EACrB,IAAAI,QAAA,CAAAhE,OAAA,EAAOgB,OAAO,CAAC2C,cAAc,MAAK,QAAQ,GAAG3C,OAAO,CAAC2C,cAAc,GAAG,CAAC,CACzE,CAAC;MACD;MACA,IAAMM,cAAc,GAAG,IAAAC,QAAA,CAAAlE,OAAA,EAAe+D,cAAc,CAAC,CAClDI,GAAG,CAAC,UAAAC,IAAA;QAAA,IAAAC,KAAA,OAAAC,eAAA,CAAAtE,OAAA,EAAAoE,IAAA;UAAEG,GAAG,GAAAF,KAAA;UAAEG,KAAK,GAAAH,KAAA;QAAA,UAAAI,MAAA,CAASF,GAAG,OAAAE,MAAA,CAAID,KAAK;MAAA,CAAE,CAAC,CACxCE,IAAI,CAAC,GAAG,CAAC;MACZ,IAAI,CAAClD,KAAK,CAACC,SAAS,CAAC,CAAC,CAACkD,IAAI,CAACpB,QAAQ,EAAE,QAAQ,EAAEU,cAAc,CAAC;IACjE,CAAC,MAAM;MACL;MACA,IAAI,CAACzC,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,GAAGiC,QAAQ;IAC5C;IAEA,OAAOqB,QAAA,CAAA5E,OAAA,CAAQ6E,OAAO,CAAC,CAAC;EAC1B,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE1B,8BAA8B,WAAAA,+BAACnC,OAAO,EAAE;IACtC,IAAI,CAACqC,MAAM,CAACC,IAAI,CAAC,yDAAyD,CAAC;IAC3E,IAAI,CAAC9B,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,GAAG,IAAI,CAACE,KAAK,CAACgB,WAAW,CAACgB,aAAa,CACpE,IAAAC,OAAA,CAAAzD,OAAA,EAAc;MAAC0D,aAAa,EAAE;IAAM,CAAC,EAAE1C,OAAO,CAChD,CAAC;IAED,OAAO4D,QAAA,CAAA5E,OAAA,CAAQ6E,OAAO,CAAC,CAAC;EAC1B,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,yBAAyB,WAAAA,0BAAAC,KAAA,EAAQ;IAAA,IAAAC,MAAA;IAAA,IAANtF,GAAG,GAAAqF,KAAA,CAAHrF,GAAG;IAC5B,IAAIuF,QAAQ,GAAG,IAAI,CAACzD,KAAK,CAAC0D,QAAQ,CAACC,QAAQ,CAACC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IAE9D,IAAIH,QAAQ,IAAIA,QAAQ,CAACI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;MAC1C;MACA;MACAJ,QAAQ,IAAI,GAAG;IACjB;IAEAA,QAAQ,GAAGA,QAAQ,IAAI3C,OAAO,CAACgD,GAAG,CAACC,iBAAiB,IAAI,gCAAgC;IAExF,OAAO,IAAI,CAAC/D,KAAK,CACdgE,OAAO,CAAC;MACPC,MAAM,EAAE,MAAM;MACdC,GAAG,KAAAjB,MAAA,CAAKQ,QAAQ,cAAW;MAC3BU,OAAO,EAAE;QACPC,aAAa,EAAElG;MACjB;IACF,CAAC,CAAC,CACDmG,IAAI,CAAC,UAAAC,KAAA;MAAA,IAAEC,IAAI,GAAAD,KAAA,CAAJC,IAAI;MAAA,OAAO;QACjBC,YAAY,EAAED,IAAI,CAACE,KAAK;QACxBC,UAAU,EAAE,QAAQ;QACpBC,UAAU,EAAEJ,IAAI,CAACK;MACnB,CAAC;IAAA,CAAC,CAAC,CACFP,IAAI,CAAC,UAACI,KAAK,EAAK;MACfjB,MAAI,CAACxD,KAAK,CAACgB,WAAW,CAACC,GAAG,CAAC;QACzBC,UAAU,EAAEuD;MACd,CAAC,CAAC;IACJ,CAAC,CAAC,CACDJ,IAAI,CAAC;MAAA,OAAMb,MAAI,CAACxD,KAAK,CAAC0D,QAAQ,CAACC,QAAQ,CAACkB,mBAAmB,CAAC,CAAC;IAAA,EAAC;EACnE,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,MAAM,WAAAA,OAAA,EAAe;IAAA,IAAdtF,OAAO,GAAA4B,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;IACjB,IAAI,CAAC5B,OAAO,CAACuF,UAAU,EAAE;MACvB,IAAI,CAAC/E,KAAK,CAACC,SAAS,CAAC,CAAC,CAACH,QAAQ,GAAG,IAAI,CAACE,KAAK,CAACgB,WAAW,CAACgE,cAAc,CAACxF,OAAO,CAAC;IAClF;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACQyF,SAAS,WAAAA,UAAAC,KAAA,EAA6C;IAAA,WAAAC,kBAAA,CAAA3G,OAAA,gBAAA4G,YAAA,CAAA5G,OAAA,CAAA6G,IAAA,UAAAC,QAAA;MAAA,IAAAC,MAAA,EAAAC,QAAA,EAAAC,WAAA,EAAAb,SAAA,EAAAc,MAAA,EAAAC,OAAA,EAAAC,GAAA,EAAAC,QAAA;MAAA,OAAAT,YAAA,CAAA5G,OAAA,CAAAsH,IAAA,UAAAC,SAAAC,QAAA;QAAA,kBAAAA,QAAA,CAAAC,IAAA,GAAAD,QAAA,CAAAE,IAAA;UAAA;YAA3CX,MAAM,GAAAL,KAAA,CAANK,MAAM,EAAEC,QAAQ,GAAAN,KAAA,CAARM,QAAQ,EAAEC,WAAW,GAAAP,KAAA,CAAXO,WAAW,EAAEb,SAAS,GAAAM,KAAA,CAATN,SAAS;YACjDc,MAAM,GAAGS,MAAM,CAACC,IAAI,CAACZ,QAAQ,EAAE,QAAQ,CAAC;YACxCG,OAAO,GAAG;cACd,KAAK,gBAAA1C,MAAA,CAAgB,IAAAoD,aAAI,EAAC,CAAC,CAAE;cAC7B,KAAK,EAAEd,MAAM;cACb,MAAM,EAAEE,WAAW,oBAAAxC,MAAA,CAAoB,IAAAoD,aAAI,EAAC,CAAC;YAC/C,CAAC;YACKT,GAAG,GAAG,OAAO;YAAAI,QAAA,CAAAC,IAAA;YAIXJ,QAAQ,GAAG3H,GAAG,CAACoI,IAAI,CAACX,OAAO,EAAED,MAAM,EAAE;cAAEd,SAAS,EAATA;YAAU,CAAC,CAAC;YAAA,OAAAoB,QAAA,CAAAO,MAAA,WAElDnD,QAAA,CAAA5E,OAAA,CAAQ6E,OAAO,CAAC;cAACnF,GAAG,EAAE2H;YAAQ,CAAC,CAAC;UAAA;YAAAG,QAAA,CAAAC,IAAA;YAAAD,QAAA,CAAAQ,EAAA,GAAAR,QAAA;YAAA,OAAAA,QAAA,CAAAO,MAAA,WAEhCnD,QAAA,CAAA5E,OAAA,CAAQiI,MAAM,CAAAT,QAAA,CAAAQ,EAAE,CAAC;UAAA;UAAA;YAAA,OAAAR,QAAA,CAAAU,IAAA;QAAA;MAAA,GAAApB,OAAA;IAAA;EAE5B,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEnF,eAAe,WAAAA,gBAACL,QAAQ,EAAE;IACxB,IAAO6G,KAAK,GAAI7G,QAAQ,CAAjB6G,KAAK;IAEZ,IAAIA,KAAK,IAAIA,KAAK,CAACC,KAAK,EAAE;MACxB,IAAMC,gBAAgB,GAAGC,sBAAW,CAACC,MAAM,CAACJ,KAAK,CAACC,KAAK,CAAC;MAExD,MAAM,IAAIC,gBAAgB,CAACF,KAAK,CAAC;IACnC;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE9F,SAAS,WAAAA,UAACf,QAAQ,EAAE;IAClBA,QAAQ,GAAG,IAAAkH,iBAAS,EAAClH,QAAQ,CAAC;IAC9B,IAAI,IAAI,CAACE,KAAK,CAACC,SAAS,CAAC,CAAC,CAACgH,OAAO,IAAI,IAAI,CAACjH,KAAK,CAACC,SAAS,CAAC,CAAC,CAACgH,OAAO,CAACC,YAAY,EAAE;MACjF,CACE,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,0BAA0B,CAC3B,CAACC,OAAO,CAAC,UAACpE,GAAG;QAAA,OAAK,IAAAqE,eAAA,CAAA5I,OAAA,EAAuBsB,QAAQ,CAACM,IAAI,EAAE2C,GAAG,CAAC;MAAA,EAAC;MAC9D,IAAI,CAAC,IAAAsE,eAAO,EAACvH,QAAQ,CAACM,IAAI,CAACI,KAAK,CAAC,EAAE;QACjCV,QAAQ,CAACM,IAAI,CAACI,KAAK,GAAGnC,cAAM,CAACC,MAAM,CACjC,IAAAC,UAAA,CAAAC,OAAA,EAAe,IAAA8I,YAAI,EAACxH,QAAQ,CAACM,IAAI,CAACI,KAAK,EAAE,YAAY,CAAC,CACxD,CAAC;QACD,IAAIV,QAAQ,CAACM,IAAI,CAACI,KAAK,KAAKpC,mBAAmB,EAAE;UAC/C,IAAAgJ,eAAA,CAAA5I,OAAA,EAAuBsB,QAAQ,CAACM,IAAI,EAAE,OAAO,CAAC;QAChD;MACF,CAAC,MAAM;QACL,IAAAgH,eAAA,CAAA5I,OAAA,EAAuBsB,QAAQ,CAACM,IAAI,EAAE,OAAO,CAAC;MAChD;MACAN,QAAQ,CAACM,IAAI,GAAGG,oBAAW,CAACgH,SAAS,CAACzH,QAAQ,CAACM,IAAI,CAAC;MACpD,IAAI,CAACJ,KAAK,CAACC,SAAS,CAAC,CAAC,CAACgH,OAAO,CAACC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAEnH,YAAG,CAACyH,MAAM,CAAC1H,QAAQ,CAAC,CAAC;IAC7E;EACF,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE0B,sBAAsB,WAAAA,uBAAA,EAAG;IACvB,IAAI,CAACK,MAAM,CAACC,IAAI,CAAC,sCAAsC,CAAC;IAExD,IAAM2C,KAAK,GAAG4B,aAAI,CAACoB,EAAE,CAAC,CAAC;IAEvB,IAAI,CAACzH,KAAK,CAACC,SAAS,CAAC,CAAC,CAACyH,cAAc,CAACC,OAAO,CAAC,mBAAmB,EAAElD,KAAK,CAAC;IAEzE,OAAOA,KAAK;EACd,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE7D,UAAU,WAAAA,WAACd,QAAQ,EAAE;IACnB,IAAMM,IAAI,GAAG,IAAA4G,iBAAS,EAAClH,QAAQ,CAACM,IAAI,CAAC;IAErC,IAAIA,IAAI,EAAE;MACR,IAAI,CAACwH,oBAAoB,CAACxH,IAAI,CAAC;IACjC;IACA,IAAI,CAACA,IAAI,CAACoE,YAAY,EAAE;MACtB,IAAI,CAACpF,KAAK,GAAG,IAAI;MAEjB,OAAOkC,SAAS;IAClB;IACA,IAAIlB,IAAI,CAACuE,UAAU,EAAE;MACnBvE,IAAI,CAACuE,UAAU,GAAG,IAAAkD,UAAA,CAAArJ,OAAA,EAAS4B,IAAI,CAACuE,UAAU,EAAE,EAAE,CAAC;IACjD;IACA,IAAIvE,IAAI,CAAC0H,wBAAwB,EAAE;MACjC1H,IAAI,CAAC0H,wBAAwB,GAAG,IAAAD,UAAA,CAAArJ,OAAA,EAAS4B,IAAI,CAAC0H,wBAAwB,EAAE,EAAE,CAAC;IAC7E;IAEA,OAAO1H,IAAI;EACb,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEwH,oBAAoB,WAAAA,qBAACxH,IAAI,EAAE;IACzB,IAAM2H,YAAY,GAAG,IAAI,CAAC/H,KAAK,CAACC,SAAS,CAAC,CAAC,CAACyH,cAAc,CAACM,OAAO,CAAC7J,iBAAiB,CAAC;IAErF,IAAI,CAAC6B,KAAK,CAACC,SAAS,CAAC,CAAC,CAACyH,cAAc,CAACO,UAAU,CAAC9J,iBAAiB,CAAC;IACnE,IAAI,CAAC4J,YAAY,EAAE;MACjB;IACF;IAEA,IAAI,CAAC3H,IAAI,CAACI,KAAK,EAAE;MACf,MAAM,IAAI0H,KAAK,wBAAAjF,MAAA,CAAwB8E,YAAY,qCAAkC,CAAC;IACxF;IAEA,IAAI,CAAC3H,IAAI,CAACI,KAAK,CAACe,UAAU,EAAE;MAC1B,MAAM,IAAI2G,KAAK,wBAAAjF,MAAA,CAAwB8E,YAAY,qCAAkC,CAAC;IACxF;IAEA,IAAMtD,KAAK,GAAGrE,IAAI,CAACI,KAAK,CAACe,UAAU;IAEnC,IAAIkD,KAAK,KAAKsD,YAAY,EAAE;MAC1B,MAAM,IAAIG,KAAK,eAAAjF,MAAA,CAAewB,KAAK,mCAAAxB,MAAA,CAAgC8E,YAAY,CAAE,CAAC;IACpF;EACF,CAAC;EAAAI,OAAA;AACH,CAAC,OAAAC,0BAAA,CAAA5J,OAAA,EAAAP,IAAA,4BAAAF,IAAA,OAAAsK,yBAAA,CAAA7J,OAAA,EAAAP,IAAA,4BAAAA,IAAA,OAAAmK,0BAAA,CAAA5J,OAAA,EAAAP,IAAA,qCAAAD,KAAA,OAAAqK,yBAAA,CAAA7J,OAAA,EAAAP,IAAA,qCAAAA,IAAA,OAAAmK,0BAAA,CAAA5J,OAAA,EAAAP,IAAA,gCA1NEqK,iBAAS,OAAAD,yBAAA,CAAA7J,OAAA,EAAAP,IAAA,gCAAAA,IAAA,IAAAA,IAAA,EA0NX,CAAC;AAAC,IAAAsK,QAAA,GAAAC,OAAA,CAAAhK,OAAA,GAEYC,aAAa"}