matrix-js-sdk 41.9.0 → 42.0.0

package/src/rust-crypto/DehydratedDeviceManager.ts

@@ -36,11 +36,11 @@ interface DehydratedDeviceResp {
     };
 }
 /**
- * The response body of `POST /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device/events`.
+ * The response body of `GET /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device/{device_id}/events`.
  */
 interface DehydratedDeviceEventsResp {
     events: IToDeviceEvent[];
-    next_batch: string;
+    next_batch?: string;
 }
 
 /**
@@ -267,28 +267,29 @@ export class DehydratedDeviceManager extends TypedEventEmitter<DehydratedDevices
         const path = encodeUri("/dehydrated_device/$device_id/events", {
             $device_id: dehydratedDeviceResp.device_id,
         });
-        // eslint-disable-next-line no-constant-condition
-        while (true) {
+
+        do {
             const eventResp: DehydratedDeviceEventsResp = await this.http.authedRequest<DehydratedDeviceEventsResp>(
-                Method.Post,
+                Method.Get,
                 path,
+                nextBatch ? { from: nextBatch } : undefined,
                 undefined,
-                nextBatch ? { next_batch: nextBatch } : {},
                 {
                     prefix: UnstablePrefix,
                 },
             );
 
-            if (eventResp.events.length === 0) {
-                break;
-            }
             toDeviceCount += eventResp.events.length;
             nextBatch = eventResp.next_batch;
-            const roomKeyInfos = await rehydratedDevice.receiveEvents(JSON.stringify(eventResp.events));
-            roomKeyCount += roomKeyInfos.length;
 
-            this.emit(CryptoEvent.RehydrationProgress, roomKeyCount, toDeviceCount);
-        }
+            if (eventResp.events.length > 0) {
+                const roomKeyInfos = await rehydratedDevice.receiveEvents(JSON.stringify(eventResp.events));
+                roomKeyCount += roomKeyInfos.length;
+
+                this.emit(CryptoEvent.RehydrationProgress, roomKeyCount, toDeviceCount);
+            }
+        } while (nextBatch !== undefined);
+
         this.logger.info(`dehydration: received ${roomKeyCount} room keys from ${toDeviceCount} to-device events`);
         this.emit(CryptoEvent.RehydrationCompleted);
 

package/src/testing.ts

@@ -27,7 +27,7 @@ import { type RoomMember } from "./models/room-member.ts";
 import { EventType } from "./@types/event.ts";
 import { type DecryptionFailureCode } from "./crypto-api/index.ts";
 import { DecryptionError, type EventDecryptionResult } from "./common-crypto/CryptoBackend.ts";
-import { OAuthGrantType, type OidcClientConfig, type ValidatedAuthMetadata } from "./oidc/index.ts";
+import { OAuthGrantType, type ValidatedAuthMetadata } from "./oauth/index.ts";
 
 /**
  * Create a {@link MatrixEvent}.
@@ -195,26 +195,7 @@ export async function decryptExistingEvent(
  * @returns OidcClientConfig
  * @experimental
  */
-export const makeDelegatedAuthConfig = (
-    issuer = "https://auth.org/",
-    additionalGrantTypes: string[] = [],
-): OidcClientConfig => {
-    const metadata = mockOpenIdConfiguration(issuer, additionalGrantTypes);
-
-    return {
-        ...metadata,
-        signingKeys: null,
-    };
-};
-
-/**
- * Useful for mocking <issuer>/.well-known/openid-configuration
- * @param issuer used as the base for all other urls
- * @param additionalGrantTypes to add to the default grant types
- * @returns ValidatedAuthMetadata
- * @experimental
- */
-export const mockOpenIdConfiguration = (
+export const makeDelegatedAuthMetadata = (
     issuer = "https://auth.org/",
     additionalGrantTypes: string[] = [],
 ): ValidatedAuthMetadata => ({
@@ -224,8 +205,8 @@ export const mockOpenIdConfiguration = (
     authorization_endpoint: issuer + "auth",
     registration_endpoint: issuer + "registration",
     device_authorization_endpoint: issuer + "device",
-    jwks_uri: issuer + "jwks",
     response_types_supported: ["code"],
     grant_types_supported: [OAuthGrantType.AuthorizationCode, OAuthGrantType.RefreshToken, ...additionalGrantTypes],
     code_challenge_methods_supported: ["S256"],
+    response_modes_supported: ["query", "fragment"],
 });

package/lib/oidc/authorize.d.ts

@@ -1,157 +0,0 @@
-import { type IdTokenClaims, type SigninRequestCreateArgs } from "oidc-client-ts";
-import { type BearerTokenResponse, type ValidatedAuthMetadata } from "./validate.ts";
-export type { BearerTokenResponse };
-/**
- * Authorization parameters which are used in the authentication request of an OIDC auth code flow.
- *
- * See https://openid.net/specs/openid-connect-basic-1_0.html#RequestParameters.
- */
-export type AuthorizationParams = {
-    state: string;
-    scope: string;
-    redirectUri: string;
-    codeVerifier: string;
-    nonce: string;
-};
-/**
- * @experimental
- * Generate the scope used in authorization request with OIDC OP
- * @returns scope
- */
-export declare const generateScope: (deviceId?: string) => string;
-/**
- * Generate authorization params to pass to {@link generateAuthorizationUrl}.
- *
- * Used as part of an authorization code OIDC flow: see https://openid.net/specs/openid-connect-basic-1_0.html#CodeFlow.
- *
- * @param redirectUri - absolute url for OP to redirect to after authorization
- * @returns AuthorizationParams
- */
-export declare const generateAuthorizationParams: ({ redirectUri }: {
-    redirectUri: string;
-}) => AuthorizationParams;
-/**
- * @deprecated use generateOidcAuthorizationUrl
- * Generate a URL to attempt authorization with the OP
- * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
- * @param authorizationUrl - endpoint to attempt authorization with the OP
- * @param clientId - id of this client as registered with the OP
- * @param authorizationParams - params to be used in the url
- * @returns a Promise with the url as a string
- */
-export declare const generateAuthorizationUrl: (authorizationUrl: string, clientId: string, { scope, redirectUri, state, nonce, codeVerifier }: AuthorizationParams) => Promise<string>;
-/**
- * @experimental
- * Generate a URL to attempt authorization with the OP
- * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
- * @param metadata - validated metadata from OP discovery
- * @param clientId - this client's id as registered with the OP
- * @param homeserverUrl - used to establish the session on return from the OP
- * @param identityServerUrl - used to establish the session on return from the OP
- * @param nonce - state
- * @param prompt - indicates to the OP which flow the user should see - eg login or registration
- *          See https://openid.net/specs/openid-connect-prompt-create-1_0.html#name-prompt-parameter
- * @param urlState - value to append to the opaque state identifier to uniquely identify the callback
- * @param loginHint - value to send as the `login_hint` to the OP, giving a hint about the login identifier the user might use to log in.
- *          See {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest OIDC core 3.1.2.1}.
- * @param responseMode - value to send as the `response_mode` to the OP, selecting how auth is passed back during redirect.
- *          See {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest OIDC core 3.1.2.1}.
- * @returns a Promise with the url as a string
- */
-export declare const generateOidcAuthorizationUrl: ({ metadata, redirectUri, clientId, homeserverUrl, identityServerUrl, nonce, prompt, urlState, loginHint, responseMode, }: {
-    clientId: string;
-    metadata: ValidatedAuthMetadata;
-    homeserverUrl: string;
-    identityServerUrl?: string;
-    redirectUri: string;
-    nonce: string;
-    prompt?: string;
-    urlState?: string;
-    loginHint?: string;
-    responseMode?: SigninRequestCreateArgs["response_mode"];
-}) => Promise<string>;
-/**
- * @experimental
- * Attempt to exchange authorization code for bearer token.
- *
- * Takes the authorization code returned by the OpenID Provider via the authorization URL, and makes a
- * request to the Token Endpoint, to obtain the access token, refresh token, etc.
- *
- * @param code - authorization code as returned by OP during authorization
- * @param state - authorization state param as returned by OP during authorization
- * @param responseMode - the response mode used for authentication
- * @returns valid bearer token response
- * @throws An `Error` with `message` set to an entry in {@link OidcError},
- *      when the request fails, or the returned token response is invalid.
- */
-export declare const completeAuthorizationCodeGrant: (code: string, state: string, responseMode?: SigninRequestCreateArgs["response_mode"]) => Promise<{
-    oidcClientSettings: {
-        clientId: string;
-        issuer: string;
-    };
-    tokenResponse: BearerTokenResponse;
-    homeserverUrl: string;
-    idTokenClaims: IdTokenClaims;
-    identityServerUrl?: string;
-}>;
-/**
- * Response from the OIDC token endpoint when exchanging a token for grant_type device_code.
- */
-export interface DeviceAccessTokenResponse {
-    id_token?: string;
-    access_token: string;
-    token_type: string;
-    refresh_token?: string;
-    scope?: string;
-    expires_in?: number;
-    session_state?: string;
-}
-/**
- * Error from the OIDC token endpoint when exchanging a token for grant_type device_code.
- */
-export interface DeviceAccessTokenError {
-    error: string;
-    error_description?: string;
-    error_uri?: string;
-    session_state?: string;
-}
-/**
- * Response from the OIDC device authorization endpoint.
- */
-export interface DeviceAuthorizationResponse {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete?: string;
-    expires_in: number;
-    interval?: number;
-}
-/**
- * Begin OIDC device authorization flow.
- * @param options - The device authorization parameters.
- * @param options.clientId - the client ID returned from client registration.
- * @param options.scope - the scope to request for authorization.
- * @param options.metadata - the validated OIDC metadata for the Identity Provider.
- * @returns a promise that resolves to a device access token response,
- *   or an error response if the user denies authorization or the device code expires.
- */
-export declare const startDeviceAuthorization: ({ clientId, scope, metadata, }: {
-    clientId: string;
-    scope: string;
-    metadata: ValidatedAuthMetadata;
-}) => Promise<DeviceAuthorizationResponse>;
-/**
- * Polls the OIDC token endpoint until we get a device access token response, or encounter an unrecoverable error.
- * @param options - The device authorization parameters.
- * @param options.session - The session returned from a previous call to {@link startDeviceAuthorization}.
- * @param options.metadata - The validated OIDC metadata for the Identity Provider.
- * @param options.clientId - The client ID returned from client registration.
- * @returns a promise that resolves to a device access token response,
- *   or an error response if the user denies authorization or the device code expires.
- */
-export declare const waitForDeviceAuthorization: ({ session, metadata, clientId, }: {
-    session: DeviceAuthorizationResponse;
-    metadata: ValidatedAuthMetadata;
-    clientId: string;
-}) => Promise<DeviceAccessTokenResponse | DeviceAccessTokenError>;
-//# sourceMappingURL=authorize.d.ts.map

package/lib/oidc/authorize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/oidc/authorize.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,aAAa,EAGlB,KAAK,uBAAuB,EAI/B,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACH,KAAK,mBAAmB,EAGxB,KAAK,qBAAqB,EAG7B,MAAM,eAAe,CAAC;AAQvB,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,WAAW,MAAM,KAAG,MAGjD,CAAC;AAcF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GAAI,iBAAiB;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,KAAG,mBAMrF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GACjC,kBAAkB,MAAM,EACxB,UAAU,MAAM,EAChB,oDAAoD,mBAAmB,KACxE,OAAO,CAAC,MAAM,CAchB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GAAU,0HAWhD;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,uBAAuB,CAAC,eAAe,CAAC,CAAC;CAC3D,KAAG,OAAO,CAAC,MAAM,CAsBjB,CAAC;AAqBF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,GACvC,MAAM,MAAM,EACZ,OAAO,MAAM,EACb,eAAc,uBAAuB,CAAC,eAAe,CAAW,KACjE,OAAO,CAAC;IACP,kBAAkB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,aAAa,EAAE,mBAAmB,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CA2EA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAU,gCAI5C;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,qBAAqB,CAAC;CACnC,KAAG,OAAO,CAAC,2BAA2B,CAiBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GAAU,kCAI9C;IACC,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CACpB,KAAG,OAAO,CAAC,yBAAyB,GAAG,sBAAsB,CAgC7D,CAAC"}

package/lib/oidc/authorize.js

@@ -1,365 +0,0 @@
-import _objectSpread from "@babel/runtime/helpers/objectSpread2";
-/*
-Copyright 2023 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { Log, OidcClient, SigninResponse, SigninState, WebStorageStateStore } from "oidc-client-ts";
-import { logger } from "../logger.js";
-import { secureRandomString } from "../randomstring.js";
-import { OidcError } from "./error.js";
-import { validateBearerTokenResponse, validateIdToken, validateStoredUserState } from "./validate.js";
-import { sha256 } from "../digest.js";
-import { encodeUnpaddedBase64Url } from "../base64.js";
-import { OAuthGrantType } from "./register.js";
-import { sleep } from "../utils.js";
-import { Method } from "../http-api/index.js";
-
-// reexport for backwards compatibility
-
-/**
- * Authorization parameters which are used in the authentication request of an OIDC auth code flow.
- *
- * See https://openid.net/specs/openid-connect-basic-1_0.html#RequestParameters.
- */
-
-/**
- * @experimental
- * Generate the scope used in authorization request with OIDC OP
- * @returns scope
- */
-export const generateScope = deviceId => {
-  const safeDeviceId = deviceId ?? secureRandomString(10);
-  return `openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:${safeDeviceId}`;
-};
-
-// https://www.rfc-editor.org/rfc/rfc7636
-const generateCodeChallenge = async codeVerifier => {
-  if (!globalThis.crypto.subtle) {
-    // @TODO(kerrya) should this be allowed? configurable?
-    logger.warn("A secure context is required to generate code challenge. Using plain text code challenge");
-    return codeVerifier;
-  }
-  const hashBuffer = await sha256(codeVerifier);
-  return encodeUnpaddedBase64Url(hashBuffer);
-};
-
-/**
- * Generate authorization params to pass to {@link generateAuthorizationUrl}.
- *
- * Used as part of an authorization code OIDC flow: see https://openid.net/specs/openid-connect-basic-1_0.html#CodeFlow.
- *
- * @param redirectUri - absolute url for OP to redirect to after authorization
- * @returns AuthorizationParams
- */
-export const generateAuthorizationParams = ({
-  redirectUri
-}) => ({
-  scope: generateScope(),
-  redirectUri,
-  state: secureRandomString(8),
-  nonce: secureRandomString(8),
-  codeVerifier: secureRandomString(64) // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters
-});
-
-/**
- * @deprecated use generateOidcAuthorizationUrl
- * Generate a URL to attempt authorization with the OP
- * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
- * @param authorizationUrl - endpoint to attempt authorization with the OP
- * @param clientId - id of this client as registered with the OP
- * @param authorizationParams - params to be used in the url
- * @returns a Promise with the url as a string
- */
-export const generateAuthorizationUrl = async (authorizationUrl, clientId, {
-  scope,
-  redirectUri,
-  state,
-  nonce,
-  codeVerifier
-}) => {
-  const url = new URL(authorizationUrl);
-  url.searchParams.append("response_mode", "query");
-  url.searchParams.append("response_type", "code");
-  url.searchParams.append("redirect_uri", redirectUri);
-  url.searchParams.append("client_id", clientId);
-  url.searchParams.append("state", state);
-  url.searchParams.append("scope", scope);
-  url.searchParams.append("nonce", nonce);
-  url.searchParams.append("code_challenge_method", "S256");
-  url.searchParams.append("code_challenge", await generateCodeChallenge(codeVerifier));
-  return url.toString();
-};
-
-/**
- * @experimental
- * Generate a URL to attempt authorization with the OP
- * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
- * @param metadata - validated metadata from OP discovery
- * @param clientId - this client's id as registered with the OP
- * @param homeserverUrl - used to establish the session on return from the OP
- * @param identityServerUrl - used to establish the session on return from the OP
- * @param nonce - state
- * @param prompt - indicates to the OP which flow the user should see - eg login or registration
- *          See https://openid.net/specs/openid-connect-prompt-create-1_0.html#name-prompt-parameter
- * @param urlState - value to append to the opaque state identifier to uniquely identify the callback
- * @param loginHint - value to send as the `login_hint` to the OP, giving a hint about the login identifier the user might use to log in.
- *          See {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest OIDC core 3.1.2.1}.
- * @param responseMode - value to send as the `response_mode` to the OP, selecting how auth is passed back during redirect.
- *          See {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest OIDC core 3.1.2.1}.
- * @returns a Promise with the url as a string
- */
-export const generateOidcAuthorizationUrl = async ({
-  metadata,
-  redirectUri,
-  clientId,
-  homeserverUrl,
-  identityServerUrl,
-  nonce,
-  prompt,
-  urlState,
-  loginHint,
-  responseMode = "query"
-}) => {
-  const scope = generateScope();
-  const oidcClient = new OidcClient(_objectSpread(_objectSpread({}, metadata), {}, {
-    client_id: clientId,
-    redirect_uri: redirectUri,
-    authority: metadata.issuer,
-    response_mode: responseMode,
-    response_type: "code",
-    scope,
-    stateStore: new WebStorageStateStore({
-      prefix: "mx_oidc_",
-      store: window.sessionStorage
-    })
-  }));
-  const userState = {
-    homeserverUrl,
-    nonce,
-    identityServerUrl
-  };
-  const request = await oidcClient.createSigninRequest({
-    state: userState,
-    nonce,
-    prompt,
-    url_state: urlState,
-    login_hint: loginHint
-  });
-  return request.url;
-};
-
-/**
- * Normalize token_type to use capital case to make consuming the token response easier
- * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: "bearer"
- * Later, when used in auth headers it is case sensitive and must be Bearer
- * See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
- *
- * @param response - validated token response
- * @returns response with token_type set to 'Bearer'
- */
-const normalizeBearerTokenResponseTokenType = response => ({
-  id_token: response.id_token,
-  scope: response.scope,
-  expires_at: response.expires_at,
-  refresh_token: response.refresh_token,
-  access_token: response.access_token,
-  token_type: "Bearer"
-});
-
-/**
- * @experimental
- * Attempt to exchange authorization code for bearer token.
- *
- * Takes the authorization code returned by the OpenID Provider via the authorization URL, and makes a
- * request to the Token Endpoint, to obtain the access token, refresh token, etc.
- *
- * @param code - authorization code as returned by OP during authorization
- * @param state - authorization state param as returned by OP during authorization
- * @param responseMode - the response mode used for authentication
- * @returns valid bearer token response
- * @throws An `Error` with `message` set to an entry in {@link OidcError},
- *      when the request fails, or the returned token response is invalid.
- */
-export const completeAuthorizationCodeGrant = async (code, state, responseMode = "query") => {
-  /**
-   * Element Web strips and changes the url on starting the app
-   * Use the code and state from query params to rebuild a url
-   * so that oidc-client can parse it
-   */
-  const reconstructedUrl = new URL(window.location.origin);
-  const params = new URLSearchParams({
-    code,
-    state
-  });
-  if (responseMode === "query") {
-    reconstructedUrl.search = params.toString();
-  } else {
-    reconstructedUrl.hash = `#${params.toString()}`;
-  }
-
-  // set oidc-client to use our logger
-  Log.setLogger(logger);
-  try {
-    const response = new SigninResponse(params);
-    const stateStore = new WebStorageStateStore({
-      prefix: "mx_oidc_",
-      store: window.sessionStorage
-    });
-
-    // retrieve the state we put in storage at the start of oidc auth flow
-    const stateString = await stateStore.get(response.state);
-    if (!stateString) {
-      throw new Error(OidcError.MissingOrInvalidStoredState);
-    }
-
-    // hydrate the sign in state and create a client
-    // the stored sign in state includes oidc configuration we set at the start of the oidc login flow
-    const signInState = await SigninState.fromStorageString(stateString);
-    const client = new OidcClient(_objectSpread(_objectSpread({}, signInState), {}, {
-      stateStore
-    }));
-
-    // validate the code and state, and attempt to swap the code for tokens
-    const signinResponse = await client.processSigninResponse(reconstructedUrl.href);
-
-    // extra values we stored at the start of the login flow
-    // used to complete login in the client
-    const userState = signinResponse.userState;
-    validateStoredUserState(userState);
-
-    // throws when response is invalid
-    validateBearerTokenResponse(signinResponse);
-    if (signinResponse.id_token) {
-      // The token is not yet in the Matrix spec so consider it optional
-      // throws when token is invalid
-      validateIdToken(signinResponse.id_token, client.settings.authority, client.settings.client_id, userState.nonce);
-    }
-    const normalizedTokenResponse = normalizeBearerTokenResponseTokenType(signinResponse);
-    return {
-      oidcClientSettings: {
-        clientId: client.settings.client_id,
-        issuer: client.settings.authority
-      },
-      tokenResponse: normalizedTokenResponse,
-      homeserverUrl: userState.homeserverUrl,
-      identityServerUrl: userState.identityServerUrl,
-      idTokenClaims: signinResponse.profile
-    };
-  } catch (error) {
-    logger.error("Oidc login failed", error);
-    const errorType = error.message;
-
-    // rethrow errors that we recognise
-    if (Object.values(OidcError).includes(errorType)) {
-      throw error;
-    }
-    throw new Error(OidcError.CodeExchangeFailed);
-  }
-};
-
-/**
- * Response from the OIDC token endpoint when exchanging a token for grant_type device_code.
- */
-
-/**
- * Error from the OIDC token endpoint when exchanging a token for grant_type device_code.
- */
-
-/**
- * Response from the OIDC device authorization endpoint.
- */
-
-/**
- * Begin OIDC device authorization flow.
- * @param options - The device authorization parameters.
- * @param options.clientId - the client ID returned from client registration.
- * @param options.scope - the scope to request for authorization.
- * @param options.metadata - the validated OIDC metadata for the Identity Provider.
- * @returns a promise that resolves to a device access token response,
- *   or an error response if the user denies authorization or the device code expires.
- */
-export const startDeviceAuthorization = async ({
-  clientId,
-  scope,
-  metadata
-}) => {
-  const body = new URLSearchParams({
-    client_id: clientId,
-    scope: scope
-  }).toString();
-  const url = metadata.device_authorization_endpoint;
-  if (!url) {
-    throw new Error("No device_authorization_endpoint given");
-  }
-  const response = await fetch(url, {
-    method: Method.Post,
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body
-  });
-  return await response.json();
-};
-
-/**
- * Polls the OIDC token endpoint until we get a device access token response, or encounter an unrecoverable error.
- * @param options - The device authorization parameters.
- * @param options.session - The session returned from a previous call to {@link startDeviceAuthorization}.
- * @param options.metadata - The validated OIDC metadata for the Identity Provider.
- * @param options.clientId - The client ID returned from client registration.
- * @returns a promise that resolves to a device access token response,
- *   or an error response if the user denies authorization or the device code expires.
- */
-export const waitForDeviceAuthorization = async ({
-  session,
-  metadata,
-  clientId
-}) => {
-  let interval = (session.interval ?? 5) * 1000; // poll interval
-  const expiration = Date.now() + session.expires_in * 1000;
-  do {
-    const body = new URLSearchParams({
-      device_code: session.device_code,
-      grant_type: OAuthGrantType.DeviceAuthorization,
-      client_id: clientId
-    }).toString();
-    const response = await fetch(metadata.token_endpoint, {
-      method: Method.Post,
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body
-    });
-    if (response.ok) {
-      return await response.json();
-    }
-    const errorResponse = await response.json();
-    switch (errorResponse.error) {
-      case "authorization_pending":
-        break;
-      case "slow_down":
-        interval += 5000;
-        break;
-      case "access_denied":
-      case "expired_token":
-        return errorResponse;
-    }
-    await sleep(interval);
-  } while (Date.now() < expiration);
-  return {
-    error: "expired"
-  };
-};
-//# sourceMappingURL=authorize.js.map