matrix-js-sdk 42.2.0 → 42.3.0

package/lib/oauth/error.d.ts

@@ -1,3 +1,4 @@
+import { HTTPError } from "../http-api/errors.ts";
 /**
  * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
  * Not intended to be displayed directly to the user.
@@ -16,4 +17,47 @@ export declare enum OAuth2Error {
     RevokeTokenFailed = "Failed to revoke token",
     DeviceAuthorizationGrantFailed = "Failed to perform device authorization grant"
 }
+/**
+ * An error response from an OAuth 2.0 endpoint,
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+export interface OAuth2ErrorResponse {
+    /** A single ASCII error code, e.g. `invalid_grant`. */
+    error: string;
+    /** Human-readable ASCII text providing additional information about the error. */
+    error_description?: string;
+    /** A URI identifying a human-readable web page with information about the error. */
+    error_uri?: string;
+}
+/**
+ * Check whether the given (JSON-parsed) response body is an OAuth 2.0 error response
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ * @param response - the parsed response body to check
+ * @returns whether the response is a valid {@link OAuth2ErrorResponse}
+ */
+export declare function isOAuth2ErrorResponse(response: unknown): response is OAuth2ErrorResponse;
+/**
+ * An error thrown when a request to an OAuth 2.0 endpoint fails with a body matching the error
+ * response format specified in [RFC 6749 section 5.2](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2).
+ */
+export declare class OAuth2HTTPError extends HTTPError implements OAuth2ErrorResponse {
+    /**
+     * RFC 6749 section 5.2 error code, e.g. `invalid_grant`
+     *
+     * IANA matains a registry of valid values at
+     * https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error
+     */
+    error: string;
+    /**
+     * RFC 6749 section 5.2 human-readable ASCII text providing additional information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    error_description?: string;
+    /**
+     * RFC 6749 section 5.2 URI identifying a human-readable web page with information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    error_uri?: string;
+    constructor(msg: string, httpStatus: number | undefined, httpHeaders: Headers | undefined, { error, error_description, error_uri }: OAuth2ErrorResponse);
+}
 //# sourceMappingURL=error.d.ts.map

package/lib/oauth/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/oauth/error.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,oBAAY,WAAW;IACnB,OAAO,+CAA+C;IACtD,SAAS,6DAA6D;IACtE,+BAA+B,uCAAuC;IACtE,yBAAyB,gCAAgC;IACzD,0BAA0B,0CAA0C;IACpE,kBAAkB,sCAAsC;IACxD,0BAA0B,kCAAkC;IAC5D,kCAAkC,0CAA0C;IAC5E,2BAA2B,iEAAiE;IAC5F,kBAAkB,4BAA4B;IAC9C,iBAAiB,2BAA2B;IAC5C,8BAA8B,iDAAiD;CAClF"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/oauth/error.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;GAGG;AACH,oBAAY,WAAW;IACnB,OAAO,+CAA+C;IACtD,SAAS,6DAA6D;IACtE,+BAA+B,uCAAuC;IACtE,yBAAyB,gCAAgC;IACzD,0BAA0B,0CAA0C;IACpE,kBAAkB,sCAAsC;IACxD,0BAA0B,kCAAkC;IAC5D,kCAAkC,0CAA0C;IAC5E,2BAA2B,iEAAiE;IAC5F,kBAAkB,4BAA4B;IAC9C,iBAAiB,2BAA2B;IAC5C,8BAA8B,iDAAiD;CAClF;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAChC,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,IAAI,mBAAmB,CAOxF;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,SAAU,YAAW,mBAAmB;IACzE;;;;;OAKG;IACI,KAAK,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACI,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAElC;;;OAGG;IACI,SAAS,CAAC,EAAE,MAAM,CAAC;IAE1B,YACI,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,OAAO,GAAG,SAAS,EAChC,EAAE,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,mBAAmB,EAM/D;CACJ"}

package/lib/oauth/error.js

@@ -1,3 +1,4 @@
+import _defineProperty from "@babel/runtime/helpers/defineProperty";
 /*
 Copyright 2023 The Matrix.org Foundation C.I.C.
 
@@ -14,6 +15,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { hasOptionalStringProperty, hasRequiredStringProperty, isRecord } from "../@types/type-guards.js";
+import { HTTPError } from "../http-api/errors.js";
+
 /**
  * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
  * Not intended to be displayed directly to the user.
@@ -33,4 +37,53 @@ export let OAuth2Error = /*#__PURE__*/function (OAuth2Error) {
   OAuth2Error["DeviceAuthorizationGrantFailed"] = "Failed to perform device authorization grant";
   return OAuth2Error;
 }({});
+
+/**
+ * An error response from an OAuth 2.0 endpoint,
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+
+/**
+ * Check whether the given (JSON-parsed) response body is an OAuth 2.0 error response
+ * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ * @param response - the parsed response body to check
+ * @returns whether the response is a valid {@link OAuth2ErrorResponse}
+ */
+export function isOAuth2ErrorResponse(response) {
+  return isRecord(response) && hasRequiredStringProperty(response, "error") && hasOptionalStringProperty(response, "error_description") && hasOptionalStringProperty(response, "error_uri");
+}
+
+/**
+ * An error thrown when a request to an OAuth 2.0 endpoint fails with a body matching the error
+ * response format specified in [RFC 6749 section 5.2](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2).
+ */
+export class OAuth2HTTPError extends HTTPError {
+  constructor(msg, httpStatus, httpHeaders, {
+    error,
+    error_description,
+    error_uri
+  }) {
+    super(msg, httpStatus, httpHeaders);
+    /**
+     * RFC 6749 section 5.2 error code, e.g. `invalid_grant`
+     *
+     * IANA matains a registry of valid values at
+     * https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error
+     */
+    _defineProperty(this, "error", void 0);
+    /**
+     * RFC 6749 section 5.2 human-readable ASCII text providing additional information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    _defineProperty(this, "error_description", void 0);
+    /**
+     * RFC 6749 section 5.2 URI identifying a human-readable web page with information about the error.
+     * This field is optional and may be omitted by the endpoint.
+     */
+    _defineProperty(this, "error_uri", void 0);
+    this.error = error;
+    this.error_description = error_description;
+    this.error_uri = error_uri;
+  }
+}
 //# sourceMappingURL=error.js.map

package/lib/oauth/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","names":[],"sources":["../../src/oauth/error.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.\n * Not intended to be displayed directly to the user.\n */\nexport enum OAuth2Error {\n    General = \"Something went wrong with OAuth2 discovery\",\n    OpSupport = \"Configured OAuth2 OP does not support required functions\",\n    DynamicRegistrationNotSupported = \"Dynamic registration not supported\",\n    DynamicRegistrationFailed = \"Dynamic registration failed\",\n    DynamicRegistrationInvalid = \"Dynamic registration invalid response\",\n    CodeExchangeFailed = \"Failed to exchange code for token\",\n    InvalidBearerTokenResponse = \"Invalid bearer token response\",\n    InvalidDeviceAuthorizationResponse = \"Invalid device authorization response\",\n    MissingOrInvalidStoredState = \"State required to finish logging in is not found in storage.\",\n    RefreshTokenFailed = \"Failed to refresh token\",\n    RevokeTokenFailed = \"Failed to revoke token\",\n    DeviceAuthorizationGrantFailed = \"Failed to perform device authorization grant\",\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA,WAAY,WAAW,0BAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAA,OAAX,WAAW;AAAA","ignoreList":[]}
+{"version":3,"file":"error.js","names":[],"sources":["../../src/oauth/error.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { hasOptionalStringProperty, hasRequiredStringProperty, isRecord } from \"../@types/type-guards.ts\";\nimport { HTTPError } from \"../http-api/errors.ts\";\n\n/**\n * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.\n * Not intended to be displayed directly to the user.\n */\nexport enum OAuth2Error {\n    General = \"Something went wrong with OAuth2 discovery\",\n    OpSupport = \"Configured OAuth2 OP does not support required functions\",\n    DynamicRegistrationNotSupported = \"Dynamic registration not supported\",\n    DynamicRegistrationFailed = \"Dynamic registration failed\",\n    DynamicRegistrationInvalid = \"Dynamic registration invalid response\",\n    CodeExchangeFailed = \"Failed to exchange code for token\",\n    InvalidBearerTokenResponse = \"Invalid bearer token response\",\n    InvalidDeviceAuthorizationResponse = \"Invalid device authorization response\",\n    MissingOrInvalidStoredState = \"State required to finish logging in is not found in storage.\",\n    RefreshTokenFailed = \"Failed to refresh token\",\n    RevokeTokenFailed = \"Failed to revoke token\",\n    DeviceAuthorizationGrantFailed = \"Failed to perform device authorization grant\",\n}\n\n/**\n * An error response from an OAuth 2.0 endpoint,\n * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2\n */\nexport interface OAuth2ErrorResponse {\n    /** A single ASCII error code, e.g. `invalid_grant`. */\n    error: string;\n    /** Human-readable ASCII text providing additional information about the error. */\n    error_description?: string;\n    /** A URI identifying a human-readable web page with information about the error. */\n    error_uri?: string;\n}\n\n/**\n * Check whether the given (JSON-parsed) response body is an OAuth 2.0 error response\n * as specified in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2\n * @param response - the parsed response body to check\n * @returns whether the response is a valid {@link OAuth2ErrorResponse}\n */\nexport function isOAuth2ErrorResponse(response: unknown): response is OAuth2ErrorResponse {\n    return (\n        isRecord(response) &&\n        hasRequiredStringProperty(response, \"error\") &&\n        hasOptionalStringProperty(response, \"error_description\") &&\n        hasOptionalStringProperty(response, \"error_uri\")\n    );\n}\n\n/**\n * An error thrown when a request to an OAuth 2.0 endpoint fails with a body matching the error\n * response format specified in [RFC 6749 section 5.2](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2).\n */\nexport class OAuth2HTTPError extends HTTPError implements OAuth2ErrorResponse {\n    /**\n     * RFC 6749 section 5.2 error code, e.g. `invalid_grant`\n     *\n     * IANA matains a registry of valid values at\n     * https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error\n     */\n    public error: string;\n\n    /**\n     * RFC 6749 section 5.2 human-readable ASCII text providing additional information about the error.\n     * This field is optional and may be omitted by the endpoint.\n     */\n    public error_description?: string;\n\n    /**\n     * RFC 6749 section 5.2 URI identifying a human-readable web page with information about the error.\n     * This field is optional and may be omitted by the endpoint.\n     */\n    public error_uri?: string;\n\n    public constructor(\n        msg: string,\n        httpStatus: number | undefined,\n        httpHeaders: Headers | undefined,\n        { error, error_description, error_uri }: OAuth2ErrorResponse,\n    ) {\n        super(msg, httpStatus, httpHeaders);\n        this.error = error;\n        this.error_description = error_description;\n        this.error_uri = error_uri;\n    }\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAS,yBAAyB,EAAE,yBAAyB,EAAE,QAAQ,QAAQ,0BAA0B;AACzG,SAAS,SAAS,QAAQ,uBAAuB;;AAEjD;AACA;AACA;AACA;AACA,WAAY,WAAW,0BAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAA,OAAX,WAAW;AAAA;;AAevB;AACA;AACA;AACA;;AAUA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAAS,qBAAqB,CAAC,QAAiB,EAAmC;EACtF,OACI,QAAQ,CAAC,QAAQ,CAAC,IAClB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAC5C,yBAAyB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,IACxD,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC;AAExD;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAM,eAAe,SAAS,SAAS,CAAgC;EAqBnE,WAAW,CACd,GAAW,EACX,UAA8B,EAC9B,WAAgC,EAChC;IAAE,KAAK;IAAE,iBAAiB;IAAE;EAA+B,CAAC,EAC9D;IACE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC;IA1BvC;AACJ;AACA;AACA;AACA;AACA;IALI;IAQA;AACJ;AACA;AACA;IAHI;IAMA;AACJ;AACA;AACA;IAHI;IAaI,IAAI,CAAC,KAAK,GAAG,KAAK;IAClB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB;IAC1C,IAAI,CAAC,SAAS,GAAG,SAAS;EAC9B;AACJ","ignoreList":[]}

package/lib/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAMnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAEH,KAAK,wBAAwB,EAGhC,MAAM,eAAe,CAAC;AASvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAE9B;;GAEG;AACH,KAAK,OAAO,GAAG;IACX,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,MAAM;aA0EK,QAAQ,EAAE,qBAAqB;IAzEnD;;;;;;;;OAQG;IACH,OAAoB,cAAc,CAC9B,YAAY,EAAE,qBAAqB,EACnC,cAAc,EAAE,wBAAwB,GACzC,OAAO,CAAC,MAAM,CAAC,CAwDjB;IAED,SAAgB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3C,YACoB,QAAQ,EAAE,qBAAqB,EAC/C,OAAO,EAAE,OAAO,EAQnB;IAED;;;;;;;;;;OAUG;IACU,iCAAiC,CAC1C,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,UAAU,GAAG,OAAoB,EAC/C,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAkBjB;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAatF;IAED;;;OAGG;IACU,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWxF;IAED;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9F;IAED;;;;;OAKG;IACU,6BAA6B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAM/F;IAED;;;;;OAKG;IACU,+BAA+B,CACxC,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,yBAAyB,GAAG,sBAAsB,CAAC,CAM7D;YAEa,KAAK;CAqBtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAMnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAEH,KAAK,wBAAwB,EAGhC,MAAM,eAAe,CAAC;AASvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAE9B;;GAEG;AACH,KAAK,OAAO,GAAG;IACX,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,MAAM;aA0EK,QAAQ,EAAE,qBAAqB;IAzEnD;;;;;;;;OAQG;IACH,OAAoB,cAAc,CAC9B,YAAY,EAAE,qBAAqB,EACnC,cAAc,EAAE,wBAAwB,GACzC,OAAO,CAAC,MAAM,CAAC,CAwDjB;IAED,SAAgB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3C,YACoB,QAAQ,EAAE,qBAAqB,EAC/C,OAAO,EAAE,OAAO,EAQnB;IAED;;;;;;;;;;OAUG;IACU,iCAAiC,CAC1C,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,UAAU,GAAG,OAAoB,EAC/C,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAkBjB;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAatF;IAED;;;OAGG;IACU,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWxF;IAED;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9F;IAED;;;;;OAKG;IACU,6BAA6B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAM/F;IAED;;;;;OAKG;IACU,+BAA+B,CACxC,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,yBAAyB,GAAG,sBAAsB,CAAC,CAM7D;YAEa,KAAK;CAsCtB"}

package/lib/oauth/index.js

@@ -20,9 +20,9 @@ import { generateScope, normalizeBearerTokenResponseTokenType, startDeviceAuthor
 import { OAuthGrantType, urlHasCommonBase, validateRegistrationResponse } from "./register.js";
 import { encodeUnpaddedBase64Url } from "../base64.js";
 import { sha256 } from "../digest.js";
-import { HTTPError, Method } from "../http-api/index.js";
+import { HTTPError, isMatrixErrorResponse, MatrixError, Method } from "../http-api/index.js";
 import { logger } from "../logger.js";
-import { OAuth2Error } from "./error.js";
+import { isOAuth2ErrorResponse, OAuth2Error, OAuth2HTTPError } from "./error.js";
 import { secureRandomString } from "../randomstring.js";
 export * from "./authorize.js";
 export * from "./error.js";
@@ -228,6 +228,23 @@ export class OAuth2 {
       body: params
     });
     if (res.status >= 400) {
+      let body;
+      try {
+        body = await res.json();
+      } catch {
+        // The endpoint didn't give us a JSON body, so we can't determine the error type. We'll throw a generic
+        // HTTPError below.
+      }
+      // Because the Matrix C-S API error response format is so similar to the OAuth 2.0 error response format
+      // the ordering of these checks is important. We want to check for a Matrix error response first, and only
+      // if it isn't one do we check for an OAuth 2.0 error response.
+      // This essentially relies on `errcode` not being present in an OAuth 2.0 error response.
+      if (isMatrixErrorResponse(body)) {
+        throw new MatrixError(body, res.status, undefined, undefined, res.headers);
+      }
+      if (isOAuth2ErrorResponse(body)) {
+        throw new OAuth2HTTPError(error, res.status, res.headers, body);
+      }
       throw new HTTPError(error, res.status, res.headers);
     }
     return await res.json();

package/lib/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/oauth/index.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport {\n    type BearerTokenResponse,\n    type DeviceAccessTokenError,\n    type DeviceAccessTokenResponse,\n    type DeviceAuthorizationResponse,\n    generateScope,\n    normalizeBearerTokenResponseTokenType,\n    startDeviceAuthorization,\n    validateBearerTokenResponse,\n    waitForDeviceAuthorization,\n} from \"./authorize.ts\";\nimport type { ValidatedAuthMetadata } from \"./discover.ts\";\nimport {\n    OAuthGrantType,\n    type OAuthRegistrationRequest,\n    urlHasCommonBase,\n    validateRegistrationResponse,\n} from \"./register.ts\";\nimport { encodeUnpaddedBase64Url } from \"../base64.ts\";\nimport { sha256 } from \"../digest.ts\";\nimport { HTTPError, Method } from \"../http-api/index.ts\";\nimport { logger } from \"../logger.ts\";\nimport { OAuth2Error } from \"./error.ts\";\nimport { secureRandomString } from \"../randomstring.ts\";\nimport { type NonEmptyArray } from \"../@types/common.ts\";\n\nexport * from \"./authorize.ts\";\nexport * from \"./error.ts\";\nexport * from \"./register.ts\";\nexport * from \"./tokenRefresher.ts\";\nexport * from \"./discover.ts\";\n\n/**\n * Type representing the persistent context needed for typical OAuth flows\n */\ntype Context = {\n    /** The OAuth client ID */\n    clientId: string;\n    /** The desired device ID */\n    deviceId?: string;\n    /** The seed used to generate the challenge code */\n    codeVerifier?: string;\n    /** The URI to redirect the user to with credentials after auth */\n    redirectUri: string;\n};\n\nexport class OAuth2 {\n    /**\n     * Attempts dynamic registration against the configured registration endpoint.\n     * Will ignore any URIs that do not use client_uri as a common base as per the spec.\n     * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}\n     * @param clientMetadata - The metadata for the client which to register,\n     *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.\n     * @returns Promise<string> resolved with registered clientId\n     * @throws when registration is not supported, on failed request or invalid response\n     */\n    public static async registerClient(\n        authMetadata: ValidatedAuthMetadata,\n        clientMetadata: OAuthRegistrationRequest,\n    ): Promise<string> {\n        const defaultGrantTypes: NonEmptyArray<string> = [\n            OAuthGrantType.AuthorizationCode,\n            OAuthGrantType.RefreshToken,\n        ];\n        // ask for device authorization grant if supported\n        if (authMetadata.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {\n            defaultGrantTypes.push(OAuthGrantType.DeviceAuthorization);\n        }\n\n        const grantTypes = clientMetadata.grant_types ?? defaultGrantTypes;\n        if (grantTypes.some((scope) => !authMetadata.grant_types_supported.includes(scope))) {\n            throw new Error(OAuth2Error.DynamicRegistrationNotSupported);\n        }\n\n        const commonBase = new URL(clientMetadata.client_uri);\n\n        const request: OAuthRegistrationRequest = {\n            // Apply some defaults\n            response_types: [\"code\"],\n            token_endpoint_auth_method: \"none\",\n            ...clientMetadata,\n            grant_types: grantTypes,\n            logo_uri: urlHasCommonBase(commonBase, clientMetadata.logo_uri) ? clientMetadata.logo_uri : undefined,\n            policy_uri: urlHasCommonBase(commonBase, clientMetadata.policy_uri) ? clientMetadata.policy_uri : undefined,\n            tos_uri: urlHasCommonBase(commonBase, clientMetadata.tos_uri) ? clientMetadata.tos_uri : undefined,\n        };\n\n        try {\n            const response = await fetch(authMetadata.registration_endpoint, {\n                method: Method.Post,\n                headers: {\n                    \"Accept\": \"application/json\",\n                    \"Content-Type\": \"application/json\",\n                },\n                body: JSON.stringify(request),\n            });\n\n            if (response.status >= 400) {\n                throw new Error(OAuth2Error.DynamicRegistrationFailed);\n            }\n\n            const registrationResponse = await response.json();\n            if (validateRegistrationResponse(registrationResponse)) {\n                return registrationResponse.client_id;\n            }\n\n            throw new Error(OAuth2Error.DynamicRegistrationInvalid);\n        } catch (error) {\n            if (Object.values(OAuth2Error).includes((error as Error).message as OAuth2Error)) {\n                throw error;\n            } else {\n                logger.error(\"Dynamic registration request failed\", error);\n                throw new Error(OAuth2Error.DynamicRegistrationFailed, { cause: error });\n            }\n        }\n    }\n\n    public readonly context: Required<Context>;\n\n    public constructor(\n        public readonly metadata: ValidatedAuthMetadata,\n        context: Context,\n    ) {\n        this.context = {\n            clientId: context.clientId,\n            redirectUri: context.redirectUri,\n            deviceId: context.deviceId ?? secureRandomString(10),\n            codeVerifier: context.codeVerifier ?? secureRandomString(96),\n        };\n    }\n\n    /**\n     * Generate a URL to attempt authorization with the OP\n     * See https://spec.matrix.org/v1.18/client-server-api/#authorization-code-flow\n     * @param state - A unique opaque identifier, like a transaction ID,\n     *     that will allow the client to maintain state between the authorization request and the callback.\n     *     The app should use this to key the storage for where the rest of the auth context is saved.\n     * @param responseMode - The manner in which the IdP should send the secrets back to the app. Defaults to `fragment` for privacy.\n     * @param prompt - Optional prompt parameter to pass to the IdP to signal intent, e.g. `create` for User registration.\n     * @param scope - The OAuth2 scope to request, will be generated based on the device ID if omitted.\n     * @returns a Promise with the url as a string\n     */\n    public async generateAuthorizationCodeGrantUrl(\n        state: string,\n        responseMode: \"fragment\" | \"query\" = \"fragment\",\n        prompt?: string,\n        scope?: string,\n    ): Promise<string> {\n        const challenge = encodeUnpaddedBase64Url(await sha256(this.context.codeVerifier));\n\n        const url = new URL(this.metadata.authorization_endpoint);\n        url.searchParams.set(\"response_type\", \"code\");\n        url.searchParams.set(\"response_mode\", responseMode);\n        url.searchParams.set(\"client_id\", this.context.clientId);\n        url.searchParams.set(\"redirect_uri\", this.context.redirectUri);\n        url.searchParams.set(\"scope\", scope ?? generateScope(this.context.deviceId));\n        url.searchParams.set(\"state\", state);\n        url.searchParams.set(\"code_challenge_method\", \"S256\");\n        url.searchParams.set(\"code_challenge\", challenge);\n\n        if (prompt) {\n            url.searchParams.set(\"prompt\", prompt);\n        }\n\n        return url.toString();\n    }\n\n    /**\n     * Attempt to exchange authorization code for bearer token.\n     *\n     * Takes the authorization code returned by the OAuth2 Provider via the authorization URL, and makes a\n     * request to the Token Endpoint, to obtain the access token, refresh token, etc.\n     *\n     * @param code - authorization code as returned by IdP during authorization\n     * @returns a validated bearer token response\n     * @throws An `Error` with `message` set to an entry in {@link OAuth2Error},\n     *      when the request fails, or the returned token response is invalid.\n     */\n    public async completeAuthorizationCodeGrant(code: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"authorization_code\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"code_verifier\", this.context.codeVerifier);\n        params.append(\"redirect_uri\", this.context.redirectUri);\n        params.append(\"code\", code);\n\n        const tokenResponse = await this.fetch(\"token\", params, OAuth2Error.CodeExchangeFailed);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Refresh the access token using the given refresh token and the refresh token grant\n     * @param refreshToken - the token to use to refresh the access token\n     */\n    public async performRefreshTokenGrant(refreshToken: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"refresh_token\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"refresh_token\", refreshToken);\n\n        const tokenResponse = await this.fetch(\"token\", params, OAuth2Error.RefreshTokenFailed);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Revokes the given token\n     * @param token - the token to remove\n     * @param type - the type of token, acts as a hint to the IdP\n     */\n    public async revokeToken(token: string, type?: \"access_token\" | \"refresh_token\"): Promise<void> {\n        const params = new URLSearchParams();\n        params.append(\"token\", token);\n        params.append(\"client_id\", this.context.clientId);\n        if (type) {\n            params.append(\"token_type_hint\", type);\n        }\n\n        await this.fetch(\"revocation\", params, OAuth2Error.RevokeTokenFailed);\n\n        const headers = new Headers();\n        headers.set(\"Content-Type\", \"application/x-www-form-urlencoded\");\n    }\n\n    /**\n     * Begin OAuth2 device authorization flow.\n     * @param scope - the scope to request for authorization.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async startDeviceAuthorizationGrant(scope?: string): Promise<DeviceAuthorizationResponse> {\n        return startDeviceAuthorization({\n            scope: scope ?? generateScope(this.context.deviceId),\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n        });\n    }\n\n    /**\n     * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.\n     * @param session - The session returned from a previous call to {@link OAuth2.startDeviceAuthorizationGrant}.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async waitForDeviceAuthorizationGrant(\n        session: DeviceAuthorizationResponse,\n    ): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError> {\n        return waitForDeviceAuthorization({\n            session,\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n        });\n    }\n\n    private async fetch(\n        target: \"token\" | \"registration\" | \"revocation\",\n        params: URLSearchParams,\n        error: OAuth2Error,\n    ): Promise<unknown> {\n        const url = this.metadata[`${target}_endpoint`];\n        const res = await fetch(url, {\n            method: Method.Post,\n            headers: {\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n                \"Accept\": \"application/json\",\n            },\n            body: params,\n        });\n\n        if (res.status >= 400) {\n            throw new HTTPError(error, res.status, res.headers);\n        }\n\n        return await res.json();\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAKI,aAAa,EACb,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,QACvB,gBAAgB;AAEvB,SACI,cAAc,EAEd,gBAAgB,EAChB,4BAA4B,QACzB,eAAe;AACtB,SAAS,uBAAuB,QAAQ,cAAc;AACtD,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,SAAS,EAAE,MAAM,QAAQ,sBAAsB;AACxD,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,WAAW,QAAQ,YAAY;AACxC,SAAS,kBAAkB,QAAQ,oBAAoB;AAGvD,cAAc,gBAAgB;AAC9B,cAAc,YAAY;AAC1B,cAAc,eAAe;AAC7B,cAAc,qBAAqB;AACnC,cAAc,eAAe;;AAE7B;AACA;AACA;;AAYA,OAAO,MAAM,MAAM,CAAC;EAChB;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,aAAoB,cAAc,CAC9B,YAAmC,EACnC,cAAwC,EACzB;IACf,MAAM,iBAAwC,GAAG,CAC7C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,YAAY,CAC9B;IACD;IACA,IAAI,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;MACjF,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC;IAC9D;IAEA,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,IAAI,iBAAiB;IAClE,IAAI,UAAU,CAAC,IAAI,CAAE,KAAK,IAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;MACjF,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,+BAA+B,CAAC;IAChE;IAEA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAErD,MAAM,OAAiC;MACnC;MACA,cAAc,EAAE,CAAC,MAAM,CAAC;MACxB,0BAA0B,EAAE;IAAM,GAC/B,cAAc;MACjB,WAAW,EAAE,UAAU;MACvB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS;MACrG,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,UAAU,GAAG,SAAS;MAC3G,OAAO,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,GAAG;IAAS,EACrG;IAED,IAAI;MACA,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE;QAC7D,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,OAAO,EAAE;UACL,QAAQ,EAAE,kBAAkB;UAC5B,cAAc,EAAE;QACpB,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;MAChC,CAAC,CAAC;MAEF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,CAAC;MAC1D;MAEA,MAAM,oBAAoB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;MAClD,IAAI,4BAA4B,CAAC,oBAAoB,CAAC,EAAE;QACpD,OAAO,oBAAoB,CAAC,SAAS;MACzC;MAEA,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAAC;IAC3D,CAAC,CAAC,OAAO,KAAK,EAAE;MACZ,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAE,KAAK,CAAW,OAAsB,CAAC,EAAE;QAC9E,MAAM,KAAK;MACf,CAAC,MAAM;QACH,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,EAAE;UAAE,KAAK,EAAE;QAAM,CAAC,CAAC;MAC5E;IACJ;EACJ;EAIO,WAAW,CACE,QAA+B,EAC/C,OAAgB,EAClB;IAAA;IAAA,KAFkB,QAA+B,GAA/B,QAA+B;IAG/C,IAAI,CAAC,OAAO,GAAG;MACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;MAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;MAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;MACpD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAC,EAAE;IAC/D,CAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,iCAAiC,CAC1C,KAAa,EACb,YAAkC,GAAG,UAAU,EAC/C,MAAe,EACf,KAAc,EACC;IACf,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;IACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAEjD,IAAI,MAAM,EAAE;MACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1C;IAEA,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,8BAA8B,CAAC,IAAY,EAAgC;IACpF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IACvD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAE3B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;;IAEvF;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;EACI,MAAa,wBAAwB,CAAC,YAAoB,EAAgC;IACtF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;IAE5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;;IAEvF;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;AACA;EACI,MAAa,WAAW,CAAC,KAAa,EAAE,IAAuC,EAAiB;IAC5F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,IAAI,IAAI,EAAE;MACN,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC;IAC1C;IAEA,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC;IAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,mCAAmC,CAAC;EACpE;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,6BAA6B,CAAC,KAAc,EAAwC;IAC7F,OAAO,wBAAwB,CAAC;MAC5B,KAAK,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;MACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,+BAA+B,CACxC,OAAoC,EACuB;IAC3D,OAAO,0BAA0B,CAAC;MAC9B,OAAO;MACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;EACN;EAEA,MAAc,KAAK,CACf,MAA+C,EAC/C,MAAuB,EACvB,KAAkB,EACF;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;MACzB,MAAM,EAAE,MAAM,CAAC,IAAI;MACnB,OAAO,EAAE;QACL,cAAc,EAAE,mCAAmC;QACnD,QAAQ,EAAE;MACd,CAAC;MACD,IAAI,EAAE;IACV,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE;MACnB,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;IACvD;IAEA,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;EAC3B;AACJ","ignoreList":[]}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/oauth/index.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport {\n    type BearerTokenResponse,\n    type DeviceAccessTokenError,\n    type DeviceAccessTokenResponse,\n    type DeviceAuthorizationResponse,\n    generateScope,\n    normalizeBearerTokenResponseTokenType,\n    startDeviceAuthorization,\n    validateBearerTokenResponse,\n    waitForDeviceAuthorization,\n} from \"./authorize.ts\";\nimport type { ValidatedAuthMetadata } from \"./discover.ts\";\nimport {\n    OAuthGrantType,\n    type OAuthRegistrationRequest,\n    urlHasCommonBase,\n    validateRegistrationResponse,\n} from \"./register.ts\";\nimport { encodeUnpaddedBase64Url } from \"../base64.ts\";\nimport { sha256 } from \"../digest.ts\";\nimport { HTTPError, isMatrixErrorResponse, MatrixError, Method } from \"../http-api/index.ts\";\nimport { logger } from \"../logger.ts\";\nimport { isOAuth2ErrorResponse, OAuth2Error, OAuth2HTTPError } from \"./error.ts\";\nimport { secureRandomString } from \"../randomstring.ts\";\nimport { type NonEmptyArray } from \"../@types/common.ts\";\n\nexport * from \"./authorize.ts\";\nexport * from \"./error.ts\";\nexport * from \"./register.ts\";\nexport * from \"./tokenRefresher.ts\";\nexport * from \"./discover.ts\";\n\n/**\n * Type representing the persistent context needed for typical OAuth flows\n */\ntype Context = {\n    /** The OAuth client ID */\n    clientId: string;\n    /** The desired device ID */\n    deviceId?: string;\n    /** The seed used to generate the challenge code */\n    codeVerifier?: string;\n    /** The URI to redirect the user to with credentials after auth */\n    redirectUri: string;\n};\n\nexport class OAuth2 {\n    /**\n     * Attempts dynamic registration against the configured registration endpoint.\n     * Will ignore any URIs that do not use client_uri as a common base as per the spec.\n     * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}\n     * @param clientMetadata - The metadata for the client which to register,\n     *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.\n     * @returns Promise<string> resolved with registered clientId\n     * @throws when registration is not supported, on failed request or invalid response\n     */\n    public static async registerClient(\n        authMetadata: ValidatedAuthMetadata,\n        clientMetadata: OAuthRegistrationRequest,\n    ): Promise<string> {\n        const defaultGrantTypes: NonEmptyArray<string> = [\n            OAuthGrantType.AuthorizationCode,\n            OAuthGrantType.RefreshToken,\n        ];\n        // ask for device authorization grant if supported\n        if (authMetadata.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {\n            defaultGrantTypes.push(OAuthGrantType.DeviceAuthorization);\n        }\n\n        const grantTypes = clientMetadata.grant_types ?? defaultGrantTypes;\n        if (grantTypes.some((scope) => !authMetadata.grant_types_supported.includes(scope))) {\n            throw new Error(OAuth2Error.DynamicRegistrationNotSupported);\n        }\n\n        const commonBase = new URL(clientMetadata.client_uri);\n\n        const request: OAuthRegistrationRequest = {\n            // Apply some defaults\n            response_types: [\"code\"],\n            token_endpoint_auth_method: \"none\",\n            ...clientMetadata,\n            grant_types: grantTypes,\n            logo_uri: urlHasCommonBase(commonBase, clientMetadata.logo_uri) ? clientMetadata.logo_uri : undefined,\n            policy_uri: urlHasCommonBase(commonBase, clientMetadata.policy_uri) ? clientMetadata.policy_uri : undefined,\n            tos_uri: urlHasCommonBase(commonBase, clientMetadata.tos_uri) ? clientMetadata.tos_uri : undefined,\n        };\n\n        try {\n            const response = await fetch(authMetadata.registration_endpoint, {\n                method: Method.Post,\n                headers: {\n                    \"Accept\": \"application/json\",\n                    \"Content-Type\": \"application/json\",\n                },\n                body: JSON.stringify(request),\n            });\n\n            if (response.status >= 400) {\n                throw new Error(OAuth2Error.DynamicRegistrationFailed);\n            }\n\n            const registrationResponse = await response.json();\n            if (validateRegistrationResponse(registrationResponse)) {\n                return registrationResponse.client_id;\n            }\n\n            throw new Error(OAuth2Error.DynamicRegistrationInvalid);\n        } catch (error) {\n            if (Object.values(OAuth2Error).includes((error as Error).message as OAuth2Error)) {\n                throw error;\n            } else {\n                logger.error(\"Dynamic registration request failed\", error);\n                throw new Error(OAuth2Error.DynamicRegistrationFailed, { cause: error });\n            }\n        }\n    }\n\n    public readonly context: Required<Context>;\n\n    public constructor(\n        public readonly metadata: ValidatedAuthMetadata,\n        context: Context,\n    ) {\n        this.context = {\n            clientId: context.clientId,\n            redirectUri: context.redirectUri,\n            deviceId: context.deviceId ?? secureRandomString(10),\n            codeVerifier: context.codeVerifier ?? secureRandomString(96),\n        };\n    }\n\n    /**\n     * Generate a URL to attempt authorization with the OP\n     * See https://spec.matrix.org/v1.18/client-server-api/#authorization-code-flow\n     * @param state - A unique opaque identifier, like a transaction ID,\n     *     that will allow the client to maintain state between the authorization request and the callback.\n     *     The app should use this to key the storage for where the rest of the auth context is saved.\n     * @param responseMode - The manner in which the IdP should send the secrets back to the app. Defaults to `fragment` for privacy.\n     * @param prompt - Optional prompt parameter to pass to the IdP to signal intent, e.g. `create` for User registration.\n     * @param scope - The OAuth2 scope to request, will be generated based on the device ID if omitted.\n     * @returns a Promise with the url as a string\n     */\n    public async generateAuthorizationCodeGrantUrl(\n        state: string,\n        responseMode: \"fragment\" | \"query\" = \"fragment\",\n        prompt?: string,\n        scope?: string,\n    ): Promise<string> {\n        const challenge = encodeUnpaddedBase64Url(await sha256(this.context.codeVerifier));\n\n        const url = new URL(this.metadata.authorization_endpoint);\n        url.searchParams.set(\"response_type\", \"code\");\n        url.searchParams.set(\"response_mode\", responseMode);\n        url.searchParams.set(\"client_id\", this.context.clientId);\n        url.searchParams.set(\"redirect_uri\", this.context.redirectUri);\n        url.searchParams.set(\"scope\", scope ?? generateScope(this.context.deviceId));\n        url.searchParams.set(\"state\", state);\n        url.searchParams.set(\"code_challenge_method\", \"S256\");\n        url.searchParams.set(\"code_challenge\", challenge);\n\n        if (prompt) {\n            url.searchParams.set(\"prompt\", prompt);\n        }\n\n        return url.toString();\n    }\n\n    /**\n     * Attempt to exchange authorization code for bearer token.\n     *\n     * Takes the authorization code returned by the OAuth2 Provider via the authorization URL, and makes a\n     * request to the Token Endpoint, to obtain the access token, refresh token, etc.\n     *\n     * @param code - authorization code as returned by IdP during authorization\n     * @returns a validated bearer token response\n     * @throws An `Error` with `message` set to an entry in {@link OAuth2Error},\n     *      when the request fails, or the returned token response is invalid.\n     */\n    public async completeAuthorizationCodeGrant(code: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"authorization_code\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"code_verifier\", this.context.codeVerifier);\n        params.append(\"redirect_uri\", this.context.redirectUri);\n        params.append(\"code\", code);\n\n        const tokenResponse = await this.fetch(\"token\", params, OAuth2Error.CodeExchangeFailed);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Refresh the access token using the given refresh token and the refresh token grant\n     * @param refreshToken - the token to use to refresh the access token\n     */\n    public async performRefreshTokenGrant(refreshToken: string): Promise<BearerTokenResponse> {\n        const params = new URLSearchParams();\n        params.append(\"grant_type\", \"refresh_token\");\n        params.append(\"client_id\", this.context.clientId);\n        params.append(\"refresh_token\", refreshToken);\n\n        const tokenResponse = await this.fetch(\"token\", params, OAuth2Error.RefreshTokenFailed);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(tokenResponse);\n        return normalizeBearerTokenResponseTokenType(tokenResponse);\n    }\n\n    /**\n     * Revokes the given token\n     * @param token - the token to remove\n     * @param type - the type of token, acts as a hint to the IdP\n     */\n    public async revokeToken(token: string, type?: \"access_token\" | \"refresh_token\"): Promise<void> {\n        const params = new URLSearchParams();\n        params.append(\"token\", token);\n        params.append(\"client_id\", this.context.clientId);\n        if (type) {\n            params.append(\"token_type_hint\", type);\n        }\n\n        await this.fetch(\"revocation\", params, OAuth2Error.RevokeTokenFailed);\n\n        const headers = new Headers();\n        headers.set(\"Content-Type\", \"application/x-www-form-urlencoded\");\n    }\n\n    /**\n     * Begin OAuth2 device authorization flow.\n     * @param scope - the scope to request for authorization.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async startDeviceAuthorizationGrant(scope?: string): Promise<DeviceAuthorizationResponse> {\n        return startDeviceAuthorization({\n            scope: scope ?? generateScope(this.context.deviceId),\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n        });\n    }\n\n    /**\n     * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.\n     * @param session - The session returned from a previous call to {@link OAuth2.startDeviceAuthorizationGrant}.\n     * @returns a promise that resolves to a device access token response,\n     *   or an error response if the user denies authorization or the device code expires.\n     */\n    public async waitForDeviceAuthorizationGrant(\n        session: DeviceAuthorizationResponse,\n    ): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError> {\n        return waitForDeviceAuthorization({\n            session,\n            metadata: this.metadata,\n            clientId: this.context.clientId,\n        });\n    }\n\n    private async fetch(\n        target: \"token\" | \"registration\" | \"revocation\",\n        params: URLSearchParams,\n        error: OAuth2Error,\n    ): Promise<unknown> {\n        const url = this.metadata[`${target}_endpoint`];\n        const res = await fetch(url, {\n            method: Method.Post,\n            headers: {\n                \"Content-Type\": \"application/x-www-form-urlencoded\",\n                \"Accept\": \"application/json\",\n            },\n            body: params,\n        });\n\n        if (res.status >= 400) {\n            let body: unknown;\n            try {\n                body = await res.json();\n            } catch {\n                // The endpoint didn't give us a JSON body, so we can't determine the error type. We'll throw a generic\n                // HTTPError below.\n            }\n            // Because the Matrix C-S API error response format is so similar to the OAuth 2.0 error response format\n            // the ordering of these checks is important. We want to check for a Matrix error response first, and only\n            // if it isn't one do we check for an OAuth 2.0 error response.\n            // This essentially relies on `errcode` not being present in an OAuth 2.0 error response.\n            if (isMatrixErrorResponse(body)) {\n                throw new MatrixError(body, res.status, undefined, undefined, res.headers);\n            }\n            if (isOAuth2ErrorResponse(body)) {\n                throw new OAuth2HTTPError(error, res.status, res.headers, body);\n            }\n            throw new HTTPError(error, res.status, res.headers);\n        }\n\n        return await res.json();\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAKI,aAAa,EACb,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,QACvB,gBAAgB;AAEvB,SACI,cAAc,EAEd,gBAAgB,EAChB,4BAA4B,QACzB,eAAe;AACtB,SAAS,uBAAuB,QAAQ,cAAc;AACtD,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,QAAQ,sBAAsB;AAC5F,SAAS,MAAM,QAAQ,cAAc;AACrC,SAAS,qBAAqB,EAAE,WAAW,EAAE,eAAe,QAAQ,YAAY;AAChF,SAAS,kBAAkB,QAAQ,oBAAoB;AAGvD,cAAc,gBAAgB;AAC9B,cAAc,YAAY;AAC1B,cAAc,eAAe;AAC7B,cAAc,qBAAqB;AACnC,cAAc,eAAe;;AAE7B;AACA;AACA;;AAYA,OAAO,MAAM,MAAM,CAAC;EAChB;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,aAAoB,cAAc,CAC9B,YAAmC,EACnC,cAAwC,EACzB;IACf,MAAM,iBAAwC,GAAG,CAC7C,cAAc,CAAC,iBAAiB,EAChC,cAAc,CAAC,YAAY,CAC9B;IACD;IACA,IAAI,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;MACjF,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC;IAC9D;IAEA,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,IAAI,iBAAiB;IAClE,IAAI,UAAU,CAAC,IAAI,CAAE,KAAK,IAAK,CAAC,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;MACjF,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,+BAA+B,CAAC;IAChE;IAEA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC;IAErD,MAAM,OAAiC;MACnC;MACA,cAAc,EAAE,CAAC,MAAM,CAAC;MACxB,0BAA0B,EAAE;IAAM,GAC/B,cAAc;MACjB,WAAW,EAAE,UAAU;MACvB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS;MACrG,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,UAAU,GAAG,SAAS;MAC3G,OAAO,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,GAAG;IAAS,EACrG;IAED,IAAI;MACA,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE;QAC7D,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,OAAO,EAAE;UACL,QAAQ,EAAE,kBAAkB;UAC5B,cAAc,EAAE;QACpB,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;MAChC,CAAC,CAAC;MAEF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,CAAC;MAC1D;MAEA,MAAM,oBAAoB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;MAClD,IAAI,4BAA4B,CAAC,oBAAoB,CAAC,EAAE;QACpD,OAAO,oBAAoB,CAAC,SAAS;MACzC;MAEA,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAAC;IAC3D,CAAC,CAAC,OAAO,KAAK,EAAE;MACZ,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAE,KAAK,CAAW,OAAsB,CAAC,EAAE;QAC9E,MAAM,KAAK;MACf,CAAC,MAAM;QACH,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,EAAE;UAAE,KAAK,EAAE;QAAM,CAAC,CAAC;MAC5E;IACJ;EACJ;EAIO,WAAW,CACE,QAA+B,EAC/C,OAAgB,EAClB;IAAA;IAAA,KAFkB,QAA+B,GAA/B,QAA+B;IAG/C,IAAI,CAAC,OAAO,GAAG;MACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;MAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;MAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;MACpD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAC,EAAE;IAC/D,CAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,iCAAiC,CAC1C,KAAa,EACb,YAAkC,GAAG,UAAU,EAC/C,MAAe,EACf,KAAc,EACC;IACf,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;IACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAEjD,IAAI,MAAM,EAAE;MACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1C;IAEA,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACI,MAAa,8BAA8B,CAAC,IAAY,EAAgC;IACpF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IACvD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAE3B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;;IAEvF;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;EACI,MAAa,wBAAwB,CAAC,YAAoB,EAAgC;IACtF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;IAE5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC;;IAEvF;IACA,2BAA2B,CAAC,aAAa,CAAC;IAC1C,OAAO,qCAAqC,CAAC,aAAa,CAAC;EAC/D;;EAEA;AACJ;AACA;AACA;AACA;EACI,MAAa,WAAW,CAAC,KAAa,EAAE,IAAuC,EAAiB;IAC5F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjD,IAAI,IAAI,EAAE;MACN,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC;IAC1C;IAEA,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC;IAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,mCAAmC,CAAC;EACpE;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,6BAA6B,CAAC,KAAc,EAAwC;IAC7F,OAAO,wBAAwB,CAAC;MAC5B,KAAK,EAAE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;MACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACI,MAAa,+BAA+B,CACxC,OAAoC,EACuB;IAC3D,OAAO,0BAA0B,CAAC;MAC9B,OAAO;MACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;MACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;EACN;EAEA,MAAc,KAAK,CACf,MAA+C,EAC/C,MAAuB,EACvB,KAAkB,EACF;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;MACzB,MAAM,EAAE,MAAM,CAAC,IAAI;MACnB,OAAO,EAAE;QACL,cAAc,EAAE,mCAAmC;QACnD,QAAQ,EAAE;MACd,CAAC;MACD,IAAI,EAAE;IACV,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE;MACnB,IAAI,IAAa;MACjB,IAAI;QACA,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;MAC3B,CAAC,CAAC,MAAM;QACJ;QACA;MAAA;MAEJ;MACA;MACA;MACA;MACA,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC;MAC9E;MACA,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;MACnE;MACA,MAAM,IAAI,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;IACvD;IAEA,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;EAC3B;AACJ","ignoreList":[]}

package/lib/oauth/tokenRefresher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenRefresher.d.ts","sourceRoot":"","sources":["../../src/oauth/tokenRefresher.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,YAAY,EAAa,KAAK,oBAAoB,EAA2B,MAAM,sBAAsB,CAAC;AACxH,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;GAEG;AACH,qBAAa,cAAc;IAInB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ9B,OAAO,CAAC,sBAAsB,CAAC,CAAwB;IAEvD,YACqB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,EACnE;IAEJ;;;;;OAKG;IACI,oBAAoB,EAAE,oBAAoB,CAiB/C;IAEF,OAAO,CAAC,mBAAmB;YAKb,YAAY;CAgB7B"}
+{"version":3,"file":"tokenRefresher.d.ts","sourceRoot":"","sources":["../../src/oauth/tokenRefresher.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,YAAY,EAAa,KAAK,oBAAoB,EAA2B,MAAM,sBAAsB,CAAC;AAExH,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;GAEG;AACH,qBAAa,cAAc;IAInB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ9B,OAAO,CAAC,sBAAsB,CAAC,CAAwB;IAEvD,YACqB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,EACnE;IAEJ;;;;;OAKG;IACI,oBAAoB,EAAE,oBAAoB,CAiB/C;IAEF,OAAO,CAAC,mBAAmB;YAWb,YAAY;CAgB7B"}

package/lib/oauth/tokenRefresher.js

@@ -16,6 +16,7 @@ limitations under the License.
 */
 
 import { HTTPError, TokenRefreshLogoutError } from "../http-api/index.js";
+import { OAuth2HTTPError } from "./error.js";
 /**
  * Class responsible for refreshing OAuth2 access tokens
  */
@@ -49,8 +50,9 @@ export class TokenRefresher {
     this.onRefresh = onRefresh;
   }
   shouldLogoutOnError(error) {
-    // As per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant
-    return typeof error.httpStatus === "number" && error.httpStatus < 500 && error.httpStatus >= 400;
+    // Treat as logout as per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant
+    // after making sure it is an RFC 6749 section 5.2 error response
+    return error instanceof OAuth2HTTPError && typeof error.httpStatus === "number" && error.httpStatus < 500 && error.httpStatus >= 400;
   }
   async getNewTokens(refreshToken) {
     const requestStart = Date.now();

package/lib/oauth/tokenRefresher.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenRefresher.js","names":[],"sources":["../../src/oauth/tokenRefresher.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { type AccessTokens, HTTPError, type TokenRefreshFunction, TokenRefreshLogoutError } from \"../http-api/index.ts\";\nimport { type OAuth2 } from \"./index.ts\";\n\n/**\n * Class responsible for refreshing OAuth2 access tokens\n */\nexport class TokenRefresher {\n    private inflightRefreshRequest?: Promise<AccessTokens>;\n\n    public constructor(\n        private readonly auth: OAuth2,\n        private readonly onRefresh: (tokens: AccessTokens) => Promise<void>,\n    ) {}\n\n    /**\n     * Attempt token refresh using given refresh token\n     * @param refreshToken - refresh token to use in request with token issuer\n     * @returns tokens - Promise that resolves with new access and refresh tokens\n     * @throws when token refresh fails\n     */\n    public tokenRefreshFunction: TokenRefreshFunction = async (refreshToken: string): Promise<AccessTokens> => {\n        if (!this.inflightRefreshRequest) {\n            this.inflightRefreshRequest = this.getNewTokens(refreshToken);\n        }\n\n        try {\n            const tokens = await this.inflightRefreshRequest;\n            return tokens;\n        } catch (e) {\n            // If we encounter a 40x error then signal that it should cause a logout by upgrading it to a TokenRefreshLogoutError\n            if (e instanceof HTTPError && this.shouldLogoutOnError(e)) {\n                throw new TokenRefreshLogoutError(e);\n            }\n            throw e;\n        } finally {\n            this.inflightRefreshRequest = undefined;\n        }\n    };\n\n    private shouldLogoutOnError(error: HTTPError): boolean {\n        // As per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant\n        return typeof error.httpStatus === \"number\" && error.httpStatus < 500 && error.httpStatus >= 400;\n    }\n\n    private async getNewTokens(refreshToken: string): Promise<AccessTokens> {\n        const requestStart = Date.now();\n\n        const response = await this.auth.performRefreshTokenGrant(refreshToken);\n\n        const tokens = {\n            accessToken: response.access_token,\n            refreshToken: response.refresh_token,\n            // We use the request start time to calculate the expiry time as we don't know when the server received our request\n            expiry: response.expires_in ? new Date(requestStart + response.expires_in * 1000) : undefined,\n        } satisfies AccessTokens;\n\n        await this.onRefresh(tokens);\n\n        return tokens;\n    }\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAA4B,SAAS,EAA6B,uBAAuB,QAAQ,sBAAsB;AAGvH;AACA;AACA;AACA,OAAO,MAAM,cAAc,CAAC;EAGjB,WAAW,CACG,IAAY,EACZ,SAAkD,EACrE;IAAA;IAEF;AACJ;AACA;AACA;AACA;AACA;IALI,8CAMoD,MAAO,YAAoB,IAA4B;MACvG,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAC9B,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;MACjE;MAEA,IAAI;QACA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB;QAChD,OAAO,MAAM;MACjB,CAAC,CAAC,OAAO,CAAC,EAAE;QACR;QACA,IAAI,CAAC,YAAY,SAAS,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE;UACvD,MAAM,IAAI,uBAAuB,CAAC,CAAC,CAAC;QACxC;QACA,MAAM,CAAC;MACX,CAAC,SAAS;QACN,IAAI,CAAC,sBAAsB,GAAG,SAAS;MAC3C;IACJ,CAAC;IAAA,KA3BoB,IAAY,GAAZ,IAAY;IAAA,KACZ,SAAkD,GAAlD,SAAkD;EACpE;EA2BK,mBAAmB,CAAC,KAAgB,EAAW;IACnD;IACA,OAAO,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG;EACpG;EAEA,MAAc,YAAY,CAAC,YAAoB,EAAyB;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC;IAEvE,MAAM,MAAM,GAAG;MACX,WAAW,EAAE,QAAQ,CAAC,YAAY;MAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;MACpC;MACA,MAAM,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG;IACxF,CAAwB;IAExB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IAE5B,OAAO,MAAM;EACjB;AACJ","ignoreList":[]}
+{"version":3,"file":"tokenRefresher.js","names":[],"sources":["../../src/oauth/tokenRefresher.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { type AccessTokens, HTTPError, type TokenRefreshFunction, TokenRefreshLogoutError } from \"../http-api/index.ts\";\nimport { OAuth2HTTPError } from \"./error.ts\";\nimport { type OAuth2 } from \"./index.ts\";\n\n/**\n * Class responsible for refreshing OAuth2 access tokens\n */\nexport class TokenRefresher {\n    private inflightRefreshRequest?: Promise<AccessTokens>;\n\n    public constructor(\n        private readonly auth: OAuth2,\n        private readonly onRefresh: (tokens: AccessTokens) => Promise<void>,\n    ) {}\n\n    /**\n     * Attempt token refresh using given refresh token\n     * @param refreshToken - refresh token to use in request with token issuer\n     * @returns tokens - Promise that resolves with new access and refresh tokens\n     * @throws when token refresh fails\n     */\n    public tokenRefreshFunction: TokenRefreshFunction = async (refreshToken: string): Promise<AccessTokens> => {\n        if (!this.inflightRefreshRequest) {\n            this.inflightRefreshRequest = this.getNewTokens(refreshToken);\n        }\n\n        try {\n            const tokens = await this.inflightRefreshRequest;\n            return tokens;\n        } catch (e) {\n            // If we encounter a 40x error then signal that it should cause a logout by upgrading it to a TokenRefreshLogoutError\n            if (e instanceof HTTPError && this.shouldLogoutOnError(e)) {\n                throw new TokenRefreshLogoutError(e);\n            }\n            throw e;\n        } finally {\n            this.inflightRefreshRequest = undefined;\n        }\n    };\n\n    private shouldLogoutOnError(error: HTTPError): boolean {\n        // Treat as logout as per https://spec.matrix.org/v1.18/client-server-api/#refresh-token-grant\n        // after making sure it is an RFC 6749 section 5.2 error response\n        return (\n            error instanceof OAuth2HTTPError &&\n            typeof error.httpStatus === \"number\" &&\n            error.httpStatus < 500 &&\n            error.httpStatus >= 400\n        );\n    }\n\n    private async getNewTokens(refreshToken: string): Promise<AccessTokens> {\n        const requestStart = Date.now();\n\n        const response = await this.auth.performRefreshTokenGrant(refreshToken);\n\n        const tokens = {\n            accessToken: response.access_token,\n            refreshToken: response.refresh_token,\n            // We use the request start time to calculate the expiry time as we don't know when the server received our request\n            expiry: response.expires_in ? new Date(requestStart + response.expires_in * 1000) : undefined,\n        } satisfies AccessTokens;\n\n        await this.onRefresh(tokens);\n\n        return tokens;\n    }\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAA4B,SAAS,EAA6B,uBAAuB,QAAQ,sBAAsB;AACvH,SAAS,eAAe,QAAQ,YAAY;AAG5C;AACA;AACA;AACA,OAAO,MAAM,cAAc,CAAC;EAGjB,WAAW,CACG,IAAY,EACZ,SAAkD,EACrE;IAAA;IAEF;AACJ;AACA;AACA;AACA;AACA;IALI,8CAMoD,MAAO,YAAoB,IAA4B;MACvG,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAC9B,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;MACjE;MAEA,IAAI;QACA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB;QAChD,OAAO,MAAM;MACjB,CAAC,CAAC,OAAO,CAAC,EAAE;QACR;QACA,IAAI,CAAC,YAAY,SAAS,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE;UACvD,MAAM,IAAI,uBAAuB,CAAC,CAAC,CAAC;QACxC;QACA,MAAM,CAAC;MACX,CAAC,SAAS;QACN,IAAI,CAAC,sBAAsB,GAAG,SAAS;MAC3C;IACJ,CAAC;IAAA,KA3BoB,IAAY,GAAZ,IAAY;IAAA,KACZ,SAAkD,GAAlD,SAAkD;EACpE;EA2BK,mBAAmB,CAAC,KAAgB,EAAW;IACnD;IACA;IACA,OACI,KAAK,YAAY,eAAe,IAChC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IACpC,KAAK,CAAC,UAAU,GAAG,GAAG,IACtB,KAAK,CAAC,UAAU,IAAI,GAAG;EAE/B;EAEA,MAAc,YAAY,CAAC,YAAoB,EAAyB;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC;IAEvE,MAAM,MAAM,GAAG;MACX,WAAW,EAAE,QAAQ,CAAC,YAAY;MAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;MACpC;MACA,MAAM,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG;IACxF,CAAwB;IAExB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IAE5B,OAAO,MAAM;EACjB;AACJ","ignoreList":[]}

package/lib/secret-storage.d.ts

@@ -4,7 +4,7 @@
  * @see https://spec.matrix.org/v1.6/client-server-api/#storage
  */
 import { type TypedEventEmitter } from "./models/typed-event-emitter.ts";
-import { ClientEvent, type ClientEventHandlerMap } from "./client.ts";
+import { type ClientEvent, type ClientEventHandlerMap } from "./client.ts";
 import { type AESEncryptedSecretStoragePayload } from "./@types/AESEncryptedSecretStoragePayload.ts";
 import { type AccountDataEvents, type SecretStorageAccountDataEvents } from "./@types/event.ts";
 import { type EmptyObject } from "./@types/common.ts";

package/lib/secret-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-storage.d.ts","sourceRoot":"","sources":["../src/secret-storage.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAMtE,OAAO,EAAE,KAAK,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AACrG,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,eAAO,MAAM,+BAA+B,sCAAsC,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAC9C,0CAA0C;IAE1C,IAAI,EAAE,MAAM,CAAC;IAEb,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAElB,2DAA2D;IAE3D,UAAU,EAAE,cAAc,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAiC,SAAQ,iCAAiC;IAOvF,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IAEX,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC3B,kDAAkD;IAClD,SAAS,EAAE,UAAU,CAAC;IAEtB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IAEnB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IAEb,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACpC,iEAAiE;IACjE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0HAA0H;IAC1H,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACjC,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,OAAO,EAAE,2BAA2B,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,WAAW,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACxG;;;;;;;OAOG;IACH,wBAAwB,EAAE,CAAC,CAAC,SAAS,MAAM,iBAAiB,EAAE,SAAS,EAAE,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpH;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,SAAS,MAAM,iBAAiB,EAC9C,SAAS,EAAE,CAAC,EACZ,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KACpD,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mBAAmB,CAAC,EAAE,CAClB,IAAI,EAAE;QACF;;;;;;;;;WASG;QACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;KACrD,EACD,IAAI,EAAE,MAAM,KACX,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACvB,SAAS,EAAE;QACP,CAAC,KAAK,EAAE,MAAM,GAAG,gCAAgC,CAAC;KACrD,CAAC;CACL;AAOD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACpC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1G;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,gCAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpF;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF;;;;;;;OAOG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnG;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1C;;;;;;;OAOG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IAYnE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAZ9B;;;;;;;;;OASG;IACH,YACqB,kBAAkB,EAAE,iBAAiB,EACrC,SAAS,EAAE,sBAAsB,EAClD;IAEJ;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIrD;IAED;;OAEG;IACI,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B1D;IAED;;;;;;;;;;;;OAYG;IACU,MAAM,CACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,uBAAuB,EAC7B,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,CAAC,CAgCjC;IAED;;;;;;;;OAQG;IACU,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUhF;IAED;;;;;;OAMG;IACU,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpD;IAED;;;;;;;OAOG;IACU,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAY5G;IAED;;OAEG;IACU,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCvG;IAED;;;;;;;;;;OAUG;IACU,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmCpE;IAED;;;;;;;;OAQG;IACU,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,GAAG,IAAI,CAAC,CAsB9G;YAEa,mBAAmB;CAoCpC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAcxD;AAKD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,EAC5B,EAAE,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,gCAAgC,CAAC,CAE3C"}
+{"version":3,"file":"secret-storage.d.ts","sourceRoot":"","sources":["../src/secret-storage.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAK3E,OAAO,EAAE,KAAK,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AACrG,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,eAAO,MAAM,+BAA+B,sCAAsC,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAC9C,0CAA0C;IAE1C,IAAI,EAAE,MAAM,CAAC;IAEb,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAElB,2DAA2D;IAE3D,UAAU,EAAE,cAAc,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAiC,SAAQ,iCAAiC;IAOvF,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IAEX,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC3B,kDAAkD;IAClD,SAAS,EAAE,UAAU,CAAC;IAEtB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IAEnB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IAEb,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACpC,iEAAiE;IACjE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0HAA0H;IAC1H,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACjC,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,OAAO,EAAE,2BAA2B,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,WAAW,CAAC,WAAW,EAAE,qBAAqB,CAAC;IACxG;;;;;;;OAOG;IACH,wBAAwB,EAAE,CAAC,CAAC,SAAS,MAAM,iBAAiB,EAAE,SAAS,EAAE,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpH;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,SAAS,MAAM,iBAAiB,EAC9C,SAAS,EAAE,CAAC,EACZ,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KACpD,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,mBAAmB,CAAC,EAAE,CAClB,IAAI,EAAE;QACF;;;;;;;;;WASG;QACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;KACrD,EACD,IAAI,EAAE,MAAM,KACX,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACvB,SAAS,EAAE;QACP,CAAC,KAAK,EAAE,MAAM,GAAG,gCAAgC,CAAC;KACrD,CAAC;CACL;AAOD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACpC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1G;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,gCAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpF;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF;;;;;;;OAOG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnG;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1C;;;;;;;OAOG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IAYnE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAZ9B;;;;;;;;;OASG;IACH,YACqB,kBAAkB,EAAE,iBAAiB,EACrC,SAAS,EAAE,sBAAsB,EAClD;IAEJ;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIrD;IAED;;OAEG;IACU,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE;IAED;;;;;;;;;;;;OAYG;IACU,MAAM,CACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,uBAAuB,EAC7B,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,CAAC,CAgCjC;IAED;;;;;;;;OAQG;IACU,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUhF;IAED;;;;;;OAMG;IACU,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpD;IAED;;;;;;;OAOG;IACU,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,gCAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAY5G;IAED;;OAEG;IACU,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCvG;IAED;;;;;;;;;;OAUG;IACU,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmCpE;IAED;;;;;;;;OAQG;IACU,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,GAAG,IAAI,CAAC,CAsB9G;YAEa,mBAAmB;CAoCpC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAcxD;AAKD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,EAC5B,EAAE,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,gCAAgC,CAAC,CAE3C"}

package/lib/secret-storage.js

@@ -20,7 +20,6 @@ limitations under the License.
  * @see https://spec.matrix.org/v1.6/client-server-api/#storage
  */
 
-import { ClientEvent } from "./client.js";
 import { secureRandomString } from "./randomstring.js";
 import { logger } from "./logger.js";
 import encryptAESSecretStorageItem from "./utils/encryptAESSecretStorageItem.js";
@@ -131,37 +130,15 @@ export class ServerSideSecretStorageImpl {
   /**
    * Implementation of {@link ServerSideSecretStorage#setDefaultKeyId}.
    */
-  setDefaultKeyId(keyId) {
-    return new Promise((resolve, reject) => {
-      const listener = ev => {
-        if (ev.getType() !== "m.secret_storage.default_key") {
-          //  Different account data item
-          return;
-        }
-
-        // If keyId === null, the content should be an empty object.
-        // Otherwise, the `key` in the content object should match keyId.
-        const content = ev.getContent();
-        const isSameKey = keyId === null ? Object.keys(content).length === 0 : content.key === keyId;
-        if (isSameKey) {
-          this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
-          resolve();
-        }
-      };
-      this.accountDataAdapter.on(ClientEvent.AccountData, listener);
-
-      // The spec [1] says that the value of the account data entry should be an object with a `key` property.
-      // It doesn't specify how to delete the default key; we do it by setting the account data to an empty object.
-      //
-      // [1]: https://spec.matrix.org/v1.13/client-server-api/#key-storage
-      const newValue = keyId === null ? {} : {
-        key: keyId
-      };
-      this.accountDataAdapter.setAccountData("m.secret_storage.default_key", newValue).catch(e => {
-        this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
-        reject(e);
-      });
-    });
+  async setDefaultKeyId(keyId) {
+    // The spec [1] says that the value of the account data entry should be an object with a `key` property.
+    // It doesn't specify how to delete the default key; we do it by setting the account data to an empty object.
+    //
+    // [1]: https://spec.matrix.org/v1.13/client-server-api/#key-storage
+    const newValue = keyId === null ? {} : {
+      key: keyId
+    };
+    await this.accountDataAdapter.setAccountData("m.secret_storage.default_key", newValue);
   }
 
   /**