oidc-spa 8.1.5-rc.1 → 8.1.5

package/src/core/createOidc.ts

@@ -38,7 +38,7 @@ import { createEvt } from "../tools/Evt";
 import { getHaveSharedParentDomain } from "../tools/haveSharedParentDomain";
 import {
     createLoginOrGoToAuthServer,
-    getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation
+    getPrSafelyRestoredFromBfCacheAfterLoginBackNavigationOrInitializationError
 } from "./loginOrGoToAuthServer";
 import { createEphemeralSessionStorage } from "../tools/EphemeralSessionStorage";
 import {
@@ -49,6 +49,8 @@ import { createGetIsNewBrowserSession } from "./isNewBrowserSession";
 import { getIsOnline } from "../tools/getIsOnline";
 import { isKeycloak } from "../keycloak/isKeycloak";
 import { INFINITY_TIME } from "../tools/INFINITY_TIME";
+import type { WELL_KNOWN_PATH } from "./diagnostic";
+import { getIsValidRemoteJson } from "../tools/getIsValidRemoteJson";
 
 // NOTE: Replaced at build time
 const VERSION = "{{OIDC_SPA_VERSION}}";
@@ -454,7 +456,7 @@ export async function createOidc_nonMemoized<
         metadata: __metadata
     });
 
-    const evtIsUserLoggedIn = createEvt<boolean>();
+    const evtInitializationOutcomeUserNotLoggedIn = createEvt<void>();
 
     const { loginOrGoToAuthServer } = createLoginOrGoToAuthServer({
         configId,
@@ -463,23 +465,13 @@ export async function createOidc_nonMemoized<
         getExtraQueryParams,
         getExtraTokenParams,
         homeUrl: homeUrlAndRedirectUri,
-        evtIsUserLoggedIn,
+        evtInitializationOutcomeUserNotLoggedIn,
         log
     });
 
     const { getIsNewBrowserSession } = createGetIsNewBrowserSession({
         configId,
-        evtUserNotLoggedIn: (() => {
-            const evt = createEvt<void>();
-
-            evtIsUserLoggedIn.subscribe(isUserLoggedIn => {
-                if (!isUserLoggedIn) {
-                    evt.post();
-                }
-            });
-
-            return evt;
-        })()
+        evtInitializationOutcomeUserNotLoggedIn
     });
 
     const { completeLoginOrRefreshProcess } = await startLoginOrRefreshProcess();
@@ -673,6 +665,8 @@ export async function createOidc_nonMemoized<
             }
         }
 
+        // NOTE: We almost never persist tokens, we have to only to support edge case
+        // of multiple oidc instance in a single App with no iframe support.
         restore_from_session_storage: {
             if (isUserStoreInMemoryOnly) {
                 break restore_from_session_storage;
@@ -744,6 +738,20 @@ export async function createOidc_nonMemoized<
                 }
 
                 if (!canUseIframe) {
+                    if (
+                        !(await getIsValidRemoteJson(
+                            `${issuerUri}${id<typeof WELL_KNOWN_PATH>(
+                                "/.well-known/openid-configuration"
+                            )}`
+                        ))
+                    ) {
+                        return (
+                            await import("./diagnostic")
+                        ).createWellKnownOidcConfigurationEndpointUnreachableInitializationError({
+                            issuerUri
+                        });
+                    }
+
                     break actual_silent_signin;
                 }
 
@@ -833,11 +841,12 @@ export async function createOidc_nonMemoized<
                     completeLoginOrRefreshProcess();
 
                     if (autoLogin && persistedAuthState !== "logged in") {
-                        evtIsUserLoggedIn.post(false);
+                        evtInitializationOutcomeUserNotLoggedIn.post();
                     }
 
                     await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
-                        prUnlock: new Promise<never>(() => {})
+                        prUnlock:
+                            getPrSafelyRestoredFromBfCacheAfterLoginBackNavigationOrInitializationError()
                     });
 
                     if (persistedAuthState === "logged in") {
@@ -846,7 +855,9 @@ export async function createOidc_nonMemoized<
                         });
                     }
 
-                    await loginOrGoToAuthServer({
+                    const dCantFetchWellKnownEndpointOrNever = new Deferred<void | never>();
+
+                    loginOrGoToAuthServer({
                         action: "login",
                         doForceReloadOnBfCache: true,
                         redirectUrl: getRootRelativeOriginalLocationHref(),
@@ -865,9 +876,20 @@ export async function createOidc_nonMemoized<
                             }
 
                             return "ensure no interaction";
-                        })()
+                        })(),
+                        onCantFetchWellKnownEndpointError: () => {
+                            dCantFetchWellKnownEndpointOrNever.resolve();
+                        }
+                    });
+
+                    await dCantFetchWellKnownEndpointOrNever.pr;
+
+                    return (
+                        await import("./diagnostic")
+                    ).createFailedToFetchTokenEndpointInitializationError({
+                        clientId,
+                        issuerUri
                     });
-                    assert(false, "321389");
                 }
 
                 if (authResponse_error !== undefined) {
@@ -914,7 +936,7 @@ export async function createOidc_nonMemoized<
             break not_loggedIn_case;
         }
 
-        evtIsUserLoggedIn.post(false);
+        evtInitializationOutcomeUserNotLoggedIn.post();
 
         if (getPersistedAuthState({ configId }) !== "explicitly logged out") {
             persistAuthState({ configId, state: undefined });
@@ -971,7 +993,8 @@ export async function createOidc_nonMemoized<
                         transformUrlBeforeRedirect
                     }) => {
                         await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
-                            prUnlock: getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation()
+                            prUnlock:
+                                getPrSafelyRestoredFromBfCacheAfterLoginBackNavigationOrInitializationError()
                         });
 
                         return loginOrGoToAuthServer({
@@ -986,7 +1009,11 @@ export async function createOidc_nonMemoized<
                             interaction:
                                 getPersistedAuthState({ configId }) === "explicitly logged out"
                                     ? "ensure interaction"
-                                    : "directly redirect if active session show login otherwise"
+                                    : "directly redirect if active session show login otherwise",
+                            onCantFetchWellKnownEndpointError: () => {
+                                log?.("Login called but the auth server seems to be down..");
+                                alert("Authentication unavailable please try again later.");
+                            }
                         });
                     },
                     initializationError: undefined
@@ -1018,8 +1045,6 @@ export async function createOidc_nonMemoized<
 
     log?.("User is logged in");
 
-    evtIsUserLoggedIn.post(true);
-
     let currentTokens = oidcClientTsUserToTokens({
         oidcClientTsUser: resultOfLoginProcess.oidcClientTsUser,
         decodedIdTokenSchema,
@@ -1199,7 +1224,16 @@ export async function createOidc_nonMemoized<
                         extraQueryParams_local: undefined,
                         transformUrlBeforeRedirect_local: undefined,
                         doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
-                        interaction: "directly redirect if active session show login otherwise"
+                        interaction: "directly redirect if active session show login otherwise",
+                        onCantFetchWellKnownEndpointError: () => {
+                            log?.(
+                                [
+                                    "The auth server seems to be down while we needed to refresh the token",
+                                    "with a full page redirect. Reloading the page"
+                                ].join(" ")
+                            );
+                            window.location.reload();
+                        }
                     });
                     assert(false, "136134");
                 };
@@ -1235,10 +1269,15 @@ export async function createOidc_nonMemoized<
                 });
 
                 if (result_loginSilent.outcome === "failure") {
-                    completeLoginOrRefreshProcess();
-                    // NOTE: This is a configuration or network error, okay to throw,
-                    // this exception doesn't have to be handle if it fails it fails.
-                    throw new Error(result_loginSilent.cause);
+                    log?.(
+                        [
+                            `Silent refresh of the token failed with ${result_loginSilent.cause}.`,
+                            `This isn't recoverable, reloading the page.`
+                        ].join(" ")
+                    );
+                    window.location.reload();
+                    await new Promise<never>(() => {});
+                    assert(false);
                 }
 
                 let oidcClientTsUser: OidcClientTsUser;
@@ -1422,7 +1461,11 @@ export async function createOidc_nonMemoized<
                 action: "go to auth server",
                 redirectUrl: redirectUrl ?? window.location.href,
                 extraQueryParams_local: extraQueryParams,
-                transformUrlBeforeRedirect_local: transformUrlBeforeRedirect
+                transformUrlBeforeRedirect_local: transformUrlBeforeRedirect,
+                onCantFetchWellKnownEndpointError: () => {
+                    log?.("goToAuthServer called but the auth server seems to be down..");
+                    alert("Authentication unavailable please try again later.");
+                }
             }),
         backFromAuthServer: resultOfLoginProcess.backFromAuthServer,
         isNewBrowserSession: (() => {
@@ -1495,12 +1538,12 @@ export async function createOidc_nonMemoized<
         });
     })();
 
-    (function scheduleRenew() {
+    (function scheduleTokenRefreshToKeepSessionAlive() {
         if (!currentTokens.hasRefreshToken && !canUseIframe) {
             log?.(
                 [
-                    "Disabling token auto refresh mechanism because we",
-                    "have no way to renew the tokens without a full page reload"
+                    "Session keep-alive disabled: no refresh token and no iframe support. ",
+                    "Result: once tokens expire, continuing requires full reload."
                 ].join(" ")
             );
             return;
@@ -1510,7 +1553,34 @@ export async function createOidc_nonMemoized<
             currentTokens.refreshTokenExpirationTime !== undefined &&
             currentTokens.refreshTokenExpirationTime >= INFINITY_TIME
         ) {
-            log?.("The refresh_token never expires, disabling auto-renewal mechanism");
+            const warningLines: string[] = [];
+
+            if (scopes.includes("offline_access")) {
+                warningLines.push("offline_access scope was explicitly requested.");
+            } else if (isKeycloak({ issuerUri })) {
+                warningLines.push("Keycloak likely enabled offline_access by default.");
+            }
+
+            if (warningLines.length > 0) {
+                warningLines.push(
+                    ...[
+                        "Misconfiguration: offline_access is for native apps, not SPAs. ",
+                        "You lose SSO and users must log in after every reload."
+                    ]
+                );
+            }
+
+            const logMessage = [
+                "Refresh token never expires → no need to ping server.",
+                "The backend session will not expire.",
+                ...warningLines
+            ].join(" ");
+
+            if (warningLines.length > 0) {
+                console.warn(`oidc-spa: ${logMessage}`);
+            } else {
+                log?.(logMessage);
+            }
             return;
         }
 
@@ -1526,7 +1596,7 @@ export async function createOidc_nonMemoized<
         if (msBeforeExpiration <= RENEW_MS_BEFORE_EXPIRES) {
             log?.(
                 [
-                    "Disabling auto renew mechanism. We just got fresh tokens",
+                    "Session keep-alive disabled. We just got fresh tokens",
                     (() => {
                         switch (typeOfTheTokenWeGotTheTtlFrom) {
                             case "refresh":
@@ -1610,7 +1680,7 @@ export async function createOidc_nonMemoized<
         const { unsubscribe: tokenChangeUnsubscribe } = oidc_loggedIn.subscribeToTokensChange(() => {
             clearTimeout(timer);
             tokenChangeUnsubscribe();
-            scheduleRenew();
+            scheduleTokenRefreshToKeepSessionAlive();
         });
     })();
 

package/src/core/diagnostic.ts

@@ -2,13 +2,13 @@ import { OidcInitializationError } from "./OidcInitializationError";
 import { isKeycloak, createKeycloakUtils } from "../keycloak";
 import { getIsValidRemoteJson } from "../tools/getIsValidRemoteJson";
 
+export const WELL_KNOWN_PATH = "/.well-known/openid-configuration";
+
 export async function createWellKnownOidcConfigurationEndpointUnreachableInitializationError(params: {
     issuerUri: string;
 }): Promise<OidcInitializationError> {
     const { issuerUri } = params;
 
-    const WELL_KNOWN_PATH = "/.well-known/openid-configuration";
-
     const commonFallbackMessagePart = [
         `The OIDC server is either down or the issuerUri you provided is incorrect.`,
         `You provided the issuerUri: ${issuerUri}`,

package/src/core/iframeMessageProtection.ts

@@ -38,20 +38,13 @@ function getSessionStorageKey(params: { stateUrlParamValue: string }) {
     return `${SESSION_STORAGE_PREFIX}${stateUrlParamValue}`;
 }
 
-export async function initIframeMessageProtection(params: {
-    stateUrlParamValue: string;
-    log: typeof console.log | undefined;
-}) {
-    const { stateUrlParamValue, log } = params;
+export async function initIframeMessageProtection(params: { stateUrlParamValue: string }) {
+    const { stateUrlParamValue } = params;
 
     const { publicKey, privateKey } = await generateKeys();
 
     const sessionStorageKey = getSessionStorageKey({ stateUrlParamValue });
 
-    log?.(
-        `Writing iframe messaging protection publicKey for state: ${stateUrlParamValue} at sessionStorage -> ${sessionStorageKey}`
-    );
-
     setItem_real.call(sessionStorage, sessionStorageKey, publicKey);
 
     function getIsEncryptedAuthResponse(params: { message: unknown }): boolean {
@@ -76,7 +69,6 @@ export async function initIframeMessageProtection(params: {
     }
 
     function clearSessionStoragePublicKey() {
-        log?.(`Clearing session storage public key at ${sessionStorageKey}`);
         sessionStorage.removeItem(sessionStorageKey);
     }
 
@@ -90,7 +82,7 @@ export async function encryptAuthResponse(params: { authResponse: AuthResponse }
         getSessionStorageKey({ stateUrlParamValue: authResponse.state })
     );
 
-    assert(publicKey !== null, `2293302 no publicKey for state ${authResponse.state}`);
+    assert(publicKey !== null, "2293302");
 
     const { encryptedMessage: encryptedMessage_withoutPrefix } = await asymmetricEncrypt({
         publicKey,

package/src/core/isNewBrowserSession.ts

@@ -2,14 +2,14 @@ import type { NonPostableEvt } from "../tools/Evt";
 
 export function createGetIsNewBrowserSession(params: {
     configId: string;
-    evtUserNotLoggedIn: NonPostableEvt<void>;
+    evtInitializationOutcomeUserNotLoggedIn: NonPostableEvt<void>;
 }) {
-    const { configId, evtUserNotLoggedIn } = params;
+    const { configId, evtInitializationOutcomeUserNotLoggedIn } = params;
 
     const SESSION_STORAGE_KEY = `oidc-spa.subject-id:${configId}`;
 
     {
-        const { unsubscribe } = evtUserNotLoggedIn.subscribe(() => {
+        const { unsubscribe } = evtInitializationOutcomeUserNotLoggedIn.subscribe(() => {
             unsubscribe();
             sessionStorage.removeItem(SESSION_STORAGE_KEY);
         });

package/src/core/loginOrGoToAuthServer.ts

@@ -7,6 +7,7 @@ import type { NonPostableEvt } from "../tools/Evt";
 import { createStatefulEvt } from "../tools/StatefulEvt";
 import { Deferred } from "../tools/Deferred";
 import { addOrUpdateSearchParam, getAllSearchParams } from "../tools/urlSearchParams";
+import { getIsOnline } from "../tools/getIsOnline";
 
 const globalContext = {
     evtHasLoginBeenCalled: createStatefulEvt(() => false)
@@ -19,6 +20,7 @@ namespace Params {
         redirectUrl: string;
         extraQueryParams_local: Record<string, string | undefined> | undefined;
         transformUrlBeforeRedirect_local: ((url: string) => string) | undefined;
+        onCantFetchWellKnownEndpointError: () => void;
     };
 
     export type Login = Common & {
@@ -36,7 +38,7 @@ namespace Params {
     };
 }
 
-export function getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation() {
+export function getPrSafelyRestoredFromBfCacheAfterLoginBackNavigationOrInitializationError() {
     const dOut = new Deferred<void>();
 
     const { unsubscribe } = globalContext.evtHasLoginBeenCalled.subscribe(hasLoginBeenCalled => {
@@ -63,7 +65,7 @@ export function createLoginOrGoToAuthServer(params: {
     getExtraTokenParams: (() => Record<string, string | undefined>) | undefined;
 
     homeUrl: string;
-    evtIsUserLoggedIn: NonPostableEvt<boolean>;
+    evtInitializationOutcomeUserNotLoggedIn: NonPostableEvt<void>;
     log: typeof console.log | undefined;
 }) {
     const {
@@ -76,12 +78,11 @@ export function createLoginOrGoToAuthServer(params: {
         getExtraTokenParams,
 
         homeUrl,
-        evtIsUserLoggedIn,
+        evtInitializationOutcomeUserNotLoggedIn,
+
         log
     } = params;
 
-    const LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN = `oidc-spa.login-redirect-initiated:${configId}`;
-
     let lastPublicUrl: string | undefined = undefined;
 
     async function loginOrGoToAuthServer(params: Params): Promise<never> {
@@ -89,11 +90,24 @@ export function createLoginOrGoToAuthServer(params: {
             redirectUrl: redirectUrl_params,
             extraQueryParams_local,
             transformUrlBeforeRedirect_local,
+            onCantFetchWellKnownEndpointError: onCantFetchWellKnownEndpointError_params,
             ...rest
         } = params;
+        let onCantFetchWellKnownEndpointError = onCantFetchWellKnownEndpointError_params;
 
         log?.(`Calling loginOrGoToAuthServer ${JSON.stringify(params, null, 2)}`);
 
+        delay_until_online: {
+            const { isOnline, prOnline } = getIsOnline();
+            if (isOnline) {
+                break delay_until_online;
+            }
+            log?.(
+                "The browser seem offline, waiting to get back a connection before proceeding to login"
+            );
+            await prOnline;
+        }
+
         login_specific_handling: {
             if (rest.action !== "login") {
                 break login_specific_handling;
@@ -125,17 +139,23 @@ export function createLoginOrGoToAuthServer(params: {
 
             bf_cache_handling: {
                 if (rest.doForceReloadOnBfCache) {
-                    window.removeEventListener("pageshow", event => {
+                    const callback = (event: { persisted: boolean }) => {
                         if (!event.persisted) {
                             return;
                         }
                         location.reload();
-                    });
+                    };
+
+                    window.addEventListener("pageshow", callback);
+
+                    onCantFetchWellKnownEndpointError = () => {
+                        window.removeEventListener("pageshow", callback);
+                        onCantFetchWellKnownEndpointError_params();
+                    };
+
                     break bf_cache_handling;
                 }
 
-                localStorage.setItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN, "true");
-
                 const callback = (event: { persisted: boolean }) => {
                     if (!event.persisted) {
                         return;
@@ -156,21 +176,19 @@ export function createLoginOrGoToAuthServer(params: {
                             window.history.back();
                         }
                     } else {
-                        log?.("The current page doesn't require auth...");
-
-                        if (
-                            localStorage.getItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN) === null
-                        ) {
-                            log?.("but the user is now authenticated, reloading the page");
-                            location.reload();
-                        } else {
-                            log?.("and the user doesn't seem to be authenticated, avoiding a reload");
-                            globalContext.evtHasLoginBeenCalled.current = false;
-                        }
+                        // NOTE: We know the user is not logged in because login can only be called when not logged in.
+                        log?.("The current page doesn't require auth, avoiding reloading the page");
+                        globalContext.evtHasLoginBeenCalled.current = false;
                     }
                 };
 
                 window.addEventListener("pageshow", callback);
+
+                onCantFetchWellKnownEndpointError = () => {
+                    window.removeEventListener("pageshow", callback);
+                    globalContext.evtHasLoginBeenCalled.current = false;
+                    onCantFetchWellKnownEndpointError_params();
+                };
             }
         }
 
@@ -327,21 +345,31 @@ export function createLoginOrGoToAuthServer(params: {
                 extraTokenParams:
                     getExtraTokenParams === undefined ? undefined : noUndefined(getExtraTokenParams())
             })
-            .then(() => new Promise<never>(() => {}));
+            .then(
+                () => new Promise<never>(() => {}),
+                (error: Error) => {
+                    if (error.message === "Failed to fetch") {
+                        // NOTE: See ./loginSilent for explanation.
+                        onCantFetchWellKnownEndpointError();
+
+                        return new Promise<never>(() => {});
+                    }
+
+                    // NOTE: Here, except error on our understanding there can't be any other
+                    // error.
+                    assert(false, "30442320");
+                }
+            );
     }
 
-    const { unsubscribe } = evtIsUserLoggedIn.subscribe(isLoggedIn => {
+    const { unsubscribe } = evtInitializationOutcomeUserNotLoggedIn.subscribe(() => {
         unsubscribe();
 
-        if (isLoggedIn) {
-            localStorage.removeItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN);
-        } else {
-            const realPushState = history.pushState.bind(history);
-            history.pushState = function pushState(...args) {
-                lastPublicUrl = window.location.href;
-                return realPushState(...args);
-            };
-        }
+        const realPushState = history.pushState.bind(history);
+        history.pushState = function pushState(...args) {
+            lastPublicUrl = window.location.href;
+            return realPushState(...args);
+        };
     });
 
     return {

package/src/core/loginSilent.ts

@@ -12,6 +12,7 @@ import { getIsDev } from "../tools/isDev";
 import { type AuthResponse } from "./AuthResponse";
 import { addOrUpdateSearchParam } from "../tools/urlSearchParams";
 import { initIframeMessageProtection } from "./iframeMessageProtection";
+import { getIsOnline } from "../tools/getIsOnline";
 
 type ResultOfLoginSilent =
     | {
@@ -55,6 +56,15 @@ export async function loginSilent(params: {
         log
     } = params;
 
+    delay_until_online: {
+        const { isOnline, prOnline } = getIsOnline();
+        if (isOnline) {
+            break delay_until_online;
+        }
+        log?.("The browser seems offline, waiting to get back a connection before proceeding to login");
+        await prOnline;
+    }
+
     const dResult = new Deferred<ResultOfLoginSilent>();
 
     const timeoutDelayMs: number = (() => {
@@ -80,8 +90,7 @@ export async function loginSilent(params: {
 
     const { decodeEncryptedAuth, getIsEncryptedAuthResponse, clearSessionStoragePublicKey } =
         await initIframeMessageProtection({
-            stateUrlParamValue: stateUrlParamValue_instance,
-            log
+            stateUrlParamValue: stateUrlParamValue_instance
         });
 
     let clearTimeouts: (params: { wasSuccess: boolean }) => void;

package/src/core/ongoingLoginOrRefreshProcesses.ts

@@ -32,6 +32,14 @@ export async function startLoginOrRefreshProcess(): Promise<{
 }
 
 export async function waitForAllOtherOngoingLoginOrRefreshProcessesToComplete(params: {
+    // NOTE: when providing
+    // - prUnlock: new Promise<never>(()=>{}); All the subsequent startLoginOrRefreshProcess()
+    //   will never resolve: No lock can be acquired anymore in this app instance.
+    // - prUnlock: Promise.resolve(); The subsequent startLoginOrRefreshProcess() will resolve
+    //   normally: The lock can be acquired again
+    // - prUnlock: prMightOrMightNotResolve. The lock will be acquirable again assuming the pr ever resolves.
+    //
+    // In any case it does not affect the call that are already running.
     prUnlock: Promise<void>;
 }): Promise<void> {
     const { prUnlock } = params;

package/vendor/backend/tsafe.js

@@ -1,2 +1,2 @@
-(()=>{"use strict";var e={720:function(e,r){var t,n=this&&this.__extends||(t=function(e,r){return t=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,r){e.__proto__=r}||function(e,r){for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(e[t]=r[t])},t(e,r)},function(e,r){if("function"!=typeof r&&null!==r)throw new TypeError("Class extends value "+String(r)+" is not a constructor or null");function n(){this.constructor=e}t(e,r),e.prototype=null===r?Object.create(r):(n.prototype=r.prototype,new n)});Object.defineProperty(r,"__esModule",{value:!0}),r.AssertionError=void 0,r.assert=function e(r,t){if(0===arguments.length&&(r=!0),void 0===i){if(!r){var n=new o("function"==typeof t?t():t);throw Error.captureStackTrace&&Error.captureStackTrace(n,e),n}}else i=void 0},r.is=function(e){var r={};if(void 0!==i)throw i=void 0,new Error(u);return i=r,Promise.resolve().then((function(){if(i===r)throw new Error(u)})),null};var o=function(e){function r(r){var t=this.constructor,n=e.call(this,"Wrong assertion encountered"+(r?': "'.concat(r,'"'):""))||this;return n.originalMessage=r,Object.setPrototypeOf(n,t.prototype),n.stack,n}return n(r,e),r}(Error);r.AssertionError=o;var i=void 0,u="Wrong usage of the `is` function refer to https://docs.tsafe.dev/is"},202:(e,r)=>{Object.defineProperty(r,"__esModule",{value:!0}),r.exclude=function(e){var r=e instanceof Object?function(r){return e.indexOf(r)<0}:function(r){return r!==e};return function(e){return r(e)}}},135:(e,r)=>{Object.defineProperty(r,"__esModule",{value:!0}),r.id=void 0,r.id=function(e){return e}},952:function(e,r){var t=this&&this.__values||function(e){var r="function"==typeof Symbol&&Symbol.iterator,t=r&&e[r],n=0;if(t)return t.call(e);if(e&&"number"==typeof e.length)return{next:function(){return e&&n>=e.length&&(e=void 0),{value:e&&e[n++],done:!e}}};throw new TypeError(r?"Object is not iterable.":"Symbol.iterator is not defined.")};Object.defineProperty(r,"__esModule",{value:!0}),r.isAmong=function(e,r){var n,o;try{for(var i=t(e),u=i.next();!u.done;u=i.next())if(u.value===r)return!0}catch(e){n={error:e}}finally{try{u&&!u.done&&(o=i.return)&&o.call(i)}finally{if(n)throw n.error}}return!1}}},r={};function t(n){var o=r[n];if(void 0!==o)return o.exports;var i=r[n]={exports:{}};return e[n].call(i.exports,i,i.exports,t),i.exports}var n={};(()=>{var e=n;Object.defineProperty(e,"__esModule",{value:!0}),e.exclude=e.isAmong=e.id=e.is=e.assert=void 0;var r=t(720);Object.defineProperty(e,"assert",{enumerable:!0,get:function(){return r.assert}}),Object.defineProperty(e,"is",{enumerable:!0,get:function(){return r.is}});var o=t(135);Object.defineProperty(e,"id",{enumerable:!0,get:function(){return o.id}});var i=t(952);Object.defineProperty(e,"isAmong",{enumerable:!0,get:function(){return i.isAmong}});var u=t(202);Object.defineProperty(e,"exclude",{enumerable:!0,get:function(){return u.exclude}})})(),module.exports=n})();
+(()=>{"use strict";var e={720:function(e,r){var t,n=this&&this.__extends||(t=function(e,r){return t=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,r){e.__proto__=r}||function(e,r){for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(e[t]=r[t])},t(e,r)},function(e,r){if("function"!=typeof r&&null!==r)throw new TypeError("Class extends value "+String(r)+" is not a constructor or null");function n(){this.constructor=e}t(e,r),e.prototype=null===r?Object.create(r):(n.prototype=r.prototype,new n)});Object.defineProperty(r,"__esModule",{value:!0}),r.AssertionError=void 0,r.assert=function e(r,t){if(0===arguments.length&&(r=!0),void 0===i){if(!r){var n=new o("function"==typeof t?t():t);throw Error.captureStackTrace&&Error.captureStackTrace(n,e),n}}else i=void 0},r.is=function(e){var r={};if(void 0!==i)throw i=void 0,new Error(u);return i=r,Promise.resolve().then((function(){if(i===r)throw new Error(u)})),null};var o=function(e){function r(r){var t=this.constructor,n=e.call(this,"Wrong assertion encountered"+(r?': "'.concat(r,'"'):""))||this;return n.originalMessage=r,Object.setPrototypeOf(n,t.prototype),n}return n(r,e),r}(Error);r.AssertionError=o;var i=void 0,u="Wrong usage of the `is` function refer to https://docs.tsafe.dev/is"},202:(e,r)=>{Object.defineProperty(r,"__esModule",{value:!0}),r.exclude=function(e){var r=e instanceof Object?function(r){return e.indexOf(r)<0}:function(r){return r!==e};return function(e){return r(e)}}},135:(e,r)=>{Object.defineProperty(r,"__esModule",{value:!0}),r.id=void 0,r.id=function(e){return e}},952:function(e,r){var t=this&&this.__values||function(e){var r="function"==typeof Symbol&&Symbol.iterator,t=r&&e[r],n=0;if(t)return t.call(e);if(e&&"number"==typeof e.length)return{next:function(){return e&&n>=e.length&&(e=void 0),{value:e&&e[n++],done:!e}}};throw new TypeError(r?"Object is not iterable.":"Symbol.iterator is not defined.")};Object.defineProperty(r,"__esModule",{value:!0}),r.isAmong=function(e,r){var n,o;try{for(var i=t(e),u=i.next();!u.done;u=i.next())if(u.value===r)return!0}catch(e){n={error:e}}finally{try{u&&!u.done&&(o=i.return)&&o.call(i)}finally{if(n)throw n.error}}return!1}}},r={};function t(n){var o=r[n];if(void 0!==o)return o.exports;var i=r[n]={exports:{}};return e[n].call(i.exports,i,i.exports,t),i.exports}var n={};(()=>{var e=n;Object.defineProperty(e,"__esModule",{value:!0}),e.exclude=e.isAmong=e.id=e.is=e.assert=void 0;var r=t(720);Object.defineProperty(e,"assert",{enumerable:!0,get:function(){return r.assert}}),Object.defineProperty(e,"is",{enumerable:!0,get:function(){return r.is}});var o=t(135);Object.defineProperty(e,"id",{enumerable:!0,get:function(){return o.id}});var i=t(952);Object.defineProperty(e,"isAmong",{enumerable:!0,get:function(){return i.isAmong}});var u=t(202);Object.defineProperty(e,"exclude",{enumerable:!0,get:function(){return u.exclude}})})(),module.exports=n})();
 exports.__oidcSpaBundle = true;