1"use strict";(self.webpackChunkhbApp=self.webpackChunkhbApp||[]).push([[7984],{67984(ut,Se,ie){ie.d(Se,{_p:()=>U,qM:()=>L,i7:()=>G,$5:()=>st,O:()=>Y});var c=ie(29293);class $ extends Error{}$.prototype.name="InvalidTokenError";var S,b,t,Te={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},K=(t=>(t[t.NONE=0]="NONE",t[t.ERROR=1]="ERROR",t[t.WARN=2]="WARN",t[t.INFO=3]="INFO",t[t.DEBUG=4]="DEBUG",t))(K||{});(t=K||(K={})).reset=function e(){S=3,b=Te},t.setLevel=function r(i){if(!(0<=i&&i<=4))throw new Error("Invalid log level");S=i},t.setLogger=function s(i){b=i};var p=class x{constructor(e){this._name=e}debug(...e){S>=4&&b.debug(x._format(this._name,this._method),...e)}info(...e){S>=3&&b.info(x._format(this._name,this._method),...e)}warn(...e){S>=2&&b.warn(x._format(this._name,this._method),...e)}error(...e){S>=1&&b.error(x._format(this._name,this._method),...e)}throw(e){throw this.error(e),e}create(e){const r=Object.create(this);return r._method=e,r.debug("begin"),r}static createStatic(e,r){const s=new x(`${e}.${r}`);return s.debug("begin"),s}static _format(e,r){const s=`[${e}]`;return r?`${s} ${r}:`:s}static debug(e,...r){S>=4&&b.debug(x._format(e),...r)}static info(e,...r){S>=3&&b.info(x._format(e),...r)}static warn(e,...r){S>=2&&b.warn(x._format(e),...r)}static error(e,...r){S>=1&&b.error(x._format(e),...r)}};K.reset();var J=class{static decode(t){try{return function Ee(t,e){if("string"!=typeof t)throw new $("Invalid token specified: must be a string");e||(e={});const r=!0===e.header?0:1,s=t.split(".")[r];if("string"!=typeof s)throw new $(`Invalid token specified: missing part #${r+1}`);let i;try{i=function ke(t){let e=t.replace(/-/g,"+").replace(/_/g,"/");switch(e.length%4){case 0:break;case 2:e+="==";break;case 3:e+="=";break;default:throw new Error("base64 string is not of the correct length")}try{return function be(t){return decodeURIComponent(atob(t).replace(/(.)/g,(e,r)=>{let s=r.charCodeAt(0).toString(16).toUpperCase();return s.length<2&&(s="0"+s),"%"+s}))}(e)}catch{return atob(e)}}(s)}catch(n){throw new $(`Invalid token specified: invalid base64 for part #${r+1} (${n.message})`)}try{return JSON.parse(i)}catch(n){throw new $(`Invalid token specified: invalid json for part #${r+1} (${n.message})`)}}(t)}catch(e){throw p.error("JwtUtils.decode",e),e}}static generateSignedJwt(t,e,r){return c(function*(){const n=`${y.encodeBase64Url((new TextEncoder).encode(JSON.stringify(t)))}.${y.encodeBase64Url((new TextEncoder).encode(JSON.stringify(e)))}`,o=yield window.crypto.subtle.sign({name:"ECDSA",hash:{name:"SHA-256"}},r,(new TextEncoder).encode(n));return`${n}.${y.encodeBase64Url(new Uint8Array(o))}`})()}static generateSignedJwtWithHmac(t,e,r){return c(function*(){const n=`${y.encodeBase64Url((new TextEncoder).encode(JSON.stringify(t)))}.${y.encodeBase64Url((new TextEncoder).encode(JSON.stringify(e)))}`,o=yield window.crypto.subtle.sign("HMAC",r,(new TextEncoder).encode(n));return`${n}.${y.encodeBase64Url(new Uint8Array(o))}`})()}},B=t=>btoa([...new Uint8Array(t)].map(e=>String.fromCharCode(e)).join("")),Re=(()=>{let t=class v{static _randomWord(){const r=new Uint32Array(1);return crypto.getRandomValues(r),r[0]}static generateUUIDv4(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,s=>(+s^v._randomWord()&15>>+s/4).toString(16)).replace(/-/g,"")}static generateCodeVerifier(){return v.generateUUIDv4()+v.generateUUIDv4()+v.generateUUIDv4()}static generateCodeChallenge(r){return c(function*(){if(!crypto.subtle)throw new Error("Crypto.subtle is available only in secure contexts (HTTPS).");try{const i=(new TextEncoder).encode(r),n=yield crypto.subtle.digest("SHA-256",i);return B(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(s){throw p.error("CryptoUtils.generateCodeChallenge",s),s}})()}static generateBasicAuth(r,s){const n=(new TextEncoder).encode([r,s].join(":"));return B(n)}static hash(r,s){return c(function*(){const i=(new TextEncoder).encode(s),n=yield crypto.subtle.digest(r,i);return new Uint8Array(n)})()}static customCalculateJwkThumbprint(r){return c(function*(){let s;switch(r.kty){case"RSA":s={e:r.e,kty:r.kty,n:r.n};break;case"EC":s={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":s={crv:r.crv,kty:r.kty,x:r.x};break;case"oct":s={crv:r.k,kty:r.kty};break;default:throw new Error("Unknown jwk type")}const i=yield v.hash("SHA-256",JSON.stringify(s));return v.encodeBase64Url(i)})()}static generateDPoPProof(r){return c(function*({url:s,accessToken:i,httpMethod:n,keyPair:o,nonce:a}){let l,d;const u={jti:window.crypto.randomUUID(),htm:n??"GET",htu:s,iat:Math.floor(Date.now()/1e3)};i&&(l=yield v.hash("SHA-256",i),d=v.encodeBase64Url(l),u.ath=d),a&&(u.nonce=a);try{const g=yield crypto.subtle.exportKey("jwk",o.publicKey),_={alg:"ES256",typ:"dpop+jwt",jwk:{crv:g.crv,kty:g.kty,x:g.x,y:g.y}};return yield J.generateSignedJwt(_,u,o.privateKey)}catch(g){throw g instanceof TypeError?new Error(`Error exporting dpop public key: ${g.message}`):g}}).apply(this,arguments)}static generateDPoPJkt(r){return c(function*(){try{const s=yield crypto.subtle.exportKey("jwk",r.publicKey);return yield v.customCalculateJwkThumbprint(s)}catch(s){throw s instanceof TypeError?new Error(`Could not retrieve dpop keys from storage: ${s.message}`):s}})()}static generateDPoPKeys(){return c(function*(){return yield window.crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign","verify"])})()}static generateClientAssertionJwt(r,s,i){return c(function*(n,o,a,l="HS256"){const d=Math.floor(Date.now()/1e3),u={alg:l,typ:"JWT"},g={iss:n,sub:n,aud:a,jti:v.generateUUIDv4(),exp:d+300,iat:d},h={HS256:"SHA-256",HS384:"SHA-384",HS512:"SHA-512"}[l];if(!h)throw new Error(`Unsupported algorithm: ${l}. Supported algorithms are: HS256, HS384, HS512`);const f=new TextEncoder,m=yield crypto.subtle.importKey("raw",f.encode(o),{name:"HMAC",hash:h},!1,["sign"]);return yield J.generateSignedJwtWithHmac(u,g,m)}).apply(this,arguments)}};return t.encodeBase64Url=e=>B(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"),t})(),y=Re,C=class{constructor(t){this._name=t,this._callbacks=[],this._logger=new p(`Event('${this._name}')`)}addHandler(t){return this._callbacks.push(t),()=>this.removeHandler(t)}removeHandler(t){const e=this._callbacks.lastIndexOf(t);e>=0&&this._callbacks.splice(e,1)}raise(...t){var e=this;
1return c(function*(){e._logger.debug("raise:",...t);for(const r of e._callbacks)yield r(...t)})()}},ne=class{static center({...t}){var e;return null==t.width&&(t.width=null!=(e=[800,720,600,480].find(i=>i<=window.outerWidth/1.618))?e:360),null!=t.left||(t.left=Math.max(0,Math.round(window.screenX+(window.outerWidth-t.width)/2))),null!=t.height&&(null!=t.top||(t.top=Math.max(0,Math.round(window.screenY+(window.outerHeight-t.height)/2)))),t}static serialize(t){return Object.entries(t).filter(([,e])=>null!=e).map(([e,r])=>`${e}=${"boolean"!=typeof r?r:r?"yes":"no"}`).join(",")}},R=class z extends C{constructor(){super(...arguments),this._logger=new p(`Timer('${this._name}')`),this._timerHandle=null,this._expiration=0,this._callback=()=>{const e=this._expiration-z.getEpochTime();this._logger.debug("timer completes in",e),this._expiration<=z.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(e){const r=this._logger.create("init");e=Math.max(Math.floor(e),1);const s=z.getEpochTime()+e;if(this.expiration===s&&this._timerHandle)return void r.debug("skipping since already initialized for expiration at",this.expiration);this.cancel(),r.debug("using duration",e),this._expiration=s;const i=Math.min(e,5);this._timerHandle=setInterval(this._callback,1e3*i)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}},V=class{static readParams(t,e="query"){if(!t)throw new TypeError("Invalid URL");const s=new URL(t,"http://127.0.0.1")["fragment"===e?"hash":"search"];return new URLSearchParams(s.slice(1))}},D=";",U=class extends Error{constructor(t,e){var r,s,i;if(super(t.error_description||t.error||""),this.form=e,this.name="ErrorResponse",!t.error)throw p.error("ErrorResponse","No error passed"),new Error("No error passed");this.error=t.error,this.error_description=null!=(r=t.error_description)?r:null,this.error_uri=null!=(s=t.error_uri)?s:null,this.state=t.userState,this.session_state=null!=(i=t.session_state)?i:null,this.url_state=t.url_state}},L=class extends Error{constructor(t){super(t),this.name="ErrorTimeout"}},Ie=class{constructor(t){this._logger=new p("AccessTokenEvents"),this._expiringTimer=new R("Access token expiring"),this._expiredTimer=new R("Access token expired"),this._expiringNotificationTimeInSeconds=t.expiringNotificationTimeInSeconds}load(t){var e=this;return c(function*(){const r=e._logger.create("load");if(t.access_token&&void 0!==t.expires_in){const s=t.expires_in;if(r.debug("access token present, remaining duration:",s),s>0){let n=s-e._expiringNotificationTimeInSeconds;n<=0&&(n=1),r.debug("registering expiring timer, raising in",n,"seconds"),e._expiringTimer.init(n)}else r.debug("canceling existing expiring timer because we're past expiration."),e._expiringTimer.cancel();const i=s+1;r.debug("registering expired timer, raising in",i,"seconds"),e._expiredTimer.init(i)}else e._expiringTimer.cancel(),e._expiredTimer.cancel()})()}unload(){var t=this;return c(function*(){t._logger.debug("unload: canceling existing access token timers"),t._expiringTimer.cancel(),t._expiredTimer.cancel()})()}addAccessTokenExpiring(t){return this._expiringTimer.addHandler(t)}removeAccessTokenExpiring(t){this._expiringTimer.removeHandler(t)}addAccessTokenExpired(t){return this._expiredTimer.addHandler(t)}removeAccessTokenExpired(t){this._expiredTimer.removeHandler(t)}},Pe=class{constructor(t,e,r,s,i){this._callback=t,this._client_id=e,this._intervalInSeconds=s,this._stopOnError=i,this._logger=new p("CheckSessionIFrame"),this._timer=null,this._session_state=null,this._message=o=>{o.origin===this._frame_origin&&o.source===this._frame.contentWindow&&("error"===o.data?(this._logger.error("error message from check session op iframe"),this._stopOnError&&this.stop()):"changed"===o.data?(this._logger.debug("changed message from check session op iframe"),this.stop(),this._callback()):this._logger.debug(o.data+" message from check session op iframe"))};const n=new URL(r);this._frame_origin=n.origin,this._frame=window.document.createElement("iframe"),this._frame.style.visibility="hidden",this._frame.style.position="fixed",this._frame.style.left="-1000px",this._frame.style.top="0",this._frame.width="0",this._frame.height="0",this._frame.src=n.href}load(){return new Promise(t=>{this._frame.onload=()=>{t()},window.document.body.appendChild(this._frame),window.addEventListener("message",this._message,!1)})}start(t){if(this._session_state===t)return;this._logger.create("start"),this.stop(),this._session_state=t;const e=()=>{!this._frame.contentWindow||!this._session_state||this._frame.contentWindow.postMessage(this._client_id+" "+this._session_state,this._frame_origin)};e(),this._timer=setInterval(e,1e3*this._intervalInSeconds)}stop(){this._logger.create("stop"),this._session_state=null,this._timer&&(clearInterval(this._timer),this._timer=null)}},G=class{constructor(){this._logger=new p("InMemoryWebStorage"),this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(t){return this._logger.create(`getItem('${t}')`),this._data[t]}setItem(t,e){this._logger.create(`setItem('${t}')`),this._data[t]=e}removeItem(t){this._logger.create(`removeItem('${t}')`),delete this._data[t]}get length(){return Object.getOwnPropertyNames(this._data).length}key(t){return Object.getOwnPropertyNames(this._data)[t]}}
1,Q=class extends Error{constructor(t,e){super(e),this.name="ErrorDPoPNonce",this.nonce=t}},X=class{constructor(t=[],e=null,r={}){this._jwtHandler=e,this._extraHeaders=r,this._logger=new p("JsonService"),this._contentTypes=[],this._contentTypes.push(...t,"application/json"),e&&this._contentTypes.push("application/jwt")}fetchWithTimeout(t){return c(function*(e,r={}){const{timeoutInSeconds:s,...i}=r;if(!s)return yield fetch(e,i);const n=new AbortController,o=setTimeout(()=>n.abort(),1e3*s);try{return yield fetch(e,{...r,signal:n.signal})}catch(a){throw a instanceof DOMException&&"AbortError"===a.name?new L("Network timed out"):a}finally{clearTimeout(o)}}).apply(this,arguments)}getJson(t){var e=this;return c(function*(r,{token:s,credentials:i,timeoutInSeconds:n}={}){const o=e._logger.create("getJson"),a={Accept:e._contentTypes.join(", ")};let l;s&&(o.debug("token passed, setting Authorization header"),a.Authorization="Bearer "+s),e._appendExtraHeaders(a);try{o.debug("url:",r),l=yield e.fetchWithTimeout(r,{method:"GET",headers:a,timeoutInSeconds:n,credentials:i})}catch(g){throw o.error("Network Error"),g}o.debug("HTTP response received, status",l.status);const d=l.headers.get("Content-Type");if(d&&!e._contentTypes.find(g=>d.startsWith(g))&&o.throw(new Error(`Invalid response Content-Type: ${d??"undefined"}, from URL: ${r}`)),l.ok&&e._jwtHandler&&d?.startsWith("application/jwt"))return yield e._jwtHandler(yield l.text());let u;try{u=yield l.json()}catch(g){throw o.error("Error parsing JSON response",g),l.ok?g:new Error(`${l.statusText} (${l.status})`)}if(!l.ok)throw o.error("Error from server:",u),u.error?new U(u):new Error(`${l.statusText} (${l.status}): ${JSON.stringify(u)}`);return u}).apply(this,arguments)}postForm(t,e){var r=this;return c(function*(s,{body:i,basicAuth:n,timeoutInSeconds:o,initCredentials:a,extraHeaders:l}){const d=r._logger.create("postForm"),u={Accept:r._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded",...l};let g;void 0!==n&&(u.Authorization="Basic "+n),r._appendExtraHeaders(u);try{d.debug("url:",s),g=yield r.fetchWithTimeout(s,{method:"POST",headers:u,body:i,timeoutInSeconds:o,credentials:a})}catch(m){throw d.error("Network error"),m}d.debug("HTTP response received, status",g.status);const _=g.headers.get("Content-Type");if(_&&!r._contentTypes.find(m=>_.startsWith(m)))throw new Error(`Invalid response Content-Type: ${_??"undefined"}, from URL: ${s}`);const h=yield g.text();let f={};if(h)try{f=JSON.parse(h)}catch(m){throw d.error("Error parsing JSON response",m),g.ok?m:new Error(`${g.statusText} (${g.status})`)}if(!g.ok){if(d.error("Error from server:",f),g.headers.has("dpop-nonce")){const m=g.headers.get("dpop-nonce");throw new Q(m,`${JSON.stringify(f)}`)}throw f.error?new U(f,i):new Error(`${g.statusText} (${g.status}): ${JSON.stringify(f)}`)}return f}).apply(this,arguments)}_appendExtraHeaders(t){const e=this._logger.create("appendExtraHeaders"),r=Object.keys(this._extraHeaders),s=["accept","content-type"],i=["authorization"];0!==r.length&&r.forEach(n=>{if(s.includes(n.toLocaleLowerCase()))return void e.warn("Protected header could not be set",n,s);if(i.includes(n.toLocaleLowerCase())&&Object.keys(t).includes(n))return void e.warn("Header could not be overridden",n,i);const o="function"==typeof this._extraHeaders[n]?this._extraHeaders[n]():this._extraHeaders[n];o&&""!==o&&(t[n]=o)})}},Ce=class{constructor(t){this._settings=t,this._logger=new p("MetadataService"),this._signingKeys=null,this._metadata=null,this._metadataUrl=this._settings.metadataUrl,this._jsonService=new X(["application/jwk-set+json"],null,this._settings.extraHeaders),this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}getMetadata(){var t=this;return c(function*(){const e=t._logger.create("getMetadata");if(t._metadata)return e.debug("using cached values"),t._metadata;if(!t._metadataUrl)throw e.throw(new Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",t._metadataUrl);const r=yield t._jsonService.getJson(t._metadataUrl,{credentials:t._fetchRequestCredentials,timeoutInSeconds:t._settings.requestTimeoutInSeconds});return e.debug("merging remote JSON with seed metadata"),t._metadata=Object.assign({},r,t._settings.metadataSeed),t._metadata})()}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(t=!0){return this._getMetadataProperty("token_endpoint",t)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(t=!0){return this._getMetadataProperty("revocation_endpoint",t)}getKeysEndpoint(t=!0){return this._getMetadataProperty("jwks_uri",t)}_getMetadataProperty(t){var e=this;return c(function*(r,s=!1){const i=e._logger.create(`_getMetadataProperty('${r}')`),n=yield e.getMetadata();if(i.debug("resolved"),void 0===n[r]){if(!0===s)return void i.warn("Metadata does not contain optional property");i.throw(new Error("Metadata does not contain property "+r))}return n[r]}).apply(this,arguments)}getSigningKeys(){var t=this;return c(function*(){const e=t._logger.create("getSigningKeys");if(t._signingKeys)return e.debug("returning signingKeys from cache"),t._signingKeys;const r=yield t.getKeysEndpoint(!1);e.debug("got jwks_uri",r);const s=yield t._jsonService.getJson(r,{timeoutInSeconds:t._settings.requestTimeoutInSeconds});if(e.debug("got key set",s),!Array.isArray(s.keys))throw e.throw(new Error("Missing keys on keyset")),null;return t._signingKeys=s.keys,t._signingKeys})()}},Y=class{constructor({prefix:t="oidc.",store:e=localStorage}={}){this._logger=new p("WebStorageStateStore"),this._store=e,this._prefix=t}set(t,e){var r=this;return c(function*(){r._logger.create(`set('${t}')`),t=r._prefix+t,yield r._store.setItem(t,e)})()}get(t){var e=this;return c(function*(){return e._logger.create(`get('${t}')`),t=e._prefix+t,yield e._store.getItem(t)})()}remove(t){var e=this;return c(function*(){e._logger.create(`remove('${t}')`),t=e._prefix+t;const r=yield e._store.getItem(t);return yield e._store.removeItem(t),r})()}getAllKeys(){var t=this;return c(function*(){t._logger.create("getAllKeys");const e=yield t._store.length,r=[];for(let s=0;s<e;s++){const i=yield t._store.key(s);i&&0===i.indexOf(t._prefix)&&r.push(i.substr(t._prefix.length))}return r})()}},Z=class{constructor({authority:t,metadataUrl:e,metadata:r,signingKeys:s,metadataSeed:i,client_id:n,client_secret:o,response_type:a="code",scope:l="openid",redirect_uri:d,post_logout_redirect_uri:u,client_authentication:g="client_secret_post",token_endpoint_auth_signing_alg:_="HS256",prompt:h,display:f,max_age:m,ui_locales:A,acr_values:O,resource:q,response_mode:N,filterProtocolClaims:I=!0,loadUserInfo:M=!1,requestTimeoutInSeconds:H,staleStateAgeInSeconds:k=900,mergeClaimsStrategy:w={array:"replace"},disablePKCE:E=!1,stateStore:T,revokeTokenAdditionalContentTypes:P,fetchRequestCredentials:W,refreshTokenAllowedScope:it,extraQueryParams:nt={},extraTokenParams:ot={},extraHeaders:at={}
1,dpop:ct,omitScopeWhenRequesting:lt=!1}){var me;if(this.authority=t,e?this.metadataUrl=e:(this.metadataUrl=t,t&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=r,this.metadataSeed=i,this.signingKeys=s,this.client_id=n,this.client_secret=o,this.response_type=a,this.scope=l,this.redirect_uri=d,this.post_logout_redirect_uri=u,this.client_authentication=g,this.token_endpoint_auth_signing_alg=_,this.prompt=h,this.display=f,this.max_age=m,this.ui_locales=A,this.acr_values=O,this.resource=q,this.response_mode=N,this.filterProtocolClaims=I??!0,this.loadUserInfo=!!M,this.staleStateAgeInSeconds=k,this.mergeClaimsStrategy=w,this.omitScopeWhenRequesting=lt,this.disablePKCE=!!E,this.revokeTokenAdditionalContentTypes=P,this.fetchRequestCredentials=W||"same-origin",this.requestTimeoutInSeconds=H,T)this.stateStore=T;else{const dt=typeof window<"u"?window.localStorage:new G;this.stateStore=new Y({store:dt})}if(this.refreshTokenAllowedScope=it,this.extraQueryParams=nt,this.extraTokenParams=ot,this.extraHeaders=at,this.dpop=ct,this.dpop&&(null==(me=this.dpop)||!me.store))throw new Error("A DPoPStore is required when dpop is enabled")}},Ne=class{constructor(t,e){var r=this;this._settings=t,this._metadataService=e,this._logger=new p("UserInfoService"),this._getClaimsFromJwt=function(){var s=c(function*(i){const n=r._logger.create("_getClaimsFromJwt");try{const o=J.decode(i);return n.debug("JWT decoding successful"),o}catch(o){throw n.error("Error parsing JWT response"),o}});return function(i){return s.apply(this,arguments)}}(),this._jsonService=new X(void 0,this._getClaimsFromJwt,this._settings.extraHeaders)}getClaims(t){var e=this;return c(function*(){const r=e._logger.create("getClaims");t||e._logger.throw(new Error("No token passed"));const s=yield e._metadataService.getUserInfoEndpoint();r.debug("got userinfo url",s);const i=yield e._jsonService.getJson(s,{token:t,credentials:e._settings.fetchRequestCredentials,timeoutInSeconds:e._settings.requestTimeoutInSeconds});return r.debug("got claims",i),i})()}},oe=class{constructor(t,e){this._settings=t,this._metadataService=e,this._logger=new p("TokenClient"),this._jsonService=new X(this._settings.revokeTokenAdditionalContentTypes,null,this._settings.extraHeaders)}exchangeCode(t){var e=this;return c(function*({grant_type:r="authorization_code",redirect_uri:s=e._settings.redirect_uri,client_id:i=e._settings.client_id,client_secret:n=e._settings.client_secret,extraHeaders:o,...a}){const l=e._logger.create("exchangeCode");i||l.throw(new Error("A client_id is required")),s||l.throw(new Error("A redirect_uri is required")),a.code||l.throw(new Error("A code is required"));const d=new URLSearchParams({grant_type:r,redirect_uri:s});for(const[h,f]of Object.entries(a))null!=f&&d.set(h,f);if(("client_secret_basic"===e._settings.client_authentication||"client_secret_jwt"===e._settings.client_authentication)&&null==n)throw l.throw(new Error("A client_secret is required")),null;let u;const g=yield e._metadataService.getTokenEndpoint(!1);switch(e._settings.client_authentication){case"client_secret_basic":u=y.generateBasicAuth(i,n);break;case"client_secret_post":d.append("client_id",i),n&&d.append("client_secret",n);break;case"client_secret_jwt":{const h=yield y.generateClientAssertionJwt(i,n,g,e._settings.token_endpoint_auth_signing_alg);d.append("client_id",i),d.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),d.append("client_assertion",h);break}}l.debug("got token endpoint");const _=yield e._jsonService.postForm(g,{body:d,basicAuth:u,timeoutInSeconds:e._settings.requestTimeoutInSeconds,initCredentials:e._settings.fetchRequestCredentials,extraHeaders:o});return l.debug("got response"),_}).apply(this,arguments)}exchangeCredentials(t){var e=this;return c(function*({grant_type:r="password",client_id:s=e._settings.client_id,client_secret:i=e._settings.client_secret,scope:n=e._settings.scope,...o}){const a=e._logger.create("exchangeCredentials");s||a.throw(new Error("A client_id is required"));const l=new URLSearchParams({grant_type:r});e._settings.omitScopeWhenRequesting||l.set("scope",n);
1for(const[_,h]of Object.entries(o))null!=h&&l.set(_,h);if(("client_secret_basic"===e._settings.client_authentication||"client_secret_jwt"===e._settings.client_authentication)&&null==i)throw a.throw(new Error("A client_secret is required")),null;let d;const u=yield e._metadataService.getTokenEndpoint(!1);switch(e._settings.client_authentication){case"client_secret_basic":d=y.generateBasicAuth(s,i);break;case"client_secret_post":l.append("client_id",s),i&&l.append("client_secret",i);break;case"client_secret_jwt":{const _=yield y.generateClientAssertionJwt(s,i,u,e._settings.token_endpoint_auth_signing_alg);l.append("client_id",s),l.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),l.append("client_assertion",_);break}}a.debug("got token endpoint");const g=yield e._jsonService.postForm(u,{body:l,basicAuth:d,timeoutInSeconds:e._settings.requestTimeoutInSeconds,initCredentials:e._settings.fetchRequestCredentials});return a.debug("got response"),g}).apply(this,arguments)}exchangeRefreshToken(t){var e=this;return c(function*({grant_type:r="refresh_token",client_id:s=e._settings.client_id,client_secret:i=e._settings.client_secret,timeoutInSeconds:n,extraHeaders:o,...a}){const l=e._logger.create("exchangeRefreshToken");s||l.throw(new Error("A client_id is required")),a.refresh_token||l.throw(new Error("A refresh_token is required"));const d=new URLSearchParams({grant_type:r});for(const[h,f]of Object.entries(a))Array.isArray(f)?f.forEach(m=>d.append(h,m)):null!=f&&d.set(h,f);if(("client_secret_basic"===e._settings.client_authentication||"client_secret_jwt"===e._settings.client_authentication)&&null==i)throw l.throw(new Error("A client_secret is required")),null;let u;const g=yield e._metadataService.getTokenEndpoint(!1);switch(e._settings.client_authentication){case"client_secret_basic":u=y.generateBasicAuth(s,i);break;case"client_secret_post":d.append("client_id",s),i&&d.append("client_secret",i);break;case"client_secret_jwt":{const h=yield y.generateClientAssertionJwt(s,i,g,e._settings.token_endpoint_auth_signing_alg);d.append("client_id",s),d.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),d.append("client_assertion",h);break}}l.debug("got token endpoint");const _=yield e._jsonService.postForm(g,{body:d,basicAuth:u,timeoutInSeconds:n,initCredentials:e._settings.fetchRequestCredentials,extraHeaders:o});return l.debug("got response"),_}).apply(this,arguments)}revoke(t){var e=this;return c(function*(){var r;const s=e._logger.create("revoke");t.token||s.throw(new Error("A token is required"));const i=yield e._metadataService.getRevocationEndpoint(!1);s.debug(`got revocation endpoint, revoking ${null!=(r=t.token_type_hint)?r:"default token type"}`);const n=new URLSearchParams;for(const[o,a]of Object.entries(t))null!=a&&n.set(o,a);n.set("client_id",e._settings.client_id),e._settings.client_secret&&n.set("client_secret",e._settings.client_secret),yield e._jsonService.postForm(i,{body:n,timeoutInSeconds:e._settings.requestTimeoutInSeconds}),s.debug("got response")})()}},Me=class{constructor(t,e,r){this._settings=t,this._metadataService=e,this._claimsService=r,this._logger=new p("ResponseValidator"),this._userInfoService=new Ne(this._settings,this._metadataService),this._tokenClient=new oe(this._settings,this._metadataService)}validateSigninResponse(t,e,r){var s=this;return c(function*(){const i=s._logger.create("validateSigninResponse");s._processSigninState(t,e),i.debug("state processed"),yield s._processCode(t,e,r),i.debug("code processed"),t.isOpenId&&s._validateIdTokenAttributes(t,"",e.nonce),i.debug("tokens validated"),yield s._processClaims(t,e?.skipUserInfo,t.isOpenId),i.debug("claims processed")})()}validateCredentialsResponse(t,e){var r=this;return c(function*(){const s=r._logger.create("validateCredentialsResponse"),i=t.isOpenId&&!!t.id_token;i&&r._validateIdTokenAttributes(t),s.debug("tokens validated"),yield r._processClaims(t,e,i),s.debug("claims processed")})()}validateRefreshResponse(t,e){var r=this;return c(function*(){const n=r._logger.create("validateRefreshResponse");t.userState=e.data,null!=t.session_state||(t.session_state=e.session_state),null!=t.scope||(t.scope=e.scope),t.isOpenId&&t.id_token&&(r._validateIdTokenAttributes(t,e.i
1d_token),n.debug("ID Token validated")),t.id_token||(t.id_token=e.id_token,t.profile=e.profile);const o=t.isOpenId&&!!t.id_token;yield r._processClaims(t,!1,o),n.debug("claims processed")})()}validateSignoutResponse(t,e){const r=this._logger.create("validateSignoutResponse");if(e.id!==t.state&&r.throw(new Error("State does not match")),r.debug("state validated"),t.userState=e.data,t.error)throw r.warn("Response was error",t.error),new U(t)}_processSigninState(t,e){const s=this._logger.create("_processSigninState");if(e.id!==t.state&&s.throw(new Error("State does not match")),e.client_id||s.throw(new Error("No client_id on state")),e.authority||s.throw(new Error("No authority on state")),this._settings.authority!==e.authority&&s.throw(new Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==e.client_id&&s.throw(new Error("client_id mismatch on settings vs. signin state")),s.debug("state validated"),t.userState=e.data,t.url_state=e.url_state,null!=t.scope||(t.scope=e.scope),t.error)throw s.warn("Response was error",t.error),new U(t);e.code_verifier&&!t.code&&s.throw(new Error("Expected code in response"))}_processClaims(t){var e=this;return c(function*(r,s=!1,i=!0){const n=e._logger.create("_processClaims");if(r.profile=e._claimsService.filterProtocolClaims(r.profile),s||!e._settings.loadUserInfo||!r.access_token)return void n.debug("not loading user info");n.debug("loading user info");const o=yield e._userInfoService.getClaims(r.access_token);n.debug("user info claims received from user info endpoint"),i&&o.sub!==r.profile.sub&&n.throw(new Error("subject from UserInfo response does not match subject in ID Token")),r.profile=e._claimsService.mergeClaims(r.profile,e._claimsService.filterProtocolClaims(o)),n.debug("user info claims received, updated profile:",r.profile)}).apply(this,arguments)}_processCode(t,e,r){var s=this;return c(function*(){const i=s._logger.create("_processCode");if(t.code){i.debug("Validating code");const n=yield s._tokenClient.exchangeCode({client_id:e.client_id,client_secret:e.client_secret,code:t.code,redirect_uri:e.redirect_uri,code_verifier:e.code_verifier,extraHeaders:r,...e.extraTokenParams});Object.assign(t,n)}else i.debug("No code to process")})()}_validateIdTokenAttributes(t,e,r){var s;const i=this._logger.create("_validateIdTokenAttributes");i.debug("decoding ID Token JWT");const n=J.decode(null!=(s=t.id_token)?s:"");if(n.sub||i.throw(new Error("ID Token is missing a subject claim")),r&&n.nonce!==r&&i.throw(new Error("nonce in id_token does not match nonce in client storage")),e){const o=J.decode(e);n.sub!==o.sub&&i.throw(new Error("sub in id_token does not match current sub")),n.auth_time&&n.auth_time!==o.auth_time&&i.throw(new Error("auth_time in id_token does not match original auth_time")),n.azp&&n.azp!==o.azp&&i.throw(new Error("azp in id_token does not match original azp")),!n.azp&&o.azp&&i.throw(new Error("azp not in id_token, but present in original id_token"))}t.profile=n}},F=class re{constructor(e){this.id=e.id||y.generateUUIDv4(),this.data=e.data,this.created=e.created&&e.created>0?e.created:R.getEpochTime(),this.request_type=e.request_type,this.url_state=e.url_state}toStorageString(){return new p("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state})}static fromStorageString(e){return p.createStatic("State","fromStorageString"),Promise.resolve(new re(JSON.parse(e)))}static clearStaleState(e,r){return c(function*(){const s=p.createStatic("State","clearStaleState"),i=R.getEpochTime()-r,n=yield e.getAllKeys();s.debug("got keys",n);for(let o=0;o<n.length;o++){const a=n[o],l=yield e.get(a);let d=!1;if(l)try{const u=yield re.fromStorageString(l);s.debug("got item from key:",a,u.created),u.created<=i&&(d=!0)}catch(u){s.error("Error parsing state for key:",a,u),d=!0}else s.debug("no item in storage for key:",a),d=!0;d&&(s.debug("removed item for key:",a),e.remove(a))}})()}},ae=class se extends F{constructor(e){super(e),this.code_verifier=e.code_verifier,this.co
1de_challenge=e.code_challenge,this.authority=e.authority,this.client_id=e.client_id,this.redirect_uri=e.redirect_uri,this.scope=e.scope,this.client_secret=e.client_secret,this.extraTokenParams=e.extraTokenParams,this.response_mode=e.response_mode,this.skipUserInfo=e.skipUserInfo,this.nonce=e.nonce}static create(e){return c(function*(){const r=!0===e.code_verifier?y.generateCodeVerifier():e.code_verifier||void 0,s=r?yield y.generateCodeChallenge(r):void 0;return new se({...e,code_verifier:r,code_challenge:s})})()}toStorageString(){return new p("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,url_state:this.url_state,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo,nonce:this.nonce})}static fromStorageString(e){p.createStatic("SigninState","fromStorageString");const r=JSON.parse(e);return se.create(r)}},ce=class ye{constructor(e){this.url=e.url,this.state=e.state}static create(e){var r=this;return c(function*({url:s,authority:i,client_id:n,redirect_uri:o,response_type:a,scope:l,state_data:d,response_mode:u,request_type:g,client_secret:_,nonce:h,url_state:f,resource:m,skipUserInfo:A,extraQueryParams:O,extraTokenParams:q,disablePKCE:N,dpopJkt:I,omitScopeWhenRequesting:M,...H}){if(!s)throw r._logger.error("create: No url passed"),new Error("url");if(!n)throw r._logger.error("create: No client_id passed"),new Error("client_id");if(!o)throw r._logger.error("create: No redirect_uri passed"),new Error("redirect_uri");if(!a)throw r._logger.error("create: No response_type passed"),new Error("response_type");if(!l)throw r._logger.error("create: No scope passed"),new Error("scope");if(!i)throw r._logger.error("create: No authority passed"),new Error("authority");const k=yield ae.create({data:d,request_type:g,url_state:f,code_verifier:!N,client_id:n,authority:i,redirect_uri:o,response_mode:u,client_secret:_,scope:l,extraTokenParams:q,skipUserInfo:A,nonce:h}),w=new URL(s);w.searchParams.append("client_id",n),w.searchParams.append("redirect_uri",o),w.searchParams.append("response_type",a),M||w.searchParams.append("scope",l),h&&w.searchParams.append("nonce",h),I&&w.searchParams.append("dpop_jkt",I);let E=k.id;f&&(E=`${E}${D}${f}`),w.searchParams.append("state",E),k.code_challenge&&(w.searchParams.append("code_challenge",k.code_challenge),w.searchParams.append("code_challenge_method","S256")),m&&(Array.isArray(m)?m:[m]).forEach(P=>w.searchParams.append("resource",P));for(const[T,P]of Object.entries({response_mode:u,...H,...O}))null!=P&&w.searchParams.append(T,P.toString());return new ye({url:w.href,state:k})}).apply(this,arguments)}};ce._logger=new p("SigninRequest");var He=ce,ee=class{constructor(t){if(this.access_token="",this.token_type="",this.profile={},this.state=t.get("state"),this.session_state=t.get("session_state"),this.state){const e=decodeURIComponent(this.state).split(D);this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(D))}this.error=t.get("error"),this.error_description=t.get("error_description"),this.error_uri=t.get("error_uri"),this.code=t.get("code")}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-R.getEpochTime()}set expires_in(t){"string"==typeof t&&(t=Number(t)),void 0!==t&&t>=0&&(this.expires_at=Math.floor(t)+R.getEpochTime())}get isOpenId(){var t;return(null==(t=this.scope)?void 0:t.split(" ").includes("openid"))||!!this.id_token}},De=class{constructor({url:t,state_data:e,id_token_hint:r,post_logout_redirect_uri:s,extraQueryParams:i,request_type:n,client_id:o,url_state:a}){if(this._logger=new p("SignoutRequest"),!t)throw this._logger.error("ctor: No url passed"),new Error("url");const l=new URL(t);if(r&&l.searchParams.append("id_token_hint",r),o&&l.searchParams.append("client_id",o),s&&(l.searchParams.append("post_logout_redirect_uri",s),e||a)){this.state=new F({data:e,request_type:n,url_state:a});let d=this.state.id;a&&(d=`${d}${D}${a}`),l.searchParams.append("state",d)}for(const[d,u]of Object.entries({...i}))null!=u&&l.searchParams.append(d,u.toString());this.url=l.href}},$e=class{constructor(t){if(this.state=t.get("state"),this.state){const e=decodeURIComponent(this.state).split(D);this.state=e[0],e.length>1&&(this.url_state=e.slice(1).join(D))}this.error=t.get("error"),this.error_description=t.get("error_description"),this.error_uri=t.get("error_uri")}},Je=["nbf","jti","auth_time","nonce","acr","amr","azp","at_hash"],We=["sub","iss","aud","exp","iat"],Ke=class{constructor(t){this._settings=t,this._logger=new p("ClaimsService")}filterProtocolClaims(t){const e={...t};if(this._settings.filterProtocolClaims){let r;r=Array.isArray(this._settings.filterProtocolClaims)?this._settings.filterProtocolClaims:Je;for(const s of r)We.includes(s)||delete e[s]}return e}mergeClaims(t,e){const r={...t};for(const[s,i]of Object.entries(e))if(r[s]!==i)if(Array.isArray(r[s])||Array.isArray(i))if("replace"==this._settings.mergeClaimsStrategy.array)r[s]=i;else{const n=Array.isArray(r[s])?r[s]:[r[s]];for(const o of Array.isArray(i)?i:[i])n.includes(o)||n.push(o);r[s]=n}else r[s]="object"==typeof r[s]&&"object"==typeof i?this.mergeClaims(r[s],i):i;return r}},le=class{constructor(t,e){this.keys=t,this.nonce=e}},Le=class{constructor(t,e){this._logger=new p("OidcClient"),this.settings=t instanceof Z?t:new Z(t),this.metadataService=e??new Ce(this.settings),this._claimsService=new Ke(this.settings),this._val
1idator=new Me(this.settings,this.metadataService,this._claimsService),this._tokenClient=new oe(this.settings,this.metadataService)}createSigninRequest(t){var e=this;return c(function*({state:r,request:s,request_uri:i,request_type:n,id_token_hint:o,login_hint:a,skipUserInfo:l,nonce:d,url_state:u,response_type:g=e.settings.response_type,scope:_=e.settings.scope,redirect_uri:h=e.settings.redirect_uri,prompt:f=e.settings.prompt,display:m=e.settings.display,max_age:A=e.settings.max_age,ui_locales:O=e.settings.ui_locales,acr_values:q=e.settings.acr_values,resource:N=e.settings.resource,response_mode:I=e.settings.response_mode,extraQueryParams:M=e.settings.extraQueryParams,extraTokenParams:H=e.settings.extraTokenParams,dpopJkt:k,omitScopeWhenRequesting:w=e.settings.omitScopeWhenRequesting}){const E=e._logger.create("createSigninRequest");if("code"!==g)throw new Error("Only the Authorization Code flow (with PKCE) is supported");const T=yield e.metadataService.getAuthorizationEndpoint();E.debug("Received authorization endpoint",T);const P=yield He.create({url:T,authority:e.settings.authority,client_id:e.settings.client_id,redirect_uri:h,response_type:g,scope:_,state_data:r,url_state:u,prompt:f,display:m,max_age:A,ui_locales:O,id_token_hint:o,login_hint:a,acr_values:q,dpopJkt:k,resource:N,request:s,request_uri:i,extraQueryParams:M,extraTokenParams:H,request_type:n,response_mode:I,client_secret:e.settings.client_secret,skipUserInfo:l,nonce:d,disablePKCE:e.settings.disablePKCE,omitScopeWhenRequesting:w});yield e.clearStaleState();const W=P.state;return yield e.settings.stateStore.set(W.id,W.toStorageString()),P}).apply(this,arguments)}readSigninResponseState(t){var e=this;return c(function*(r,s=!1){const i=e._logger.create("readSigninResponseState"),n=new ee(V.readParams(r,e.settings.response_mode));if(!n.state)throw i.throw(new Error("No state in response")),null;const o=yield e.settings.stateStore[s?"remove":"get"](n.state);if(!o)throw i.throw(new Error("No matching state found in storage")),null;return{state:yield ae.fromStorageString(o),response:n}}).apply(this,arguments)}processSigninResponse(t,e){var r=this;return c(function*(s,i,n=!0){const o=r._logger.create("processSigninResponse"),{state:a,response:l}=yield r.readSigninResponseState(s,n);if(o.debug("received state from storage; validating response"),r.settings.dpop&&r.settings.dpop.store){const d=yield r.getDpopProof(r.settings.dpop.store);i={...i,DPoP:d}}try{yield r._validator.validateSigninResponse(l,a,i)}catch(d){if(!(d instanceof Q&&r.settings.dpop))throw d;{const u=yield r.getDpopProof(r.settings.dpop.store,d.nonce);
1i.DPoP=u,yield r._validator.validateSigninResponse(l,a,i)}}return l}).apply(this,arguments)}getDpopProof(t,e){var r=this;return c(function*(){let s,i;return(yield t.getAllKeys()).includes(r.settings.client_id)?(i=yield t.get(r.settings.client_id),i.nonce!==e&&e&&(i.nonce=e,yield t.set(r.settings.client_id,i))):(s=yield y.generateDPoPKeys(),i=new le(s,e),yield t.set(r.settings.client_id,i)),yield y.generateDPoPProof({url:yield r.metadataService.getTokenEndpoint(!1),httpMethod:"POST",keyPair:i.keys,nonce:i.nonce})})()}processResourceOwnerPasswordCredentials(t){var e=this;return c(function*({username:r,password:s,skipUserInfo:i=!1,extraTokenParams:n={}}){const o=yield e._tokenClient.exchangeCredentials({username:r,password:s,...n}),a=new ee(new URLSearchParams);return Object.assign(a,o),yield e._validator.validateCredentialsResponse(a,i),a}).apply(this,arguments)}useRefreshToken(t){var e=this;return c(function*({state:r,redirect_uri:s,resource:i,timeoutInSeconds:n,extraHeaders:o,extraTokenParams:a}){var l;const d=e._logger.create("useRefreshToken");let u,g;if(void 0===e.settings.refreshTokenAllowedScope)u=r.scope;else{const h=e.settings.refreshTokenAllowedScope.split(" ");u=((null==(l=r.scope)?void 0:l.split(" "))||[]).filter(m=>h.includes(m)).join(" ")}if(e.settings.dpop&&e.settings.dpop.store){const h=yield e.getDpopProof(e.settings.dpop.store);o={...o,DPoP:h}}try{g=yield e._tokenClient.exchangeRefreshToken({refresh_token:r.refresh_token,scope:u,redirect_uri:s,resource:i,timeoutInSeconds:n,extraHeaders:o,...a})}catch(h){if(!(h instanceof Q&&e.settings.dpop))throw h;o.DPoP=yield e.getDpopProof(e.settings.dpop.store,h.nonce),g=yield e._tokenClient.exchangeRefreshToken({refresh_token:r.refresh_token,scope:u,redirect_uri:s,resource:i,timeoutInSeconds:n,extraHeaders:o,...a})}const _=new ee(new URLSearchParams);return Object.assign(_,g),d.debug("validating response",_),yield e._validator.validateRefreshResponse(_,{...r,scope:u}),_}).apply(this,arguments)}createSignoutRequest(){var t=this;return c(function*({state:e,id_token_hint:r,client_id:s,request_type:i,url_state:n,post_logout_redirect_uri:o=t.settings.post_logout_redirect_uri,extraQueryParams:a=t.settings.extraQueryParams}={}){const l=t._logger.create("createSignoutRequest"),d=yield t.metadataService.getEndSessionEndpoint();if(!d)throw l.throw(new Error("No end session endpoint")),null;l.debug("Received end session endpoint",d),!s&&o&&!r&&(s=t.settings.client_id);const u=new De({url:d,id_token_hint:r,client_id:s,post_logout_redirect_uri:o,state_data:e,extraQueryParams:a,request_type:i,url_state:n});yield t.clearStaleState();const g=u.state;return g&&(l.debug("Signout request has state to persist"),yield t.settings.stateStore.set(g.id,g.toStorageString())),u}).apply(this,arguments)}readSignoutResponseState(t){var e=this;return c(function*(r,s=!1){const i=e._logger.create("readSignoutResponseState"),n=new $e(V.readParams(r,e.settings.response_mode));if(!n.state){if(i.debug("No state in response"),n.error)throw i.warn("Response was error:",n.error),new U(n);return{state:void 0,response:n}}const o=yield e.settings.stateStore[s?"remove":"get"](n.state);if(!o)throw i.throw(new Error("No matching state found in storage")),null;return{state:yield F.fromStorageString(o),response:n}}).apply(this,arguments)}processSignoutResponse(t){var e=this;return c(function*(){const r=e._logger.create("processSignoutResponse"),{state:s,response:i}=yield e.readSignoutResponseState(t,!0);return s?(r.debug("Received state from storage; validating response"),e._validator.validateSignoutResponse(i,s)):r.debug("No state from storage; skipping response validation"),i})()}clearStaleState(){return this._logger.create("clearStaleState"),F.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}revokeToken(t,e){var r=this;return c(function*(){return r._logger.create("revokeToken"),yield r._tokenClient.revoke({token:t,token_type_hint:e})})()}},Fe=class{constructor(t){var e=this;this._userManager=t,this._logger=new p("SessionMonitor"),this._start=function(){var r=c(function*(s){const i=s.session_state;if(!i)return;const n=e._logger.create("_start");if(s.profile?(e._sub=s.profile.sub,n.debug("session_state",i,", sub",e._sub)):(e._sub=void 0,n.debug("session_state",i,", anonymous user")),e._checkSessionIFrame)e._checkSessionIFrame.start(i);else try{const o=yield e._userManager.metadataService.getCheckSessionIframe();if(o){n.debug("initializing check session iframe");const u=new Pe(e._callback,e._userManager.settings.client_id,o,e._userManager.settings.checkSessionIntervalInSeconds,e._userManager.settings.stopCheckSessionOnError);yield u.load(),e._checkSessionIFrame=u,u.start(i)}else n.warn("no check session iframe found in the metadata")}catch(o){n.error("Error from getCheckSessionIframe:",o instanceof Error?o.message:o)}});return function(s){return r.apply(this,arguments)}}(),this._stop=()=>{const r=this._logger.create("_stop");if(this._sub=void 0,this._checkSessionIFrame&&this._checkSessionIFrame.stop(),this._userManager.settings.monitorAnonymousSession){const s=setInterval(c(function*(){clearInterval(s);try{const i=yield e._userManager.querySessionStatus();i&&e._start({session_state:i.session_state,profile:i.sub?{sub:i.sub}:null})}catch(i){r.error("error from querySessionStatus",i instanceof Error?i.message:i)}}),1e3)}},this._callback=c(function*(){const r=e._logger.create("_callback");try{const s=yield e._userManager.querySessionStatus();let i=!0;s&&e._checkSessionIFrame?s.sub===e._sub?(i=!1,e._checkSessionIFrame.start(s.session_state),r.debug("same sub still logged in at OP, session state has changed, restarting check session iframe; session_state",s.session_state),yield e._userManager.events._raiseUserSessionChanged()):r.debug("different subject signed into OP",s.sub):r.debug("subject no longer signed into OP"),i?e._sub?yield e._userManager.events._raiseUserSignedOut():yield e._userManager.events._raiseUserSignedIn():r.debug("no change in session detected, no event to raise")}catch(s){e._sub&&(r.debug("Error calling queryCurrentSigninSession; raising signed out event",s),yield e._userManager.events._raiseUserSignedOut())}}),t||this._logger.throw(new Error("No user manager passed")),this._userManager.events.addUserLoaded(this._start),this._userManager.events.addUserUnloaded(this._stop),this._init().catch(r=>{this._logger.error(r)})}_init(){var t=this;return c(function*(){t._logger.create("_init");const e=yield t._userManager.getUser();if(e)t._start(e);else if(t._userManager.settings.monitorAnonymousSession){const r=yield t._userManager.querySessionStatus();r&&t._start({session_state:r.session_state,profile:r.sub?{sub:r.sub}:null})}})()}},te=class we{constructor(e){var r;this.id_token=e.id_token,this.session_state=null!=(r=e.session_state)?r:null,this.access_token=e.access_token,this.refresh_token=e.refresh_token,this.token_type=e.token_type,this.scope=e.scope,this.profile=e.profile,this.expires_at=e.expires_at,this.state=e.userState,this.url_state=e.url_state}get expires_in(){if(void 0!==this.expires_at)return this.expires_at-R.getEpochTime()}set expires_in(e){void 0!==e&&(this.expires_at=Math.floor(e)+R.getEpochTime())}get expired(){const e=this.expires_in;if(void 0!==e)return e<=0}get scopes(){var e,r;return null!=(r=null==(e=this.scope)?void 0:e.split(" "))?r:[]}toStorageString(){return new p("User").create("toStorageString"),JSON.stringify({id_token:this.id_token,session_state:this.session_state,access_token:this.access_token,refresh_token:this.refresh_token,token_type:this.token_type,scope:this.scope,profile:this.profile,expires_at:this.expires_at})}static fromStorageString(e){return p.createStatic("User","fromStorageString"),new we(JSON.parse(e))}},de="oidc-client",ue=class{constructor(){this._abort=new C("Window navigation aborted"),this._disposeHandlers=new Set,this._window=null}navigate(t){var e=this;return c(function*(){const r=e._logger.create("navigate");if(!e._window)throw new Error("Attempted to navigate on a disposed window");r.debug("setting URL in window"),e._window.location.replace(t.url);const{url:s,keepOpen:i}=yield new Promise((n,o)=>{const a=d=>{var u;const g=d.data,_=null!=(u=t.scriptOrigin)?u:window.location.origin;if(d.origin===_&&g?.source===de){try{const h=V.readParams(g.url,t.response_mode).get("state");if(h||r.warn("no state found in response url"),d.source!==e._window&&h!==t.state)return}catch{e._dispose(),o(new Error("Invalid response from window"))}n(g)}};window.addEventListener("message",a,!1),e._disposeHandlers.add(()=>window.removeEventListener("message",a,!1));const l=new BroadcastChannel(`oidc-client-popup-${t.state}`);l.addEventListener("message",a,!1),e._disposeHandlers.add(()=>l.close()),e._disposeHandlers.add(e._abort.addHandler(d=>{e._dispose(),o(d)}))});return r.debug("got response from window"),e._dispose(),i||e.close(),{url:s}})()}_dispose(){this._logger.create("_dispose");for(const t of this._disposeHandlers)t();this._disposeHandlers.clear()}static _notifyParent(t,e,r=!1,s=window.location.origin){const i={source:de,url:e,keepOpen:r},n=new p("_notifyParent");
1if(t)n.debug("With parent. Using parent.postMessage."),t.postMessage(i,s);else{n.debug("No parent. Using BroadcastChannel.");const o=new URL(e).searchParams.get("state");if(!o)throw new Error("No parent and no state in URL. Can't complete notification.");const a=new BroadcastChannel(`oidc-client-popup-${o}`);a.postMessage(i),a.close()}}},ge={location:!1,toolbar:!1,height:640,closePopupWindowAfterInSeconds:-1},_e="_blank",ze=60,Be=2,Ve=class extends Z{constructor(t){const{popup_redirect_uri:e=t.redirect_uri,popup_post_logout_redirect_uri:r=t.post_logout_redirect_uri,popupWindowFeatures:s=ge,popupWindowTarget:i=_e,redirectMethod:n="assign",redirectTarget:o="self",iframeNotifyParentOrigin:a=t.iframeNotifyParentOrigin,iframeScriptOrigin:l=t.iframeScriptOrigin,requestTimeoutInSeconds:d,silent_redirect_uri:u=t.redirect_uri,silentRequestTimeoutInSeconds:g,automaticSilentRenew:_=!0,validateSubOnSilentRenew:h=!0,includeIdTokenInSilentRenew:f=!1,monitorSession:m=!1,monitorAnonymousSession:A=!1,checkSessionIntervalInSeconds:O=Be,query_status_response_type:q="code",stopCheckSessionOnError:N=!0,revokeTokenTypes:I=["access_token","refresh_token"],revokeTokensOnSignout:M=!1,includeIdTokenInSilentSignout:H=!1,accessTokenExpiringNotificationTimeInSeconds:k=ze,maxSilentRenewTimeoutRetries:w,userStore:E}=t;if(super(t),this.popup_redirect_uri=e,this.popup_post_logout_redirect_uri=r,this.popupWindowFeatures=s,this.popupWindowTarget=i,this.redirectMethod=n,this.redirectTarget=o,this.iframeNotifyParentOrigin=a,this.iframeScriptOrigin=l,this.silent_redirect_uri=u,this.silentRequestTimeoutInSeconds=g||d||10,this.automaticSilentRenew=_,this.validateSubOnSilentRenew=h,this.includeIdTokenInSilentRenew=f,this.monitorSession=m,this.monitorAnonymousSession=A,this.checkSessionIntervalInSeconds=O,this.stopCheckSessionOnError=N,this.query_status_response_type=q,this.revokeTokenTypes=I,this.revokeTokensOnSignout=M,this.includeIdTokenInSilentSignout=H,this.accessTokenExpiringNotificationTimeInSeconds=k,this.maxSilentRenewTimeoutRetries=w,E)this.userStore=E;else{const T=typeof window<"u"?window.sessionStorage:new G;this.userStore=new Y({store:T})}}},pe=class ve extends ue{constructor({silentRequestTimeoutInSeconds:e=10}){super(),this._logger=new p("IFrameWindow"),this._timeoutInSeconds=e,this._frame=ve.createHiddenIframe(),this._window=this._frame.contentWindow}static createHiddenIframe(){const e=window.document.createElement("iframe");return e.style.visibility="hidden",e.style.position="fixed",e.style.left="-1000px",e.style.top="0",e.width="0",e.height="0",window.document.body.appendChild(e),e}navigate(e){var r=()=>super.navigate,s=this;return c(function*(){s._logger.debug("navigate: Using timeout of:",s._timeoutInSeconds);const i=setTimeout(()=>{s._abort.raise(new L("IFrame timed out without a response"))},1e3*s._timeoutInSeconds);return s._disposeHandlers.add(()=>clearTimeout(i)),yield r().call(s,e)})()}close(){var e;this._frame&&(this._frame.parentNode&&(this._frame.addEventListener("load",r=>{var s;const i=r.target;null==(s=i.parentNode)||s.removeChild(i),this._abort.raise(new Error("IFrame removed from DOM"))},!0),null==(e=this._frame.contentWindow)||e.location.replace("about:blank")),this._frame=null),this._window=null}static notifyParent(e,r){return super._notifyParent(window.parent,e,!1,r)}},Ge=class{constructor(t){this._settings=t,this._logger=new p("IFrameNavigator")}prepare(t){var e=this;return c(function*({silentRequestTimeoutInSeconds:r=e._settings.silentRequestTimeoutInSeconds}){return new pe({silentRequestTimeoutInSeconds:r})}).apply(this,arguments)}callback(t){var e=this;return c(function*(){e._logger.create("callback"),pe.notifyParent(t,e._settings.iframeNotifyParentOrigin)})()}},fe=class extends ue{constructor({popupWindowTarget:t=_e,popupWindowFeatures:e={},popupSignal:r,popupAbortOnClose:s}){super(),this._logger=new p("PopupWindow");const i=ne.center({...ge,...e});this._window=window.open(void 0,t,ne.serialize(i)),this.abortOnClose=!!s,r&&r.addEventListener("abort",()=>{var n;this._abort.raise(new Error(null!=(n=r.reason)?n:"Popup aborted"))}),e.closePopupWindowAfterInSeconds&&e.closePopupWindowAfterInSeconds>0&&setTimeout(()=>{this._window&&"boolean"==typeof this._window.closed&&!this._window.closed?this.close():this._abort.raise(new Error("Popup blocked by user"))},1e3*e.closePopupWindowAfterInSeconds)}navigate(t){var e=()=>super.navigate,r=this;return c(function*(){var s;null==(s=r._window)||s.focus();const i=setInterval(()=>{(!r._window||r._window.closed)&&(r._logger.debug("Popup closed by user or isolated by redirect"),n(),r._disposeHandlers.delete(n),r.abortOnClose&&r._abort.raise(new Error("Popup closed by user")))},500),n=()=>clearInterval(i);return r._disposeHandlers.add(n),yield e().call(r,t)})()}close(){this._window&&(this._window.closed||(this._window.close(),this._abort.raise(new Error("Popup closed")))),this._window=null}static notifyOpener(t,e){super._notifyParent(window.opener,t,e),!e&&!window.opener&&window.close()}},Ye=class{constructor(t){this._settings=t,this._logger=new p("PopupNavigator")}prepare(t){var e=this;return c(function*({popupWindowFeatures:r=e._settings.popupWindowFeatures,popupWindowTarget:s=e._settings.popupWindowTarget,popupSignal:i,popupAbortOnClose:n}){return new fe({popupWindowFeatures:r,popupWindowTarget:s,popupSignal:i,popupAbortOnClose:n})}).apply(this,arguments)}callback(t,e){var r=this;return c(function*(s,{keepOpen:i=!1}){r._logger.create("callback"),fe.notifyOpener(s,i)}).apply(this,arguments)}}
1,Ze=class{constructor(t){this._settings=t,this._logger=new p("RedirectNavigator")}prepare(t){var e=this;return c(function*({redirectMethod:r=e._settings.redirectMethod,redirectTarget:s=e._settings.redirectTarget}){var i;e._logger.create("prepare");let n=window.self;"top"===s&&(n=null!=(i=window.top)?i:window.self);const o=n.location[r].bind(n.location);let a;return{navigate:(l=c(function*(u){return e._logger.create("navigate"),yield new Promise((_,h)=>{a=h,window.addEventListener("pageshow",()=>_(window.location.href)),o(u.url)})}),function d(u){return l.apply(this,arguments)}),close:()=>{e._logger.create("close"),a?.(new Error("Redirect aborted")),n.stop()}};var l}).apply(this,arguments)}callback(){return c(function*(){})()}},et=class extends Ie{constructor(t){super({expiringNotificationTimeInSeconds:t.accessTokenExpiringNotificationTimeInSeconds}),this._logger=new p("UserManagerEvents"),this._userLoaded=new C("User loaded"),this._userUnloaded=new C("User unloaded"),this._silentRenewError=new C("Silent renew error"),this._userSignedIn=new C("User signed in"),this._userSignedOut=new C("User signed out"),this._userSessionChanged=new C("User session changed")}load(t){var e=()=>super.load,r=this;return c(function*(s,i=!0){yield e().call(r,s),i&&(yield r._userLoaded.raise(s))}).apply(this,arguments)}unload(){var t=()=>super.unload,e=this;return c(function*(){yield t().call(e),yield e._userUnloaded.raise()})()}addUserLoaded(t){return this._userLoaded.addHandler(t)}removeUserLoaded(t){return this._userLoaded.removeHandler(t)}addUserUnloaded(t){return this._userUnloaded.addHandler(t)}removeUserUnloaded(t){return this._userUnloaded.removeHandler(t)}addSilentRenewError(t){return this._silentRenewError.addHandler(t)}removeSilentRenewError(t){return this._silentRenewError.removeHandler(t)}_raiseSilentRenewError(t){var e=this;return c(function*(){yield e._silentRenewError.raise(t)})()}addUserSignedIn(t){return this._userSignedIn.addHandler(t)}removeUserSignedIn(t){this._userSignedIn.removeHandler(t)}_raiseUserSignedIn(){var t=this;return c(function*(){yield t._userSignedIn.raise()})()}addUserSignedOut(t){return this._userSignedOut.addHandler(t)}removeUserSignedOut(t){this._userSignedOut.removeHandler(t)}_raiseUserSignedOut(){var t=this;return c(function*(){yield t._userSignedOut.raise()})()}addUserSessionChanged(t){return this._userSessionChanged.addHandler(t)}removeUserSessionChanged(t){this._userSessionChanged.removeHandler(t)}_raiseUserSessionChanged(){var t=this;return c(function*(){yield t._userSessionChanged.raise()})()}},tt=class{constructor(t){var e=this;this._userManager=t,this._logger=new p("SilentRenewService"),this._isStarted=!1,this._retryTimer=new R("Retry Silent Renew"),this._timeoutRetryCount=0,this._tokenExpiring=c(function*(){const r=e._logger.create("_tokenExpiring");try{yield e._userManager.signinSilent(),e._timeoutRetryCount=0,r.debug("silent token renewal successful")}catch(s){if(s instanceof L){e._timeoutRetryCount++;const i=e._userManager.settings.maxSilentRenewTimeoutRetries;return void 0!==i&&e._timeoutRetryCount>i?(r.error(`Timeout retry limit reached (${e._timeoutRetryCount} > ${i}), raising silentRenewError:`,s),e._timeoutRetryCount=0,void(yield e._userManager.events._raiseSilentRenewError(s))):(r.warn(`ErrorTimeout from signinSilent (attempt ${e._timeoutRetryCount}), retry in 5s:`,s),void e._retryTimer.init(5))}r.error("Error from signinSilent:",s),e._timeoutRetryCount=0,yield e._userManager.events._raiseSilentRenewError(s)}})}start(){var t=this;return c(function*(){const e=t._logger.create("start");if(!t._isStarted){t._isStarted=!0,t._userManager.events.addAccessTokenExpiring(t._tokenExpiring),t._retryTimer.addHandler(t._tokenExpiring);try{yield t._userManager.getUser()}catch(r){e.error("getUser error",r)}}})()}stop(){this._isStarted&&(this._retryTimer.cancel(),this._retryTimer.removeHandler(this._tokenExpiring),this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring),this._isStarted=!1)}},rt=class{constructor(t){this.refresh_token=t.refresh_token,this.id_token=t.id_token,this.session_state=t.session_state,this.scope=t.scope,this.profile=t.profile,this.data=t.state}},st=class{constructor(t,e,r,s){this._logger=new p("UserManager"),this.settings=new Ve(t),this._client=new Le(t),this._redirectNavigator=e??new Ze(this.settings),this._popupNavigator=r??new Ye(this.settings),this._iframeNavigator=s??new Ge(this.settings),this._events=new et(this.settings),this._silentRenewService=new tt(this),this.settings.automaticSilentRenew&&this.startSilentRenew(),this._sessionMonitor=null,this.settings.monitorSession&&(this._sessionMonitor=new Fe(this))}get events(){return this._events}get metadataService(){return this._client.metadataService}getUser(){var t=this;return c(function*(e=!1){const r=t._logger.create("getUser"),s=yield t._loadUser();return s?(r.info("user loaded"),yield t._events.load(s,e),s):(r.info("user not found in storage"),null)}).apply(this,arguments)}removeUser(){var t=this;return c(function*(){const e=t._logger.create("removeUser");yield t.storeUser(null),e.info("user removed from storage"),yield t._events.unload()})()}signinRedirect(){var t=this;return c(function*(e={}){var r;t._logger.create("signinRedirect");const{redirectMethod:s,...i}=e;let n;null!=(r=t.settings.dpop)&&r.bind_authorization_code&&(n=yield t.generateDPoPJkt(t.settings.dpop));const o=yield t._redirectNavigator.prepare({redirectMethod:s});yield t._signinStart({request_type:"si:r",dpopJkt:n,...i},o)}).apply(this,arguments)}signinRedirectCallback(){var t=this;return c(function*(e=window.location.href){const r=t._logger.create("signinRedirectCallback"),s=yield t._signinEnd(e);return s.profile&&s.profile.sub?r.info("success, signed in subject",s.profile.sub):r.info("no subject"),s}).apply(this,arguments)}signinResourceOwnerCredentials(t){var e=this;return c(function*({username:r,password:s,skipUserInfo:i=!1}){const n=e._logger.create("signinResourceOwnerCredential"),o=yield e._client.processResourceOwnerPasswordCredentials({username:r,password:s,skipUserInfo:i,extraTokenParams:e.settings.extraTokenParams});n.debug("got signin response");const a=yield e._buildUser(o);return a.profile&&a.profile.sub?n.info("success, signed in subject",a.profile.sub):n.info("no subject"),a}).apply(this,arguments)}signinPopup(){var t=this;return c(function*(e={}){var r;const s=t._logger.create("signinPopup");let i;null!=(r=t.settings.dpop)&&r.bind_authorization_code&&(i=yield t.generateDPoPJkt(t.settings.dpop));const{popupWindowFeatures:n,popupWindowTarget:o,popupSignal:a,popupAbortOnClose:l,...d}=e,u=t.settings.popup_redirect_uri;u||s.throw(new Error("No popup_redirect_uri configured"));const g=yield t._popupNavigator.prepare({popupWindowFeatures:n,popupWindowTarget:o,popupSignal:a,popupAbortOnClose:l}),_=yield t._signin({request_type:"si:p",redirect_uri:u,display:"popup",dpopJkt:i,...d},g);return _&&(_.profile&&_.profile.sub?s.info("success, signed in subject",_.profile.sub):s.info("no subject")),_}).apply(this,arguments)}signinPopupCallback(){var t=this;return c(function*(e=window.location.href,r=!1){const s=t._logger.create("signinPopupCallback");yield t._popupNavigator.callback(e,{keepOpen:r}),s.info("success")}).apply(this,arguments)}signinSilent(){var t=this;return c(function*(e={}){var r,s;const i=t._logger.create("signinSilent"),{silentRequestTimeoutInSeconds:n,...o}=e;let l,a=yield t._loadUser();if(!e.forceIframeAuth&&a?.refresh_token){i.debug("using refresh token");const _=new rt(a);return yield t._useRefreshToken({state:_,redirect_uri:o.redirect_uri,resource:o.resource,extraTokenParams:o.extraTokenParams,timeoutInSeconds:n})}null!=(r=t.settings.dpop)&&r.bind_authorization_code&&(l=yield t.generateDPoPJkt(t.settings.dpop));const d=t.settings.silent_redirect_uri;let u;d||i.throw(new Error("No silent_redirect_uri configured")),a&&t.settings.val
1idateSubOnSilentRenew&&(i.debug("subject prior to silent renew:",a.profile.sub),u=a.profile.sub);const g=yield t._iframeNavigator.prepare({silentRequestTimeoutInSeconds:n});return a=yield t._signin({request_type:"si:s",redirect_uri:d,prompt:"none",id_token_hint:t.settings.includeIdTokenInSilentRenew?a?.id_token:void 0,dpopJkt:l,...o},g,u),a&&(null!=(s=a.profile)&&s.sub?i.info("success, signed in subject",a.profile.sub):i.info("no subject")),a}).apply(this,arguments)}_useRefreshToken(t){var e=this;return c(function*(){const r=yield e._client.useRefreshToken({timeoutInSeconds:e.settings.silentRequestTimeoutInSeconds,...t}),s=new te({...t.state,...r});return yield e.storeUser(s),yield e._events.load(s),s})()}signinSilentCallback(){var t=this;return c(function*(e=window.location.href){const r=t._logger.create("signinSilentCallback");yield t._iframeNavigator.callback(e),r.info("success")}).apply(this,arguments)}signinCallback(){var t=this;return c(function*(e=window.location.href){const{state:r}=yield t._client.readSigninResponseState(e);switch(r.request_type){case"si:r":return yield t.signinRedirectCallback(e);case"si:p":yield t.signinPopupCallback(e);break;case"si:s":yield t.signinSilentCallback(e);break;default:throw new Error("invalid request_type in state")}}).apply(this,arguments)}signoutCallback(){var t=this;return c(function*(e=window.location.href,r=!1){const{state:s}=yield t._client.readSignoutResponseState(e);if(s)switch(s.request_type){case"so:r":return yield t.signoutRedirectCallback(e);case"so:p":yield t.signoutPopupCallback(e,r);break;case"so:s":yield t.signoutSilentCallback(e);break;default:throw new Error("invalid request_type in state")}}).apply(this,arguments)}querySessionStatus(){var t=this;return c(function*(e={}){const r=t._logger.create("querySessionStatus"),{silentRequestTimeoutInSeconds:s,...i}=e,n=t.settings.silent_redirect_uri;n||r.throw(new Error("No silent_redirect_uri configured"));const o=yield t._loadUser(),a=yield t._iframeNavigator.prepare({silentRequestTimeoutInSeconds:s}),l=yield t._signinStart({request_type:"si:s",redirect_uri:n,prompt:"none",id_token_hint:t.settings.includeIdTokenInSilentRenew?o?.id_token:void 0,response_type:t.settings.query_status_response_type,scope:"openid",skipUserInfo:!0,...i},a);try{const d={},u=yield t._client.processSigninResponse(l.url,d);return r.debug("got signin response"),u.session_state&&u.profile.sub?(r.info("success for subject",u.profile.sub),{session_state:u.session_state,sub:u.profile.sub}):(r.info("success, user not authenticated"),null)}catch(d){if(t.settings.monitorAnonymousSession&&d instanceof U)switch(d.error){case"login_required":case"consent_required":case"interaction_required":case"account_selection_required":return r.info("success for anonymous user"),{session_state:d.session_state}}throw d}}).apply(this,arguments)}_signin(t,e,r){var s=this;return c(function*(){const i=yield s._signinStart(t,e);return yield s._signinEnd(i.url,r)})()}_signinStart(t,e){var r=this;return c(function*(){const s=r._logger.create("_signinStart");try{const i=yield r._client.createSigninRequest(t);return s.debug("got signin request"),yield e.navigate({url:i.url,state:i.state.id,response_mode:i.state.response_mode,scriptOrigin:r.settings.iframeScriptOrigin})}catch(i){throw s.debug("error after preparing navigator, closing navigator window"),e.close(),i}})()}_signinEnd(t,e){var r=this;return c(function*(){const s=r._logger.create("_signinEnd"),n=yield r._client.processSigninResponse(t,{});return s.debug("got signin response"),yield r._buildUser(n,e)})()}_buildUser(t,e){var r=this;return c(function*(){const s=r._logger.create("_buildUser"),i=new te(t);if(e){if(e!==i.profile.sub)throw s.debug("current user does not match user returned from signin. sub from signin:",i.profile.sub),new U({...t,error:"login_required"});s.debug("current user matches user returned from signin")}return yield r.storeUser(i),s.debug("user stored"),yield r._events.load(i),i})()}signoutRedirect(){var t=this;return c(function*(e={}){const r=t._logger.create("signoutRedirect"),{redirectMethod:s,...i}=e,n=yield t._redirectNavigator.prepare({redirectMethod:s});yield t._signoutStart({request_type:"so:r",post_logout_redirect_uri:t.settings.post_logout_redirect_uri,...i},n),r.info("success")}).apply(this,arguments)}signoutRedirectCallback(){var t=this;return c(function*(e=window.location.href){const r=t._logger.create("signoutRedirectCallback"),s=yield t._signoutEnd(e);return r.info("success"),s}).apply(this,arguments)}signoutPopup(){var t=this;return c(function*(e={}){const r=t._logger.create("signoutPopup"),{popupWindowFeatures:s,popupWindowTarget:i,popupSignal:n,...o}=e,a=t.settings.popup_post_logout_redirect_uri,l=yield t._popupNavigator.prepare({popupWindowFeatures:s,popupWindowTarget:i,popupSignal:n});yield t._signout({request_type:"so:p",post_logout_redirect_uri:a,state:null==a?void 0:{},...o},l),r.info("success")}).apply(this,arguments)}signoutPopupCallback(){var t=this;return c(function*(e=window.location.href,r=!1){const s=t._logger.create("signoutPopupCallback");yield t._popupNavigator.callback(e,{keepOpen:r}),s.info("success")}).apply(this,arguments)}_signout(t,e){var r=this;return c(function*(){const s=yield r._signoutStart(t,e);return yield r._signoutEnd(s.url)})()}_signoutStart(){var t=this;return c(function*(e={},r){var s;const i=t._logger.create("_signoutStart");try{const n=yield t._loadUser();i.debug("loaded current user from storage"),t.settings.revokeTokensOnSignout&&(yield t._revokeInternal(n));const o=e.id_token_hint||n&&n.id_token;o&&(i.debug("setting id_token_hint in signout request"),e.id_token_hint=o),yield t.removeUser(),i.debug("user removed, creating signout request");
1const a=yield t._client.createSignoutRequest(e);return i.debug("got signout request"),yield r.navigate({url:a.url,state:null==(s=a.state)?void 0:s.id,scriptOrigin:t.settings.iframeScriptOrigin})}catch(n){throw i.debug("error after preparing navigator, closing navigator window"),r.close(),n}}).apply(this,arguments)}_signoutEnd(t){var e=this;return c(function*(){const r=e._logger.create("_signoutEnd"),s=yield e._client.processSignoutResponse(t);return r.debug("got signout response"),s})()}signoutSilent(){var t=this;return c(function*(e={}){var r;const s=t._logger.create("signoutSilent"),{silentRequestTimeoutInSeconds:i,...n}=e,o=t.settings.includeIdTokenInSilentSignout?null==(r=yield t._loadUser())?void 0:r.id_token:void 0,a=t.settings.popup_post_logout_redirect_uri,l=yield t._iframeNavigator.prepare({silentRequestTimeoutInSeconds:i});yield t._signout({request_type:"so:s",post_logout_redirect_uri:a,id_token_hint:o,...n},l),s.info("success")}).apply(this,arguments)}signoutSilentCallback(){var t=this;return c(function*(e=window.location.href){const r=t._logger.create("signoutSilentCallback");yield t._iframeNavigator.callback(e),r.info("success")}).apply(this,arguments)}revokeTokens(t){var e=this;return c(function*(){const r=yield e._loadUser();yield e._revokeInternal(r,t)})()}_revokeInternal(t){var e=this;return c(function*(r,s=e.settings.revokeTokenTypes){const i=e._logger.create("_revokeInternal");if(!r)return;const n=s.filter(o=>"string"==typeof r[o]);if(n.length){for(const o of n)yield e._client.revokeToken(r[o],o),i.info(`${o} revoked successfully`),"access_token"!==o&&(r[o]=null);yield e.storeUser(r),i.debug("user stored"),yield e._events.load(r)}else i.debug("no need to revoke due to no token(s)")}).apply(this,arguments)}startSilentRenew(){this._logger.create("startSilentRenew"),this._silentRenewService.start()}stopSilentRenew(){this._silentRenewService.stop()}get _userStoreKey(){return`user:${this.settings.authority}:${this.settings.client_id}`}_loadUser(){var t=this;return c(function*(){const e=t._logger.create("_loadUser"),r=yield t.settings.userStore.get(t._userStoreKey);return r?(e.debug("user storageString loaded"),te.fromStorageString(r)):(e.debug("no user storageString"),null)})()}storeUser(t){var e=this;return c(function*(){const r=e._logger.create("storeUser");if(t){r.debug("storing user");const s=t.toStorageString();yield e.settings.userStore.set(e._userStoreKey,s)}else e._logger.debug("removing user"),yield e.settings.userStore.remove(e._userStoreKey),e.settings.dpop&&(yield e.settings.dpop.store.remove(e.settings.client_id))})()}clearStaleState(){var t=this;return c(function*(){yield t._client.clearStaleState()})()}dpopProof(t,e,r,s){var i=this;return c(function*(){var n,o;const a=yield null==(o=null==(n=i.settings.dpop)?void 0:n.store)?void 0:o.get(i.settings.client_id);if(a)return yield y.generateDPoPProof({url:t,accessToken:e?.access_token,httpMethod:r,keyPair:a.keys,nonce:s})})()}generateDPoPJkt(t){var e=this;return c(function*(){let r=yield t.store.get(e.settings.client_id);if(!r){const s=yield y.generateDPoPKeys();r=new le(s),yield t.store.set(e.settings.client_id,r)}return yield y.generateDPoPJkt(r.keys)})()}}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.