https://waymind.ai/assets/diagnostic-QJjieMbN.js

1import{t as C,O as l}from"./desiredPostLoginRedirectUrl--AbHTvC5.js";import{i as g,W as f}from"./index-B7Lskjt_.js";import{b as $}from"./index-BLBvecUy.js";import"./urlSearchParams-CpA8CwXx.js";function T(a){const{issuerUri:e}=a;if(!g({issuerUri:e}))throw new Error([`oidc-spa: The issuer uri provided ${e}`,"if you are in an environnement that should support multiple","auth provider, you should first test `isKeycloakUrl({ issuerUri })`","before calling parseKeycloakIssuerUri({ issuerUri })"].join(" "));const t=new URL(e.replace(/\/$/,"")),n=t.pathname.split("/realms/");$(n.length===2);const[c,i]=n;return{origin:t.origin,realm:i,kcHttpRelativePath:c===""?void 0:c}}function U(a){const{issuerUri:e}=a,t=T({issuerUri:e}),n=`${t.origin}${t.kcHttpRelativePath??""}`,c=s=>`${n}/admin/${encodeURIComponent(s)}/console`,i=`${n}/realms/${encodeURIComponent(t.realm)}`;return{issuerUriParsed:t,adminConsoleUrl:c(t.realm),adminConsoleUrl_master:c("master"),getAccountUrl:({clientId:s,locale:r,validRedirectUri:u})=>{const o=new URL(`${n}/realms/${t.realm}/account`);return o.searchParams.set("referrer",s),o.searchParams.set("referrer_uri",(()=>{try{return C({urlish:u,doAssertNoQueryParams:!0,doOutputWithTrailingSlash:!0})}catch{return C({urlish:u,doAssertNoQueryParams:!1})}})()),r!==void 0&&o.searchParams.set("kc_locale",r),o.href},fetchUserProfile:({accessToken:s})=>fetch(`${i}/account`,{headers:{Accept:"application/json",Authorization:`Bearer ${s}`}}).then(r=>r.json()),fetchUserInfo:({accessToken:s})=>fetch(`${i}/protocol/openid-connect/userinfo`,{headers:{Accept:"application/json",Authorization:`Bearer ${s}`}}).then(r=>r.json()),transformUrlBeforeRedirectForRegister:s=>{const r=new URL(s);return r.pathname=r.pathname.replace(/\/auth$/,"/registrations"),r.href}}}function y(a){return fetch(a).then(async e=>{if(!e.ok)return!1;try{await e.json()}catch{return!1}return!0},()=>!1)}function R(a){const{stringWithWildcards:e,candidate:t}=a;if(!e.includes("*"))return e===t;const n=e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/\\\*/g,".*");return new RegExp(`^${n}$`).test(t)}async function P(a){const{issuerUri:e}=a,t=["The OIDC server is either down or the issuerUri you provided is incorrect.",`You provided the issuerUri: ${e}`,`Endpoint that couldn't be reached: ${e}${f}`].join(`
2`);if(!g({issuerUri:e}))return new l({messageOrCause:[t,"","If you happen to be using Keycloak, be aware that the issuerUri you provided doesn't match the expected shape.","It should look like: https://<YOUR_KEYCLOAK_DOMAIN><KC_HTTP_RELATIVE_PATH>/realms/<YOUR_REALM>","Unless configured otherwise the KC_HTTP_RELATIVE_PATH is '/' by default on recent version of Keycloak."].join(`
3`),isAuthServerLikelyDown:!0});const n=U({issuerUri:e}),c=i=>{const{kcHttpRelativePath:s}=i;return`${n.issuerUriParsed.origin}${s??""}/realms/${encodeURIComponent(n.issuerUriParsed.realm)}`};if(n.issuerUriParsed.kcHttpRelativePath===void 0){const i=c({kcHttpRelativePath:"/auth"});if(await y(`${i}${f}`))return new l({messageOrCause:["Your Keycloak server is configured with KC_HTTP_RELATIVE_PATH=/auth",`The issuerUri you provided: ${e}`,`The correct issuerUri is: ${i}`,"(You are missing the /auth portion)"].join(`
4`),isAuthServerLikelyDown:!1})}else{const i=c({kcHttpRelativePath:void 0});if(await y(`${i}${f}`))return new l({messageOrCause:["Your Keycloak server is configured with KC_HTTP_RELATIVE_PATH=/",`The issuerUri you provided: ${e}`,`The correct issuerUri is: ${i}`,`(You should remove the ${n.issuerUriParsed.kcHttpRelativePath} portion.)`].join(`
5`),isAuthServerLikelyDown:!1})}return new l({messageOrCause:[t,"","Given the shape of the issuerUri you provided, it seems that you are using Keycloak.",`- Make sure the realm '${n.issuerUriParsed.realm}' exists.`,"- Check the KC_HTTP_RELATIVE_PATH that you might have configured your keycloak server with.",`  For example if you have KC_HTTP_RELATIVE_PATH=/xxx the issuerUri should be ${c({kcHttpRelativePath:"/xxx"})}`].join(`
6`),isAuthServerLikelyDown:!0})}async function _(a){const{redirectUri:e,issuerUri:t,clientId:n,authorizationEndpointUrl:c}=a;e:{if(await y(`${t}${f}`))break e;return P({issuerUri:t})}{const i=await fetch(e).then(r=>r.ok?{"Content-Security-Policy":r.headers.get("Content-Security-Policy"),"X-Frame-Options":r.headers.get("X-Frame-Options")}:new Error(`${e} responded with a ${r.status} status code.`),r=>r);if(i instanceof Error)return new l({isAuthServerLikelyDown:!1,messageOrCause:new Error("Unexpected error while trying to diagnose why the silent sign-in process timed out.",{cause:cspOrError})});const s=i;e:{const r=s["Content-Security-Policy"];if(r===null)break e;const u=Object.fromEntries(r.split(";").filter(o=>o!=="").map(o=>{const[m,...p]=o.split(" ");return $(m!==void 0),$(p.length!==0),[m,p]}));

6r:{const o=u["frame-src"];if(o===void 0||!(()=>{for(const d of o){if(d==="'none'")return!0;const h=new URL(c).origin;if(d==="'self'"&&new URL(location.href).origin===h||R({candidate:h,stringWithWildcards:d}))return!1}return!0})())break r;const p=(()=>{const d=new URL(location.href).hostname,{hostname:h,origin:v}=new URL(c);if(d===h)return"'self'";const[w,k]=d.split(".").reverse();return k&&h.endsWith(`.${k}.${w}`)?`https://*.${k}.${w}`:v})();return new l({isAuthServerLikelyDown:!1,messageOrCause:[`Session restoration via iframe failed due to the following HTTP header on GET ${e}:`,`
7Content-Security-Policy “frame-src”: ${o.join("; ")}`,`
8This header prevents opening an iframe to ${c}.`,`
9To fix this:`,`
10  - Update your CSP to: frame-src ${[...o.filter(d=>d!=="'none'"),p]}`,`
11  - OR remove the frame-src directive from your CSP`,`
12  - OR, if you cannot change your CSP, call bootstrapOidc/createOidc with sessionRestorationMethod: "full page redirect"`,`
13
14More info: https://docs.oidc-spa.dev/v/v10/resources/csp-configuration`].join(" ")})}r:{const o=u["frame-ancestors"];if(o===void 0||!(o.includes("'none'")||!o.includes("'self'")))break r;return new l({isAuthServerLikelyDown:!1,messageOrCause:[`Session restoration via iframe failed due to the following HTTP header on GET ${e}:`,`
15Content-Security-Policy “frame-ancestors”: ${o.join("; ")}`,`
16This header prevents your app from being iframed by itself.`,`
17To fix this:`,`

18  - Update your CSP to: frame-ancestors 'self'`,`
19  - OR remove the frame-ancestors directive from your CSP`,`
20  - OR, if you cannot modify your CSP, call bootstrapOidc/createOidc with sessionRestorationMethod: "full page redirect"`,`
21
22More info: https://docs.oidc-spa.dev/v/v10/resources/csp-configuration`].join(" ")})}}e:{const r="X-Frame-Options",u=s[r];if(u===null||!u.toLowerCase().includes("deny"))break e;return new l({isAuthServerLikelyDown:!1,messageOrCause:[`Session restoration via iframe failed due to the following HTTP header on GET ${e}:`,`
23${r}: ${u}`,`
24This header prevents your app from being framed by itself.`,`
25To fix this, remove the ${r} header and rely on Content-Security-Policy if you need to restrict framing.`,`
26
27More info: https://docs.oidc-spa.dev/v/v10/resources/csp-configuration`].join(" ")})}}return new l({isAuthServerLikelyDown:!1,messageOrCause:[`The silent sign-in process timed out.
28`,`Based on the diagnostic performed by oidc-spa the more likely causes are:
29`,`- Either the client ID "${n}" does not exist, or
30`,`- You forgot to add the OIDC callback URL to the list of Valid Redirect URIs.
31`,`Client ID: "${n}"
32`,`Callback URL to add to the list of Valid Redirect URIs: "${e}"
33
34`,...(()=>{if(!g({issuerUri:t}))return["Check the documentation of your OIDC server to learn how to configure the public client (Authorization Code Flow + PKCE) properly."];const i=U({issuerUri:t});return[`It seems you are using Keycloak. Follow these steps to resolve the issue:
35
36`,`1. Go to the Keycloak admin console: ${i.adminConsoleUrl_master}
37`,`2. Log in as an admin user.
38`,`3. In the top left corner select the realm "${i.issuerUriParsed.realm}".
39`,`4. In the left menu, click on "Clients".
40`,`5. Locate the client "${n}" in the list and click on it.
41`,`6. Find "Valid Redirect URIs" and add "${e}" to the list.
42`,`7. Save the changes.
43
44`,"For more information, refer to the documentation: https://docs.oidc-spa.dev/v/v10/providers-configuration/keycloak"]})(),`
45
46`,"If nothing works, or if you see in the console a message mentioning 'refused to frame' there might be a problem with your CSP.","Read more: https://docs.oidc-spa.dev/v/v10/resources/csp-configuration"].join(" ")})}async function b(a){const{issuerUri:e,clientId:t}=a;e:{if(await y(`${e}${f}`))break e;return P({issuerUri:e})}return new l({isAuthServerLikelyDown:!1,messageOrCause:[`Failed to fetch the token endpoint.
47`,`This is usually due to a CORS issue.
48`,`Make sure you have added '${window.location.origin}' to the list of Web Origins`,`in the '${t}' client configuration of your OIDC server.
49`,`
50`,...(()=>{if(!g({issuerUri:e}))return["Check the documentation of your OIDC server to learn how to configure the public client (Authorization Code Flow + PKCE) properly."];const n=U({issuerUri:e});return[`Since it seems that you are using Keycloak, here are the steps to follow:
51`,`1. Go to the Keycloak admin console: ${n.adminConsoleUrl_master}
52`,`2. Log in as an admin user.
53`,`3. In the top left corner select the realm "${n.issuerUriParsed.realm}".
54`,`4. In the left menu, click on "Clients".
55`,`5. Find '${t}' in the list of clients and click on it.
56`,`6. Find 'Web Origins' and add '${window.location.origin}' to the list.
57`,`7. Save the changes.
58
59`,"More info: https://docs.oidc-spa.dev/v/v10/providers-configuration/keycloak"]})()].join(" ")})}export{b as createFailedToFetchTokenEndpointInitializationError,_ as createIframeTimeoutInitializationError,P as createWellKnownOidcConfigurationEndpointUnreachableInitializationError};