1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/web-DiIECAkN.js","assets/app-BMB7SW2A.js","assets/app-OQuk6CE5.css","assets/tslib.es6-CDuPK5Eb.js"])))=>i.map(i=>d[i]); 2import{W as Ee,r as Se,_ as ye}from"./app-BMB7SW2A.js";import{_ as j}from"./tslib.es6-CDuPK5Eb.js";const Oe="USER_CANCELLED",Ie=["access_denied","access denied","user_cancelled_authorize","user_cancelled","user cancelled","user canceled","login cancelled","login canceled","popup closed","window was closed"];function H(n){const e=new Error(n);return e.code=Oe,e}function F(n){const e=n.toLowerCase();return Ie.some(t=>e.includes(t))?H(n):new Error(n)}class m extends Ee{constructor(){super()}parseJwt(e){const o=e.split(".")[1].replace(/-/g,"+").replace(/_/g,"/"),r=decodeURIComponent(atob(o).split("").map(i=>"%"+("00"+i.charCodeAt(0).toString(16)).slice(-2)).join(""));return JSON.parse(r)}async loadScript(e){return new Promise((t,o)=>{const r=document.createElement("script");r.src=e,r.async=!0,r.onload=()=>{t()},r.onerror=o,document.body.appendChild(r)})}}m.OAUTH_STATE_KEY="social_login_oauth_pending";const he="social_login_oauth_pending",te="social_login_oauth_popup",Ae="social_login_oauth_result_",Z="social_login_oauth_delivered",Ue=new Set(["OAuth2Login","XLogin","Google Sign In","Authorization","TelegramLogin"]);function ge(n){return`${Ae}${n}`}function pe(n,e){return n==="oauth2"?`oauth2_${e}`:n==="twitter"?`twitter_oauth_${e}`:n==="telegram"?`telegram_oauth_${e}`:`google_oauth_${e}`}function be(n){try{sessionStorage.removeItem(Z),sessionStorage.setItem(te,n)}catch{}}function Pe(){try{sessionStorage.removeItem(te)}catch{}}function Le(){const n=new URLSearchParams(window.location.search),e=new URLSearchParams(window.location.hash.replace(/^#/,""));return n.has("code")||n.has("error")||n.has("hash")&&n.has("auth_date")||e.has("access_token")||e.has("id_token")||e.has("error")}function Re(){return typeof window>"u"?!1:!!window.opener||Ue.has(window.name)||!!sessionStorage.getItem(te)}function oe(){return localStorage.getItem(he)?Re()||Le():!1}function M(n,e,t){try{if(sessionStorage.getItem(Z))return;sessionStorage.setItem(Z,"1")}catch{}try{window.opener&&window.opener.postMessage(t,window.location.origin)}catch{}if(e)try{const o=new BroadcastChannel(pe(n,e));o.postMessage(t),o.close()}catch{}if(e)try{localStorage.setItem(ge(e),JSON.stringify(Object.assign(Object.assign({},t),{_ts:Date.now()})))}catch{}}function fe(n,e,t){const o=ge(e),r=pe(n,e);let i=null;try{i=new BroadcastChannel(r)}catch{}const s=c=>c?.source&&String(c.source).startsWith("angular")?!1:c?.type==="oauth-response"?(t.onResponse(c),!0):c?.type==="oauth-error"?(t.onError(c.error||"User cancelled the OAuth flow",c.code),!0):!1,l=c=>{c.origin===window.location.origin&&s(c.data)},a=c=>{if(!(c.key!==o||!c.newValue))try{const h=JSON.parse(c.newValue);localStorage.removeItem(o),s(h)}catch{}},u=c=>{s(c.data)};window.addEventListener("message",l),window.addEventListener("storage",a),i&&(i.onmessage=u);const d=window.setInterval(()=>{try{const c=localStorage.getItem(o);if(!c)return;localStorage.removeItem(o);const h=JSON.parse(c);s(h)}catch{}},300);return()=>{window.removeEventListener("message",l),window.removeEventListener("storage",a),clearInterval(d),i&&i.close();try{localStorage.removeItem(o)}catch{}}}const ie="Google refresh() is not available when using offline mode. Offline mode only returns serverAuthCode for backend token exchange. Send serverAuthCode to your backend and refresh tokens there, or switch google.mode to 'online' for client-side refresh.";class Ce extends m{constructor(){super(...arguments),this.clientId=null,this.loginType="online",this.GOOGLE_TOKEN_REQUEST_URL="https://www.googleapis.com/oauth2/v3/tokeninfo",this.GOOGLE_STATE_KEY="capgo_social_login_google_state"}async initialize(e,t,o,r){this.clientId=e,t&&(this.loginType=t),this.hostedDomain=o,this.redirectUrl=r}async login(e){if(!this.clientId)throw new Error("Google Client ID not set. Call initialize() first.");let t=e.scopes||[];t.length>0?(t.includes("https://www.googleapis.com/auth/userinfo.email")||t.push("https://www.googleapis.com/auth/userinfo.email"),t.includes("https://www.googleapis.com/auth/userinfo.profile")||t.push("https://www.googleapis.com/auth/userinfo.profile"),t.includes("openid")||t.push("openid")):t=["https://www.googleapis.com/auth/userinfo.email","https://www.googleapis.com/auth/userinfo.profile","openid"];const o=e.nonce||Math.random().toString(36).substring(2);return this.traditionalOAuth({scopes:t,nonce:o,hostedDomain:this.hostedDomain,prompt:e.prompt})}async logout(){if(this.loginType==="offline")return Promise.reject("Offline login doesn't store tokens. logout is not available");const e=this.getGoogleState();e&&await this.rawLogoutGoogle(e.accessToken)}async isLoggedIn(){if(this.loginType==="offline")return Promise.reject("Offline login doesn't store tokens. isLoggedIn is not available");const e=this.getGoogleState();if(!e)return{isLoggedIn:!1};try{const t=await this.accessTokenIsValid(e.accessToken),o=this.idTokenValid(e.idToken);if(t&&o)return{isLoggedIn:!0};try{await this.rawLogoutGoogle(e.accessToken,!1)}
2catch(r){console.error("Access token is not valid, but cannot logout",r)}return{isLoggedIn:!1}}catch(t){return Promise.reject(t)}}async getAuthorizationCode(){if(this.loginType==="offline")return Promise.reject("Offline login doesn't store tokens. getAuthorizationCode is not available");const e=this.getGoogleState();if(!e)throw new Error("No Google authorization code available");try{const t=await this.accessTokenIsValid(e.accessToken),o=this.idTokenValid(e.idToken);if(t&&o)return{accessToken:e.accessToken,jwt:e.idToken};try{await this.rawLogoutGoogle(e.accessToken,!1)}catch(r){console.error("Access token is not valid, but cannot logout",r)}throw new Error("No Google authorization code available")}catch(t){return Promise.reject(t)}}async refresh(){return this.loginType==="offline"?(console.warn(`[SocialLogin] ${ie}`),Promise.reject(new Error(ie))):Promise.reject(new Error("Google refresh is not implemented on web. Use login() again to obtain a new token."))}handleOAuthRedirect(e){const t=e.searchParams,o=t.get("error");
2if(o)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:t.get("error_description")||o};const r=t.get("code");if(r&&t.has("scope"))return{provider:"google",result:{serverAuthCode:r,responseType:"offline"}};const i=e.hash.substring(1);if(!i)return null;const s=new URLSearchParams(i),l=s.get("error");if(l)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:s.get("error_description")||l};const a=s.get("access_token"),u=s.get("id_token");if(a&&u){localStorage.removeItem(m.OAUTH_STATE_KEY);const d=this.parseJwt(u);return{provider:"google",result:{accessToken:{token:a},idToken:u,profile:{email:d.email||null,familyName:d.family_name||null,givenName:d.given_name||null,id:d.sub||null,name:d.name||null,imageUrl:d.picture||null},responseType:"online"}}}return null}async accessTokenIsValid(e){const t=`${this.GOOGLE_TOKEN_REQUEST_URL}?access_token=${encodeURIComponent(e)}`;try{const o=await fetch(t);if(!o.ok)return console.log(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. Response not successful. Status code: ${o.status}. Assuming that the token is not valid`),!1;const r=await o.text();if(!r)throw console.error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. Response body is null`),new Error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. Response body is null`);let i;try{i=JSON.parse(r)}catch(a){throw console.error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. Response body is not valid JSON. Error: ${a}`),new Error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. Response body is not valid JSON. Error: ${a}`)}const s=i.expires_in;if(s==null)throw console.error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. Response JSON does not include 'expires_in'.`),new Error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. Response JSON does not include 'expires_in'.`);let l;try{if(l=parseInt(s,10),isNaN(l))throw new Error("'expires_in' is not a valid integer")}catch(a){throw console.error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. 'expires_in': ${s} is not a valid integer. Error: ${a}`),new Error(`Invalid response from ${this.GOOGLE_TOKEN_REQUEST_URL}. 'expires_in': ${s} is not a valid integer. Error: ${a}`)}return l>5}catch(o){throw console.error(o),o}}idTokenValid(e){try{const t=this.parseJwt(e),o=Math.ceil(Date.now()/1e3)+5;return t.exp&&o<t.exp}catch{return!1}}async rawLogoutGoogle(e,t=null){if(t===null&&(t=await this.accessTokenIsValid(e)),t===!0){try{await fetch(`https://accounts.google.com/o/oauth2/revoke?token=${encodeURIComponent(e)}`),this.clearStateGoogle()}catch{}return}else{this.clearStateGoogle();return}}persistStateGoogle(e,t){try{window.localStorage.setItem(this.GOOGLE_STATE_KEY,JSON.stringify({accessToken:e,idToken:t}))}catch(o){console.error("Cannot persist state google",o)}}clearStateGoogle(){try{window.localStorage.removeItem(this.GOOGLE_STATE_KEY)}catch(e){console.error("Cannot clear state google",e)}}getGoogleState(){try{const e=window.localStorage.getItem(this.GOOGLE_STATE_KEY);if(!e)return null;const{accessToken:t,idToken:o}=JSON.parse(e);return{accessToken:t,idToken:o}}catch(e){return console.error("Cannot get state google",e),null}}async traditionalOAuth({scopes:e,hostedDomain:t,nonce:o,prompt:r}){var i;const s=[...new Set([...e||[],"openid"])],l=new URLSearchParams(Object.assign(Object.assign({client_id:(i=this.clientId)!==null&&i!==void 0?i:"",redirect_uri:this.redirectUrl||window.location.origin+window.location.pathname,response_type:this.loginType==="offline"?"code":"token id_token",scope:s.join(" ")},o&&{nonce:o}),{include_granted_scopes:"true",state:"popup"}));t!==void 0&&l.append("hd",t),r!==void 0&&l.append("prompt",r);const a=`https://accounts.google.com/o/oauth2/v2/auth?${l.toString()}`,u=500,d=600,c=window.screenX+(window.outerWidth-u)/2,h=window.screenY+(window.outerHeight-d)/2;localStorage.setItem(m.OAUTH_STATE_KEY,JSON.stringify({provider:"google",loginType:this.loginType,nonce:o})),be(o);const p=window.open(a,"Google Sign In",`width=${u},height=${d},left=${c},top=${h},popup=1`);let E,g,k=null;return new Promise((v,S)=>{if(!p){S(new Error("Failed to open popup"));return}let A=!1,N=!1;const b=(y=!1)=>
2{if(clearInterval(E),clearTimeout(g),k&&(k(),k=null),y)try{p.close()}catch{}},T=(y,P)=>{A||(A=!0,b(y),P())};k=fe("google",o,{onResponse:y=>{if(this.loginType==="online"){const{accessToken:P,idToken:L}=y;if(P&&L){const O=this.parseJwt(L);this.persistStateGoogle(P.token,L),T(!0,()=>{v({provider:"google",result:{accessToken:{token:P.token},idToken:L,profile:{email:O.email||null,familyName:O.family_name||null,givenName:O.given_name||null,id:O.sub||null,name:O.name||null,imageUrl:O.picture||null},responseType:"online"}})})}else T(!0,()=>{S(new Error("Invalid OAuth response: missing accessToken or idToken"))})}else{const{serverAuthCode:P}=y;if(!P){T(!0,()=>{S(new Error("Invalid OAuth response: missing serverAuthCode"))});return}T(!0,()=>{v({provider:"google",result:{responseType:"offline",serverAuthCode:P}})})}},onError:y=>{T(!0,()=>{S(F(y))})}}),g=setTimeout(()=>{T(!0,()=>{S(new Error("OAuth timeout"))})},3e5),E=setInterval(()=>{if(!N)try{p.closed&&T(!1,()=>{S(H("Popup closed"))})}catch{N=!0}},1e3)})}}const D=(n,e)=>{if(typeof n!="string")return e;const t=n.trim();return t.length>0?t:e};class Ne extends m{constructor(){super(),this.providers=new Map,this.TOKENS_KEY_PREFIX="capgo_social_login_oauth2_tokens_",this.STATE_PREFIX="capgo_social_login_oauth2_state_",this.CONFIG_KEY_PREFIX="capgo_social_login_oauth2_config_",this.restoreConfigurationsFromStorage()}normalizeScopeValue(e){return e?typeof e=="string"?e:Array.isArray(e)?e.filter(Boolean).join(" "):"":""}normalizeConfig(e,t){var o,r,i,s,l,a,u,d;const c=(o=t.appId)!==null&&o!==void 0?o:t.clientId,h=(r=t.authorizationBaseUrl)!==null&&r!==void 0?r:t.authorizationEndpoint,p=(i=t.accessTokenEndpoint)!==null&&i!==void 0?i:t.tokenEndpoint,E=(s=t.logoutUrl)!==null&&s!==void 0?s:t.endSessionEndpoint,g=(l=t.scope)!==null&&l!==void 0?l:t.scopes;if(!c)throw new Error(`OAuth2 provider '${e}' requires appId (or clientId).`);if(!t.redirectUrl)throw new Error(`OAuth2 provider '${e}' requires redirectUrl.`);if(!h&&!t.issuerUrl)throw new Error(`OAuth2 provider '${e}' requires authorizationBaseUrl (or authorizationEndpoint) or issuerUrl.`);return{appId:c,clientSecret:t.clientSecret,clientIdParamName:D(t.clientIdParamName,"client_id"),clientSecretParamName:D(t.clientSecretParamName,"client_secret"),issuerUrl:t.issuerUrl,authorizationBaseUrl:h,accessTokenEndpoint:p,redirectUrl:t.redirectUrl,resourceUrl:t.resourceUrl,responseType:(a=t.responseType)!==null&&a!==void 0?a:"code",pkceEnabled:(u=t.pkceEnabled)!==null&&u!==void 0?u:!0,scope:this.normalizeScopeValue(g),additionalParameters:t.additionalParameters,loginHint:t.loginHint,prompt:t.prompt,additionalTokenParameters:t.additionalTokenParameters,additionalResourceHeaders:t.additionalResourceHeaders,logoutUrl:E,postLogoutRedirectUrl:t.postLogoutRedirectUrl,additionalLogoutParameters:t.additionalLogoutParameters,logsEnabled:(d=t.logsEnabled)!==null&&d!==void 0?d:!1}}async ensureDiscovered(e){const t=this.providers.get(e);if(!t?.issuerUrl||t.authorizationBaseUrl&&t.accessTokenEndpoint)return;const r=`${t.issuerUrl.replace(/\/+$/,"")}/.well-known/openid-configuration`,i=await fetch(r);if(!i.ok){const d=await i.text().catch(()=>"");throw new Error(`OAuth2 discovery failed (${i.status}): ${d||r}`)}const s=await i.json(),l=s.authorization_endpoint,a=s.token_endpoint,u=s.end_session_endpoint;!t.authorizationBaseUrl&&typeof l=="string"&&(t.authorizationBaseUrl=l),!t.accessTokenEndpoint&&typeof a=="string"&&(t.accessTokenEndpoint=a),!t.logoutUrl&&typeof u=="string"&&(t.logoutUrl=u),t.logsEnabled&&console.log(`[OAuth2:${e}] Discovery resolved`,{authorizationBaseUrl:t.authorizationBaseUrl,accessTokenEndpoint:t.accessTokenEndpoint,logoutUrl:t.logoutUrl}),this.persistConfiguration(e,t)}async initializeProviders(e){for(const[t,o]of Object.entries(e)){const r=this.normalizeConfig(t,o);this.providers.set(t,r),r.logsEnabled&&console.log(`[OAuth2:${t}] Initialized with config:`,{appId:r.appId,issuerUrl:r.issuerUrl,authorizationBaseUrl:r.authorizationBaseUrl,redirectUrl:r.redirectUrl,responseType:r.responseType,pkceEnabled:r.pkceEnabled}
2),await this.ensureDiscovered(t),this.persistConfiguration(t,r)}}normalizeStoredConfig(e){return Object.assign(Object.assign({},e),{clientIdParamName:D(e.clientIdParamName,"client_id"),clientSecretParamName:D(e.clientSecretParamName,"client_secret")})}getProvider(e){const t=this.providers.get(e);if(!t)throw new Error(`OAuth2 provider '${e}' not configured. Call initialize() first.`);return t.clientIdParamName=D(t.clientIdParamName,"client_id"),t.clientSecretParamName=D(t.clientSecretParamName,"client_secret"),t}getTokensKey(e){return`${this.TOKENS_KEY_PREFIX}${e}`}getConfigKey(e){return`${this.CONFIG_KEY_PREFIX}${e}`}persistConfiguration(e,t){try{localStorage.setItem(this.getConfigKey(e),JSON.stringify(t))}catch(o){console.warn(`Failed to persist OAuth2 configuration for provider '${e}'`,o)}}restoreConfigurationsFromStorage(){const e=Object.keys(localStorage);for(const t of e)if(t.startsWith(this.CONFIG_KEY_PREFIX)){const o=t.substring(this.CONFIG_KEY_PREFIX.length);try{const r=localStorage.getItem(t);if(r){const i=this.normalizeStoredConfig(JSON.parse(r));this.providers.set(o,i)}}catch(r){console.warn(`Failed to restore OAuth2 configuration for provider '${o}'`,r)}}}async login(e){var t,o,r,i,s,l,a,u,d;const{providerId:c}=e,h=this.getProvider(c);await this.ensureDiscovered(c);const p=(t=e.redirectUrl)!==null&&t!==void 0?t:h.redirectUrl,E=this.normalizeScopeValue((r=(o=e.scope)!==null&&o!==void 0?o:e.scopes)!==null&&r!==void 0?r:h.scope),g=(i=e.state)!==null&&i!==void 0?i:this.generateState(),k=(s=e.codeVerifier)!==null&&s!==void 0?s:this.generateCodeVerifier(),v=new URLSearchParams({response_type:h.responseType,[h.clientIdParamName]:h.appId,redirect_uri:p,state:g});E&&v.set("scope",E);const S=Object.assign(Object.assign({},(l=h.additionalParameters)!==null&&l!==void 0?l:{}),(a=e.additionalParameters)!==null&&a!==void 0?a:{}),A=(u=e.loginHint)!==null&&u!==void 0?u:h.loginHint,N=(d=e.prompt)!==null&&d!==void 0?d:h.prompt;if(A&&!("login_hint"in S)&&(S.login_hint=A),N&&!("prompt"in S)&&(S.prompt=N),h.responseType==="code"&&h.pkceEnabled){const O=await this.generateCodeChallenge(k);v.set("code_challenge",O),v.set("code_challenge_method","S256")}for(const[O,R]of Object.entries(S))R!==void 0&&v.set(O,R);if(this.persistPendingLogin(g,{providerId:c,codeVerifier:k,redirectUri:p,scope:E}),localStorage.setItem(m.OAUTH_STATE_KEY,JSON.stringify({provider:"oauth2",providerId:c,state:g})),!h.authorizationBaseUrl)throw new Error(`OAuth2 provider '${c}' is missing authorizationBaseUrl (discovery may have failed).`);const b=`${h.authorizationBaseUrl}?${v.toString()}`;if(h.logsEnabled&&console.log(`[OAuth2:${c}] Opening authorization URL:`,b),e.flow==="redirect")return window.location.assign(b),new Promise(()=>{});const T=500,U=650,y=window.screenX+(window.outerWidth-T)/2,P=window.screenY+(window.outerHeight-U)/2,L=window.open(b,"OAuth2Login",`width=${T},height=${U},left=${y},top=${P},popup=1`);return new Promise((O,R)=>{if(!L){R(new Error("Unable to open login window. Please allow popups."));return}const w=`oauth2_${g}`;let C=null;try{C=new BroadcastChannel(w)}catch{h.logsEnabled&&console.log(`[OAuth2:${c}] BroadcastChannel not supported, using postMessage only`)}const K=(f,W,ne)=>{window.removeEventListener("message",f),clearTimeout(W),clearInterval(ne),C&&C.close()},q=f=>{if(f?.type==="oauth-response"){if(f?.provider&&f.provider!=="oauth2"||f?.providerId&&f.providerId!==c)return!1;K(x,X,Y);const W=f,{provider:ne,type:mt}=W,ke=j(W,["provider","type"]);return O({provider:"oauth2",result:ke}),!0}else if(f?.type==="oauth-error")return f?.provider&&f.provider!=="oauth2"?!1:(K(x,X,Y),R(F(f.error||"OAuth2 login was cancelled.")),!0);return!1};C&&(C.onmessage=f=>{q(f.data)});const x=f=>{f.origin===window.location.origin&&q(f.data)};window.addEventListener("message",x);const X=window.setTimeout(()=>{K(x,X,Y);try{L.close()}catch{}R(new Error("OAuth2 login timed out."))},3e5),Y=window.setInterval(()=>{try{L.closed&&(K(x,X,Y),R(H("OAuth2 login window was closed.")))}catch{clearInterval(Y),h.logsEnabled&&console.log(`[OAuth2:${c}] Cannot check popup.closed due to cross-origin restrictions. Relying on message handlers and timeout.`)}},1e3)})}async logout(e){await this.ensureDiscovered(e);const t=this.providers.get(e),o=this.getStoredTokens(e);if(localStorage.removeItem(this.getTokensKey(e)),t?.logoutUrl)try{const r=new
2URL(t.logoutUrl);o?.idToken&&r.searchParams.set("id_token_hint",o.idToken);const i=t.postLogoutRedirectUrl;if(i&&r.searchParams.set("post_logout_redirect_uri",i),t.additionalLogoutParameters)for(const[s,l]of Object.entries(t.additionalLogoutParameters))r.searchParams.set(s,l);window.open(r.toString(),"_blank")}catch{window.open(t.logoutUrl,"_blank")}}async isLoggedIn(e){const t=this.getStoredTokens(e);if(!t)return{isLoggedIn:!1};const o=t.expiresAt>Date.now();return o||localStorage.removeItem(this.getTokensKey(e)),{isLoggedIn:o}}async getAuthorizationCode(e){const t=this.getStoredTokens(e);if(!t)throw new Error(`OAuth2 access token is not available for provider '${e}'.`);return{accessToken:t.accessToken,jwt:t.idToken}}async refresh(e){await this.refreshToken(e)}async refreshToken(e,t,o){var r,i,s,l,a,u;await this.ensureDiscovered(e);const d=this.getProvider(e),c=this.getStoredTokens(e),h=t??c?.refreshToken;if(!h)throw new Error(`No OAuth2 refresh token is available for provider '${e}'. Include offline_access scope to receive one.`);if(!d.accessTokenEndpoint)throw new Error(`No accessTokenEndpoint configured for provider '${e}'.`);const p=await this.refreshWithRefreshToken(e,h,o),E=p.expires_in?Date.now()+p.expires_in*1e3:Date.now()+36e5,g=(s=(i=(r=p.scope)===null||r===void 0?void 0:r.split(" ").filter(Boolean))!==null&&i!==void 0?i:c?.scope)!==null&&s!==void 0?s:[];let k=null;d.resourceUrl&&(k=await this.fetchResource(e,p.access_token));const v=(l=p.refresh_token)!==null&&l!==void 0?l:h;return this.persistTokens(e,{accessToken:p.access_token,refreshToken:v,idToken:p.id_token,expiresAt:E,scope:g,tokenType:p.token_type}),{providerId:e,accessToken:{token:p.access_token,tokenType:p.token_type,expires:new Date(E).toISOString(),refreshToken:v},idToken:(a=p.id_token)!==null&&a!==void 0?a:null,refreshToken:v??null,resourceData:k,scope:g,tokenType:p.token_type,expiresIn:(u=p.expires_in)!==null&&u!==void 0?u:null}}async handleOAuthRedirect(e,t){var o,r,i,s,l;const a=new URLSearchParams(e.search);new URLSearchParams(e.hash.slice(1)).forEach((g,k)=>{a.set(k,g)});const d=t??a.get("state");if(!d)return null;const c=this.consumePendingLogin(d);if(!c)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"OAuth2 login session expired or state mismatch."};const{providerId:h}=c;await this.ensureDiscovered(h);const p=this.providers.get(h);if(!p)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:`OAuth2 provider '${h}' configuration not found.`};const E=a.get("error");if(E)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:a.get("error_description")||E};try{let g;if(a.has("code")){const A=a.get("code");if(!A)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"OAuth2 authorization code missing from redirect."};g=await this.exchangeAuthorizationCode(h,A,c)}else if(a.has("access_token"))g={access_token:a.get("access_token"),token_type:a.get("token_type")||"bearer",expires_in:a.has("expires_in")?parseInt(a.get("expires_in"),10):void 0,scope:a.get("scope")||void 0,id_token:a.get("id_token")||void 0};else return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"No authorization code or access token in redirect."};const k=g.expires_in?Date.now()+g.expires_in*1e3:Date.now()+36e5,v=(r=(o=g.scope)===null||o===void 0?void 0:o.split(" ").filter(Boolean))!==null&&r!==void 0?r:[];let S=null;return p.resourceUrl&&(S=await this.fetchResource(h,g.access_token)),this.persistTokens(h,{accessToken:g.access_token,refreshToken:g.refresh_token,idToken:g.id_token,expiresAt:k,scope:v,tokenType:g.token_type}),{provider:"oauth2",result:{providerId:h,accessToken:{token:g.access_token,tokenType:g.token_type,expires:new Date(k).toISOString(),refreshToken:g.refresh_token},idToken:(i=g.id_token)!==null&&i!==void 0?i:null,refreshToken:(s=g.refresh_token)!==null&&s!==void 0?s:null,resourceData:S,scope:v,tokenType:g.token_type,expiresIn:(l=g.expires_in)!==null&&l!==void 0?l:null}}}catch(g){return g instanceof Error?{error:g.message}:{error:"OAuth2 login failed unexpectedly."}}finally{localStorage.removeItem(m.OAUTH_STATE_KEY)}}async exchangeAuthorizationCode(e,t,o){const r=this.getProvider(e);if(!r.accessTokenEndpoint)throw new Error(`No accessTokenEndpoint configured for provider '${e}'.`);const i=new URLSearchParams({grant_type:"authorization_code",[r.clientIdParamName]:r.appId,code:t,redirect_uri:o.redirectUri});
2if(r.pkceEnabled&&i.set("code_verifier",o.codeVerifier),r.clientSecret&&i.set(r.clientSecretParamName,r.clientSecret),r.additionalTokenParameters)for(const[l,a]of Object.entries(r.additionalTokenParameters))i.set(l,a);r.logsEnabled&&console.log(`[OAuth2:${e}] Exchanging code at:`,r.accessTokenEndpoint);const s=await fetch(r.accessTokenEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i.toString()});if(!s.ok){const l=await s.text();throw new Error(`OAuth2 token exchange failed (${s.status}): ${l}`)}return await s.json()}async refreshWithRefreshToken(e,t,o){const r=this.getProvider(e);if(!r.accessTokenEndpoint)throw new Error(`No accessTokenEndpoint configured for provider '${e}'.`);const i=new URLSearchParams({grant_type:"refresh_token",refresh_token:t,[r.clientIdParamName]:r.appId});if(r.clientSecret&&i.set(r.clientSecretParamName,r.clientSecret),r.additionalTokenParameters)for(const[l,a]of Object.entries(r.additionalTokenParameters))i.set(l,a);if(o)for(const[l,a]of Object.entries(o))i.set(l,a);const s=await fetch(r.accessTokenEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i.toString()});if(!s.ok){const l=await s.text();throw new Error(`OAuth2 refresh failed (${s.status}): ${l}`)}return await s.json()}async fetchResource(e,t){const o=this.getProvider(e);if(!o.resourceUrl)throw new Error(`No resourceUrl configured for provider '${e}'.`);const r={Authorization:`Bearer ${t}`};o.additionalResourceHeaders&&Object.assign(r,o.additionalResourceHeaders);const i=await fetch(o.resourceUrl,{headers:r});if(!i.ok){const s=await i.text();throw new Error(`Unable to fetch OAuth2 resource (${i.status}): ${s}`)}return await i.json()}persistTokens(e,t){localStorage.setItem(this.getTokensKey(e),JSON.stringify(t))}getStoredTokens(e){const t=localStorage.getItem(this.getTokensKey(e));if(!t)return null;try{return JSON.parse(t)}catch(o){return console.warn(`Failed to parse stored OAuth2 tokens for provider '${e}'`,o),null}}persistPendingLogin(e,t){localStorage.setItem(`${this.STATE_PREFIX}${e}`,JSON.stringify(t))}consumePendingLogin(e){const t=`${this.STATE_PREFIX}${e}`,o=localStorage.getItem(t);if(localStorage.removeItem(t),!o)return null;try{return JSON.parse(o)}catch(r){return console.warn("Failed to parse pending OAuth2 login payload",r),null}}generateState(){return[...crypto.getRandomValues(new Uint8Array(16))].map(e=>e.toString(16).padStart(2,"0")).join("")}generateCodeVerifier(){const e=new Uint8Array(64);return crypto.getRandomValues(e),Array.from(e).map(t=>"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~"[t%66]).join("")}async generateCodeChallenge(e){const o=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",o);return this.base64UrlEncode(new Uint8Array(r))}base64UrlEncode(e){let t="";return e.forEach(o=>t+=String.fromCharCode(o)),btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}decodeIdToken(e){const t=e.split(".");if(t.length<2)throw new Error("Invalid JWT: missing parts");const r=t[1].replace(/-/g,"+").replace(/_/g,"/"),i=r+"=".repeat((4-r.length%4)%4),s=atob(i);return JSON.parse(s)}getAccessTokenExpirationDate(e){const t=this.getStoredTokens(e);return t?.expiresAt?{expirationDate:new Date(t.expiresAt).toISOString()}:{expirationDate:null}}isAccessTokenAvailable(e){const t=this.getStoredTokens(e);return{isAvailable:!!t?.accessToken}}isAccessTokenExpired(e){const t=this.getStoredTokens(e);return t?.expiresAt?{isExpired:t.expiresAt<=Date.now()}:{isExpired:!0}}isRefreshTokenAvailable(e){const t=this.getStoredTokens(e);return{isAvailable:!!t?.refreshToken}}}class $e extends m{constructor(){super(...arguments),this.botId=null,this.redirectUrl=null,this.origin=null,this.requestAccess="write",this.languageCode=null,this.TOKENS_KEY="capgo_social_login_telegram_session_v1",this.STATE_PREFIX="capgo_social_login_telegram_state_",this.SESSION_TTL_MS=1440*60*1e3}initialize(e,t,o,r,i){this.botId=e,this.requestAccess=t??"write",this.redirectUrl=o??null,this.origin=r??null,this.languageCode=i??null}async login(e){var t,o,r,i,s;if(!this.botId)throw new Error("Telegram botId is not configured. Call initialize() first.");const l=(o=(t=e.redirectUrl)!==null&&t!==void 0?t:this.redirectUrl)!==null&&o!==void 0?o:window.location.origin+window.location.pathname,a=(r=e.state)!==null&&r!==void 0?r:this.generateState(),u=(i=e.requestAccess)!==null&&i!==void 0?i:this.requestAccess,d=(s=this.origin)!==null&&s!==void 0?s:this.getOriginFromRedirect(l);
2if(!this.isHttpOrigin(d))throw new Error("Telegram origin must be a valid http(s) URL registered with BotFather. Pass origin when redirectUrl is not http(s).");const c=this.appendStateToRedirect(l,a);this.persistPendingLogin(a,{redirectUri:l,requestAccess:u}),localStorage.setItem(m.OAUTH_STATE_KEY,JSON.stringify({provider:"telegram",state:a}));const h=this.buildAuthUrl(d,u,c),p=this.openPopup(h);return new Promise((E,g)=>{if(!p){this.clearPendingTelegramState(a),g(new Error("Unable to open login window. Please allow popups."));return}let k=!1,v=0,S=0,A=null;const N=(T=!1)=>{if(clearTimeout(v),clearInterval(S),A&&(A(),A=null),this.clearPendingTelegramState(a),T)try{p.close()}catch{}},b=(T,U)=>{k||(k=!0,N(T),U())};A=fe("telegram",a,{onResponse:T=>{if(T?.provider&&T.provider!=="telegram")return;const U=T,{provider:y,type:P,_ts:L}=U,O=j(U,["provider","type","_ts"]);b(!0,()=>{E({provider:"telegram",result:O})})},onError:(T,U)=>{const y=T||"Telegram login was cancelled.";b(!0,()=>{g(U==="USER_CANCELLED"?H(y):F(y))})}}),v=window.setTimeout(()=>{b(!0,()=>{g(new Error("Telegram login timed out."))})},3e5),S=window.setInterval(()=>{try{p.closed&&b(!1,()=>{g(H("Telegram login window was closed."))})}catch{clearInterval(S)}},1e3)})}async logout(){localStorage.removeItem(this.TOKENS_KEY)}async isLoggedIn(){const e=this.getStoredSession();if(!e)return{isLoggedIn:!1};const t=e.expiresAt>Date.now();return t||localStorage.removeItem(this.TOKENS_KEY),{isLoggedIn:t}}async getAuthorizationCode(){throw new Error("getAuthorizationCode is not available for Telegram.")}async refresh(){throw new Error("Telegram refresh is not supported. Call login() again.")}async handleOAuthRedirect(e,t){var o;const r=e.searchParams,i=r.get("state");if(!i)return null;if(t&&t!==i)return{error:"Telegram login session expired or state mismatch."};const s=this.consumePendingLogin(i);if(!s)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"Telegram login session expired or state mismatch."};const l=r.get("error");if(l)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:r.get("error_description")||l};const a=r.get("id"),u=r.get("auth_date"),d=r.get("hash");if(!a||!u||!d)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"Telegram login payload is incomplete."};const c={id:a,firstName:(o=r.get("first_name"))!==null&&o!==void 0?o:"",lastName:r.get("last_name"),username:r.get("username"),photoUrl:r.get("photo_url")},h=Number(u);if(!Number.isInteger(h))return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"Telegram auth_date is invalid."};const p={profile:c,authDate:h,hash:d,requestAccess:s.requestAccess};return this.persistSession({expiresAt:h*1e3+this.SESSION_TTL_MS}),localStorage.removeItem(m.OAUTH_STATE_KEY),{provider:"telegram",result:p}}buildAuthUrl(e,t,o){var r;const i=new URLSearchParams({bot_id:(r=this.botId)!==null&&r!==void 0?r:"",origin:e,request_access:t,return_to:o,embed:"1",mobile:"1"});return this.languageCode&&i.set("lang",this.languageCode),`https://oauth.telegram.org/auth?${i.toString()}`}openPopup(e){const r=window.screenX+(window.outerWidth-500)/2,i=window.screenY+(window.outerHeight-650)/2;return window.open(e,"TelegramLogin",`width=500,height=650,left=${r},top=${i},popup=1`)}appendStateToRedirect(e,t){try{const o=new URL(e);return o.searchParams.set("state",t),o.toString()}catch{return e}}isHttpOrigin(e){if(!e)return!1;try{const t=new URL(e);return t.protocol==="http:"||t.protocol==="https:"}catch{return!1}}getOriginFromRedirect(e){return this.isHttpOrigin(e)?new URL(e).origin:void 0}persistSession(e){localStorage.setItem(this.TOKENS_KEY,JSON.stringify(e))}getStoredSession(){const e=localStorage.getItem(this.TOKENS_KEY);if(!e)return null;try{return JSON.parse(e)}catch(t){return console.warn("Failed to parse stored Telegram session",t),null}}persistPendingLogin(e,t){localStorage.setItem(`${this.STATE_PREFIX}${e}`,JSON.stringify(t))}consumePendingLogin(e){const t=`${this.STATE_PREFIX}${e}`,o=localStorage.getItem(t);if(localStorage.removeItem(t),!o)return null;try{return JSON.parse(o)}catch(r){return console.warn("Failed to parse pending Telegram login payload",r),null}}clearPendingTelegramState(e){try{localStorage.removeItem(`${this.STATE_PREFIX}${e}`);const t=localStorage.getItem(m.OAUTH_STATE_KEY);if(!t)return;const o=JSON.parse(t);o.provider==="telegram"&&o.state===e&&localStorage.removeItem(m.OAUTH_STATE_KEY)}catch{}}generateState(){return[...crypto.getRandomValues(new Uint8Array(16))].map(e=>e.toString(16).padStart(2,"0")).join("")}}class ze extends m{constructor(){super(...arguments),this.clientId=null,this.redirectUrl=null,this.defaultScopes=["tweet.read","users.read"],this.forceLogin=!1,this.TOKENS_KEY="capgo_social_login_twitter_tokens_v1",this.STATE_PREFIX="capgo_social_login_twitter_state_"}async initialize(e,t,o,r,i){this.clientId=e,this.redirectUrl=t??null,o?.length&&(this.defaultScopes=o),this.forceLogin=r??!1,this.audience=i??void 0}async login(e){var t,o,r,i,s,l;if(!this.clientId)throw new Error("Twitter Client ID not configured. Call initialize() first.");const a=(o=(t=e.redirectUrl)!==null&&t!==void 0?t:this.redirectUrl)!==null&&o!==void 0?o:window.location.origin+window.location.pathname,u=!((r=e.scopes)===null||r===void 0)&&r.length?e.scopes:this.defaultScopes,d=(i=e.state)!==null&&i!==void 0?i:this.generateState(),c=(s=e.codeVerifier)!==null&&s!==void 0?s:this.generateCodeVerifier(),h=await this.generateCodeChallenge(c);this.persistPendingLogin(d,{clientId:this.clientId,codeVerifier:c,redirectUri:a,scopes:u}),localStorage.setItem(m.OAUTH_STATE_KEY,JSON.stringify({provider:"twitter",state:d}));const p=new URLSearchParams({response_type:"code",client_id:this.clientId,redirect_uri:a,scope:u.join(" "),state:d,code_challenge:h,code_challenge_method:"S256"});((l=e.forceLogin)!==null&&l!==void 0?l:this.forceLogin)===!0&&p.set("force_login","true"),this.audience&&p.set("audience",this.audience);const E=`https://x.com/i/oauth2/authorize?${p.toString()}`,g=500,k=650,v=window.screenX+(window.outerWidth-g)/2,S=window.screenY+(window.outerHeight-k)/2,A=window.open(E,"XLogin",`width=${g},height=${k},left=${v},top=${S},popup=1`);return new Promise((N,b)=>{if(!A){b(new Error("Unable to open login window. Please allow popups."));return}const T=`twitter_oauth_${d}`;let U=null;try{U=new BroadcastChannel(T)}catch{}const y=(w,C,K)=>{window.removeEventListener("message",w),clearTimeout(C),clearInterval(K),U&&U.close()},P=w=>{if(w?.type==="oauth-response"){if(w?.provider&&w.provider!=="twitter")return!1;y(L,O,R);const C=w,{provider:K,type:q}=C,x=j(C,["provider","type"]);return N({provider:"twitter",result:x}),!0}else if(w?.type==="oauth-error")return w?.provider&&w.provider!=="twitter"?!1:(y(L,O,R),b(F(w.error||"Twitter login was cancelled.")),!0);return!1};U&&(U.onmessage=w=>{P(w.data)});const L=w=>{w.origin===window.location.origin&&P(w.data)};window.addEventListener("message",L);const O=window.setTimeout(()=>{y(L,O,R);try{A.close()}catch{}b(new Error("Twitter login timed out."))},3e5),R=window.setInterval(()=>{try{A.closed&&(y(L,O,R),b(H("Twitter login window was closed.")))}catch{clearInterval(R)}},1e3)})}async logout(){localStorage.removeItem(this.TOKENS_KEY)}async isLoggedIn(){const e=this.getStoredTokens();if(!e)return{isLoggedIn:!1};const t=e.expiresAt>Date.now();return t||localStorage.removeItem(this.TOKENS_KEY),{isLoggedIn:t}}async getAuthorizationCode(){const e=this.getStoredTokens();if(!e)throw new Error("Twitter access token is not available.");return{accessToken:e.accessToken}}async refresh(){const e=this.getStoredTokens();if(!e?.refreshToken)throw new Error("No Twitter refresh token is available. Include offline.access scope to receive one.");await this.refreshWithRefreshToken(e.refreshToken)}async handleOAuthRedirect(e,t){const o=e.searchParams,r=t??o.get("state");if(!r)return null;const i=this.consumePendingLogin(r);if(!i)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"Twitter login session expired or state mismatch."};const s=o.get("error");
2if(s)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:o.get("error_description")||s};const l=o.get("code");if(!l)return localStorage.removeItem(m.OAUTH_STATE_KEY),{error:"Twitter authorization code missing from redirect."};try{const a=await this.exchangeAuthorizationCode(l,i),u=await this.fetchProfile(a.access_token),d=Date.now()+a.expires_in*1e3,c=a.scope.split(" ").filter(Boolean);return this.persistTokens({accessToken:a.access_token,refreshToken:a.refresh_token,expiresAt:d,scope:c,tokenType:a.token_type,userId:u.id,profile:u}),{provider:"twitter",result:{accessToken:{token:a.access_token,tokenType:a.token_type,expires:new Date(d).toISOString(),userId:u.id},refreshToken:a.refresh_token,scope:c,tokenType:a.token_type,expiresIn:a.expires_in,profile:u}}}catch(a){return a instanceof Error?{error:a.message}:{error:"Twitter login failed unexpectedly."}}finally{localStorage.removeItem(m.OAUTH_STATE_KEY)}}async exchangeAuthorizationCode(e,t){const o=new URLSearchParams({grant_type:"authorization_code",client_id:t.clientId,code:e,redirect_uri:t.redirectUri,code_verifier:t.codeVerifier}),r=await fetch("https://api.x.com/2/oauth2/token",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!r.ok){const i=await r.text();throw new Error(`Twitter token exchange failed (${r.status}): ${i}`)}return await r.json()}async refreshWithRefreshToken(e){var t,o;const r=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:(t=this.clientId)!==null&&t!==void 0?t:""}),i=await fetch("https://api.x.com/2/oauth2/token",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r.toString()});if(!i.ok){const d=await i.text();throw new Error(`Twitter refresh failed (${i.status}): ${d}`)}const s=await i.json(),l=await this.fetchProfile(s.access_token),a=Date.now()+s.expires_in*1e3,u=s.scope.split(" ").filter(Boolean);this.persistTokens({accessToken:s.access_token,refreshToken:(o=s.refresh_token)!==null&&o!==void 0?o:e,expiresAt:a,scope:u,tokenType:s.token_type,userId:l.id,profile:l})}async fetchProfile(e){var t,o,r,i;const l=await fetch(`https://api.x.com/2/users/me?user.fields=${["profile_image_url","verified","name","username"].join(",")}`,{headers:{Authorization:`Bearer ${e}`}});if(!l.ok){const u=await l.text();throw new Error(`Unable to fetch Twitter profile (${l.status}): ${u}`)}const a=await l.json();if(!a.data)throw new Error("Twitter profile payload is missing data.");return{id:a.data.id,username:a.data.username,name:(t=a.data.name)!==null&&t!==void 0?t:null,profileImageUrl:(o=a.data.profile_image_url)!==null&&o!==void 0?o:null,verified:(r=a.data.verified)!==null&&r!==void 0?r:!1,email:(i=a.data.email)!==null&&i!==void 0?i:null}}persistTokens(e){localStorage.setItem(this.TOKENS_KEY,JSON.stringify(e))}getStoredTokens(){const e=localStorage.getItem(this.TOKENS_KEY);if(!e)return null;try{return JSON.parse(e)}catch(t){return console.warn("Failed to parse stored Twitter tokens",t),null}}persistPendingLogin(e,t){localStorage.setItem(`${this.STATE_PREFIX}${e}`,JSON.stringify(t))}consumePendingLogin(e){const t=`${this.STATE_PREFIX}${e}`,o=localStorage.getItem(t);if(localStorage.removeItem(t),!o)return null;try{return JSON.parse(o)}catch(r){return console.warn("Failed to parse pending Twitter login payload",r),null}}generateState(){return[...crypto.getRandomValues(new Uint8Array(16))].map(e=>e.toString(16).padStart(2,"0")).join("")}generateCodeVerifier(){const e=new Uint8Array(64);return crypto.getRandomValues(e),Array.from(e).map(t=>"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~"[t%66]).join("")}async generateCodeChallenge(e){const o=new TextEncoder().encode(e),r=await crypto.subtle.digest("SHA-256",o);return this.base64UrlEncode(new Uint8Array(r))}base64UrlEncode(e){let t="";return e.forEach(o=>t+=String.fromCharCode(o)),btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}}async function se(){var n;const e=new URL(window.location.href),t=localStorage.getItem(he);let o=null,r,i;if(t)try{const c=JSON.parse(t);o=(n=c.provider)!==null&&n!==void 0?n:null,r=c.state,i=c.nonce}catch{o=t==="true"?"google":null}const s=new Ce,l=new Ne,a=new ze,u=new $e;let d=null;switch(o){case"twitter":d=await a.handleOAuthRedirect(e,r);break;case"telegram":d=await u.handleOAuthRedirect(e,r);break;case"oauth2":d=await l.handleOAuthRedirect(e,r);break;default:d=s.handleOAuthRedirect(e);break}return{provider:o,state:r,nonce:i,result:d}}function ae(n){const{result:e}=n;if(!e)return null;if("error"in e){const t=F(e.error);return Object.assign({type:"oauth-error",provider:n.provider,error:t.message},t.code?{code:t.code}:null)}return Object.assign({type:"oauth-response",provider:e.provider},e.result)}async function _e(){var n,e,t,o,r;const i=await se(),s=(n=i.nonce)!==null&&n!==void 0?n:i.state,l=ae(i);if(l)M((r=i.provider)!==null&&r!==void 0?r:"google",s,l);else if(oe()){await new Promise(d=>setTimeout(d,100));const a=await se(),u=ae(a);u?M((e=a.provider)!==null&&e!==void 0?e:"google",(t=a.nonce)!==null&&t!==void 0?t:a.state,u):M((o=i.provider)!==null&&o!==void 0?o:"google",s,{type:"oauth-error",provider:i.provider,error:"OAuth redirect did not contain expected parameters."})}Pe();try{window.close()}catch{}}function Ke(){oe()&&_e()}function xe(){typeof window>"u"||(oe()&&_e(),window.addEventListener("hashchange",Ke))}xe();const $="linkedin",ee="capgo_social_login_linkedin_redirect",De="https://www.linkedin.com/oauth/v2/authorization",je="https://www.linkedin.com/oauth/v2/accessToken",He="https://api.linkedin.com/v2/userinfo",Ge="openid profile email",Ye=n=>
2n?Array.isArray(n)?n.filter(Boolean).join(" "):n:Ge,Fe=n=>{var e,t,o,r,i,s,l,a,u;const d=Ye((e=n.scope)!==null&&e!==void 0?e:n.scopes);return Object.assign(Object.assign({},n),{appId:(t=n.appId)!==null&&t!==void 0?t:n.clientId,clientSecret:n.clientSecret,authorizationBaseUrl:(r=(o=n.authorizationBaseUrl)!==null&&o!==void 0?o:n.authorizationEndpoint)!==null&&r!==void 0?r:De,accessTokenEndpoint:(s=(i=n.accessTokenEndpoint)!==null&&i!==void 0?i:n.tokenEndpoint)!==null&&s!==void 0?s:je,resourceUrl:(l=n.resourceUrl)!==null&&l!==void 0?l:He,responseType:(a=n.responseType)!==null&&a!==void 0?a:"code",pkceEnabled:(u=n.pkceEnabled)!==null&&u!==void 0?u:!0,scope:d})},Be=()=>[...crypto.getRandomValues(new Uint8Array(16))].map(n=>n.toString(16).padStart(2,"0")).join(""),le=(n={})=>{var e;const t=(e=n.scope)!==null&&e!==void 0?e:n.scopes,o=Object.assign(Object.assign(Object.assign({},n),{providerId:$}),t===void 0?{}:{scope:t});return o.flow==="redirect"&&!o.state&&(o.state=Be()),o},Tt=n=>n.provider==="oauth2"&&n.result.providerId===$,Ve=n=>({provider:"linkedin",result:n.result}),Je=n=>{try{sessionStorage.setItem(ee,n)}catch{}},kt=n=>{try{const e=sessionStorage.getItem(ee);return sessionStorage.removeItem(ee),!!(e&&n&&e===n)}catch{return!1}},z="tiktok",Xe="https://www.tiktok.com/v2/auth/authorize/",We="https://open.tiktokapis.com/v2/oauth/token/",qe="user.info.basic",me=n=>{if(!(n==null||n===""))return Array.isArray(n)?n.filter(Boolean).join(","):n},Me=n=>{var e,t,o,r;return{appId:n.clientKey,clientSecret:n.clientSecret,authorizationBaseUrl:Xe,accessTokenEndpoint:We,redirectUrl:n.redirectUrl,responseType:"code",pkceEnabled:(e=n.pkceEnabled)!==null&&e!==void 0?e:!0,scope:(o=me((t=n.scope)!==null&&t!==void 0?t:n.scopes))!==null&&o!==void 0?o:qe,clientIdParamName:"client_key",clientSecretParamName:"client_secret",logsEnabled:(r=n.logsEnabled)!==null&&r!==void 0?r:!1}},ce=(n={})=>{var e;const t=me((e=n.scope)!==null&&e!==void 0?e:n.scopes);return Object.assign(Object.assign({providerId:z},t===void 0?{}:{scope:t}),{state:n.state,codeVerifier:n.codeVerifier,redirectUrl:n.redirectUrl})},Qe=n=>n.provider==="oauth2"&&n.result.providerId===z,de=n=>({provider:"tiktok",result:n.result}),Ze="Google refresh() is not available when using offline mode. Offline mode only returns serverAuthCode for backend token exchange. Send serverAuthCode to your backend and refresh tokens there, or switch google.mode to 'online' for client-side refresh.",_=Se("SocialLogin",{web:()=>ye(()=>import("./web-DiIECAkN.js"),__vite__mapDeps([0,1,2,3])).then(n=>new n.SocialLoginWeb)});class et{normalizeInitializeOptions(e){var t,o;let r=e;if(r.linkedin){const{linkedin:i,oauth2:s}=r,l=j(r,["linkedin","oauth2"]);r=Object.assign(Object.assign({},l),{linkedin:i,oauth2:Object.assign(Object.assign({},s??{}),{[$]:(t=s?.[$])!==null&&t!==void 0?t:Fe(i)})})}if(r.tiktok){if(!r.tiktok.clientKey||!r.tiktok.redirectUrl)throw new Error("tiktok.clientKey and tiktok.redirectUrl are required");const{tiktok:i,oauth2:s}=r,l=j(r,["tiktok","oauth2"]);r=Object.assign(Object.assign({},l),{tiktok:i,oauth2:Object.assign(Object.assign({},s??{}),{[z]:(o=s?.[z])!==null&&o!==void 0?o:Me(i)})})}return r}constructor(){this.initialize=this.initialize.bind(this),this.refresh=this.refresh.bind(this)}async initialize(e){const t=this.normalizeInitializeOptions(e);await _.initialize(t),this.initializeOptions=t}async login(e){var t;if(e.provider==="linkedin"){const o=(t=e.options)!==null&&t!==void 0?t:{},r=le(o);r.flow==="redirect"&&r.state&&Je(r.state);const i=await _.login({provider:"oauth2",options:r});return Ve(i)}if(e.provider==="tiktok"){const o=await _.login({provider:"oauth2",options:ce(e.options)});return de(o)}return _.login(e)}async logout(e){return e.provider==="linkedin"?_.logout({provider:"oauth2",providerId:$}):e.provider==="tiktok"?_.logout({provider:"oauth2",providerId:z}):_.logout(e)}async isLoggedIn(e){return e.provider==="linkedin"?_.isLoggedIn({provider:"oauth2",providerId:$}):e.provider==="tiktok"?_.isLoggedIn({provider:"oauth2",providerId:z}):_.isLoggedIn(e)}async getAuthorizationCode(e){return e.provider==="linkedin"?_.getAuthorizationCode({provider:"oauth2",providerId:$}):e.provider==="tiktok"?_.getAuthorizationCode({provider:"oauth2",providerId:z}):_.getAuthorizationCode(e)}async refresh(e){var t,o,r;return e.provider==="google"&&((o=(t=this.initializeOptions)===null||t===void 0?void 0:t.google)===null||o===void 0?void 0:o.mode)==="offline"&&console.warn(`[SocialLogin] ${Ze}`),e.provider==="linkedin"?_.refresh({provider:"oauth2",options:le((r=e.options)!==null&&r!==void 0?r:{})}):e.provider==="tiktok"?_.refresh({provider:"oauth2",options:ce(e.options)}):_.refresh(e)}async refreshToken(e){return e.provider==="linkedin"?_.refreshToken({provider:"oauth2",providerId:$,refreshToken:e.refreshToken,additionalParameters:e.additionalParameters}):e.provider==="tiktok"?_.refreshToken({provider:"oauth2",providerId:z,refreshToken:e.refreshToken,additionalParameters:e.additionalParameters}):_.refreshToken(e)}async handleRedirectCallback(){const e=await _.handleRedirectCallback();return e&&Qe(e)?de(e):e}async decodeIdToken(e){return _.decodeIdToken(e)}async getAccessTokenExpirationDate(e){return _.getAccessTokenExpirationDate(e)}async isAccessTokenAvailable(e){return _.isAccessTokenAvailable(e)}async isAccessTokenExpired(e){return _.isAccessTokenExpired(e)}async isRefreshTokenAvailable(e){return _.isRefreshTokenAvailable(e)}async providerSpecificCall(e){return _.providerSpecificCall(e)}async getPluginVersion(){return _.getPluginVersion()}async openSecureWindow(e){return _.openSecureWindow(e)}}const tt=_,we=new et,ot=["auth0","azure","cognito","okta","onelogin"],rt={auth0:"openid profile email offline_access",azure:"openid profile email",cognito:"openid profile email",okta:"openid profile email offline_access",onelogin:"openid profile email"},nt={azure:"https://graph.microsoft.com/v1.0/me"},it="https://login.microsoftonline.com",B=n=>n.startsWith("http://")||n.startsWith("https://")?n:`https://${n}`,G=n=>n.replace(/\/+$/,""),I=(n,e)=>{const t=G(n),o=e.replace(/^\/+/,"");return`${t}/${o}`},ue=(n,e)=>{if(!(!n&&!e))return Object.assign(Object.assign({},n??{}),e??{})},V=(n,e)=>{if(!e.clientId)throw new Error(`[authConnect] ${n} requires clientId.`);if(!e.redirectUrl)throw new Error(`[authConnect] ${n} requires redirectUrl.`)},st=n=>{if(V("auth0",n),!n.domain)throw new Error("[authConnect] auth0 requires domain.");const e=G(B(n.domain));return J("auth0",n,{authorizationBaseUrl:I(e,"authorize"),accessTokenEndpoint:I(e,"oauth/token"),resourceUrl:I(e,"userinfo"),logoutUrl:I(e,"v2/logout"),additionalParameters:n.audience?{audience:n.audience}:void 0})},at=n=>{var e,t;V("azure",n);const o=(e=n.tenantId)!==null&&e!==void 0?e:"common",r=G(B((t=n.authorityHost)!==null&&t!==void 0?t:it)),i=I(r,`${o}/oauth2/v2.0`);return J("azure",n,{authorizationBaseUrl:I(i,"authorize"),accessTokenEndpoint:I(i,"token"),resourceUrl:nt.azure})},lt=n=>{if(V("cognito",n),!n.domain)throw new Error("[authConnect] cognito requires domain.");const e=G(B(n.domain));return J("cognito",n,{authorizationBaseUrl:I(e,"oauth2/authorize"),accessTokenEndpoint:I(e,"oauth2/token"),resourceUrl:I(e,"oauth2/userInfo"),logoutUrl:I(e,"logout")})},ct=n=>{if(V("okta",n),!n.issuer)throw new Error("[authConnect] okta requires issuer.");const e=G(B(n.issuer));return J("okta",n,{authorizationBaseUrl:I(e,"v1/authorize"),accessTokenEndpoint:I(e,"v1/token"),resourceUrl:I(e,"v1/userinfo"),logoutUrl:I(e,"v1/logout")})},dt=n=>{if(V("onelogin",n),!n.issuer)throw new Error("[authConnect] onelogin requires issuer.");const e=G(B(n.issuer));return J("onelogin",n,{authorizationBaseUrl:I(e,"auth"),accessTokenEndpoint:I(e,"token"),resourceUrl:I(e,"me"),logoutUrl:I(e,"logout")})},J=(n,e,t)=>{var o,r,i,s,l,a,u,d,c,h,p,E;const g=ue(t.additionalParameters,e.additionalParameters),k=ue(t.additionalResourceHeaders,e.additionalResourceHeaders),v={appId:e.clientId,authorizationBaseUrl:(r=(o=e.authorizationBaseUrl)!==null&&o!==void 0?o:t.authorizationBaseUrl)!==null&&r!==void 0?r:"",accessTokenEndpoint:(i=e.accessTokenEndpoint)!==null&&i!==void 0?i:t.accessTokenEndpoint,redirectUrl:e.redirectUrl,resourceUrl:(s=e.resourceUrl)!==null&&s!==void 0?s:t.resourceUrl,responseType:(a=(l=e.responseType)!==null&&l!==void 0?l:t.responseType)!==null&&a!==void 0?a:"code",pkceEnabled:(d=(u=e.pkceEnabled)!==null&&u!==void 0?u:t.pkceEnabled)!==null&&d!==void 0?d:!0,scope:(h=(c=e.scope)!==null&&c!==void 0?c:t.scope)!==null&&h!==void 0?h:rt[n],additionalParameters:g,additionalResourceHeaders:k,logoutUrl:(p=e.logoutUrl)!==null&&p!==void 0?p:t.logoutUrl,logsEnabled:(E=e.logsEnabled)!==null&&E!==void 0?E:t.logsEnabled};if(!v.authorizationBaseUrl)throw new Error(`[authConnect] ${n} authorizationBaseUrl is required.`);return v},ut=n=>{if(!n)return{};const e={};return n.auth0&&(e.auth0=st(n.auth0)),n.azure&&(e.azure=at(n.azure)),n.cognito&&(e.cognito=lt(n.cognito)),n.okta&&(e.okta=ct(n.okta)),n.onelogin&&(e.onelogin=dt(n.onelogin)),e},re=n=>ot.includes(n),ht=n=>re(n.provider),gt=n=>re(n.provider),ve=n=>{var e;return gt(n)?{provider:"oauth2",options:Object.assign({providerId:n.provider},(e=n.options)!==null&&e!==void 0?e:{})}:n},Q=n=>ht(n)?{provider:"oauth2",providerId:n.provider}:n,pt=n=>ve(n),ft=(n,e)=>!Object.keys(n).length&&!e?e:Object.assign(Object.assign({},n),e??{}),Te=n=>({initialize:async e=>{const{authConnect:t,oauth2:o}=e,r=j(e,["authConnect","oauth2"]),i=ut(t),s=ft(i,o),l=Object.assign(Object.assign({},r),s?{oauth2:s}:{});return n.initialize(l)},login:async e=>{if(re(e.provider)){const t=ve(e),o=await n.login(t);return{provider:e.provider,result:o.result}}return n.login(e)},logout:async e=>n.logout(Q(e)),isLoggedIn:async e=>n.isLoggedIn(Q(e)),getAuthorizationCode:async e=>n.getAuthorizationCode(Q(e)),refresh:async e=>n.refresh(pt(e)),providerSpecificCall:async e=>n.providerSpecificCall(e),getPluginVersion:async()=>n.getPluginVersion()}),_t=Te(we),Et=Object.freeze(Object.defineProperty({__proto__:null,SocialLogin:we,SocialLoginAuthConnect:_t,SocialLoginBase:tt,createAuthConnectClient:Te},Symbol.toStringTag,{value:"Module"}));
2export{m as B,Ce as G,$ as L,Ne as O,ze as T,$e as a,Pe as b,H as c,M as d,Fe as e,z as f,Me as g,ce as h,F as i,de as j,le as k,Ve as l,Je as m,kt as n,Tt as o,Qe as p,he as q,Et as r,oe as s};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.