@kinde-oss/kinde-auth-react
Version:
Kinde React SDK for authentication
902 lines (901 loc) • 34.1 kB
JavaScript
//#region node_modules/.pnpm/@kinde+js-utils@0.32.0/node_modules/@kinde/js-utils/dist/js-utils.js
var e = /* @__PURE__ */ function(e) {
return e.email = "email", e.profile = "profile", e.openid = "openid", e.offline_access = "offline", e;
}({}), t = /* @__PURE__ */ function(e) {
return e.none = "none", e.create = "create", e.login = "login", e;
}({}), n = /* @__PURE__ */ function(e) {
return e.organizationDetails = "organization_details", e.organizationMembers = "organization_members", e.organizationPlanDetails = "organization_plan_details", e.organizationPaymentDetails = "organization_payment_details", e.organizationPlanSelection = "organization_plan_selection", e.paymentDetails = "payment_details", e.planSelection = "plan_selection", e.planDetails = "plan_details", e.profile = "profile", e;
}({}), r = /* @__PURE__ */ function(e) {
return e.organizationDetails = "organization_details", e.organizationMembers = "organization_members", e.organizationPlanDetails = "organization_plan_details", e.organizationPaymentDetails = "organization_payment_details", e.organizationPlanSelection = "organization_plan_selection", e.profile = "profile", e;
}({}), i = /* @__PURE__ */ function(e) {
return e.logout = "logout", e.login = "login", e.register = "registration", e.token = "token", e.profile = "profile", e;
}({}), a = /* @__PURE__ */ function(e) {
return e[e.refreshToken = 0] = "refreshToken", e[e.cookie = 1] = "cookie", e;
}({}), o = (e) => {
let t = (e) => btoa(e).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
if (e instanceof ArrayBuffer || Object.prototype.toString.call(e) === "[object ArrayBuffer]") {
let n = new Uint8Array(e);
return t(String.fromCharCode(...n));
}
let n = new TextEncoder().encode(e);
return t(String.fromCharCode(...n));
}, s = (e) => {
let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t.length % 4;
n && (t += "=".repeat(4 - n));
let r = atob(t), i = new Uint8Array(r.length);
for (let e = 0; e < r.length; e++) i[e] = r.charCodeAt(e);
return new TextDecoder().decode(i);
}, c = (e = 28) => {
if (crypto) {
let t = new Uint8Array(e / 2);
return crypto.getRandomValues(t), Array.from(t, l).join("");
} else return u(e);
};
function l(e) {
return e.toString(16).padStart(2, "0");
}
function u(e = 28) {
let t = "";
for (let n = 0; n < e; n++) t += "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".charAt(Math.floor(Math.random() * 62));
return t;
}
var d = (e) => {
e = e.split("?")[1];
let t = new URLSearchParams(e);
return {
accessToken: t.get("access_token"),
idToken: t.get("id_token"),
expiresIn: +(t.get("expires_in") || 0)
};
}, f = (e) => {
let t = e.replace(/([^:]\/)\/+/g, "$1");
return t.match(/^\/\/[^/?]+/) && t.includes(".") ? t = t.replace(/^\/\/\/+/, "//") : t.match(/^\/\/+/) && (t = t.replace(/^\/\/+/, "/")), t !== "/" && (t = t.replace(/\/$/, "")), t;
}, p = (e, t = !1) => {
let n = Array.isArray(e.audience) ? e.audience.join(" ") : e.audience || "", r = {
login_hint: e.loginHint,
is_create_org: e.isCreateOrg?.toString(),
connection_id: e.connectionId,
redirect_uri: e.redirectURL ? t ? e.redirectURL : f(e.redirectURL) : void 0,
audience: n,
scope: e.scope?.join(" ") || "email profile openid offline",
prompt: e.prompt,
lang: e.lang,
org_code: e.orgCode,
org_name: e.orgName,
has_success_page: e.hasSuccessPage?.toString(),
workflow_deployment_id: e.workflowDeploymentId,
supports_reauth: e.supportsReauth?.toString(),
plan_interest: e.planInterest,
pricing_table_key: e.pricingTableKey,
pages_mode: e.pagesMode,
invitation_code: e.invitationCode,
is_invitation: e.invitationCode ? "true" : void 0
};
return Object.keys(r).forEach((e) => r[e] === void 0 && delete r[e]), r;
}, m = (e) => typeof e != "object" || !e ? e : Array.isArray(e) ? e.map((e) => m(e)) : Object.fromEntries(Object.entries(e).map(([e, t]) => [e.replace(/_([a-z])/g, (e, t) => t.toUpperCase()), m(t)])), ee = /* @__PURE__ */ "utm_source.utm_medium.utm_campaign.utm_content.utm_term.gclid.click_id.hsa_acc.hsa_cam.hsa_grp.hsa_ad.hsa_src.hsa_tgt.hsa_kw.hsa_mt.hsa_net.hsa_ver.match_type.keyword.device.ad_group_id.campaign_id.creative.network.ad_position.fbclid.li_fat_id.msclkid.twclid.ttclid".split("."), h = async (e, n = i.login, r, a) => {
let o = `${e}/oauth2/auth`, s = $();
if (r.reauthState) try {
let e = m(JSON.parse(atob(r.reauthState)));
r = {
...r,
...e
}, delete r.reauthState;
} catch (e) {
let t = e instanceof Error ? e.message : "Unknown error";
throw Error(`Error handling reauth state: ${t}`, { cause: e });
}
if (!r.clientId) throw Error("Error generating auth URL: Client ID missing");
let l = {
client_id: r.clientId,
response_type: r.responseType || "code",
...p(r, a?.disableUrlSanitization)
};
r.state ||= c(32), s && s.setSessionItem(T.state, r.state), l.state = r.state, r.nonce ||= c(16), l.nonce = r.nonce, s && s.setSessionItem(T.nonce, r.nonce);
let u = "";
if (r.codeChallenge) l.code_challenge = r.codeChallenge;
else {
let { codeVerifier: e, codeChallenge: t } = await g();
u = e, s && s.setSessionItem(T.codeVerifier, e), l.code_challenge = t;
}
l.code_challenge_method = "S256", r.codeChallengeMethod && (l.code_challenge_method = r.codeChallengeMethod), !r.prompt && n === i.register && (l.prompt = t.create), r.properties && Object.keys(r.properties).forEach((e) => {
if (!ee.includes(e)) {
console.warn("Unsupported Property for url generation: ", e);
return;
}
let t = r.properties?.[e];
t !== void 0 && (l[e] = t);
});
let d = new URLSearchParams(l).toString();
return {
url: new URL(`${o}?${d}`),
state: l.state,
nonce: l.nonce,
codeChallenge: l.code_challenge,
codeVerifier: u
};
};
async function g() {
let e = c(52), t = new TextEncoder().encode(e), n;
return n = crypto ? o(await crypto.subtle.digest("SHA-256", t)) : o(e), {
codeVerifier: e,
codeChallenge: n
};
}
var _ = () => typeof window < "u", v;
function y(e, t) {
if (b(), !_()) throw Error("setRefreshTimer requires a browser environment");
if (e <= 0) throw Error("Timer duration must be positive");
v = window.setTimeout(t, Math.min(e * 1e3 - 1e4, 864e5));
}
function b() {
_() && v !== void 0 && (window.clearTimeout(v), v = void 0);
}
var x = {
framework: "",
frameworkVersion: "",
sdkVersion: ""
}, te = async () => {
await $()?.removeItems(T.state, T.nonce, T.codeVerifier);
}, S = () => `${x.framework}/${x.sdkVersion}/${x.frameworkVersion}/Javascript`, ne = async ({ urlParams: e, domain: t, clientId: n, clientSecret: r, redirectURL: i, autoRefresh: a = !1, onRefresh: o }) => {
let s = e.get("state"), c = e.get("code");
if (!s || !c) return console.error("Invalid state or code"), {
success: !1,
error: "Invalid state or code"
};
let l = $();
if (!l) return console.error("No active storage found"), {
success: !1,
error: "Authentication storage is not initialized"
};
(!x.framework || !x.frameworkVersion) && console.warn("Framework and version not set. Please set the framework and version in the config object");
let u = await l.getSessionItem(T.state);
if (s !== u) return console.error("Invalid state"), {
success: !1,
error: `Invalid state; supplied ${s}, expected ${u}`
};
let d = await l.getSessionItem(T.codeVerifier);
if (d === null) return console.error("Code verifier not found"), {
success: !1,
error: "Code verifier not found"
};
let f = { "Content-type": "application/x-www-form-urlencoded; charset=UTF-8" };
x.framework && (f["Kinde-SDK"] = S());
let p = !k.useInsecureForRefreshToken && C(t) ? { credentials: "include" } : {}, m = new URLSearchParams({
client_id: n,
code: c,
code_verifier: d,
grant_type: "authorization_code",
redirect_uri: i
});
r && m.append("client_secret", r);
let ee = {
method: "POST",
...p,
headers: new Headers(f),
body: m
}, h;
b();
try {
if (h = await fetch(`${t}/oauth2/token`, ee), !h?.ok) {
let e = await h.text();
return console.error("Token exchange failed:", h.status, e), {
success: !1,
error: `Token exchange failed: ${h.status} - ${e}`
};
}
} catch (e) {
return te(), console.error("Token exchange failed:", e), {
success: !1,
error: `Token exchange failed: ${e}`
};
}
let g = await h.json(), v = Q();
if (v) try {
await v.setItems({
[T.accessToken]: g.access_token,
[T.idToken]: g.id_token,
[T.refreshToken]: g.refresh_token
});
} catch (e) {
return console.error("Failed to persist tokens to secure storage:", e), {
success: !1,
error: `Failed to persist tokens: ${e}`
};
}
(k.useInsecureForRefreshToken || !C(t)) && l.setSessionItem(T.refreshToken, g.refresh_token), a && y(g.expires_in, async () => {
X({
domain: t,
clientId: n,
onRefresh: o
});
}), te();
let ne = (e) => (e.search = "", e);
if (_()) {
let e = ne(new URL(window.location.toString()));
window.history.replaceState(window.history.state, "", e);
}
return !g.access_token || !g.id_token || !g.refresh_token ? {
success: !1,
error: "No access token received"
} : {
success: !0,
[T.accessToken]: g.access_token,
[T.idToken]: g.id_token,
[T.refreshToken]: g.refresh_token
};
};
function re(e) {
let t = document.cookie.split("; ").find((t) => t.startsWith(`${e}=`));
if (!t) return null;
try {
let e = t.split("=")[1];
return e ? decodeURIComponent(e) : null;
} catch (t) {
return console.error(`Error parsing cookie ${e}:`, t), null;
}
}
var ie = "_kbrte", ae = async ({ domain: e, clientId: t }) => {
if (!e) return {
success: !1,
error: "Domain is required for authentication check"
};
if (!t) return {
success: !1,
error: "Client ID is required for authentication check"
};
let n = Q();
if (n) {
let { [T.accessToken]: r, [T.idToken]: i, [T.refreshToken]: o } = await n.getItems(T.accessToken, T.idToken, T.refreshToken);
if (r && i && o) return await Y({ threshold: 10 }) ? await X({
domain: e,
clientId: t,
refreshType: a.refreshToken
}) : {
success: !0,
accessToken: r,
idToken: i,
refreshToken: o
};
}
let r = C(e), i = k.useInsecureForRefreshToken, o = null;
return r && !i && (o = re(ie)), await X({
domain: e,
clientId: t,
refreshType: o ? a.cookie : a.refreshToken
});
}, C = (e) => !e.match(/^(?:https?:\/\/)?[a-zA-Z0-9][.-a-zA-Z0-9]*\.kinde\.com$/i);
function w(e, t) {
return t <= 0 ? [] : e.match(RegExp(`.{1,${t}}`, "g")) || [];
}
var T = /* @__PURE__ */ function(e) {
return e.accessToken = "accessToken", e.idToken = "idToken", e.refreshToken = "refreshToken", e.state = "state", e.nonce = "nonce", e.codeVerifier = "codeVerifier", e;
}({}), E = /* @__PURE__ */ function(e) {
return e.preWarning = "preWarning", e.timeout = "timeout", e;
}({}), D = class {
listeners = /* @__PURE__ */ new Set();
notificationScheduled = !1;
notifyListeners() {
this.listeners.size !== 0 && this.scheduleNotification();
}
async scheduleNotification() {
this.notificationScheduled || (this.notificationScheduled = !0, await new Promise((e) => {
setTimeout(async () => {
await Promise.all(Array.from(this.listeners).map((e) => e())), this.notificationScheduled = !1, e();
}, 0);
}));
}
subscribe(e) {
return this.listeners.add(e), () => {
this.listeners.delete(e);
};
}
async setItems(e) {
await Promise.all(Object.entries(e).map(([e, t]) => this.setSessionItem(e, t)));
}
async getItems(...e) {
let t = e.map(async (e) => [e, await this.getSessionItem(e)]), n = await Promise.all(t);
return Object.fromEntries(n);
}
async removeItems(...e) {
await Promise.all(e.map((e) => this.removeSessionItem(e)));
}
}, oe = class extends D {
asyncStore = !1;
memCache = {};
destroySession() {
this.memCache = {}, this.notifyListeners();
}
setSessionItem(e, t) {
if (this.removeSessionItem(e), typeof t == "string") {
w(t, k.maxLength).forEach((t, n) => {
this.memCache[`${k.keyPrefix}${e}${n}`] = t;
}), this.notifyListeners();
return;
}
this.memCache[`${k.keyPrefix}${String(e)}0`] = t, this.notifyListeners();
}
getSessionItem(e) {
if (this.memCache[`${k.keyPrefix}${String(e)}0`] === void 0) return null;
let t = "", n = 0, r = `${k.keyPrefix}${String(e)}${n}`;
for (; this.memCache[r] !== void 0;) t += this.memCache[r], n++, r = `${k.keyPrefix}${String(e)}${n}`;
return t;
}
removeSessionItem(e) {
for (let t in this.memCache) t.startsWith(`${k.keyPrefix}${String(e)}`) && delete this.memCache[t];
this.notifyListeners();
}
};
function O(e) {
return new Promise((t, n) => {
chrome.storage.local.get([e], function(r) {
chrome.runtime.lastError ? n(void 0) : t(r[e]);
});
});
}
var se = class extends D {
asyncStore = !0;
async destroySession() {
await chrome.storage.local.clear(), this.notifyListeners();
}
async setSessionItem(e, t) {
if (await this.removeSessionItem(e), typeof t == "string") {
let n = w(t, k.maxLength);
await Promise.all(n.map((t, n) => chrome.storage.local.set({ [`${k.keyPrefix}${e}${n}`]: t }))), this.notifyListeners();
return;
}
await chrome.storage.local.set({ [`${k.keyPrefix}${e}0`]: t }), this.notifyListeners();
}
async getSessionItem(e) {
let t = "", n = 0, r = `${k.keyPrefix}${String(e)}${n}`;
for (; await O(`${k.keyPrefix}${String(e)}${n}`) !== void 0;) t += await O(r), n++, r = `${k.keyPrefix}${String(e)}${n}`;
return t;
}
async removeSessionItem(e) {
let t = 0;
for (; await O(`${k.keyPrefix}${String(e)}${t}`) !== void 0;) await chrome.storage.local.remove(`${k.keyPrefix}${String(e)}${t}`), t++;
this.notifyListeners();
}
}, ce = class extends D {
asyncStore = !1;
constructor() {
super(), k.useInsecureForRefreshToken && console.warn("LocalStorage store should not be used in production");
}
internalItems = /* @__PURE__ */ new Set();
destroySession() {
Array.from(this.internalItems).forEach((e) => this.removeSessionItem(e)), this.notifyListeners();
}
setSessionItem(e, t) {
if (this.removeSessionItem(e), this.internalItems.add(e), typeof t == "string") {
w(t, k.maxLength).forEach((t, n) => {
localStorage.setItem(`${k.keyPrefix}${e}${n}`, t);
}), this.notifyListeners();
return;
}
localStorage.setItem(`${k.keyPrefix}${e}0`, t), this.notifyListeners();
}
getSessionItem(e) {
if (localStorage.getItem(`${k.keyPrefix}${e}0`) === null) return null;
let t = "", n = 0, r = `${k.keyPrefix}${String(e)}${n}`;
for (; localStorage.getItem(r) !== null;) t += localStorage.getItem(r), n++, r = `${k.keyPrefix}${String(e)}${n}`;
return t;
}
removeSessionItem(e) {
let t = 0;
for (; localStorage.getItem(`${k.keyPrefix}${String(e)}${t}`) !== null;) localStorage.removeItem(`${k.keyPrefix}${String(e)}${t}`), t++;
this.internalItems.delete(e), this.notifyListeners();
}
}, k = {
keyPrefix: "kinde-",
maxLength: 2e3,
useInsecureForRefreshToken: !1,
activityTimeoutMinutes: void 0,
activityTimeoutPreWarningMinutes: void 0,
onActivityTimeout: void 0
}, A = null, j = null, M = !1, le = () => {
if (M) return;
let e = Q() ?? $();
if (!e) throw Error("Session manager not found");
if (!k.activityTimeoutMinutes) throw Error("No activity timeout minutes set");
if (k.activityTimeoutPreWarningMinutes !== void 0 && k.activityTimeoutPreWarningMinutes >= k.activityTimeoutMinutes) throw Error("activityTimeoutPreWarningMinutes must be less than activityTimeoutMinutes");
A && clearTimeout(A), j && clearTimeout(j), j = setTimeout(async () => {
M = !0;
let t = {
accessToken: null,
idToken: null,
refreshToken: null
};
try {
let n = await e.getItems(T.accessToken, T.idToken, T.refreshToken);
t.accessToken = n[T.accessToken] ?? null, t.idToken = n[T.idToken] ?? null, t.refreshToken = n[T.refreshToken] ?? null;
} catch (e) {
console.error("Failed to capture tokens:", e);
}
let n = $();
if (n && n !== e) try {
t.refreshToken = (await n.getItems(T.refreshToken))[T.refreshToken] ?? null;
} catch (e) {
console.error("Failed to capture refresh token from insecure storage:", e);
}
M = !1;
try {
await e.destroySession();
} catch (e) {
console.error("Failed to destroy secure session:", e);
}
if (n && n !== e) try {
await n.destroySession();
} catch (e) {
console.error("Failed to destroy insecure session:", e);
}
try {
k.onActivityTimeout?.(E.timeout, t);
} catch (e) {
console.error("[activityTimeout] onActivityTimeout(timeout) threw:", e);
}
}, k.activityTimeoutMinutes * 60 * 1e3), k.activityTimeoutPreWarningMinutes !== void 0 && (A = setTimeout(() => {
try {
k.onActivityTimeout?.(E.preWarning);
} catch (e) {
console.error("[activityTimeout] onActivityTimeout(preWarning) threw:", e);
}
}, k.activityTimeoutPreWarningMinutes * 60 * 1e3));
}, N = (e) => {
if (!e) throw Error("Session manager not found");
if (!k.activityTimeoutMinutes) return e;
if (k.activityTimeoutPreWarningMinutes !== void 0 && k.activityTimeoutPreWarningMinutes >= k.activityTimeoutMinutes) throw Error("activityTimeoutPreWarningMinutes must be less than activityTimeoutMinutes");
return new Proxy(e, { get(e, t) {
let n = e[t];
return typeof n == "function" ? (t !== "destroySession" && le(), n.bind(e)) : n;
} });
};
function ue(e, t) {
if (!e) return null;
let n = e.split(".");
if (n.length !== 3) return null;
let r = n[t ?? 1].replace(/-/g, "+").replace(/_/g, "/"), i = decodeURIComponent(atob(r).split("").map((e) => "%" + ("00" + e.charCodeAt(0).toString(16)).slice(-2)).join(""));
return JSON.parse(i);
}
var de = (e) => {
if (!e) return null;
let t = ue(e);
return t || console.warn("No decoded token found"), t;
}, P = async (e = T.accessToken) => {
let t = Q();
return t ? de(await t.getSessionItem(e === "accessToken" ? T.accessToken : T.idToken)) : null;
}, F = (e = T.accessToken) => {
let t = Q();
if (!t) return null;
if (t.asyncStore) throw Error("Active storage is async-only. Use the async helpers.");
return de(t.getSessionItem(e === "accessToken" ? T.accessToken : T.idToken));
}, I = (e, t) => {
if (Array.isArray(e) && Array.isArray(t)) return Array.from(/* @__PURE__ */ new Set([...e, ...t]));
if (e && typeof e == "object" && t && typeof t == "object") {
let n = { ...e };
for (let e of Object.keys(t)) e in n ? n[e] = I(n[e], t[e]) : n[e] = t[e];
return n;
}
return t;
};
async function L(e) {
let t = Q();
if (!t) throw Error("No active storage found.");
let n = await t.getSessionItem(T.accessToken);
if (!n) throw Error("Authentication token not found.");
let r = await J("iss");
if (!r?.value) throw Error("Domain (iss claim) not found.");
let i;
try {
i = await fetch(`${r.value}/${e}`, {
method: "GET",
headers: {
Authorization: `Bearer ${n}`,
"Content-Type": "application/json"
}
});
} catch (t) {
throw Error(`Failed to fetch from ${r.value}/${e}`, { cause: t });
}
if (!i.ok) throw Error(`API request failed with status ${i.status}`);
return await i.json();
}
var R = async ({ url: e }) => {
let t = await L(e), n = t.data;
if (t.metadata?.has_more) {
let r = t.metadata.next_page_starting_after;
for (; t.metadata.has_more;) t = await L(`${e}?starting_after=${r}`), n = I(n, t.data), r = t.metadata.next_page_starting_after;
}
return n;
}, z = (e) => {
if (!e) return {
orgCode: null,
permissions: []
};
let t = e.permissions || e["x-hasura-permissions"] || [];
return {
orgCode: e.org_code || e["x-hasura-org-code"],
permissions: t
};
}, B = async (e) => {
if (e?.forceApi) {
let e = await R({ url: "account_api/v1/permissions" });
return {
orgCode: e.org_code,
permissions: e.permissions?.map((e) => e.key) || []
};
}
return z(await P());
}, fe = (e) => {
if (e?.forceApi) throw Error("forceApi cannot be used in sync mode");
return z(F());
}, pe = (e) => typeof e == "object" && !!e && "permission" in e && "condition" in e, V = async (e) => {
if (!e || !e.permissions || e?.permissions?.length === 0) return !0;
let { permissions: t } = e, n;
try {
n = await B({ forceApi: e.forceApi });
} catch (e) {
return console.error("[hasPermissions] Error getting permissions", e), !1;
}
return (await Promise.all(t.map(async (e) => pe(e) ? n.permissions.find((t) => t === e.permission) ? await e.condition({
permissionKey: e.permission,
orgCode: n.orgCode
}) : !1 : !!n.permissions.find((t) => t === e)))).every((e) => e === !0);
}, H = (e) => e ? !e.roles && !e["x-hasura-roles"] ? (console.warn("No roles found in token, ensure roles have been included in the token customisation within the application settings"), []) : e.roles || e["x-hasura-roles"] : [], U = async (e) => {
let t = await J("roles");
return e?.forceApi || !t?.value ? (await R({ url: "account_api/v1/roles" })).roles?.map((e) => ({
id: e.id,
name: e.name,
key: e.key
})) || [] : H(await P());
}, me = (e) => {
if (e?.forceApi) throw Error("forceApi cannot be used in sync mode");
let t = F();
if (!t) throw Error("Authentication token not found.");
return H(t);
}, he = (e) => typeof e == "object" && !!e && "role" in e && "condition" in e, W = async (e) => {
if (!e || !e.roles || e?.roles?.length === 0) return !0;
let { roles: t } = e, n;
try {
n = await U({ forceApi: e.forceApi });
} catch (e) {
return console.error("[hasRoles] Error getting roles", e), !1;
}
return (await Promise.all(t.map(async (e) => {
if (he(e)) {
let t = n.find((t) => t.key === e.role);
return t ? await e.condition(t) : !1;
} else return n.map((e) => e.key).includes(e);
}))).every((e) => e === !0);
}, ge = async (e) => e?.forceApi ? (await R({ url: "account_api/v1/feature_flags" })).feature_flags?.map((e) => ({
key: e.key,
value: e.value,
type: e.type
})) || [] : _e(await P()), _e = (e) => {
if (!e) return null;
let t = e.feature_flags || e["x-hasura-feature-flags"];
return t ? Object.entries(t).map(([e, t]) => ({
key: e,
value: t.v,
type: t.t
})) : null;
}, ve = (e) => typeof e == "object" && !!e && "flag" in e && "value" in e, ye = async (e) => {
if (!e || !e.featureFlags || e?.featureFlags?.length === 0) return !0;
let { featureFlags: t } = e, n;
try {
n = await ge({ forceApi: e.forceApi });
} catch (e) {
return console.error("[hasFeatureFlags] Error getting feature flags", e), !1;
}
return t.map((e) => {
if (ve(e)) {
let t = n?.find((t) => t.key === e.flag);
return t !== void 0 && t.value === e.value;
} else return n?.find((t) => t.key === e) !== void 0;
}).every((e) => e === !0);
}, be = async () => {
let e = await R({ url: "account_api/v1/entitlements" });
return {
orgCode: e.org_code,
plans: e.plans?.map((e) => ({
key: e.key,
subscribedOn: e.subscribed_on
})) || [],
entitlements: e.entitlements?.map((e) => ({
id: e.id,
fixedCharge: e.fixed_charge,
priceName: e.price_name,
unitAmount: e.unit_amount,
featureKey: e.feature_key,
featureName: e.feature_name,
entitlementLimitMax: e.entitlement_limit_max,
entitlementLimitMin: e.entitlement_limit_min
})) || []
};
}, xe = (e) => typeof e == "object" && !!e && "entitlement" in e && "condition" in e, Se = async (e) => {
if (!e || !e.billingEntitlements || e?.billingEntitlements?.length === 0) return !0;
let { billingEntitlements: t } = e, n;
try {
n = await be();
} catch (e) {
return console.error("[hasBillingEntitlements] Error getting entitlements", e), !1;
}
return (await Promise.all(t.map(async (e) => {
if (xe(e)) {
let t = n.entitlements.find((t) => t.priceName === e.entitlement);
return t ? await e.condition(t) : !1;
} else return n.entitlements.map((e) => e.priceName).includes(e);
}))).every((e) => e === !0);
}, G = (e) => e !== void 0 && typeof e == "object", Ce = async (e) => {
let t = [];
return e.roles && t.push(W({
roles: e.roles,
forceApi: G(e.forceApi) ? e.forceApi.roles : e.forceApi
})), e.permissions && t.push(V({
permissions: e.permissions,
forceApi: G(e.forceApi) ? e.forceApi.permissions : e.forceApi
})), e.featureFlags && t.push(ye({
featureFlags: e.featureFlags,
forceApi: G(e.forceApi) ? e.forceApi.featureFlags : e.forceApi
})), e.billingEntitlements && t.push(Se({ billingEntitlements: e.billingEntitlements })), (await Promise.all(t)).every(Boolean);
}, K = async (e = "accessToken") => P(e), q = (e = "accessToken") => F(e), we = (e, t) => e ? {
name: t,
value: e[t]
} : null, J = async (e, t = "accessToken") => we(await K(t), e), Te = (e, t = "accessToken") => we(q(t), e), Ee = async () => Oe(await P()), De = () => Oe(F()), Oe = (e) => e ? e.org_code || e["x-hasura-org-code"] : null, ke = async (e = T.accessToken) => {
let t = Q();
return t && await t.getSessionItem(e === "accessToken" ? T.accessToken : T.idToken) || null;
}, Ae = (e = T.accessToken) => {
let t = Q();
if (!t) return null;
if (t.asyncStore) throw Error("Active storage is async-only. Use the async helpers.");
return t.getSessionItem(e === "accessToken" ? T.accessToken : T.idToken) || null;
}, je = async (e, t) => {
if (t?.forceApi) {
let t = (await R({ url: "account_api/v1/feature_flags" })).feature_flags.find((t) => t.name === e);
return t ? t.value : null;
}
return Ne(await P(), e);
}, Me = (e, t) => {
if (t?.forceApi) throw Error("forceApi cannot be used in sync mode");
return Ne(F(), e);
}, Ne = (e, t) => {
if (!e) return null;
let n = e.feature_flags || e["x-hasura-feature-flags"];
return n ? n[t]?.v ?? null : null;
}, Pe = (e) => {
if (!e) return null;
let { sub: t } = e;
return t ? {
id: e.sub,
givenName: e.given_name,
familyName: e.family_name,
email: e.email,
picture: e.picture
} : (console.error("No sub in idToken"), null);
}, Fe = async () => Pe(await K("idToken")), Ie = () => Pe(q("idToken")), Le = (e, t) => {
if (!e) return {
permissionKey: t,
orgCode: null,
isGranted: !1
};
let n = e.permissions || e["x-hasura-permissions"] || [];
return {
permissionKey: t,
orgCode: e.org_code || e["x-hasura-org-code"] || null,
isGranted: !!n.includes(t)
};
}, Re = async (e, t) => t?.forceApi ? L(`account_api/v1/permission/${encodeURIComponent(e)}`) : Le(await P(), e), ze = (e, t) => {
if (t?.forceApi) throw Error("forceApi cannot be used in sync mode");
return Le(F(), e);
}, Be = async () => He(await P("idToken")), Ve = () => He(F("idToken")), He = (e) => e ? !e.org_codes && !e["x-hasura-org-codes"] ? (console.warn("Org codes not found in token, ensure org codes have been included in the token customisation within the application settings"), null) : e.org_codes || e["x-hasura-org-codes"] : null, Ue = async (e) => {
try {
let t = await Y({ threshold: e?.expiredThreshold });
return t && e?.useRefreshToken ? (await X({
domain: e.domain,
clientId: e.clientId
})).success : !t;
} catch (e) {
return console.error("Error checking authentication:", e), !1;
}
}, Y = async (e) => {
try {
let t = await P("accessToken");
return t ? t.exp ? t.exp < Math.floor(Date.now() / 1e3) + (e?.threshold || 0) : (console.error("Token does not have an expiry"), !0) : !0;
} catch (e) {
return console.error("Error checking authentication:", e), !1;
}
}, X = async ({ domain: e, clientId: t, clientSecret: n, refreshType: r = a.refreshToken, onRefresh: i }) => {
let o = (e) => (i && i(e), e);
if (!e) return o({
success: !1,
error: "Domain is required for token refresh"
});
if (!t) return o({
success: !1,
error: "Client ID is required for token refresh"
});
let s = "", c;
if (c = k.useInsecureForRefreshToken || !C(e) ? $() : Q(), r === a.refreshToken) {
if (!c) return o({
success: !1,
error: "No active storage found"
});
if (s = await c.getSessionItem(T.refreshToken), !s) return o({
success: !1,
error: "No refresh token found"
});
}
b();
let l, u;
try {
if (k.onRefreshHandler) l = await k.onRefreshHandler(r);
else {
let i = new URLSearchParams({
...r === a.refreshToken && { refresh_token: s },
grant_type: "refresh_token",
client_id: t
});
n && i.append("client_secret", n);
let c = r === a.cookie || C(e) && !k.useInsecureForRefreshToken, d = await fetch(`${f(e)}/oauth2/token`, {
method: "POST",
...c && { credentials: "include" },
headers: { "Content-type": "application/x-www-form-urlencoded; charset=UTF-8" },
body: i.toString()
});
if (!d.ok) return o({
success: !1,
error: "Failed to refresh token"
});
u = await d.json(), l = {
success: !0,
[T.accessToken]: u.access_token,
[T.idToken]: u.id_token,
[T.refreshToken]: u.refresh_token
};
}
if (l.accessToken) {
let n = Q();
if (!n) return o({
success: !1,
error: "No active storage found"
});
if (await n.setSessionItem(T.accessToken, l.accessToken), l.idToken && await n.setSessionItem(T.idToken, l.idToken), c && l.refreshToken && await c.setSessionItem(T.refreshToken, l.refreshToken), _()) {
let n = Number((await J("exp"))?.value);
if (Number.isFinite(n) || u?.expires_in) {
let a = 0;
if (!u?.expires_in) {
let e = Math.floor(Date.now() / 1e3);
a = Math.max(n - e, 1);
}
y(u?.expires_in || a, async () => {
X({
domain: e,
clientId: t,
refreshType: r,
onRefresh: i
});
});
}
}
return o(l);
}
} catch (e) {
return o({
success: !1,
error: `No access token received: ${e}`
});
}
return o({
success: !1,
error: "No access token received"
});
}, We = async (e) => {
let t = await L(`account_api/v1/entitlement/${encodeURIComponent(e)}`);
return {
orgCode: t.data.org_code,
entitlement: {
id: t.data.entitlement.id,
fixedCharge: t.data.entitlement.fixed_charge,
priceName: t.data.entitlement.price_name,
unitAmount: t.data.entitlement.unit_amount,
featureKey: t.data.entitlement.feature_key,
featureName: t.data.entitlement.feature_name,
entitlementLimitMax: t.data.entitlement.entitlement_limit_max,
entitlementLimitMin: t.data.entitlement.entitlement_limit_min
}
};
}, Z = {
secure: null,
insecure: null
}, Ge = (e) => {
if (k.activityTimeoutMinutes) {
Z.secure = N(e);
return;
}
Z.secure = e;
}, Q = () => Z.secure || null, Ke = () => Z.secure !== null, qe = () => {
Z.secure = null;
}, Je = (e) => {
if (k.activityTimeoutMinutes) {
Z.insecure = N(e);
return;
}
Z.insecure = e;
}, $ = () => Z.insecure || Z.secure || null, Ye = () => Z.insecure !== null, Xe = () => {
Z.insecure = null;
}, Ze = async (e) => (console.warn("Warning: generateProfileUrl is deprecated. Please use generatePortalUrl instead."), $e({
domain: e.domain,
returnUrl: e.returnUrl,
subNav: e.subNav
}));
function Qe(e, t = []) {
try {
let n = new URL(e);
return !t.includes(n.protocol) && !!n.host;
} catch {
return !1;
}
}
var $e = async ({ domain: e, returnUrl: t, subNav: r }) => {
let i = Q();
if (!i) throw Error("generatePortalUrl: Active storage not found");
let a = await i.getSessionItem(T.accessToken);
if (!a) throw Error("generatePortalUrl: Access Token not found");
if (!e || typeof e != "string") {
let t = await J("iss");
if (!t?.value || typeof t.value != "string") throw Error("generatePortalUrl: Unable to determine domain from access token");
e = t.value;
}
if (!Qe(t, ["ftp:", "ws:"])) throw Error("generatePortalUrl: returnUrl must be an absolute URL");
let o = new URLSearchParams({
subnav: r || n.profile,
return_url: t
}), s = await fetch(`${f(e)}/account_api/v1/portal_link?${o.toString()}`, { headers: { Authorization: `Bearer ${a}` } });
if (!s.ok) throw Error(`Failed to fetch profile URL: ${s.status} ${s.statusText}`);
let c = await s.json();
if (!c.url || typeof c.url != "string") throw Error("Invalid URL received from API");
try {
return { url: new URL(c.url) };
} catch (e) {
throw console.error(e), Error(`Invalid URL format received from API: ${c.url}`, { cause: e });
}
}, et = () => window.self !== window.top, tt = async ({ url: e, popupOptions: t = {}, handleResult: n, forcePopup: r = !1 }) => {
et() || r ? await nt({
url: e,
popupOptions: t,
handleResult: n
}) : document.location = e;
}, nt = async ({ url: e, popupOptions: t = {}, handleResult: n }) => {
let { width: r = 500, height: i = 600, left: a = (window.screen.width - r) / 2, top: o = (window.screen.height - i) / 2 } = t, s = window.open(e, "kinde_auth_popup", `width=${r},height=${i},left=${a},top=${o},scrollbars=yes,resizable=yes,toolbar=no,menubar=no,location=no,status=no`);
if (!s) throw Error("Popup was blocked by the browser");
let c = () => new Promise((e) => {
let t = (r) => {
if (r.origin === window.location.origin && r.data && r.data.type === "KINDE_AUTH_RESULT") {
window.removeEventListener("message", t);
let i = new URLSearchParams();
Object.entries(r.data.result).forEach(([e, t]) => {
i.append(e, t);
}), n?.(i).then(() => e());
}
};
window.addEventListener("message", t);
});
try {
await c();
} catch (e) {
throw Error("Popup authentication failed", { cause: e });
}
return s;
}, rt = () => !_(), it = ({ domain: e, clientId: n, orgCode: r, redirectURL: a }) => {
if (!e) throw Error("domain is required for switchOrg");
if (!n) throw Error("clientId is required for switchOrg");
if (!r) throw Error("orgCode is required for switchOrg");
if (!a) throw Error("redirectURL is required for switchOrg");
let o = {
clientId: n,
prompt: t.none,
orgCode: r,
redirectURL: a
};
return h(e, i.login, o);
};
//#endregion
export { it as $, Ue as A, _ as B, Q as C, T as D, Se as E, X as F, c as G, ae as H, Xe as I, e as J, ce as K, Y as L, Ve as M, W as N, Te as O, We as P, i as Q, Ye as R, P as S, ze as St, S as T, b as U, a as V, be as W, fe as X, f as Y, h as Z, Je as _, tt as _t, Be as a, n as at, Me as b, y as bt, D as c, oe as ct, Ee as d, qe as dt, je as et, F as f, r as ft, J as g, t as gt, Ie as h, se as ht, B as i, me as it, V as j, U as k, De as l, p as lt, Ge as m, s as mt, $e as n, ke as nt, C as o, ne as ot, Fe as p, rt as pt, d as q, Ae as r, le as rt, Ce as s, o as st, $ as t, k as tt, E as u, q as ut, K as v, w as vt, Re as w, N as x, ye as xt, Ke as y, x as yt, Ze as z };