oidc-client-ts
Version:
OpenID Connect (OIDC) & OAuth2 client library
1 lines • 65.5 kB
JavaScript
"use strict";var oidc=(()=>{var Ze=Object.create;var le=Object.defineProperty;var et=Object.getOwnPropertyDescriptor;var tt=Object.getOwnPropertyNames;var rt=Object.getPrototypeOf,it=Object.prototype.hasOwnProperty;var Me=(d=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(d,{get:(e,t)=>(typeof require<"u"?require:e)[t]}):d)(function(d){if(typeof require<"u")return require.apply(this,arguments);throw new Error('Dynamic require of "'+d+'" is not supported')});var ie=(d,e)=>()=>(e||d((e={exports:{}}).exports,e),e.exports),st=(d,e)=>{for(var t in e)le(d,t,{get:e[t],enumerable:!0})},Ne=(d,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of tt(e))!it.call(d,i)&&i!==t&&le(d,i,{get:()=>e[i],enumerable:!(r=et(e,i))||r.enumerable});return d};var de=(d,e,t)=>(t=d!=null?Ze(rt(d)):{},Ne(e||!d||!d.__esModule?le(t,"default",{value:d,enumerable:!0}):t,d)),nt=d=>Ne(le({},"__esModule",{value:!0}),d);var We=ie(()=>{});var se=ie((ge,Le)=>{(function(d,e){typeof ge=="object"?Le.exports=ge=e():typeof define=="function"&&define.amd?define([],e):d.CryptoJS=e()})(ge,function(){var d=d||function(e,t){var r;if(typeof window<"u"&&window.crypto&&(r=window.crypto),typeof self<"u"&&self.crypto&&(r=self.crypto),typeof globalThis<"u"&&globalThis.crypto&&(r=globalThis.crypto),!r&&typeof window<"u"&&window.msCrypto&&(r=window.msCrypto),!r&&typeof global<"u"&&global.crypto&&(r=global.crypto),!r&&typeof Me=="function")try{r=We()}catch{}var i=function(){if(r){if(typeof r.getRandomValues=="function")try{return r.getRandomValues(new Uint32Array(1))[0]}catch{}if(typeof r.randomBytes=="function")try{return r.randomBytes(4).readInt32LE()}catch{}}throw new Error("Native crypto module could not be used to get secure random number.")},s=Object.create||function(){function a(){}return function(u){var w;return a.prototype=u,w=new a,a.prototype=null,w}}(),n={},o=n.lib={},c=o.Base=function(){return{extend:function(a){var u=s(this);return a&&u.mixIn(a),(!u.hasOwnProperty("init")||this.init===u.init)&&(u.init=function(){u.$super.init.apply(this,arguments)}),u.init.prototype=u,u.$super=this,u},create:function(){var a=this.extend();return a.init.apply(a,arguments),a},init:function(){},mixIn:function(a){for(var u in a)a.hasOwnProperty(u)&&(this[u]=a[u]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},clone:function(){return this.init.prototype.extend(this)}}}(),l=o.WordArray=c.extend({init:function(a,u){a=this.words=a||[],u!=t?this.sigBytes=u:this.sigBytes=a.length*4},toString:function(a){return(a||h).stringify(this)},concat:function(a){var u=this.words,w=a.words,b=this.sigBytes,v=a.sigBytes;if(this.clamp(),b%4)for(var S=0;S<v;S++){var P=w[S>>>2]>>>24-S%4*8&255;u[b+S>>>2]|=P<<24-(b+S)%4*8}else for(var R=0;R<v;R+=4)u[b+R>>>2]=w[R>>>2];return this.sigBytes+=v,this},clamp:function(){var a=this.words,u=this.sigBytes;a[u>>>2]&=4294967295<<32-u%4*8,a.length=e.ceil(u/4)},clone:function(){var a=c.clone.call(this);return a.words=this.words.slice(0),a},random:function(a){for(var u=[],w=0;w<a;w+=4)u.push(i());return new l.init(u,a)}}),m=n.enc={},h=m.Hex={stringify:function(a){for(var u=a.words,w=a.sigBytes,b=[],v=0;v<w;v++){var S=u[v>>>2]>>>24-v%4*8&255;b.push((S>>>4).toString(16)),b.push((S&15).toString(16))}return b.join("")},parse:function(a){for(var u=a.length,w=[],b=0;b<u;b+=2)w[b>>>3]|=parseInt(a.substr(b,2),16)<<24-b%8*4;return new l.init(w,u/2)}},p=m.Latin1={stringify:function(a){for(var u=a.words,w=a.sigBytes,b=[],v=0;v<w;v++){var S=u[v>>>2]>>>24-v%4*8&255;b.push(String.fromCharCode(S))}return b.join("")},parse:function(a){for(var u=a.length,w=[],b=0;b<u;b++)w[b>>>2]|=(a.charCodeAt(b)&255)<<24-b%4*8;return new l.init(w,u)}},f=m.Utf8={stringify:function(a){try{return decodeURIComponent(escape(p.stringify(a)))}catch{throw new Error("Malformed UTF-8 data")}},parse:function(a){return p.parse(unescape(encodeURIComponent(a)))}},_=o.BufferedBlockAlgorithm=c.extend({reset:function(){this._data=new l.init,this._nDataBytes=0},_append:function(a){typeof a=="string"&&(a=f.parse(a)),this._data.concat(a),this._nDataBytes+=a.sigBytes},_process:function(a){var u,w=this._data,b=w.words,v=w.sigBytes,S=this.blockSize,P=S*4,R=v/P;a?R=e.ceil(R):R=e.max((R|0)-this._minBufferSize,0);var I=R*S,W=e.min(I*4,v);if(I){for(var L=0;L<I;L+=S)this._doProcessBlock(b,L);u=b.splice(0,I),w.sigBytes-=W}return new l.init(u,W)},clone:function(){var a=c.clone.call(this);return a._data=this._data.clone(),a},_minBufferSize:0}),k=o.Hasher=_.extend({cfg:c.extend(),init:function(a){this.cfg=this.cfg.extend(a),this.reset()},reset:function(){_.reset.call(this),this._doReset()},update:function(a){return this._append(a),this._process(),this},finalize:function(a){a&&this._append(a);var u=this._doFinalize();return u},blockSize:512/32,_createHelper:function(a){return function(u,w){return new a.init(w).finalize(u)}},_createHmacHelper:function(a){return function(u,w){return new y.HMAC.init(a,w).finalize(u)}}}),y=n.algo={};return n}(Math);return d})});var Fe=ie((ue,je)=>{(function(d,e){typeof ue=="object"?je.exports=ue=e(se()):typeof define=="function"&&define.amd?define(["./core"],e):e(d.CryptoJS)})(ue,function(d){return function(e){var t=d,r=t.lib,i=r.WordArray,s=r.Hasher,n=t.algo,o=[],c=[];(function(){function h(k){for(var y=e.sqrt(k),a=2;a<=y;a++)if(!(k%a))return!1;return!0}function p(k){return(k-(k|0))*4294967296|0}for(var f=2,_=0;_<64;)h(f)&&(_<8&&(o[_]=p(e.pow(f,1/2))),c[_]=p(e.pow(f,1/3)),_++),f++})();var l=[],m=n.SHA256=s.extend({_doReset:function(){this._hash=new i.init(o.slice(0))},_doProcessBlock:function(h,p){for(var f=this._hash.words,_=f[0],k=f[1],y=f[2],a=f[3],u=f[4],w=f[5],b=f[6],v=f[7],S=0;S<64;S++){if(S<16)l[S]=h[p+S]|0;else{var P=l[S-15],R=(P<<25|P>>>7)^(P<<14|P>>>18)^P>>>3,I=l[S-2],W=(I<<15|I>>>17)^(I<<13|I>>>19)^I>>>10;l[S]=R+l[S-7]+W+l[S-16]}var L=u&w^~u&b,Pe=_&k^_&y^k&y,re=(_<<30|_>>>2)^(_<<19|_>>>13)^(_<<10|_>>>22),Ce=(u<<26|u>>>6)^(u<<21|u>>>11)^(u<<7|u>>>25),ce=v+Ce+L+c[S]+l[S],Ie=re+Pe;v=b,b=w,w=u,u=a+ce|0,a=y,y=k,k=_,_=ce+Ie|0}f[0]=f[0]+_|0,f[1]=f[1]+k|0,f[2]=f[2]+y|0,f[3]=f[3]+a|0,f[4]=f[4]+u|0,f[5]=f[5]+w|0,f[6]=f[6]+b|0,f[7]=f[7]+v|0},_doFinalize:function(){var h=this._data,p=h.words,f=this._nDataBytes*8,_=h.sigBytes*8;return p[_>>>5]|=128<<24-_%32,p[(_+64>>>9<<4)+14]=e.floor(f/4294967296),p[(_+64>>>9<<4)+15]=f,h.sigBytes=p.length*4,this._process(),this._hash},clone:function(){var h=s.clone.call(this);return h._hash=this._hash.clone(),h}});t.SHA256=s._createHelper(m),t.HmacSHA256=s._createHmacHelper(m)}(Math),d.SHA256})});var Be=ie((pe,He)=>{(function(d,e){typeof pe=="object"?He.exports=pe=e(se()):typeof define=="function"&&define.amd?define(["./core"],e):e(d.CryptoJS)})(pe,function(d){return function(){var e=d,t=e.lib,r=t.WordArray,i=e.enc,s=i.Base64={stringify:function(o){var c=o.words,l=o.sigBytes,m=this._map;o.clamp();for(var h=[],p=0;p<l;p+=3)for(var f=c[p>>>2]>>>24-p%4*8&255,_=c[p+1>>>2]>>>24-(p+1)%4*8&255,k=c[p+2>>>2]>>>24-(p+2)%4*8&255,y=f<<16|_<<8|k,a=0;a<4&&p+a*.75<l;a++)h.push(m.charAt(y>>>6*(3-a)&63));var u=m.charAt(64);if(u)for(;h.length%4;)h.push(u);return h.join("")},parse:function(o){var c=o.length,l=this._map,m=this._reverseMap;if(!m){m=this._reverseMap=[];for(var h=0;h<l.length;h++)m[l.charCodeAt(h)]=h}var p=l.charAt(64);if(p){var f=o.indexOf(p);f!==-1&&(c=f)}return n(o,c,m)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="};function n(o,c,l){for(var m=[],h=0,p=0;p<c;p++)if(p%4){var f=l[o.charCodeAt(p-1)]<<p%4*2,_=l[o.charCodeAt(p)]>>>6-p%4*2,k=f|_;m[h>>>2]|=k<<24-h%4*8,h++}return r.create(m,h)}}(),d.enc.Base64})});var De=ie((he,Je)=>{(function(d,e){typeof he=="object"?Je.exports=he=e(se()):typeof define=="function"&&define.amd?define(["./core"],e):e(d.CryptoJS)})(he,function(d){return d.enc.Utf8})});var vt={};st(vt,{AccessTokenEvents:()=>Q,CheckSessionIFrame:()=>V,ErrorResponse:()=>U,ErrorTimeout:()=>q,InMemoryWebStorage:()=>j,Log:()=>D,Logger:()=>g,MetadataService:()=>G,OidcClient:()=>oe,OidcClientSettingsStore:()=>B,SessionMonitor:()=>Z,SigninResponse:()=>J,SigninState:()=>M,SignoutResponse:()=>X,State:()=>T,User:()=>N,UserManager:()=>qe,UserManagerSettingsStore:()=>te,Version:()=>Xe,WebStorageStateStore:()=>H});var Ke=de(se()),$e=de(Fe()),Ue=de(Be()),ze=de(De());var ot={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},A,O,D=(s=>(s[s.NONE=0]="NONE",s[s.ERROR=1]="ERROR",s[s.WARN=2]="WARN",s[s.INFO=3]="INFO",s[s.DEBUG=4]="DEBUG",s))(D||{});(r=>{function d(){A=3,O=ot}r.reset=d;function e(i){if(!(0<=i&&i<=4))throw new Error("Invalid log level");A=i}r.setLevel=e;function t(i){O=i}r.setLogger=t})(D||(D={}));var g=class{constructor(e){this._name=e}debug(...e){A>=4&&O.debug(g._format(this._name,this._method),...e)}info(...e){A>=3&&O.info(g._format(this._name,this._method),...e)}warn(...e){A>=2&&O.warn(g._format(this._name,this._method),...e)}error(...e){A>=1&&O.error(g._format(this._name,this._method),...e)}throw(e){throw this.error(e),e}create(e){let t=Object.create(this);return t._method=e,t.debug("begin"),t}static createStatic(e,t){let r=new g(`${e}.${t}`);return r.debug("begin"),r}static _format(e,t){let r=`[${e}]`;return t?`${r} ${t}:`:r}static debug(e,...t){A>=4&&O.debug(g._format(e),...t)}static info(e,...t){A>=3&&O.info(g._format(e),...t)}static warn(e,...t){A>=2&&O.warn(g._format(e),...t)}static error(e,...t){A>=1&&O.error(g._format(e),...t)}};D.reset();var at="10000000-1000-4000-8000-100000000000",C=class{static _randomWord(){return Ke.default.lib.WordArray.random(1).words[0]}static generateUUIDv4(){return at.replace(/[018]/g,t=>(+t^C._randomWord()&15>>+t/4).toString(16)).replace(/-/g,"")}static generateCodeVerifier(){return C.generateUUIDv4()+C.generateUUIDv4()+C.generateUUIDv4()}static generateCodeChallenge(e){try{let t=(0,$e.default)(e);return Ue.default.stringify(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(t){throw g.error("CryptoUtils.generateCodeChallenge",t),t}}static generateBasicAuth(e,t){let r=ze.default.parse([e,t].join(":"));return Ue.default.stringify(r)}};var E=class{constructor(e){this._name=e;this._logger=new g(`Event('${this._name}')`);this._callbacks=[]}addHandler(e){return this._callbacks.push(e),()=>this.removeHandler(e)}removeHandler(e){let t=this._callbacks.lastIndexOf(e);t>=0&&this._callbacks.splice(t,1)}raise(...e){this._logger.debug("raise:",...e);for(let t of this._callbacks)t(...e)}};function Te(d){this.message=d}Te.prototype=new Error,Te.prototype.name="InvalidCharacterError";var Qe=typeof window<"u"&&window.atob&&window.atob.bind(window)||function(d){var e=String(d).replace(/=+$/,"");if(e.length%4==1)throw new Te("'atob' failed: The string to be decoded is not correctly encoded.");for(var t,r,i=0,s=0,n="";r=e.charAt(s++);~r&&(t=i%4?64*t+r:r,i++%4)?n+=String.fromCharCode(255&t>>(-2*i&6)):0)r="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(r);return n};function ct(d){var e=d.replace(/-/g,"+").replace(/_/g,"/");switch(e.length%4){case 0:break;case 2:e+="==";break;case 3:e+="=";break;default:throw"Illegal base64url string!"}try{return function(t){return decodeURIComponent(Qe(t).replace(/(.)/g,function(r,i){var s=i.charCodeAt(0).toString(16).toUpperCase();return s.length<2&&(s="0"+s),"%"+s}))}(e)}catch{return Qe(e)}}function fe(d){this.message=d}function lt(d,e){if(typeof d!="string")throw new fe("Invalid token specified");var t=(e=e||{}).header===!0?0:1;try{return JSON.parse(ct(d.split(".")[t]))}catch(r){throw new fe("Invalid token specified: "+r.message)}}fe.prototype=new Error,fe.prototype.name="InvalidTokenError";var Ve=lt;var K=class{static decode(e){try{return Ve(e)}catch(t){throw g.error("JwtUtils.decode",t),t}}};var ne=class{static center({...e}){var t,r,i;return e.width==null&&(e.width=(t=[800,720,600,480].find(s=>s<=window.outerWidth/1.618))!=null?t:360),(r=e.left)!=null||(e.left=Math.max(0,Math.round(window.screenX+(window.outerWidth-e.width)/2))),e.height!=null&&((i=e.top)!=null||(e.top=Math.max(0,Math.round(window.screenY+(window.outerHeight-e.height)/2)))),e}static serialize(e){return Object.entries(e).filter(([,t])=>t!=null).map(([t,r])=>`${t}=${typeof r!="boolean"?r:r?"yes":"no"}`).join(",")}};var x=class extends E{constructor(){super(...arguments);this._logger=new g(`Timer('${this._name}')`);this._timerHandle=null;this._expiration=0;this._callback=()=>{let t=this._expiration-x.getEpochTime();this._logger.debug("timer completes in",t),this._expiration<=x.getEpochTime()&&(this.cancel(),super.raise())}}static getEpochTime(){return Math.floor(Date.now()/1e3)}init(t){let r=this._logger.create("init");t=Math.max(Math.floor(t),1);let i=x.getEpochTime()+t;if(this.expiration===i&&this._timerHandle){r.debug("skipping since already initialized for expiration at",this.expiration);return}this.cancel(),r.debug("using duration",t),this._expiration=i;let s=Math.min(t,5);this._timerHandle=setInterval(this._callback,s*1e3)}get expiration(){return this._expiration}cancel(){this._logger.create("cancel"),this._timerHandle&&(clearInterval(this._timerHandle),this._timerHandle=null)}};var $=class{static readParams(e,t="query"){if(!e)throw new TypeError("Invalid URL");let i=new URL(e,window.location.origin)[t==="fragment"?"hash":"search"];return new URLSearchParams(i.slice(1))}};var U=class extends Error{constructor(t,r){var i,s,n;super(t.error_description||t.error||"");this.form=r;this.name="ErrorResponse";if(!t.error)throw g.error("ErrorResponse","No error passed"),new Error("No error passed");this.error=t.error,this.error_description=(i=t.error_description)!=null?i:null,this.error_uri=(s=t.error_uri)!=null?s:null,this.state=t.userState,this.session_state=(n=t.session_state)!=null?n:null}};var q=class extends Error{constructor(t){super(t);this.name="ErrorTimeout"}};var Q=class{constructor(e){this._logger=new g("AccessTokenEvents");this._expiringTimer=new x("Access token expiring");this._expiredTimer=new x("Access token expired");this._expiringNotificationTimeInSeconds=e.expiringNotificationTimeInSeconds}load(e){let t=this._logger.create("load");if(e.access_token&&e.expires_in!==void 0){let r=e.expires_in;if(t.debug("access token present, remaining duration:",r),r>0){let s=r-this._expiringNotificationTimeInSeconds;s<=0&&(s=1),t.debug("registering expiring timer, raising in",s,"seconds"),this._expiringTimer.init(s)}else t.debug("canceling existing expiring timer because we're past expiration."),this._expiringTimer.cancel();let i=r+1;t.debug("registering expired timer, raising in",i,"seconds"),this._expiredTimer.init(i)}else this._expiringTimer.cancel(),this._expiredTimer.cancel()}unload(){this._logger.debug("unload: canceling existing access token timers"),this._expiringTimer.cancel(),this._expiredTimer.cancel()}addAccessTokenExpiring(e){return this._expiringTimer.addHandler(e)}removeAccessTokenExpiring(e){this._expiringTimer.removeHandler(e)}addAccessTokenExpired(e){return this._expiredTimer.addHandler(e)}removeAccessTokenExpired(e){this._expiredTimer.removeHandler(e)}};var V=class{constructor(e,t,r,i,s){this._callback=e;this._client_id=t;this._intervalInSeconds=i;this._stopOnError=s;this._logger=new g("CheckSessionIFrame");this._timer=null;this._session_state=null;this._message=e=>{e.origin===this._frame_origin&&e.source===this._frame.contentWindow&&(e.data==="error"?(this._logger.error("error message from check session op iframe"),this._stopOnError&&this.stop()):e.data==="changed"?(this._logger.debug("changed message from check session op iframe"),this.stop(),this._callback()):this._logger.debug(e.data+" message from check session op iframe"))};let n=new URL(r);this._frame_origin=n.origin,this._frame=window.document.createElement("iframe"),this._frame.style.visibility="hidden",this._frame.style.position="fixed",this._frame.style.left="-1000px",this._frame.style.top="0",this._frame.width="0",this._frame.height="0",this._frame.src=n.href}load(){return new Promise(e=>{this._frame.onload=()=>{e()},window.document.body.appendChild(this._frame),window.addEventListener("message",this._message,!1)})}start(e){if(this._session_state===e)return;this._logger.create("start"),this.stop(),this._session_state=e;let t=()=>{!this._frame.contentWindow||!this._session_state||this._frame.contentWindow.postMessage(this._client_id+" "+this._session_state,this._frame_origin)};t(),this._timer=setInterval(t,this._intervalInSeconds*1e3)}stop(){this._logger.create("stop"),this._session_state=null,this._timer&&(clearInterval(this._timer),this._timer=null)}};var j=class{constructor(){this._logger=new g("InMemoryWebStorage");this._data={}}clear(){this._logger.create("clear"),this._data={}}getItem(e){return this._logger.create(`getItem('${e}')`),this._data[e]}setItem(e,t){this._logger.create(`setItem('${e}')`),this._data[e]=t}removeItem(e){this._logger.create(`removeItem('${e}')`),delete this._data[e]}get length(){return Object.getOwnPropertyNames(this._data).length}key(e){return Object.getOwnPropertyNames(this._data)[e]}};var F=class{constructor(e=[],t=null){this._jwtHandler=t;this._logger=new g("JsonService");this._contentTypes=[];this._contentTypes.push(...e,"application/json"),t&&this._contentTypes.push("application/jwt")}async fetchWithTimeout(e,t={}){let{timeoutInSeconds:r,...i}=t;if(!r)return await fetch(e,i);let s=new AbortController,n=setTimeout(()=>s.abort(),r*1e3);try{return await fetch(e,{...t,signal:s.signal})}catch(o){throw o instanceof DOMException&&o.name==="AbortError"?new q("Network timed out"):o}finally{clearTimeout(n)}}async getJson(e,{token:t,credentials:r}={}){let i=this._logger.create("getJson"),s={Accept:this._contentTypes.join(", ")};t&&(i.debug("token passed, setting Authorization header"),s.Authorization="Bearer "+t);let n;try{i.debug("url:",e),n=await this.fetchWithTimeout(e,{method:"GET",headers:s,credentials:r})}catch(l){throw i.error("Network Error"),l}i.debug("HTTP response received, status",n.status);let o=n.headers.get("Content-Type");if(o&&!this._contentTypes.find(l=>o.startsWith(l))&&i.throw(new Error(`Invalid response Content-Type: ${o!=null?o:"undefined"}, from URL: ${e}`)),n.ok&&this._jwtHandler&&(o==null?void 0:o.startsWith("application/jwt")))return await this._jwtHandler(await n.text());let c;try{c=await n.json()}catch(l){throw i.error("Error parsing JSON response",l),n.ok?l:new Error(`${n.statusText} (${n.status})`)}if(!n.ok)throw i.error("Error from server:",c),c.error?new U(c):new Error(`${n.statusText} (${n.status}): ${JSON.stringify(c)}`);return c}async postForm(e,{body:t,basicAuth:r,timeoutInSeconds:i,initCredentials:s}){let n=this._logger.create("postForm"),o={Accept:this._contentTypes.join(", "),"Content-Type":"application/x-www-form-urlencoded"};r!==void 0&&(o.Authorization="Basic "+r);let c;try{n.debug("url:",e),c=await this.fetchWithTimeout(e,{method:"POST",headers:o,body:t,timeoutInSeconds:i,credentials:s})}catch(p){throw n.error("Network error"),p}n.debug("HTTP response received, status",c.status);let l=c.headers.get("Content-Type");if(l&&!this._contentTypes.find(p=>l.startsWith(p)))throw new Error(`Invalid response Content-Type: ${l!=null?l:"undefined"}, from URL: ${e}`);let m=await c.text(),h={};if(m)try{h=JSON.parse(m)}catch(p){throw n.error("Error parsing JSON response",p),c.ok?p:new Error(`${c.statusText} (${c.status})`)}if(!c.ok)throw n.error("Error from server:",h),h.error?new U(h,t):new Error(`${c.statusText} (${c.status}): ${JSON.stringify(h)}`);return h}};var G=class{constructor(e){this._settings=e;this._logger=new g("MetadataService");this._jsonService=new F(["application/jwk-set+json"]);this._signingKeys=null;this._metadata=null;this._metadataUrl=this._settings.metadataUrl,this._settings.signingKeys&&(this._logger.debug("using signingKeys from settings"),this._signingKeys=this._settings.signingKeys),this._settings.metadata&&(this._logger.debug("using metadata from settings"),this._metadata=this._settings.metadata),this._settings.fetchRequestCredentials&&(this._logger.debug("using fetchRequestCredentials from settings"),this._fetchRequestCredentials=this._settings.fetchRequestCredentials)}resetSigningKeys(){this._signingKeys=null}async getMetadata(){let e=this._logger.create("getMetadata");if(this._metadata)return e.debug("using cached values"),this._metadata;if(!this._metadataUrl)throw e.throw(new Error("No authority or metadataUrl configured on settings")),null;e.debug("getting metadata from",this._metadataUrl);let t=await this._jsonService.getJson(this._metadataUrl,{credentials:this._fetchRequestCredentials});return e.debug("merging remote JSON with seed metadata"),this._metadata=Object.assign({},this._settings.metadataSeed,t),this._metadata}getIssuer(){return this._getMetadataProperty("issuer")}getAuthorizationEndpoint(){return this._getMetadataProperty("authorization_endpoint")}getUserInfoEndpoint(){return this._getMetadataProperty("userinfo_endpoint")}getTokenEndpoint(e=!0){return this._getMetadataProperty("token_endpoint",e)}getCheckSessionIframe(){return this._getMetadataProperty("check_session_iframe",!0)}getEndSessionEndpoint(){return this._getMetadataProperty("end_session_endpoint",!0)}getRevocationEndpoint(e=!0){return this._getMetadataProperty("revocation_endpoint",e)}getKeysEndpoint(e=!0){return this._getMetadataProperty("jwks_uri",e)}async _getMetadataProperty(e,t=!1){let r=this._logger.create(`_getMetadataProperty('${e}')`),i=await this.getMetadata();if(r.debug("resolved"),i[e]===void 0){if(t===!0){r.warn("Metadata does not contain optional property");return}r.throw(new Error("Metadata does not contain property "+e))}return i[e]}async getSigningKeys(){let e=this._logger.create("getSigningKeys");if(this._signingKeys)return e.debug("returning signingKeys from cache"),this._signingKeys;let t=await this.getKeysEndpoint(!1);e.debug("got jwks_uri",t);let r=await this._jsonService.getJson(t);if(e.debug("got key set",r),!Array.isArray(r.keys))throw e.throw(new Error("Missing keys on keyset")),null;return this._signingKeys=r.keys,this._signingKeys}};var H=class{constructor({prefix:e="oidc.",store:t=localStorage}={}){this._logger=new g("WebStorageStateStore");this._store=t,this._prefix=e}async set(e,t){this._logger.create(`set('${e}')`),e=this._prefix+e,await this._store.setItem(e,t)}async get(e){return this._logger.create(`get('${e}')`),e=this._prefix+e,await this._store.getItem(e)}async remove(e){this._logger.create(`remove('${e}')`),e=this._prefix+e;let t=await this._store.getItem(e);return await this._store.removeItem(e),t}async getAllKeys(){this._logger.create("getAllKeys");let e=await this._store.length,t=[];for(let r=0;r<e;r++){let i=await this._store.key(r);i&&i.indexOf(this._prefix)===0&&t.push(i.substr(this._prefix.length))}return t}};var dt="code",gt="openid",ut="client_secret_post",pt="query",ht=60*15,ft=60*5,B=class{constructor({authority:e,metadataUrl:t,metadata:r,signingKeys:i,metadataSeed:s,client_id:n,client_secret:o,response_type:c=dt,scope:l=gt,redirect_uri:m,post_logout_redirect_uri:h,client_authentication:p=ut,prompt:f,display:_,max_age:k,ui_locales:y,acr_values:a,resource:u,response_mode:w=pt,filterProtocolClaims:b=!0,loadUserInfo:v=!1,staleStateAgeInSeconds:S=ht,clockSkewInSeconds:P=ft,userInfoJwtIssuer:R="OP",mergeClaims:I=!1,stateStore:W,refreshTokenCredentials:L,revokeTokenAdditionalContentTypes:Pe,fetchRequestCredentials:re,extraQueryParams:Ce={},extraTokenParams:ce={}}){if(this.authority=e,t?this.metadataUrl=t:(this.metadataUrl=e,e&&(this.metadataUrl.endsWith("/")||(this.metadataUrl+="/"),this.metadataUrl+=".well-known/openid-configuration")),this.metadata=r,this.metadataSeed=s,this.signingKeys=i,this.client_id=n,this.client_secret=o,this.response_type=c,this.scope=l,this.redirect_uri=m,this.post_logout_redirect_uri=h,this.client_authentication=p,this.prompt=f,this.display=_,this.max_age=k,this.ui_locales=y,this.acr_values=a,this.resource=u,this.response_mode=w,this.filterProtocolClaims=!!b,this.loadUserInfo=!!v,this.staleStateAgeInSeconds=S,this.clockSkewInSeconds=P,this.userInfoJwtIssuer=R,this.mergeClaims=!!I,this.revokeTokenAdditionalContentTypes=Pe,re&&L&&console.warn("Both fetchRequestCredentials and refreshTokenCredentials is set. Only fetchRequestCredentials will be used."),this.fetchRequestCredentials=re||L||"same-origin",W)this.stateStore=W;else{let Ie=typeof window!="undefined"?window.localStorage:new j;this.stateStore=new H({store:Ie})}this.extraQueryParams=Ce,this.extraTokenParams=ce}};var me=class{constructor(e,t){this._settings=e;this._metadataService=t;this._logger=new g("UserInfoService");this._getClaimsFromJwt=async e=>{let t=this._logger.create("_getClaimsFromJwt");try{let r=K.decode(e);return t.debug("JWT decoding successful"),r}catch(r){throw t.error("Error parsing JWT response"),r}};this._jsonService=new F(void 0,this._getClaimsFromJwt)}async getClaims(e){let t=this._logger.create("getClaims");e||this._logger.throw(new Error("No token passed"));let r=await this._metadataService.getUserInfoEndpoint();t.debug("got userinfo url",r);let i=await this._jsonService.getJson(r,{token:e,credentials:this._settings.fetchRequestCredentials});return t.debug("got claims",i),i}};var Y=class{constructor(e,t){this._settings=e;this._metadataService=t;this._logger=new g("TokenClient");this._jsonService=new F(this._settings.revokeTokenAdditionalContentTypes)}async exchangeCode({grant_type:e="authorization_code",redirect_uri:t=this._settings.redirect_uri,client_id:r=this._settings.client_id,client_secret:i=this._settings.client_secret,...s}){let n=this._logger.create("exchangeCode");r||n.throw(new Error("A client_id is required")),t||n.throw(new Error("A redirect_uri is required")),s.code||n.throw(new Error("A code is required")),s.code_verifier||n.throw(new Error("A code_verifier is required"));let o=new URLSearchParams({grant_type:e,redirect_uri:t});for(let[h,p]of Object.entries(s))p!=null&&o.set(h,p);let c;switch(this._settings.client_authentication){case"client_secret_basic":if(!i)throw n.throw(new Error("A client_secret is required")),null;c=C.generateBasicAuth(r,i);break;case"client_secret_post":o.append("client_id",r),i&&o.append("client_secret",i);break}let l=await this._metadataService.getTokenEndpoint(!1);n.debug("got token endpoint");let m=await this._jsonService.postForm(l,{body:o,basicAuth:c,initCredentials:this._settings.fetchRequestCredentials});return n.debug("got response"),m}async exchangeCredentials({grant_type:e="password",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,scope:i=this._settings.scope,username:s,password:n}){let o=this._logger.create("exchangeCredentials");t||o.throw(new Error("A client_id is required"));let c=new URLSearchParams({grant_type:e,username:s,password:n,scope:i}),l;switch(this._settings.client_authentication){case"client_secret_basic":if(!r)throw o.throw(new Error("A client_secret is required")),null;l=C.generateBasicAuth(t,r);break;case"client_secret_post":c.append("client_id",t),r&&c.append("client_secret",r);break}let m=await this._metadataService.getTokenEndpoint(!1);o.debug("got token endpoint");let h=await this._jsonService.postForm(m,{body:c,basicAuth:l,initCredentials:this._settings.fetchRequestCredentials});return o.debug("got response"),h}async exchangeRefreshToken({grant_type:e="refresh_token",client_id:t=this._settings.client_id,client_secret:r=this._settings.client_secret,timeoutInSeconds:i,...s}){let n=this._logger.create("exchangeRefreshToken");t||n.throw(new Error("A client_id is required")),s.refresh_token||n.throw(new Error("A refresh_token is required"));let o=new URLSearchParams({grant_type:e});for(let[h,p]of Object.entries(s))p!=null&&o.set(h,p);let c;switch(this._settings.client_authentication){case"client_secret_basic":if(!r)throw n.throw(new Error("A client_secret is required")),null;c=C.generateBasicAuth(t,r);break;case"client_secret_post":o.append("client_id",t),r&&o.append("client_secret",r);break}let l=await this._metadataService.getTokenEndpoint(!1);n.debug("got token endpoint");let m=await this._jsonService.postForm(l,{body:o,basicAuth:c,timeoutInSeconds:i,initCredentials:this._settings.fetchRequestCredentials});return n.debug("got response"),m}async revoke(e){var s;let t=this._logger.create("revoke");e.token||t.throw(new Error("A token is required"));let r=await this._metadataService.getRevocationEndpoint(!1);t.debug(`got revocation endpoint, revoking ${(s=e.token_type_hint)!=null?s:"default token type"}`);let i=new URLSearchParams;for(let[n,o]of Object.entries(e))o!=null&&i.set(n,o);i.set("client_id",this._settings.client_id),this._settings.client_secret&&i.set("client_secret",this._settings.client_secret),await this._jsonService.postForm(r,{body:i}),t.debug("got response")}};var mt=["iss","aud","exp","nbf","iat","jti","auth_time","nonce","acr","amr","azp","at_hash"],_e=class{constructor(e,t){this._settings=e;this._metadataService=t;this._logger=new g("ResponseValidator");this._userInfoService=new me(this._settings,this._metadataService);this._tokenClient=new Y(this._settings,this._metadataService)}async validateSigninResponse(e,t){let r=this._logger.create("validateSigninResponse");this._processSigninState(e,t),r.debug("state processed"),await this._processCode(e,t),r.debug("code processed"),e.isOpenId&&this._validateIdTokenAttributes(e),r.debug("tokens validated"),await this._processClaims(e,t==null?void 0:t.skipUserInfo,e.isOpenId),r.debug("claims processed")}async validateCredentialsResponse(e,t){let r=this._logger.create("validateCredentialsResponse");e.isOpenId&&this._validateIdTokenAttributes(e),r.debug("tokens validated"),await this._processClaims(e,t,e.isOpenId),r.debug("claims processed")}async validateRefreshResponse(e,t){var s,n;let r=this._logger.create("validateRefreshResponse");e.userState=t.data,(s=e.session_state)!=null||(e.session_state=t.session_state),(n=e.scope)!=null||(e.scope=t.scope),e.isOpenId&&!!e.id_token&&(this._validateIdTokenAttributes(e,t.id_token),r.debug("ID Token validated")),e.id_token||(e.id_token=t.id_token,e.profile=t.profile);let i=e.isOpenId&&!!e.id_token;await this._processClaims(e,!1,i),r.debug("claims processed")}validateSignoutResponse(e,t){let r=this._logger.create("validateSignoutResponse");if(t.id!==e.state&&r.throw(new Error("State does not match")),r.debug("state validated"),e.userState=t.data,e.error)throw r.warn("Response was error",e.error),new U(e)}_processSigninState(e,t){var i;let r=this._logger.create("_processSigninState");if(t.id!==e.state&&r.throw(new Error("State does not match")),t.client_id||r.throw(new Error("No client_id on state")),t.authority||r.throw(new Error("No authority on state")),this._settings.authority!==t.authority&&r.throw(new Error("authority mismatch on settings vs. signin state")),this._settings.client_id&&this._settings.client_id!==t.client_id&&r.throw(new Error("client_id mismatch on settings vs. signin state")),r.debug("state validated"),e.userState=t.data,(i=e.scope)!=null||(e.scope=t.scope),e.error)throw r.warn("Response was error",e.error),new U(e);t.code_verifier&&!e.code&&r.throw(new Error("Expected code in response")),!t.code_verifier&&e.code&&r.throw(new Error("Unexpected code in response"))}async _processClaims(e,t=!1,r=!0){let i=this._logger.create("_processClaims");if(e.profile=this._filterProtocolClaims(e.profile),t||!this._settings.loadUserInfo||!e.access_token){i.debug("not loading user info");return}i.debug("loading user info");let s=await this._userInfoService.getClaims(e.access_token);i.debug("user info claims received from user info endpoint"),r&&s.sub!==e.profile.sub&&i.throw(new Error("subject from UserInfo response does not match subject in ID Token")),e.profile=this._mergeClaims(e.profile,this._filterProtocolClaims(s)),i.debug("user info claims received, updated profile:",e.profile)}_mergeClaims(e,t){let r={...e};for(let[i,s]of Object.entries(t))for(let n of Array.isArray(s)?s:[s]){let o=r[i];o?Array.isArray(o)?o.includes(n)||o.push(n):r[i]!==n&&(typeof n=="object"&&this._settings.mergeClaims?r[i]=this._mergeClaims(o,n):r[i]=[o,n]):r[i]=n}return r}_filterProtocolClaims(e){let t={...e};if(this._settings.filterProtocolClaims)for(let r of mt)delete t[r];return t}async _processCode(e,t){let r=this._logger.create("_processCode");if(e.code){r.debug("Validating code");let i=await this._tokenClient.exchangeCode({client_id:t.client_id,client_secret:t.client_secret,code:e.code,redirect_uri:t.redirect_uri,code_verifier:t.code_verifier,...t.extraTokenParams});Object.assign(e,i)}else r.debug("No code to process")}_validateIdTokenAttributes(e,t){var s;let r=this._logger.create("_validateIdTokenAttributes");r.debug("decoding ID Token JWT");let i=K.decode((s=e.id_token)!=null?s:"");if(i.sub||r.throw(new Error("ID Token is missing a subject claim")),t){let n=K.decode(t);n.sub!==i.sub&&r.throw(new Error("sub in id_token does not match current sub")),n.auth_time&&n.auth_time!==i.auth_time&&r.throw(new Error("auth_time in id_token does not match original auth_time")),n.azp&&n.azp!==i.azp&&r.throw(new Error("azp in id_token does not match original azp")),!n.azp&&i.azp&&r.throw(new Error("azp not in id_token, but present in original id_token"))}e.profile=i}};var T=class{constructor(e){this.id=e.id||C.generateUUIDv4(),this.data=e.data,e.created&&e.created>0?this.created=e.created:this.created=x.getEpochTime(),this.request_type=e.request_type}toStorageString(){return new g("State").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type})}static fromStorageString(e){return g.createStatic("State","fromStorageString"),new T(JSON.parse(e))}static async clearStaleState(e,t){let r=g.createStatic("State","clearStaleState"),i=x.getEpochTime()-t,s=await e.getAllKeys();r.debug("got keys",s);for(let n=0;n<s.length;n++){let o=s[n],c=await e.get(o),l=!1;if(c)try{let m=T.fromStorageString(c);r.debug("got item from key:",o,m.created),m.created<=i&&(l=!0)}catch(m){r.error("Error parsing state for key:",o,m),l=!0}else r.debug("no item in storage for key:",o),l=!0;l&&(r.debug("removed item for key:",o),e.remove(o))}}};var M=class extends T{constructor(t){super(t);t.code_verifier===!0?this.code_verifier=C.generateCodeVerifier():t.code_verifier&&(this.code_verifier=t.code_verifier),this.code_verifier&&(this.code_challenge=C.generateCodeChallenge(this.code_verifier)),this.authority=t.authority,this.client_id=t.client_id,this.redirect_uri=t.redirect_uri,this.scope=t.scope,this.client_secret=t.client_secret,this.extraTokenParams=t.extraTokenParams,this.response_mode=t.response_mode,this.skipUserInfo=t.skipUserInfo}toStorageString(){return new g("SigninState").create("toStorageString"),JSON.stringify({id:this.id,data:this.data,created:this.created,request_type:this.request_type,code_verifier:this.code_verifier,authority:this.authority,client_id:this.client_id,redirect_uri:this.redirect_uri,scope:this.scope,client_secret:this.client_secret,extraTokenParams:this.extraTokenParams,response_mode:this.response_mode,skipUserInfo:this.skipUserInfo})}static fromStorageString(t){g.createStatic("SigninState","fromStorageString");let r=JSON.parse(t);return new M(r)}};var we=class{constructor({url:e,authority:t,client_id:r,redirect_uri:i,response_type:s,scope:n,state_data:o,response_mode:c,request_type:l,client_secret:m,nonce:h,skipUserInfo:p,extraQueryParams:f,extraTokenParams:_,...k}){this._logger=new g("SigninRequest");if(!e)throw this._logger.error("ctor: No url passed"),new Error("url");if(!r)throw this._logger.error("ctor: No client_id passed"),new Error("client_id");if(!i)throw this._logger.error("ctor: No redirect_uri passed"),new Error("redirect_uri");if(!s)throw this._logger.error("ctor: No response_type passed"),new Error("response_type");if(!n)throw this._logger.error("ctor: No scope passed"),new Error("scope");if(!t)throw this._logger.error("ctor: No authority passed"),new Error("authority");this.state=new M({data:o,request_type:l,code_verifier:!0,client_id:r,authority:t,redirect_uri:i,response_mode:c,client_secret:m,scope:n,extraTokenParams:_,skipUserInfo:p});let y=new URL(e);y.searchParams.append("client_id",r),y.searchParams.append("redirect_uri",i),y.searchParams.append("response_type",s),y.searchParams.append("scope",n),h&&y.searchParams.append("nonce",h),y.searchParams.append("state",this.state.id),this.state.code_challenge&&(y.searchParams.append("code_challenge",this.state.code_challenge),y.searchParams.append("code_challenge_method","S256"));for(let[a,u]of Object.entries({response_mode:c,...k,...f}))u!=null&&y.searchParams.append(a,u.toString());this.url=y.href}};var _t="openid",J=class{constructor(e){this.access_token="";this.token_type="";this.profile={};this.state=e.get("state"),this.session_state=e.get("session_state"),this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri"),this.code=e.get("code")}get expires_in(){if(this.expires_at!==void 0)return this.expires_at-x.getEpochTime()}set expires_in(e){typeof e=="string"&&(e=Number(e)),e!==void 0&&e>=0&&(this.expires_at=Math.floor(e)+x.getEpochTime())}get isOpenId(){var e;return((e=this.scope)==null?void 0:e.split(" ").includes(_t))||!!this.id_token}};var be=class{constructor({url:e,state_data:t,id_token_hint:r,post_logout_redirect_uri:i,extraQueryParams:s,request_type:n}){this._logger=new g("SignoutRequest");if(!e)throw this._logger.error("ctor: No url passed"),new Error("url");let o=new URL(e);r&&o.searchParams.append("id_token_hint",r),i&&(o.searchParams.append("post_logout_redirect_uri",i),t&&(this.state=new T({data:t,request_type:n}),o.searchParams.append("state",this.state.id)));for(let[c,l]of Object.entries({...s}))l!=null&&o.searchParams.append(c,l.toString());this.url=o.href}};var X=class{constructor(e){this.state=e.get("state"),this.error=e.get("error"),this.error_description=e.get("error_description"),this.error_uri=e.get("error_uri")}};var oe=class{constructor(e){this._logger=new g("OidcClient");this.settings=new B(e),this.metadataService=new G(this.settings),this._validator=new _e(this.settings,this.metadataService),this._tokenClient=new Y(this.settings,this.metadataService)}async createSigninRequest({state:e,request:t,request_uri:r,request_type:i,id_token_hint:s,login_hint:n,skipUserInfo:o,nonce:c,response_type:l=this.settings.response_type,scope:m=this.settings.scope,redirect_uri:h=this.settings.redirect_uri,prompt:p=this.settings.prompt,display:f=this.settings.display,max_age:_=this.settings.max_age,ui_locales:k=this.settings.ui_locales,acr_values:y=this.settings.acr_values,resource:a=this.settings.resource,response_mode:u=this.settings.response_mode,extraQueryParams:w=this.settings.extraQueryParams,extraTokenParams:b=this.settings.extraTokenParams}){let v=this._logger.create("createSigninRequest");if(l!=="code")throw new Error("Only the Authorization Code flow (with PKCE) is supported");let S=await this.metadataService.getAuthorizationEndpoint();v.debug("Received authorization endpoint",S);let P=new we({url:S,authority:this.settings.authority,client_id:this.settings.client_id,redirect_uri:h,response_type:l,scope:m,state_data:e,prompt:p,display:f,max_age:_,ui_locales:k,id_token_hint:s,login_hint:n,acr_values:y,resource:a,request:t,request_uri:r,extraQueryParams:w,extraTokenParams:b,request_type:i,response_mode:u,client_secret:this.settings.client_secret,skipUserInfo:o,nonce:c});await this.clearStaleState();let R=P.state;return await this.settings.stateStore.set(R.id,R.toStorageString()),P}async readSigninResponseState(e,t=!1){let r=this._logger.create("readSigninResponseState"),i=new J($.readParams(e,this.settings.response_mode));if(!i.state)throw r.throw(new Error("No state in response")),null;let s=await this.settings.stateStore[t?"remove":"get"](i.state);if(!s)throw r.throw(new Error("No matching state found in storage")),null;return{state:M.fromStorageString(s),response:i}}async processSigninResponse(e){let t=this._logger.create("processSigninResponse"),{state:r,response:i}=await this.readSigninResponseState(e,!0);return t.debug("received state from storage; validating response"),await this._validator.validateSigninResponse(i,r),i}async processResourceOwnerPasswordCredentials({username:e,password:t,skipUserInfo:r=!1}){let i=await this._tokenClient.exchangeCredentials({username:e,password:t}),s=new J(new URLSearchParams);return Object.assign(s,i),await this._validator.validateCredentialsResponse(s,r),s}async useRefreshToken({state:e,timeoutInSeconds:t}){let r=this._logger.create("useRefreshToken"),i=await this._tokenClient.exchangeRefreshToken({refresh_token:e.refresh_token,scope:e.scope,timeoutInSeconds:t}),s=new J(new URLSearchParams);return Object.assign(s,i),r.debug("validating response",s),await this._validator.validateRefreshResponse(s,e),s}async createSignoutRequest({state:e,id_token_hint:t,request_type:r,post_logout_redirect_uri:i=this.settings.post_logout_redirect_uri,extraQueryParams:s=this.settings.extraQueryParams}={}){let n=this._logger.create("createSignoutRequest"),o=await this.metadataService.getEndSessionEndpoint();if(!o)throw n.throw(new Error("No end session endpoint")),null;n.debug("Received end session endpoint",o);let c=new be({url:o,id_token_hint:t,post_logout_redirect_uri:i,state_data:e,extraQueryParams:s,request_type:r});await this.clearStaleState();let l=c.state;return l&&(n.debug("Signout request has state to persist"),await this.settings.stateStore.set(l.id,l.toStorageString())),c}async readSignoutResponseState(e,t=!1){let r=this._logger.create("readSignoutResponseState"),i=new X($.readParams(e,this.settings.response_mode));if(!i.state){if(r.debug("No state in response"),i.error)throw r.warn("Response was error:",i.error),new U(i);return{state:void 0,response:i}}let s=await this.settings.stateStore[t?"remove":"get"](i.state);if(!s)throw r.throw(new Error("No matching state found in storage")),null;return{state:T.fromStorageString(s),response:i}}async processSignoutResponse(e){let t=this._logger.create("processSignoutResponse"),{state:r,response:i}=await this.readSignoutResponseState(e,!0);return r?(t.debug("Received state from storage; validating response"),this._validator.validateSignoutResponse(i,r)):t.debug("No state from storage; skipping response validation"),i}clearStaleState(){return this._logger.create("clearStaleState"),T.clearStaleState(this.settings.stateStore,this.settings.staleStateAgeInSeconds)}async revokeToken(e,t){return this._logger.create("revokeToken"),await this._tokenClient.revoke({token:e,token_type_hint:t})}};var Z=class{constructor(e){this._userManager=e;this._logger=new g("SessionMonitor");this._start=async e=>{let t=e.session_state;if(!t)return;let r=this._logger.create("_start");if(e.profile?(this._sub=e.profile.sub,this._sid=e.profile.sid,r.debug("session_state",t,", sub",this._sub)):(this._sub=void 0,this._sid=void 0,r.debug("session_state",t,", anonymous user")),this._checkSessionIFrame){this._checkSessionIFrame.start(t);return}try{let i=await this._userManager.metadataService.getCheckSessionIframe();if(i){r.debug("initializing check session iframe");let s=this._userManager.settings.client_id,n=this._userManager.settings.checkSessionIntervalInSeconds,o=this._userManager.settings.stopCheckSessionOnError,c=new V(this._callback,s,i,n,o);await c.load(),this._checkSessionIFrame=c,c.start(t)}else r.warn("no check session iframe found in the metadata")}catch(i){r.error("Error from getCheckSessionIframe:",i instanceof Error?i.message:i)}};this._stop=()=>{let e=this._logger.create("_stop");if(this._sub=void 0,this._sid=void 0,this._checkSessionIFrame&&this._checkSessionIFrame.stop(),this._userManager.settings.monitorAnonymousSession){let t=setInterval(async()=>{clearInterval(t);try{let r=await this._userManager.querySessionStatus();if(r){let i={session_state:r.session_state,profile:r.sub&&r.sid?{sub:r.sub,sid:r.sid}:null};this._start(i)}}catch(r){e.error("error from querySessionStatus",r instanceof Error?r.message:r)}},1e3)}};this._callback=async()=>{let e=this._logger.create("_callback");try{let t=await this._userManager.querySessionStatus(),r=!0;t&&this._checkSessionIFrame?t.sub===this._sub?(r=!1,this._checkSessionIFrame.start(t.session_state),t.sid===this._sid?e.debug("same sub still logged in at OP, restarting check session iframe; session_state",t.session_state):(e.debug("same sub still logged in at OP, session state has changed, restarting check session iframe; session_state",t.session_state),this._userManager.events._raiseUserSessionChanged())):e.debug("different subject signed into OP",t.sub):e.debug("subject no longer signed into OP"),r?this._sub?this._userManager.events._raiseUserSignedOut():this._userManager.events._raiseUserSignedIn():e.debug("no change in session detected, no event to raise")}catch(t){this._sub&&(e.debug("Error calling queryCurrentSigninSession; raising signed out event",t),this._userManager.events._raiseUserSignedOut())}};e||this._logger.throw(new Error("No user manager passed")),this._userManager.events.addUserLoaded(this._start),this._userManager.events.addUserUnloaded(this._stop),this._init().catch(t=>{this._logger.error(t)})}async _init(){this._logger.create("_init");let e=await this._userManager.getUser();if(e)this._start(e);else if(this._userManager.settings.monitorAnonymousSession){let t=await this._userManager.querySessionStatus();if(t){let r={session_state:t.session_state,profile:t.sub&&t.sid?{sub:t.sub,sid:t.sid}:null};this._start(r)}}}};var N=class{constructor(e){var t;this.id_token=e.id_token,this.session_state=(t=e.session_state)!=null?t:null,this.access_token=e.access_token,this.refresh_token=e.refresh_token,this.token_type=e.token_type,this.scope=e.scope,this.profile=e.profile,this.expires_at=e.expires_at,this.state=e.userState}get expires_in(){if(this.expires_at!==void 0)return this.expires_at-x.getEpochTime()}set expires_in(e){e!==void 0&&(this.expires_at=Math.floor(e)+x.getEpochTime())}get expired(){let e=this.expires_in;if(e!==void 0)return e<=0}get scopes(){var e,t;return(t=(e=this.scope)==null?void 0:e.split(" "))!=null?t:[]}toStorageString(){return new g("User").create("toStorageString"),JSON.stringify({id_token:this.id_token,session_state:this.session_state,access_token:this.access_token,refresh_token:this.refresh_token,token_type:this.token_type,scope:this.scope,profile:this.profile,expires_at:this.expires_at})}static fromStorageString(e){return g.createStatic("User","fromStorageString"),new N(JSON.parse(e))}};var Ge="oidc-client",ee=class{constructor(){this._abort=new E("Window navigation aborted");this._disposeHandlers=new Set;this._window=null}async navigate(e){let t=this._logger.create("navigate");if(!this._window)throw new Error("Attempted to navigate on a disposed window");t.debug("setting URL in window"),this._window.location.replace(e.url);let{url:r,keepOpen:i}=await new Promise((s,n)=>{let o=c=>{var h;let l=c.data,m=(h=e.scriptOrigin)!=null?h:window.location.origin;if(!(c.origin!==m||(l==null?void 0:l.source)!==Ge)){try{let p=$.readParams(l.url,e.response_mode).get("state");if(p||t.warn("no state found in response url"),c.source!==this._window&&p!==e.state)return}catch{this._dispose(),n(new Error("Invalid response from window"))}s(l)}};window.addEventListener("message",o,!1),this._disposeHandlers.add(()=>window.removeEventListener("message",o,!1)),this._disposeHandlers.add(this._abort.addHandler(c=>{this._dispose(),n(c)}))});return t.debug("got response from window"),this._dispose(),i||this.close(),{url:r}}_dispose(){this._logger.create("_dispose");for(let e of this._disposeHandlers)e();this._disposeHandlers.clear()}static _notifyParent(e,t,r=!1,i=window.location.origin){e.postMessage({source:Ge,url:t,keepOpen:r},i)}};var Ee={location:!1,toolbar:!1,height:640},Ae="_blank",wt=60,bt=2,Oe=10,te=class extends B{constructor(t){let{popup_redirect_uri:r=t.redirect_uri,popup_post_logout_redirect_uri:i=t.post_logout_redirect_uri,popupWindowFeatures:s=Ee,popupWindowTarget:n=Ae,redirectMethod:o="assign",redirectTarget:c="self",iframeNotifyParentOrigin:l=t.iframeNotifyParentOrigin,iframeScriptOrigin:m=t.iframeScriptOrigin,silent_redirect_uri:h=t.redirect_uri,silentRequestTimeoutInSeconds:p=Oe,automaticSilentRenew:f=!0,validateSubOnSilentRenew:_=!0,includeIdTokenInSilentRenew:k=!1,monitorSession:y=!1,monitorAnonymousSession:a=!1,checkSessionIntervalInSeconds:u=bt,query_status_response_type:w="code",stopCheckSessionOnError:b=!0,revokeTokenTypes:v=["access_token","refresh_token"],revokeTokensOnSignout:S=!1,includeIdTokenInSilentSignout:P=!1,accessTokenExpiringNotificationTimeInSeconds:R=wt,userStore:I}=t;super(t);if(this.popup_redirect_uri=r,this.popup_post_logout_redirect_uri=i,this.popupWindowFeatures=s,this.popupWindowTarget=n,this.redirectMethod=o,this.redirectTarget=c,this.iframeNotifyParentOrigin=l,this.iframeScriptOrigin=m,this.silent_redirect_uri=h,this.silentRequestTimeoutInSeconds=p,this.automaticSilentRenew=f,this.validateSubOnSilentRenew=_,this.includeIdTokenInSilentRenew=k,this.monitorSession=y,this.monitorAnonymousSession=a,this.checkSessionIntervalInSeconds=u,this.stopCheckSessionOnError=b,this.query_status_response_type=w,this.revokeTokenTypes=v,this.revokeTokensOnSignout=S,this.includeIdTokenInSilentSignout=P,this.accessTokenExpiringNotificationTimeInSeconds=R,I)this.userStore=I;else{let W=typeof window!="undefined"?window.sessionStorage:new j;this.userStore=new H({store:W})}}};var z=class extends ee{constructor({silentRequestTimeoutInSeconds:t=Oe}){super();this._logger=new g("IFrameWindow");this._timeoutInSeconds=t,this._frame=z.createHiddenIframe(),this._window=this._frame.contentWindow}static createHiddenIframe(){let t=window.document.createElement("iframe");return t.style.visibility="hidden",t.style.position="fixed",t.style.left="-1000px",t.style.top="0",t.width="0",t.height="0",t.setAttribute("sandbox","allow-scripts allow-same-origin allow-forms"),window.document.body.appendChild(t),t}async navigate(t){this._logger.debug("navigate: Using timeout of:",this._timeoutInSeconds);let r=setTimeout(()=>this._abort.raise(new q("IFrame timed out without a response")),this._timeoutInSeconds*1e3);return this._disposeHandler