/* * ATTENTION: An "eval-source-map" devtool has been used. * This devtool is neither made for production nor for readable output files. * It uses "eval()" calls to create a separate source file with attached SourceMaps in the browser devtools. * If you are trying to read the output file, select a different devtool (https://webpack.js.org/configuration/devtool/) * or disable the default devtool with "devtool: false". * If you are looking for production-ready output files, see mode: "production" (https://webpack.js.org/configuration/mode/). */ exports.id = "vendor-chunks/openid-client"; exports.ids = ["vendor-chunks/openid-client"]; exports.modules = { /***/ "(rsc)/./node_modules/openid-client/lib/client.js": /*!**************************************************!*\ !*** ./node_modules/openid-client/lib/client.js ***! \**************************************************/ /***/ ((module, __unused_webpack_exports, __webpack_require__) => { "use strict"; eval("\nconst { inspect } = __webpack_require__(/*! util */ \"util\");\nconst stdhttp = __webpack_require__(/*! http */ \"http\");\nconst crypto = __webpack_require__(/*! crypto */ \"crypto\");\nconst { strict: assert } = __webpack_require__(/*! assert */ \"assert\");\nconst querystring = __webpack_require__(/*! querystring */ \"querystring\");\nconst url = __webpack_require__(/*! url */ \"url\");\nconst { URL, URLSearchParams } = __webpack_require__(/*! url */ \"url\");\nconst jose = __webpack_require__(/*! jose */ \"(rsc)/./node_modules/jose/dist/node/cjs/index.js\");\nconst tokenHash = __webpack_require__(/*! oidc-token-hash */ \"(rsc)/./node_modules/oidc-token-hash/lib/index.js\");\nconst isKeyObject = __webpack_require__(/*! ./helpers/is_key_object */ \"(rsc)/./node_modules/openid-client/lib/helpers/is_key_object.js\");\nconst decodeJWT = __webpack_require__(/*! ./helpers/decode_jwt */ \"(rsc)/./node_modules/openid-client/lib/helpers/decode_jwt.js\");\nconst base64url = __webpack_require__(/*! ./helpers/base64url */ \"(rsc)/./node_modules/openid-client/lib/helpers/base64url.js\");\nconst defaults = __webpack_require__(/*! ./helpers/defaults */ \"(rsc)/./node_modules/openid-client/lib/helpers/defaults.js\");\nconst parseWwwAuthenticate = __webpack_require__(/*! ./helpers/www_authenticate_parser */ \"(rsc)/./node_modules/openid-client/lib/helpers/www_authenticate_parser.js\");\nconst { assertSigningAlgValuesSupport, assertIssuerConfiguration } = __webpack_require__(/*! ./helpers/assert */ \"(rsc)/./node_modules/openid-client/lib/helpers/assert.js\");\nconst pick = __webpack_require__(/*! ./helpers/pick */ \"(rsc)/./node_modules/openid-client/lib/helpers/pick.js\");\nconst isPlainObject = __webpack_require__(/*! ./helpers/is_plain_object */ \"(rsc)/./node_modules/openid-client/lib/helpers/is_plain_object.js\");\nconst processResponse = __webpack_require__(/*! ./helpers/process_response */ \"(rsc)/./node_modules/openid-client/lib/helpers/process_response.js\");\nconst TokenSet = __webpack_require__(/*! ./token_set */ \"(rsc)/./node_modules/openid-client/lib/token_set.js\");\nconst { OPError, RPError } = __webpack_require__(/*! ./errors */ \"(rsc)/./node_modules/openid-client/lib/errors.js\");\nconst now = __webpack_require__(/*! ./helpers/unix_timestamp */ \"(rsc)/./node_modules/openid-client/lib/helpers/unix_timestamp.js\");\nconst { random } = __webpack_require__(/*! ./helpers/generators */ \"(rsc)/./node_modules/openid-client/lib/helpers/generators.js\");\nconst request = __webpack_require__(/*! ./helpers/request */ \"(rsc)/./node_modules/openid-client/lib/helpers/request.js\");\nconst { CLOCK_TOLERANCE } = __webpack_require__(/*! ./helpers/consts */ \"(rsc)/./node_modules/openid-client/lib/helpers/consts.js\");\nconst { keystores } = __webpack_require__(/*! ./helpers/weak_cache */ \"(rsc)/./node_modules/openid-client/lib/helpers/weak_cache.js\");\nconst KeyStore = __webpack_require__(/*! ./helpers/keystore */ \"(rsc)/./node_modules/openid-client/lib/helpers/keystore.js\");\nconst clone = __webpack_require__(/*! ./helpers/deep_clone */ \"(rsc)/./node_modules/openid-client/lib/helpers/deep_clone.js\");\nconst { authenticatedPost, resolveResponseType, resolveRedirectUri } = __webpack_require__(/*! ./helpers/client */ \"(rsc)/./node_modules/openid-client/lib/helpers/client.js\");\nconst { queryKeyStore } = __webpack_require__(/*! ./helpers/issuer */ \"(rsc)/./node_modules/openid-client/lib/helpers/issuer.js\");\nconst DeviceFlowHandle = __webpack_require__(/*! ./device_flow_handle */ \"(rsc)/./node_modules/openid-client/lib/device_flow_handle.js\");\nconst [major, minor] = process.version.slice(1).split('.').map((str)=>parseInt(str, 10));\nconst rsaPssParams = major >= 17 || major === 16 && minor >= 9;\nconst retryAttempt = Symbol();\nconst skipNonceCheck = Symbol();\nconst skipMaxAgeCheck = Symbol();\nfunction pickCb(input) {\n return pick(input, 'access_token', 'code', 'error_description', 'error_uri', 'error', 'expires_in', 'id_token', 'iss', 'response', 'session_state', 'state', 'token_type');\n}\nfunction authorizationHeaderValue(token, tokenType = 'Bearer') {\n return `${tokenType} ${token}`;\n}\nfunction getSearchParams(input) {\n const parsed = url.parse(input);\n if (!parsed.search) return {};\n return querystring.parse(parsed.search.substring(1));\n}\nfunction verifyPresence(payload, jwt, prop) {\n if (payload[prop] === undefined) {\n throw new RPError({\n message: `missing required JWT property ${prop}`,\n jwt\n });\n }\n}\nfunction authorizationParams(params) {\n const authParams = {\n client_id: this.client_id,\n scope: 'openid',\n response_type: resolveResponseType.call(this),\n redirect_uri: resolveRedirectUri.call(this),\n ...params\n };\n Object.entries(authParams).forEach(([key, value])=>{\n if (value === null || value === undefined) {\n delete authParams[key];\n } else if (key === 'claims' && typeof value === 'object') {\n authParams[key] = JSON.stringify(value);\n } else if (key === 'resource' && Array.isArray(value)) {\n authParams[key] = value;\n } else if (typeof value !== 'string') {\n authParams[key] = String(value);\n }\n });\n return authParams;\n}\nfunction getKeystore(jwks) {\n if (!isPlainObject(jwks) || !Array.isArray(jwks.keys) || jwks.keys.some((k)=>!isPlainObject(k) || !('kty' in k))) {\n throw new TypeError('jwks must be a JSON Web Key Set formatted object');\n }\n return KeyStore.fromJWKS(jwks, {\n onlyPrivate: true\n });\n}\n// if an OP doesnt support client_secret_basic but supports client_secret_post, use it instead\n// this is in place to take care of most common pitfalls when first using discovered Issuers without\n// the support for default values defined by Discovery 1.0\nfunction checkBasicSupport(client, properties) {\n try {\n const supported = client.issuer.token_endpoint_auth_methods_supported;\n if (!supported.includes(properties.token_endpoint_auth_method)) {\n if (supported.includes('client_secret_post')) {\n properties.token_endpoint_auth_method = 'client_secret_post';\n }\n }\n } catch (err) {}\n}\nfunction handleCommonMistakes(client, metadata, properties) {\n if (!metadata.token_endpoint_auth_method) {\n // if no explicit value was provided\n checkBasicSupport(client, properties);\n }\n // :fp: c'mon people... RTFM\n if (metadata.redirect_uri) {\n if (metadata.redirect_uris) {\n throw new TypeError('provide a redirect_uri or redirect_uris, not both');\n }\n properties.redirect_uris = [\n metadata.redirect_uri\n ];\n delete properties.redirect_uri;\n }\n if (metadata.response_type) {\n if (metadata.response_types) {\n throw new TypeError('provide a response_type or response_types, not both');\n }\n properties.response_types = [\n metadata.response_type\n ];\n delete properties.response_type;\n }\n}\nfunction getDefaultsForEndpoint(endpoint, issuer, properties) {\n if (!issuer[`${endpoint}_endpoint`]) return;\n const tokenEndpointAuthMethod = properties.token_endpoint_auth_method;\n const tokenEndpointAuthSigningAlg = properties.token_endpoint_auth_signing_alg;\n const eam = `${endpoint}_endpoint_auth_method`;\n const easa = `${endpoint}_endpoint_auth_signing_alg`;\n if (properties[eam] === undefined && properties[easa] === undefined) {\n if (tokenEndpointAuthMethod !== undefined) {\n properties[eam] = tokenEndpointAuthMethod;\n }\n if (tokenEndpointAuthSigningAlg !== undefined) {\n properties[easa] = tokenEndpointAuthSigningAlg;\n }\n }\n}\nclass BaseClient {\n #metadata;\n #issuer;\n #aadIssValidation;\n #additionalAuthorizedParties;\n constructor(issuer, aadIssValidation, metadata = {}, jwks, options){\n this.#metadata = new Map();\n this.#issuer = issuer;\n this.#aadIssValidation = aadIssValidation;\n if (typeof metadata.client_id !== 'string' || !metadata.client_id) {\n throw new TypeError('client_id is required');\n }\n const properties = {\n grant_types: [\n 'authorization_code'\n ],\n id_token_signed_response_alg: 'RS256',\n authorization_signed_response_alg: 'RS256',\n response_types: [\n 'code'\n ],\n token_endpoint_auth_method: 'client_secret_basic',\n ...this.fapi1() ? {\n grant_types: [\n 'authorization_code',\n 'implicit'\n ],\n id_token_signed_response_alg: 'PS256',\n authorization_signed_response_alg: 'PS256',\n response_types: [\n 'code id_token'\n ],\n tls_client_certificate_bound_access_tokens: true,\n token_endpoint_auth_method: undefined\n } : undefined,\n ...this.fapi2() ? {\n id_token_signed_response_alg: 'PS256',\n authorization_signed_response_alg: 'PS256',\n token_endpoint_auth_method: undefined\n } : undefined,\n ...metadata\n };\n if (this.fapi()) {\n switch(properties.token_endpoint_auth_method){\n case 'self_signed_tls_client_auth':\n case 'tls_client_auth':\n break;\n case 'private_key_jwt':\n if (!jwks) {\n throw new TypeError('jwks is required');\n }\n break;\n case undefined:\n throw new TypeError('token_endpoint_auth_method is required');\n default:\n throw new TypeError('invalid or unsupported token_endpoint_auth_method');\n }\n }\n if (this.fapi2()) {\n if (properties.tls_client_certificate_bound_access_tokens && properties.dpop_bound_access_tokens) {\n throw new TypeError('either tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens must be set to true');\n }\n if (!properties.tls_client_certificate_bound_access_tokens && !properties.dpop_bound_access_tokens) {\n throw new TypeError('either tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens must be set to true');\n }\n }\n handleCommonMistakes(this, metadata, properties);\n assertSigningAlgValuesSupport('token', this.issuer, properties);\n [\n 'introspection',\n 'revocation'\n ].forEach((endpoint)=>{\n getDefaultsForEndpoint(endpoint, this.issuer, properties);\n assertSigningAlgValuesSupport(endpoint, this.issuer, properties);\n });\n Object.entries(properties).forEach(([key, value])=>{\n this.#metadata.set(key, value);\n if (!this[key]) {\n Object.defineProperty(this, key, {\n get () {\n return this.#metadata.get(key);\n },\n enumerable: true\n });\n }\n });\n if (jwks !== undefined) {\n const keystore = getKeystore.call(this, jwks);\n keystores.set(this, keystore);\n }\n if (options != null && options.additionalAuthorizedParties) {\n this.#additionalAuthorizedParties = clone(options.additionalAuthorizedParties);\n }\n this[CLOCK_TOLERANCE] = 0;\n }\n authorizationUrl(params = {}) {\n if (!isPlainObject(params)) {\n throw new TypeError('params must be a plain object');\n }\n assertIssuerConfiguration(this.issuer, 'authorization_endpoint');\n const target = new URL(this.issuer.authorization_endpoint);\n for (const [name, value] of Object.entries(authorizationParams.call(this, params))){\n if (Array.isArray(value)) {\n target.searchParams.delete(name);\n for (const member of value){\n target.searchParams.append(name, member);\n }\n } else {\n target.searchParams.set(name, value);\n }\n }\n // TODO: is the replace needed?\n return target.href.replace(/\\+/g, '%20');\n }\n authorizationPost(params = {}) {\n if (!isPlainObject(params)) {\n throw new TypeError('params must be a plain object');\n }\n const inputs = authorizationParams.call(this, params);\n const formInputs = Object.keys(inputs).map((name)=>``).join('\\n');\n return `\n
\n