{
  "version": 3,
  "sources": ["../../src/index.ts", "../../src/types.ts", "../../src/crypto.ts"],
  "sourcesContent": ["import { InAppBrowser } from 'react-native-inappbrowser-reborn';\nimport { Extension } from '@magic-sdk/react-native-bare';\nimport {\n  OAuthErrorData,\n  OAuthPayloadMethods,\n  OAuthRedirectConfiguration,\n  OAuthRedirectError,\n  OAuthRedirectResult,\n  OAuthRedirectStartResult,\n} from './types';\nimport { createCryptoChallenge } from './crypto';\n\nexport class OAuthExtension extends Extension.Internal<'oauth'> {\n  name = 'oauth' as const;\n  config = {};\n  compat = {\n    'magic-sdk': false,\n    '@magic-sdk/react-native-bare': '>=13.0.0',\n    '@magic-sdk/react-native-expo': false,\n    '@magic-sdk/react-native': false,\n  };\n\n  public loginWithPopup(configuration: OAuthRedirectConfiguration) {\n    return this.utils.createPromiEvent<OAuthRedirectResult>(async (resolve, reject) => {\n      try {\n        const { codeVerifier, codeChallenge, cryptoChallengeState } = createCryptoChallenge();\n\n        const startPayload = this.utils.createJsonRpcRequestPayload(OAuthPayloadMethods.Start, [\n          {\n            ...configuration,\n            apiKey: this.sdk.apiKey,\n            platform: 'rn',\n            codeChallenge,\n            cryptoChallengeState,\n            // codeVerifier is intentionally NOT sent here \u2014 it stays in the SDK closure.\n          },\n        ]);\n\n        const result = await this.request<OAuthRedirectStartResult | OAuthRedirectError>(startPayload);\n        const successResult = result as OAuthRedirectStartResult;\n        const errorResult = result as OAuthRedirectError;\n\n        if (errorResult.error) {\n          reject(\n            this.createError<OAuthErrorData>(errorResult.error, errorResult.error_description ?? 'An error occurred.', {\n              errorURI: errorResult.error_uri,\n              provider: errorResult.provider,\n            }),\n          );\n          return;\n        }\n\n        if (!successResult?.oauthAuthoriationURI) {\n          reject(this.createError<object>('NO_AUTH_URI', 'No authorization URI was returned', {}));\n          return;\n        }\n\n        const url = successResult.oauthAuthoriationURI;\n        const res = await InAppBrowser.openAuth(url, configuration.redirectURI, {});\n\n        if (res.type === 'success') {\n          const queryString = new URL(res.url).search;\n          // Build clientMetadata from closure \u2014 codeVerifier and pkceMetadata never left this scope.\n          const clientMetadata = successResult.pkceMetadata\n            ? { codeVerifier, ...successResult.pkceMetadata }\n            : undefined;\n\n          // State verification for the new PKCE path.\n          // The extension generated the state, so it verifies it here \u2014 before any RPC call \u2014 as CSRF protection.\n          // In the legacy path (no clientMetadata), embedded-wallet handles state verification itself.\n          if (clientMetadata) {\n            const returnedState = new URLSearchParams(queryString).get('state');\n            if (!returnedState || returnedState !== clientMetadata.state) {\n              reject(this.createError<object>('STATE_MISMATCH', 'OAuth state parameter mismatch \u2014 request may have been tampered with', {}));\n              return;\n            }\n          }\n\n          resolve(getResult.call(this, queryString.toString(), clientMetadata));\n        } else {\n          reject(this.createError<object>(res.type, 'User has cancelled the authentication', {}));\n        }\n      } catch (err: any) {\n        reject(\n          this.createError<object>(err.message, 'An error has occurred', {\n            err,\n          }),\n        );\n      }\n    });\n  }\n}\n\nexport function getResult(\n  this: OAuthExtension,\n  queryString: string,\n  clientMetadata?: Record<string, string>,\n) {\n  return this.utils.createPromiEvent<OAuthRedirectResult>(async (resolve, reject) => {\n    const parseRedirectResult = this.utils.createJsonRpcRequestPayload(OAuthPayloadMethods.Verify, [\n      {\n        authorizationResponseParams: queryString,\n        magicApiKey: this.sdk.apiKey,\n        platform: 'rn',\n        // Forward full metadata from closure (new PKCE path).\n        // When absent, embedded-wallet falls back to its stored metadata (backward compat).\n        ...(clientMetadata ? { clientMetadata } : {}),\n      },\n    ]);\n\n    // Parse the result, which may contain an OAuth-formatted error.\n    const resultOrError = await this.request<OAuthRedirectResult | OAuthRedirectError>(parseRedirectResult);\n    const maybeResult = resultOrError as OAuthRedirectResult;\n    const maybeError = resultOrError as OAuthRedirectError;\n\n    if (maybeError.error) {\n      reject(\n        this.createError<OAuthErrorData>(maybeError.error, maybeError.error_description ?? 'An error occurred.', {\n          errorURI: maybeError.error_uri,\n          provider: maybeError.provider,\n        }),\n      );\n    }\n\n    resolve(maybeResult);\n  });\n}\n\nexport * from './types';\n", "import { MagicUserMetadata } from '@magic-sdk/types';\n\nexport enum OAuthPayloadMethods {\n  Start = 'magic_oauth_login_with_redirect_start',\n  Verify = 'magic_oauth_login_with_redirect_verify',\n  Popup = 'magic_oauth_login_with_popup',\n}\n\nexport type OAuthProvider =\n  | 'google'\n  | 'facebook'\n  | 'apple'\n  | 'github'\n  | 'bitbucket'\n  | 'gitlab'\n  | 'linkedin'\n  | 'twitter'\n  | 'discord'\n  | 'twitch'\n  | 'microsoft';\n\nexport interface OAuthErrorData {\n  provider: OAuthProvider;\n  errorURI?: string;\n}\n\nexport interface OpenIDConnectProfile {\n  name?: string;\n  familyName?: string;\n  givenName?: string;\n  middleName?: string;\n  nickname?: string;\n  preferredUsername?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  gender?: string;\n  birthdate?: string;\n  zoneinfo?: string;\n  locale?: string;\n  updatedAt?: number;\n}\n\nexport interface OpenIDConnectEmail {\n  email?: string;\n  emailVerified?: boolean;\n}\n\nexport interface OpenIDConnectPhone {\n  phoneNumber?: string;\n  phoneNumberVerified?: boolean;\n}\n\nexport interface OpenIDConnectAddress {\n  address?: {\n    formatted?: string;\n    streetAddress?: string;\n    locality?: string;\n    region?: string;\n    postalCode?: string;\n    country?: string;\n  };\n}\n\nexport type OpenIDConnectUserInfo = OpenIDConnectProfile &\n  OpenIDConnectEmail &\n  OpenIDConnectPhone &\n  OpenIDConnectAddress & { sub?: string; sources?: Record<string, any> } & Record<string, any>;\n\nexport interface OAuthRedirectResult {\n  oauth: {\n    provider: OAuthProvider;\n    scope: string[];\n    accessToken: string;\n    userHandle: string;\n    userInfo: OpenIDConnectUserInfo;\n  };\n\n  magic: {\n    idToken: string;\n    userMetadata: MagicUserMetadata;\n  };\n}\n\nexport interface OAuthRedirectError {\n  provider: OAuthProvider;\n  error: string;\n  error_description?: string;\n  error_uri?: string;\n}\n\nexport interface OAuthRedirectConfiguration {\n  provider: OAuthProvider;\n  redirectURI: string;\n  scope?: string[];\n  loginHint?: string;\n}\n\nexport enum OAuthErrorCode {\n  InvalidRequest = 'invalid_request',\n  InvalidClient = 'invalid_client',\n  InvalidScope = 'invalid_scope',\n  InvalidGrant = 'invalid_grant',\n  UnauthorizedClient = 'unauthorized_client',\n  UnsupportedResponseType = 'unsupported_response_type',\n  UnsupportedGrantType = 'unsupported_grant_type',\n  UnsupportedTokenType = 'unsupported_token_type',\n  AccessDenied = 'access_denied',\n  ServerError = 'server_error',\n  TemporarilyUnavailable = 'temporarily_unavailable',\n}\n\nexport interface OAuthRedirectStartResult {\n  oauthAuthoriationURI?: string;\n  useMagicServerCallback?: boolean;\n  shouldReturnURI?: boolean;\n  /** Present in the new client-PKCE path; forwarded with codeVerifier in the verify call. */\n  pkceMetadata?: {\n    state: string;\n    redirectUri: string;\n    appID: string;\n    provider: string;\n  };\n}\n", "import CryptoJS from 'crypto-js';\n\n// In React Native, `window` is undefined; crypto is available at `global.crypto` in Hermes (RN 0.70+).\n// The Math.random fallback activates automatically when native crypto is unavailable.\nconst HAS_BUILT_IN_CRYPTO =\n  typeof global !== 'undefined' && typeof (global as any).crypto?.getRandomValues === 'function';\n\nfunction bytesToOAuth2CompatibleString(bytes: Uint8Array): string {\n  const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';\n  return Array.from(bytes)\n    .map((value) => charset[value % charset.length])\n    .join('');\n}\n\nfunction createRandomString(size: number): string {\n  if (!HAS_BUILT_IN_CRYPTO) {\n    throw new Error('Secure random number generation is not available in this environment. PKCE requires crypto.getRandomValues (available in Hermes / React Native 0.70+).');\n  }\n  const bytes = new Uint8Array(size);\n  (global as any).crypto.getRandomValues(bytes);\n  return bytesToOAuth2CompatibleString(bytes);\n}\n\nfunction verifierToBase64URL(input: CryptoJS.lib.WordArray): string {\n  return input.toString(CryptoJS.enc.Base64).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n\nexport function createCryptoChallenge(): { codeVerifier: string; codeChallenge: string; cryptoChallengeState: string } {\n  const cryptoChallengeState = createRandomString(128);\n  const codeVerifier = createRandomString(128);\n  const codeChallenge = verifierToBase64URL(CryptoJS.SHA256(codeVerifier));\n  return { codeVerifier, codeChallenge, cryptoChallengeState };\n}\n"],
  "mappings": "AAAA,OAAS,gBAAAA,MAAoB,mCAC7B,OAAS,aAAAC,MAAiB,+BCCnB,IAAKC,OACVA,EAAA,MAAQ,wCACRA,EAAA,OAAS,yCACTA,EAAA,MAAQ,+BAHEA,OAAA,IAgGAC,OACVA,EAAA,eAAiB,kBACjBA,EAAA,cAAgB,iBAChBA,EAAA,aAAe,gBACfA,EAAA,aAAe,gBACfA,EAAA,mBAAqB,sBACrBA,EAAA,wBAA0B,4BAC1BA,EAAA,qBAAuB,yBACvBA,EAAA,qBAAuB,yBACvBA,EAAA,aAAe,gBACfA,EAAA,YAAc,eACdA,EAAA,uBAAyB,0BAXfA,OAAA,IClGZ,OAAOC,MAAc,YAIrB,IAAMC,EACJ,OAAO,OAAW,KAAe,OAAQ,OAAe,QAAQ,iBAAoB,WAEtF,SAASC,EAA8BC,EAA2B,CAChE,IAAMC,EAAU,qEAChB,OAAO,MAAM,KAAKD,CAAK,EACpB,IAAKE,GAAUD,EAAQC,EAAQD,EAAQ,MAAM,CAAC,EAC9C,KAAK,EAAE,CACZ,CAEA,SAASE,EAAmBC,EAAsB,CAChD,GAAI,CAACN,EACH,MAAM,IAAI,MAAM,wJAAwJ,EAE1K,IAAME,EAAQ,IAAI,WAAWI,CAAI,EACjC,OAAC,OAAe,OAAO,gBAAgBJ,CAAK,EACrCD,EAA8BC,CAAK,CAC5C,CAEA,SAASK,EAAoBC,EAAuC,CAClE,OAAOA,EAAM,SAAST,EAAS,IAAI,MAAM,EAAE,QAAQ,KAAM,EAAE,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,GAAG,CACrG,CAEO,SAASU,GAAuG,CACrH,IAAMC,EAAuBL,EAAmB,GAAG,EAC7CM,EAAeN,EAAmB,GAAG,EACrCO,EAAgBL,EAAoBR,EAAS,OAAOY,CAAY,CAAC,EACvE,MAAO,CAAE,aAAAA,EAAc,cAAAC,EAAe,qBAAAF,CAAqB,CAC7D,CFpBO,IAAMG,EAAN,cAA6BC,EAAU,QAAkB,CAC9D,KAAO,QACP,OAAS,CAAC,EACV,OAAS,CACP,YAAa,GACb,+BAAgC,WAChC,+BAAgC,GAChC,0BAA2B,EAC7B,EAEO,eAAeC,EAA2C,CAC/D,OAAO,KAAK,MAAM,iBAAsC,MAAOC,EAASC,IAAW,CACjF,GAAI,CACF,GAAM,CAAE,aAAAC,EAAc,cAAAC,EAAe,qBAAAC,CAAqB,EAAIC,EAAsB,EAE9EC,EAAe,KAAK,MAAM,oEAAuD,CACrF,CACE,GAAGP,EACH,OAAQ,KAAK,IAAI,OACjB,SAAU,KACV,cAAAI,EACA,qBAAAC,CAEF,CACF,CAAC,EAEKG,EAAS,MAAM,KAAK,QAAuDD,CAAY,EACvFE,EAAgBD,EAChBE,EAAcF,EAEpB,GAAIE,EAAY,MAAO,CACrBR,EACE,KAAK,YAA4BQ,EAAY,MAAOA,EAAY,mBAAqB,qBAAsB,CACzG,SAAUA,EAAY,UACtB,SAAUA,EAAY,QACxB,CAAC,CACH,EACA,MACF,CAEA,GAAI,CAACD,GAAe,qBAAsB,CACxCP,EAAO,KAAK,YAAoB,cAAe,oCAAqC,CAAC,CAAC,CAAC,EACvF,MACF,CAEA,IAAMS,EAAMF,EAAc,qBACpBG,EAAM,MAAMC,EAAa,SAASF,EAAKX,EAAc,YAAa,CAAC,CAAC,EAE1E,GAAIY,EAAI,OAAS,UAAW,CAC1B,IAAME,EAAc,IAAI,IAAIF,EAAI,GAAG,EAAE,OAE/BG,EAAiBN,EAAc,aACjC,CAAE,aAAAN,EAAc,GAAGM,EAAc,YAAa,EAC9C,OAKJ,GAAIM,EAAgB,CAClB,IAAMC,EAAgB,IAAI,gBAAgBF,CAAW,EAAE,IAAI,OAAO,EAClE,GAAI,CAACE,GAAiBA,IAAkBD,EAAe,MAAO,CAC5Db,EAAO,KAAK,YAAoB,iBAAkB,4EAAwE,CAAC,CAAC,CAAC,EAC7H,MACF,CACF,CAEAD,EAAQgB,EAAU,KAAK,KAAMH,EAAY,SAAS,EAAGC,CAAc,CAAC,CACtE,MACEb,EAAO,KAAK,YAAoBU,EAAI,KAAM,wCAAyC,CAAC,CAAC,CAAC,CAE1F,OAASM,EAAU,CACjBhB,EACE,KAAK,YAAoBgB,EAAI,QAAS,wBAAyB,CAC7D,IAAAA,CACF,CAAC,CACH,CACF,CACF,CAAC,CACH,CACF,EAEO,SAASD,EAEdH,EACAC,EACA,CACA,OAAO,KAAK,MAAM,iBAAsC,MAAOd,EAASC,IAAW,CACjF,IAAMiB,EAAsB,KAAK,MAAM,qEAAwD,CAC7F,CACE,4BAA6BL,EAC7B,YAAa,KAAK,IAAI,OACtB,SAAU,KAGV,GAAIC,EAAiB,CAAE,eAAAA,CAAe,EAAI,CAAC,CAC7C,CACF,CAAC,EAGKK,EAAgB,MAAM,KAAK,QAAkDD,CAAmB,EAChGE,EAAcD,EACdE,EAAaF,EAEfE,EAAW,OACbpB,EACE,KAAK,YAA4BoB,EAAW,MAAOA,EAAW,mBAAqB,qBAAsB,CACvG,SAAUA,EAAW,UACrB,SAAUA,EAAW,QACvB,CAAC,CACH,EAGFrB,EAAQoB,CAAW,CACrB,CAAC,CACH",
  "names": ["InAppBrowser", "Extension", "OAuthPayloadMethods", "OAuthErrorCode", "CryptoJS", "HAS_BUILT_IN_CRYPTO", "bytesToOAuth2CompatibleString", "bytes", "charset", "value", "createRandomString", "size", "verifierToBase64URL", "input", "createCryptoChallenge", "cryptoChallengeState", "codeVerifier", "codeChallenge", "OAuthExtension", "Extension", "configuration", "resolve", "reject", "codeVerifier", "codeChallenge", "cryptoChallengeState", "createCryptoChallenge", "startPayload", "result", "successResult", "errorResult", "url", "res", "InAppBrowser", "queryString", "clientMetadata", "returnedState", "getResult", "err", "parseRedirectResult", "resultOrError", "maybeResult", "maybeError"]
}