{"version":3,"sources":["../../src/auth/json-web-token.ts"],"names":[],"mappings":";;;AASO,MAAM,YAAA,CAA+B;AAAA,EAC1C,IAAI,QAAA,GAAW;AACb,IAAA,OAAO,KAAK,QAAA,CAAS,GAAA;AAAA,EACvB;AAAA,EAEA,IAAI,MAAA,GAAS;AACX,IAAA,OAAO,KAAK,QAAA,CAAS,GAAA;AAAA,EACvB;AAAA,EAEA,IAAI,KAAA,GAA4B;AAC9B,IAAA,OAAO,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,EAC5B;AAAA,EAEA,IAAI,KAAA,GAAgB;AAClB,IAAA,OAAO,IAAA,CAAK,SAAS,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,IAAI,cAAA,GAAqC;AACvC,IAAA,OAAO,IAAA,CAAK,SAAS,iBAAiB,CAAA;AAAA,EACxC;AAAA,EAEA,IAAI,QAAA,GAA+B;AACjC,IAAA,OAAO,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,EAC5B;AAAA,EAEA,IAAI,OAAA,GAA8B;AAChC,IAAA,OAAO,IAAA,CAAK,SAAS,SAAS,CAAA;AAAA,EAChC;AAAA,EAEA,IAAI,UAAA,GAAqB;AACvB,IAAA,IAAI,CAAA,GAAY,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,IAAK,uCAAA;AAE/C,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,EAAG;AACnB,MAAA,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAA,CAAE,SAAS,CAAC,CAAA;AAAA,IAC7B;AAEA,IAAA,OAAO,CAAA;AAAA,EACT;AAAA,EAEA,IAAI,IAAA,GAAmB;AACrB,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,IAAI,MAAA,GAAiB;AACnB,IAAA,IAAI,IAAA,CAAK,SAAS,KAAA,EAAO;AACvB,MAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAA,CAAA,EAAI,KAAK,KAAK,CAAA,CAAA;AAAA,IACvC;AAEA,IAAA,OAAO,SAAA,CAAU,KAAA;AAAA,EACnB;AAAA,EAEA,IAAI,UAAA,GAAiC;AACnC,IAAA,IAAI,IAAA,CAAK,SAAS,GAAA,EAAK;AACrB,MAAA,OAAO,IAAA,CAAK,SAAS,GAAA,GAAM,GAAA;AAAA,IAC7B;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEiB,MAAA;AAAA,EACA,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBjB,YAAY,KAAA,EAAe;AACzB,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,UAAU,KAAK,CAAA;AAAA,EACjC;AAAA,EAEA,SAAA,CAAU,QAAA,GAAW,GAAA,GAAO,EAAA,GAAK,CAAA,EAAG;AAClC,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,EAAY,OAAO,KAAA;AAC7B,IAAA,OAAO,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA;AAAA,EACxC;AAAA,EAEA,QAAA,GAAW;AACT,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AACF","file":"json-web-token.mjs","sourcesContent":["import { jwtDecode, JwtPayload } from 'jwt-decode';\n\nimport { CallerIds, CallerType } from './caller';\nimport { IToken } from './token';\n\nexport type JsonWebTokenPayload = JwtPayload & {\n  readonly [key: string]: any;\n};\n\nexport class JsonWebToken implements IToken {\n  get audience() {\n    return this._payload.aud;\n  }\n\n  get issuer() {\n    return this._payload.iss;\n  }\n\n  get keyId(): string | undefined {\n    return this._payload['kid'];\n  }\n\n  get appId(): string {\n    return this._payload['appid'];\n  }\n\n  get appDisplayName(): string | undefined {\n    return this._payload['app_displayname'];\n  }\n\n  get tenantId(): string | undefined {\n    return this._payload['tid'];\n  }\n\n  get version(): string | undefined {\n    return this._payload['version'];\n  }\n\n  get serviceUrl(): string {\n    let v: string = this._payload['serviceurl'] || 'https://smba.trafficmanager.net/teams';\n\n    if (v.endsWith('/')) {\n      v = v.slice(0, v.length - 1);\n    }\n\n    return v;\n  }\n\n  get from(): CallerType {\n    if (this.appId) {\n      return 'bot';\n    }\n\n    return 'azure';\n  }\n\n  get fromId(): string {\n    if (this.from === 'bot') {\n      return `${CallerIds.bot}:${this.appId}`;\n    }\n\n    return CallerIds.azure;\n  }\n\n  get expiration(): number | undefined {\n    if (this._payload.exp) {\n      return this._payload.exp * 1000;\n    }\n\n    return undefined;\n  }\n\n  private readonly _value: string;\n  private readonly _payload: JsonWebTokenPayload;\n\n  /**\n   * Typed accessor for an already-validated JWT payload. This constructor\n   * performs no signature verification, no issuer/audience checks, and no\n   * expiry enforcement. Constructing it from an untrusted token does NOT\n   * establish trust in the contained claims.\n   *\n   * Signature verification happens at the HTTP trust boundary via\n   * `JwtValidator.validateAccessToken` (packages/apps/src/middleware/auth/\n   * jwt-validator.ts). Internal callers may also construct from tokens\n   * sourced from trusted identity infrastructure (MSAL, Bot Framework API\n   * responses).\n   *\n   * Callers must not construct this class from raw network input.\n   */\n  constructor(value: string) {\n    this._value = value;\n    this._payload = jwtDecode(value);\n  }\n\n  isExpired(bufferMs = 1000 * 60 * 5) {\n    if (!this.expiration) return false;\n    return this.expiration < Date.now() + bufferMs;\n  }\n\n  toString() {\n    return this._value;\n  }\n}\n"]}