{"version":3,"sources":["jsdelivr-header.js","/npm/@salzhrani/hapi-auth-jwt2@7.3.0/lib/index.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,ACNA,aAEA,MAAM,KAAO,QAAQ,QACf,OAAS,QAAQ,UACjB,IAAM,QAAQ,gBACd,QAAU,QAAQ,aAClB,IAAM,QAAQ,mBACd,UAAY,CAAC,EAWnB,QAAQ,OAAS,CACf,SAAU,SAAU,EAAQ,GAC1B,EAAO,KAAK,OAAO,MAAO,UAAU,eACtC,GAOF,QAAQ,OAAO,IAAM,IAQrB,UAAU,WAAa,SAAU,GAC/B,IAAI,EAAU,CAAC,EAEf,OAAO,IAC0C,sBAA3C,EAAQ,SAAS,KAAK,IAAuF,2BAA3C,EAAQ,SAAS,KAAK,GAChG,EAWA,UAAU,eAAiB,SAAU,EAAQ,GAM3C,SAAS,EAAY,EAAW,EAAS,EAAQ,GAC/C,IAAI,EAAe,CACjB,UAAW,EACX,QAAS,EACT,OAAQ,EACR,WAAY,GAEV,EAAa,EACb,EAAW,EACX,EAAU,EACV,EAAc,EAalB,OAXI,EAAQ,WAAa,UAAU,WAAW,EAAQ,aACpD,EAAe,EAAQ,UAAU,GAE7B,IACF,EAAa,EAAa,UAC1B,EAAW,EAAa,QACxB,EAAU,EAAa,OACvB,EAAc,EAAa,aAIxB,KAAK,GAAY,EAAU,EAAS,EAC7C,CAEA,OA/BA,OAAO,EAAS,4CAChB,OAAO,EAAQ,UACV,EAAQ,OAAQ,4CA6Bd,CASL,aAAc,eAAgB,EAAS,GACrC,IAEI,EAFA,EAAQ,QAAQ,EAAS,GACzB,EAAY,EAAQ,WAAa,QAGrC,IAAK,EACH,OAAO,EAAE,gBAAgB,EAAW,eAAgB,KAAM,GAAY,CAAC,YAAa,IAItF,IAAK,QAAQ,QAAQ,GACnB,OAAO,EAAE,gBAAgB,EAAW,eAClC,uBAAwB,GAAY,CAAC,YAAa,IAGtD,EAAQ,KAAK,MAAQ,EAErB,IACE,EAAU,IAAI,OAAO,EAAO,CAAE,SAAU,EAAQ,WAAY,GAC9D,CAAE,MAAM,GACN,OAAO,EAAE,gBAAgB,EAAW,eACpC,uBAAwB,GAAY,CAAE,YAAa,GACrD,CACA,MAAM,IAAE,KAAQ,GAAc,UAAU,WAAW,EAAQ,WAAa,EAAQ,IAAI,GAAW,CAAC,IAAK,EAAQ,KAE7G,GAAgC,mBAArB,EAAQ,SAAyB,CAE1C,IAQI,EARA,EAAgB,EAAQ,eAAiB,CAAC,EAC1C,EAAQ,MAAM,QAAQ,GAAQ,EAAM,CAAC,GAGrC,IACF,EAAQ,QAAQ,IAAI,MAAQ,CAAC,cAI/B,IAAI,IAAI,EAAI,EAAG,EAAI,EAAK,SAAU,EAAG,CAEnC,IAAI,EADJ,EAAI,EAAK,GAET,IACE,EAAiB,IAAI,OAAO,EAAO,EAAG,EACxC,CAAE,MAAM,GACN,GAAI,GAAK,EAAK,OAAS,EAAG,CAExB,IAAI,EAAsC,gBAAvB,EAAW,QAA4B,gBAAkB,gBAC5E,OAAO,EAAE,gBAAgB,EAAW,eAClC,EAAa,GAAY,CAAE,YAAa,GAC5C,CAEA,QACF,CACA,IACE,IAAI,QAAE,EAAO,YAAE,EAAW,SAAE,SAAmB,EAAQ,SAAS,EAAgB,EAAS,GACzF,YAAiB,IAAb,EACK,EAAE,SAAS,GAAU,WAEzB,EAOE,EAAE,cAAc,CACrB,YAAa,GAAsC,iBAAhB,EAA2B,EAAc,EAC5E,UAAW,IAPJ,EAAE,gBAAgB,EAAW,eACpC,sBAAuB,GACvB,CAAE,YAAa,GAOnB,CAAE,MAAM,GACN,OAAO,EAAE,gBAAgB,EAAW,UAAW,GAAe,CAAE,YAAa,GAC/E,CACF,CACF,CAEA,IACE,IAAI,QAAE,EAAO,YAAE,SAAsB,EAAQ,OAAO,EAAS,GAC7D,OAAK,EAIE,EAAE,cAAc,CACrB,YAAa,GAAe,EAC5B,UAAW,IALJ,EAAE,gBAAgB,EAAW,eAAgB,sBACpD,GAAY,CAAE,YAAa,GAM/B,CAAE,MAAM,GACN,OAAO,EAAE,gBAAgB,EAAW,UAAW,GAAe,CAAE,YAAa,GAC/E,CACF,EASA,SAAU,SAAU,EAAS,GAC3B,GAAI,EAAQ,cAAgD,mBAAzB,EAAQ,aACzC,IAEE,EAAQ,aAAa,EAAS,EAChC,CAAE,MAAM,GACN,MAAM,EAAW,UAAW,EAC9B,CAEF,OAAO,EAAE,QACX,EAEJ","file":"/npm/@salzhrani/hapi-auth-jwt2@7.3.0/lib/index.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.39.0.\n * Original file: /npm/@salzhrani/hapi-auth-jwt2@7.3.0/lib/index.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","'use strict';\n\nconst Boom = require('boom');           // error handling https://github.com/hapijs/boom\nconst assert = require('assert');       // use assert to check if options are set\nconst JWT = require('jsonwebtoken');    // https://github.com/docdis/learn-json-web-tokens\nconst extract = require('./extract');   // extract token from Auth Header, URL or Coookie\nconst pkg = require('../package.json'); // use package name and version rom package.json\nconst internals = {};                   // see: http://hapijs.com/styleguide#module-globals\n\n/**\n * register registers the name and exposes the implementation of the plugin\n * see: http://hapijs.com/api#serverplugins for plugin format\n * @param {Object} server - the hapi server to which we are attaching the plugin\n * @param {Object} options - any options set during plugin registration\n * in this case we are not using the options during register but we do later.\n * @param {Function} next - the callback called once registration succeeds\n * @returns {Function} next - returns (calls) the callback when complete.\n */\nexports.plugin = {\n  register: function (server, options) {\n    server.auth.scheme('jwt', internals.implementation); // hapijs.com/api#serverauthapi\n  }\n}\n\n/**\n * attributes merely aliases the package.json (re-uses package name & version)\n * simple example: github.com/hapijs/hapi/blob/master/API.md#serverplugins\n */\nexports.plugin.pkg = pkg // hapi requires attributes for a plugin.\n                         // also see: http://hapijs.com/tutorials/plugins\n\n/**\n * isFunction checks if a given value is a function.\n * @param {Object} functionToCheck - the object we want to confirm is a function\n * @returns {Boolean} - true if the functionToCheck is a function. :-)\n */\ninternals.isFunction = function (functionToCheck) {\n  let getType = {};\n\n  return functionToCheck\n    && (getType.toString.call(functionToCheck) === '[object Function]' || getType.toString.call(functionToCheck) === '[object AsyncFunction]');\n};\n\n/**\n * implementation is the \"main\" interface to the plugin and contains all the\n * \"implementation details\" (methods) such as authenicate, response & raiseError\n * @param {Object} server - the Hapi.js server object we are attaching the\n * the hapi-auth-jwt2 plugin to.\n * @param {Object} options - any configuration options passed in.\n * @returns {Function} authenicate - we return the authenticate method after\n * registering the plugin as that's the method that gets called for each route.\n */\ninternals.implementation = function (server, options) {\n  assert(options, 'options are required for jwt auth scheme'); // pre-auth checks\n  assert(options.validate\n    || options.verify, 'validate OR verify function is required!');\n\n  // allow custom error raising or default to Boom if no errorFunc is defined\n  function raiseError (errorType, message, scheme, attributes) {\n    let errorContext = {\n      errorType: errorType,\n      message: message,\n      scheme: scheme,\n      attributes: attributes\n    };\n    let _errorType = errorType;   // copies of params\n    let _message = message;       // so we can over-write them below\n    let _scheme = scheme;         // without a linter warning\n    let _attributes = attributes; // if you know a better way please PR!\n\n    if (options.errorFunc && internals.isFunction(options.errorFunc)) {\n      errorContext = options.errorFunc(errorContext);\n\n      if (errorContext) {\n        _errorType = errorContext.errorType;\n        _message = errorContext.message;\n        _scheme = errorContext.scheme;\n        _attributes = errorContext.attributes;\n      }\n    }\n\n    return Boom[_errorType](_message, _scheme, _attributes);\n  }\n\n  return {\n    /**\n     * authenticate is the \"work horse\" of the plugin. it's the method that gets\n     * called every time a route is requested and needs to validate/verify a JWT\n     * @param {Object} request - the standard route handler request object\n     * @param {Object} h - the standard hapi reply interface\n     * @returns {Boolean} if the JWT is valid we return a credentials object\n     * otherwise throw an error to inform the app & client of unauthorized req.\n     */\n    authenticate: async function (request, h) {\n      let token = extract(request, options); // extract token Header/Cookie/Query\n      let tokenType = options.tokenType || 'Token'; // see: https://git.io/vXje9\n      let decoded, keyFunc;\n\n      if (!token) {\n        return h.unauthenticated(raiseError('unauthorized', null, tokenType), {credentials: tokenType});\n      }\n      \n      // quick check for validity of token format\n      if (!extract.isValid(token)) {\n        return h.unauthenticated(raiseError('unauthorized',\n          'Invalid token format', tokenType), {credentials: token});\n      }\n      // verification is done later, but we want to avoid decoding if malformed\n      request.auth.token = token; // keep encoded JWT available in the request\n      // otherwise use the same key (String) to validate all JWTs\n      try {\n        decoded = JWT.decode(token, { complete: options.complete || false });\n      } catch(e) {\n        return h.unauthenticated(raiseError('unauthorized',\n        'Invalid token format', tokenType), { credentials: token });\n      }\n      const { key, ...extraInfo } = internals.isFunction(options.key) ? await options.key(decoded) : {key: options.key };\n      // if keyFunc is function allow dynamic key lookup: https://git.io/vXjvY\n      if (typeof options.validate === 'function') {\n        \n        let verifyOptions = options.verifyOptions || {};\n        let keys = (Array.isArray(key)) ? key : [key];\n        let keysTried = 0;\n\n        if (extraInfo) {\n          request.plugins[pkg.name] = {extraInfo};\n        }\n        \n        let k;\n        for(let i = 0; i < keys.length; ++i) {\n          k = keys[i];\n          let verify_decoded;\n          try {\n            verify_decoded = JWT.verify(token, k, verifyOptions);\n          } catch(verify_err) {\n            if (i >= keys.length - 1) {\n              // we have exhausted all keys and still fail\n              let err_message = (verify_err.message === 'jwt expired' ? 'Expired token' : 'Invalid token');\n              return h.unauthenticated(raiseError('unauthorized',\n                err_message, tokenType), { credentials: token });\n            }\n            // verification failed but there are still keys to try\n            continue;\n          }\n          try {\n            let { isValid, credentials, response } = await options.validate(verify_decoded, request, h);\n            if (response !== undefined) {\n              return h.response(response).takeover();\n            }\n            if (!isValid) {\n              // invalid credentials\n              return h.unauthenticated(raiseError('unauthorized',\n              'Invalid credentials', tokenType),\n              { credentials: decoded });\n            }\n            // valid key and credentials\n            return h.authenticated({\n              credentials: credentials && typeof credentials === 'object' ? credentials : decoded,\n              artifacts: token\n            });\n          } catch(validate_err) {\n            return h.unauthenticated(raiseError('boomify', validate_err), { credentials: decoded })\n          }\n        };\n      }\n      // see: https://github.com/dwyl/hapi-auth-jwt2/issues/130\n      try {\n        let { isValid, credentials } = await options.verify(decoded, request);\n        if (!isValid) {\n          return h.unauthenticated(raiseError('unauthorized', 'Invalid credentials',\n          tokenType), { credentials: decoded });\n        }\n        return h.authenticated({\n          credentials: credentials || decoded,\n          artifacts: token\n        });\n      } catch(verify_error) {\n        return h.unauthenticated(raiseError('boomify', verify_error), { credentials: decoded })\n      }\n    },\n    /**\n     * response is an Optional method called if an options.responseFunc is set.\n     * @param {Object} request - the standard route handler request object\n     * @param {Object} h - the standard hapi reply interface ...\n     * after we run the custom options.responseFunc we h.continue to execute\n     * the next plugin in the list.\n     * @returns {Boolean} true. always return true (unless there's an error...)\n     */\n    response: function (request, h) {\n      if (options.responseFunc && typeof options.responseFunc === 'function') {\n        try {\n          // allow responseFunc to decorate or throw\n          options.responseFunc(request, h);\n        } catch(err) {\n          throw raiseError('boomify', err);\n        }\n      }\n      return h.continue;\n    }\n  }\n};\n"]}