{"version":3,"sources":["jsdelivr-header.js","/npm/keycloak-connect@23.0.1/keycloak.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,ACUA,MAAM,YAAc,QAAQ,yBACtB,YAAc,QAAQ,yBACtB,aAAe,QAAQ,0BAEvB,OAAS,QAAQ,kCACjB,aAAe,QAAQ,yCACvB,MAAQ,QAAQ,sBAChB,MAAQ,QAAQ,sBAChB,OAAS,QAAQ,uBACjB,SAAW,QAAQ,0BACnB,cAAgB,QAAQ,+BACxB,QAAU,QAAQ,wBAClB,SAAW,QAAQ,yBACnB,SAAW,QAAQ,0BA+BzB,SAAS,SAAU,EAAQ,GAQzB,GANA,KAAK,OAAS,IAAI,OAAO,GAEzB,KAAK,aAAe,IAAI,aAAa,KAAK,QAE1C,KAAK,OAAS,CAAC,cAEV,EACH,MAAM,IAAI,MAAM,2CAMlB,GAFA,KAAK,OAAO,MAAQ,EAAO,MAEvB,GAAU,EAAO,OAAS,EAAO,QACnC,MAAM,IAAI,MAAM,wDAGd,GAAU,EAAO,MACnB,KAAK,OAAO,KAAK,IAAI,aAAa,EAAO,QAChC,GAAU,EAAO,SAC1B,KAAK,OAAO,KAAK,aAGnB,KAAK,OAAO,QAAU,EAAO,OAC/B,CAuBA,SAAS,UAAU,WAAa,SAAU,GACnC,IACH,EAAU,CAAE,OAAQ,GAAI,MAAO,KAGjC,EAAQ,OAAS,EAAQ,QAAU,UACnC,EAAQ,MAAQ,EAAQ,OAAS,IAEjC,MAAM,EAAc,GAQpB,OANA,EAAY,KAAK,OACjB,EAAY,KAAK,SAAS,OAC1B,EAAY,KAAK,MAAM,KAAM,EAAQ,QACrC,EAAY,KAAK,cAAc,OAC/B,EAAY,KAAK,OAAO,KAAM,EAAQ,SAE/B,CACT,EA6DA,SAAS,UAAU,QAAU,SAAU,GACrC,OAAO,QAAQ,KAAM,EACvB,EAkDA,SAAS,UAAU,SAAW,SAAU,EAAa,GACnD,OAAO,IAAI,SAAS,KAAM,GAAQ,QAAQ,EAC5C,EAUA,SAAS,UAAU,SAAW,WAC5B,OAAO,SAAS,KAClB,EAmBA,SAAS,UAAU,cAAgB,SAAU,GAE7C,EAWA,SAAS,UAAU,gBAAkB,SAAU,GAE/C,EAaA,SAAS,UAAU,aAAe,SAAU,EAAS,GACnD,EAAS,OAAO,KAChB,EAAS,IAAI,gBACf;cAGA,SAAS,UAAU,SAAW,SAAU,EAAS,GAC/C,IAAI,EAEJ,IAAK,IAAI,EAAI,EAAG,EAAI,KAAK,OAAO,SAC9B,EAAU,KAAK,OAAO,GAAG,IAAI,IACzB,KAFoC,GAQ1C,IAAI,EAAY,EAKhB,GAJ2B,iBAAhB,IACT,EAAY,KAAK,MAAM,IAGrB,IAAc,EAAU,MAAO,CACjC,MAAM,EAAO,KACb,OAAO,KAAK,aAAa,YAAY,KAAK,UAAU,IACjD,MAAK,IACJ,EAAK,WAAW,EAAO,EAAS,GACzB,KAER,OAAM,IAAe,QAAQ,OAAO,IAAI,MAAM,sCACnD,CAEA,OAAO,QAAQ,OAAO,IAAI,MAAM,qCAClC,EAEA,SAAS,UAAU,WAAa,SAAU,EAAO,EAAS,GACxD,KAAI,KAAK,OAAO,OAAS,GAAK,YAAY,IAAI,IAA9C,CAKA,GAAK,EAOL,OAFA,KAAK,OAAO,GAAG,KAAK,GACpB,EAAM,MAAM,EAAS,GACd,EANL,KAAK,aAAa,EAAS,EAF7B,CASF,EAEA,SAAS,UAAU,aAAe,SAAU,GACtC,KAAK,OAAO,OAAS,GAKzB,KAAK,OAAO,GAAG,MAAM,EACvB,EAEA,SAAS,UAAU,iBAAmB,SAAU,EAAM,EAAS,GAC7D,GAAI,KAAK,OAAO,OAAS,EAEvB,MAAM,IAAI,MAAM,sDAGlB,MAAM,EAAY,EAAQ,QAAQ,GAE5B,EAAO,KACb,OAAO,KAAK,aAAa,eAAe,EAAS,EAAM,GACpD,MAAK,SAAU,GAEd,OADA,EAAK,WAAW,EAAO,EAAS,GACzB,CACT,GACJ,EAEA,SAAS,UAAU,iBAAmB,SAAU,EAAc,EAAS,GACrE,MAAM,EAAO,KACb,OAAO,KAAK,aAAa,iBAAiB,EAAc,EAAS,GAC9D,MAAK,SAAU,GAId,OAHK,EAAa,eAChB,EAAK,WAAW,EAAO,GAElB,CACT,GACJ,EAEA,SAAS,UAAU,SAAW,SAAU,EAAM,GAC5C,IAAI,EAAM,KAAK,OAAO,SAAZ,2CAEM,mBAAmB,KAAK,OAAO,UAC/C,UAAY,mBAAmB,GAC/B,iBAAmB,mBAAmB,GACtC,UAAY,mBAAmB,KAAK,OAAO,MAAQ,UAAY,KAAK,OAAO,MAAQ,UACnF,sBAKA,OAHI,KAAK,QAAU,KAAK,OAAO,UAC7B,GAAO,gBAAkB,mBAAmB,KAAK,OAAO,UAEnD,CACT,EAEA,SAAS,UAAU,UAAY,SAAU,EAAa,GACpD,MAAM,EAAM,IAAI,IAAI,KAAK,OAAO,SAAW,mCAO3C,OALI,GAAe,IACjB,EAAI,aAAa,IAAI,gBAAiB,GACtC,EAAI,aAAa,IAAI,2BAA4B,IAG5C,EAAI,UACb,EAEA,SAAS,UAAU,WAAa,WAC9B,OAAO,KAAK,OAAO,SAAW,UAChC,EAEA,SAAS,UAAU,WAAa,SAAU,GACxC,OAAO,KAAK,aAAa,WAAW,EACtC,EAEA,SAAS,UAAU,gBAAkB,SAAU,GAC7C,OAAQ,KAAK,OAAO,UACtB,EAEA,SAAS,UAAU,UAAY,WAC7B,OAAO,KAAK,MACd,EAEA,OAAO,QAAU","file":"/npm/keycloak-connect@23.0.1/keycloak.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.39.0.\n * Original file: /npm/keycloak-connect@23.0.1/keycloak.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","/*\n * Copyright 2016 Red Hat Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\"); you may not\n * use this file except in compliance with the License. You may obtain a copy of\n * the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the\n * License for the specific language governing permissions and limitations under\n * the License.\n */\n\nconst BearerStore = require('./stores/bearer-store')\nconst CookieStore = require('./stores/cookie-store')\nconst SessionStore = require('./stores/session-store')\n\nconst Config = require('./middleware/auth-utils/config')\nconst GrantManager = require('./middleware/auth-utils/grant-manager')\nconst Setup = require('./middleware/setup')\nconst Admin = require('./middleware/admin')\nconst Logout = require('./middleware/logout')\nconst PostAuth = require('./middleware/post-auth')\nconst GrantAttacher = require('./middleware/grant-attacher')\nconst Protect = require('./middleware/protect')\nconst Enforcer = require('./middleware/enforcer')\nconst CheckSso = require('./middleware/check-sso')\n\n/**\n * Instantiate a Keycloak.\n *\n * The `config` and `keycloakConfig` hashes are both optional.\n *\n * The `config` hash, if provided, may include either `store`, pointing\n * to the actual session-store used by your application, or `cookies`\n * with boolean `true` as the value to support using cookies as your\n * authentication store. Bear in mind that cookies session store expects\n * a cookie parser to be present, e.g. \"cookie-parser\" in case of Express.js.\n *\n * A session-based store is recommended, as it allows more assured control\n * from the Keycloak console to explicitly logout some or all sessions.\n *\n * In all cases, also, authentication through a Bearer authentication\n * header is supported for non-interactive APIs.\n *\n * The `keycloakConfig` object, by default, is populated by the contents of\n * a `keycloak.json` file installed alongside your application, copied from\n * the Keycloak administration console when you provision your application.\n *\n * @constructor\n *\n * @param      {Object}    config          Configuration for the Keycloak connector.\n * @param      {Object}    keycloakConfig  Keycloak-specific configuration.\n *\n * @return     {Keycloak}  A constructed Keycloak object.\n *\n */\nfunction Keycloak (config, keycloakConfig) {\n  // If keycloakConfig is null, Config() will search for `keycloak.json`.\n  this.config = new Config(keycloakConfig)\n\n  this.grantManager = new GrantManager(this.config)\n\n  this.stores = [BearerStore]\n\n  if (!config) {\n    throw new Error('Adapter configuration must be provided.')\n  }\n\n  // Add the custom scope value\n  this.config.scope = config.scope\n\n  if (config && config.store && config.cookies) {\n    throw new Error('Either `store` or `cookies` may be set, but not both')\n  }\n\n  if (config && config.store) {\n    this.stores.push(new SessionStore(config.store))\n  } else if (config && config.cookies) {\n    this.stores.push(CookieStore)\n  }\n\n  this.config.idpHint = config.idpHint\n}\n\n/**\n * Obtain an array of middleware for use in your application.\n *\n * Generally this should be installed at the root of your application,\n * as it provides general wiring for Keycloak interaction, without actually\n * causing Keycloak to get involved with any particular URL until asked\n * by using `protect(...)`.\n *\n * Example:\n *\n *     var app = express();\n *     var keycloak = new Keycloak();\n *     app.use( keycloak.middleware() );\n *\n * Options:\n *\n *  - `logout` URL for logging a user out. Defaults to `/logout`.\n *  - `admin` Root URL for Keycloak admin callbacks.  Defaults to `/`.\n *\n * @param {Object} options Optional options for specifying details.\n */\nKeycloak.prototype.middleware = function (options) {\n  if (!options) {\n    options = { logout: '', admin: '' }\n  }\n\n  options.logout = options.logout || '/logout'\n  options.admin = options.admin || '/'\n\n  const middlewares = []\n\n  middlewares.push(Setup)\n  middlewares.push(PostAuth(this))\n  middlewares.push(Admin(this, options.admin))\n  middlewares.push(GrantAttacher(this))\n  middlewares.push(Logout(this, options.logout))\n\n  return middlewares\n}\n\n/**\n * Apply protection middleware to an application or specific URL.\n *\n * If no `spec` parameter is provided, the subsequent handlers will\n * be invoked if the user is authenticated, regardless of what roles\n * he or she may or may not have.\n *\n * If a user is not currently authenticated, the middleware will cause\n * the authentication workflow to begin by redirecting the user to the\n * Keycloak installation to login.  Upon successful login, the user will\n * be redirected back to the originally-requested URL, fully-authenticated.\n *\n * If a `spec` is provided, the same flow as above will occur to ensure that\n * a user it authenticated.  Once authenticated, the spec will then be evaluated\n * to determine if the user may or may not access the following resource.\n *\n * The `spec` may be either a `String`, specifying a single required role,\n * or a function to make more fine-grained determination about access-control\n *\n * If the `spec` is a `String`, then the string will be interpreted as a\n * role-specification according to the following rules:\n *\n *  - If the string starts with `realm:`, the suffix is treated as the name\n *    of a realm-level role that is required for the user to have access.\n *  - If the string contains a colon, the portion before the colon is treated\n *    as the name of an application within the realm, and the portion after the\n *    colon is treated as a role within that application.  The user then must have\n *    the named role within the named application to proceed.\n *  - If the string contains no colon, the entire string is interpreted as\n *    as the name of a role within the current application (defined through\n *    the installed `keycloak.json` as provisioned within Keycloak) that the\n *    user must have in order to proceed.\n *\n * Example\n *\n *     // Users must have the `special-people` role within this application\n *     app.get( '/special/:page', keycloak.protect( 'special-people' ), mySpecialHandler );\n *\n * If the `spec` is a function, it may take up to two parameters in order to\n * assist it in making an authorization decision: the access token, and the\n * current HTTP request.  It should return `true` if access is allowed, otherwise\n * `false`.\n *\n * The `token` object has a method `hasRole(...)` which follows the same rules\n * as above for `String`-based specs.\n *\n *     // Ensure that users have either `nicepants` realm-level role, or `mr-fancypants` app-level role.\n *     function pants(token, request) {\n *       return token.hasRole( 'realm:nicepants') || token.hasRole( 'mr-fancypants');\n *     }\n *\n *     app.get( '/fancy/:page', keycloak.protect( pants ), myPantsHandler );\n *\n * With no spec, simple authentication is all that is required:\n *\n *     app.get( '/complain', keycloak.protect(), complaintHandler );\n *\n * @param {String} spec The protection spec (optional)\n */\nKeycloak.prototype.protect = function (spec) {\n  return Protect(this, spec)\n}\n\n/**\n * Enforce access based on the given permissions. This method operates in two modes, depending on the `response_mode`\n * defined for this policy enforcer.\n *\n * If `response_mode` is set to `token`, permissions are obtained using an specific grant type. As a consequence, the\n * token with the permissions granted by the server is updated and made available to the application via `request.kauth.grant.access_token`.\n * Use this mode when your application is using sessions and you want to cache previous decisions from the server, as well automatically handle\n * refresh tokens. This mode is especially useful for applications acting as client and resource server.\n *\n * If `response_mode` is set to `permissions`, the server only returns the list of granted permissions (no oauth2 response).\n * Previous decisions are not cached and the policy enforcer will query the server every time to get a decision.\n * This is the default `response_mode`.\n *\n * You can set `response_mode` as follows:\n *\n *      keycloak.enforcer('item:read', {response_mode: 'token'})\n *\n * In all cases, if the request is already populated with a valid access token (for instance, bearer tokens sent by clients to the application),\n * the policy enforcer will first try to resolve permissions from the current token before querying the server.\n *\n * By default, the policy enforcer will use the `client_id` defined to the application (for instance, via `keycloak.json`) to\n * reference a client in Keycloak that supports Keycloak Authorization Services. In this case, the client can not be public given\n * that it is actually a resource server.\n *\n * If your application is acting as a client and resource server, you can use the following configuration to specify the client\n * in Keycloak with the authorization settings:\n *\n *      keycloak.enforcer('item:read', {resource_server_id: 'nodejs-apiserver'})\n *\n * It is recommended to use separated clients in Keycloak to represent your frontend and backend.\n *\n * If the application you are protecting is enabled with Keycloak authorization services and you have defined client credentials\n * in `keycloak.json`, you can push additional claims to the server and make them available to your policies in order to make decisions.\n * For that, you can define a `claims` configuration option which expects a `function` that returns a JSON with the claims you want to push:\n *\n *      app.get('/protected/resource', keycloak.enforcer(['resource:view', 'resource:write'], {\n          claims: function(request) {\n            return {\n              \"http.uri\": [\"/protected/resource\"],\n              \"user.agent\": // get user agent  from request\n            }\n          }\n        }), function (req, res) {\n          // access granted\n        });\n *\n * @param {String[]} expectedPermissions A single string representing a permission or an arrat of strings representing the permissions. For instance, 'item:read' or ['item:read', 'item:write'].\n */\nKeycloak.prototype.enforcer = function (permissions, config) {\n  return new Enforcer(this, config).enforce(permissions)\n}\n\n/**\n * Apply check SSO middleware to an application or specific URL.\n *\n * Check SSO will only authenticate the client if the user is already logged-in,\n * if the user is not logged-in the browser will be redirected back\n * to the originally-requested URL and remain unauthenticated.\n *\n */\nKeycloak.prototype.checkSso = function () {\n  return CheckSso(this)\n}\n\n/**\n * Callback made upon successful authentication of a user.\n *\n * By default, this a no-op, but may assigned to another\n * function for application-specific login which may be useful\n * for linking authentication information from Keycloak to\n * application-maintained user information.\n *\n * The `request.kauth.grant` object contains the relevant tokens\n * which may be inspected.\n *\n * For instance, to obtain the unique subject ID:\n *\n *     request.kauth.grant.id_token.sub => bf2056df-3803-4e49-b3ba-ff2b07d86995\n *\n * @param {Object} request The HTTP request.\n */\nKeycloak.prototype.authenticated = function (request) {\n  // no-op\n}\n\n/**\n * Callback made upon successful de-authentication of a user.\n *\n * By default, this is a no-op, but may be used by the application\n * in the case it needs to remove information from the user's session\n * or otherwise perform additional logic once a user is logged out.\n *\n * @param {Object} request The HTTP request.\n */\nKeycloak.prototype.deauthenticated = function (request) {\n  // no-op\n}\n\n/**\n * Replaceable function to handle access-denied responses.\n *\n * In the event the Keycloak middleware decides a user may\n * not access a resource, or has failed to authenticate at all,\n * this function will be called.\n *\n * By default, a simple string of \"Access denied\" along with\n * an HTTP status code for 403 is returned.  Chances are an\n * application would prefer to render a fancy template.\n */\nKeycloak.prototype.accessDenied = function (request, response) {\n  response.status(403)\n  response.end('Access denied')\n}\n\n/*! ignore */\nKeycloak.prototype.getGrant = function (request, response) {\n  let rawData\n\n  for (let i = 0; i < this.stores.length; ++i) {\n    rawData = this.stores[i].get(request)\n    if (rawData) {\n      // store = this.stores[i];\n      break\n    }\n  }\n\n  let grantData = rawData\n  if (typeof (grantData) === 'string') {\n    grantData = JSON.parse(grantData)\n  }\n\n  if (grantData && !grantData.error) {\n    const self = this\n    return this.grantManager.createGrant(JSON.stringify(grantData))\n      .then(grant => {\n        self.storeGrant(grant, request, response)\n        return grant\n      })\n      .catch(() => { return Promise.reject(new Error('Could not store grant code error')) })\n  }\n\n  return Promise.reject(new Error('Could not obtain grant code error'))\n}\n\nKeycloak.prototype.storeGrant = function (grant, request, response) {\n  if (this.stores.length < 2 || BearerStore.get(request)) {\n    // cannot store bearer-only, and should not store if grant is from the\n    // authorization header\n    return\n  }\n  if (!grant) {\n    this.accessDenied(request, response)\n    return\n  }\n\n  this.stores[1].wrap(grant)\n  grant.store(request, response)\n  return grant\n}\n\nKeycloak.prototype.unstoreGrant = function (sessionId) {\n  if (this.stores.length < 2) {\n    // cannot unstore, bearer-only, this is weird\n    return\n  }\n\n  this.stores[1].clear(sessionId)\n}\n\nKeycloak.prototype.getGrantFromCode = function (code, request, response) {\n  if (this.stores.length < 2) {\n    // bearer-only, cannot do this;\n    throw new Error('Cannot exchange code for grant in bearer-only mode')\n  }\n\n  const sessionId = request.session.id\n\n  const self = this\n  return this.grantManager.obtainFromCode(request, code, sessionId)\n    .then(function (grant) {\n      self.storeGrant(grant, request, response)\n      return grant\n    })\n}\n\nKeycloak.prototype.checkPermissions = function (authzRequest, request, callback) {\n  const self = this\n  return this.grantManager.checkPermissions(authzRequest, request, callback)\n    .then(function (grant) {\n      if (!authzRequest.response_mode) {\n        self.storeGrant(grant, request)\n      }\n      return grant\n    })\n}\n\nKeycloak.prototype.loginUrl = function (uuid, redirectUrl) {\n  let url = this.config.realmUrl +\n  '/protocol/openid-connect/auth' +\n  '?client_id=' + encodeURIComponent(this.config.clientId) +\n  '&state=' + encodeURIComponent(uuid) +\n  '&redirect_uri=' + encodeURIComponent(redirectUrl) +\n  '&scope=' + encodeURIComponent(this.config.scope ? 'openid ' + this.config.scope : 'openid') +\n  '&response_type=code'\n\n  if (this.config && this.config.idpHint) {\n    url += '&kc_idp_hint=' + encodeURIComponent(this.config.idpHint)\n  }\n  return url\n}\n\nKeycloak.prototype.logoutUrl = function (redirectUrl, idTokenHint) {\n  const url = new URL(this.config.realmUrl + '/protocol/openid-connect/logout')\n\n  if (redirectUrl && idTokenHint) {\n    url.searchParams.set('id_token_hint', idTokenHint)\n    url.searchParams.set('post_logout_redirect_uri', redirectUrl)\n  }\n\n  return url.toString()\n}\n\nKeycloak.prototype.accountUrl = function () {\n  return this.config.realmUrl + '/account'\n}\n\nKeycloak.prototype.getAccount = function (token) {\n  return this.grantManager.getAccount(token)\n}\n\nKeycloak.prototype.redirectToLogin = function (request) {\n  return !this.config.bearerOnly\n}\n\nKeycloak.prototype.getConfig = function () {\n  return this.config\n}\n\nmodule.exports = Keycloak\n"]}