{"version":3,"sources":["jsdelivr-header.js","/npm/oauth2-framework@2.0.5/dist/index.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,ACNA,aACA,OAAO,eAAe,QAAS,aAAc,CAAE,OAAO,IACtD,MAAM,aAAe,QAAQ,gBACvB,eAAiB,QAAQ,yBAC/B,IAAI,SAAW,QAAQ,mBACvB,QAAQ,OAAS,SAAS,OAC1B,IAAI,QAAU,QAAQ,kBACtB,QAAQ,MAAQ,QAAQ,MACxB,IAAI,SAAW,QAAQ,YACvB,QAAQ,sBAAwB,SAAS,sBACzC,IAAI,eAAiB,QAAQ,yBAC7B,QAAQ,qBAAuB,eAAe,qBAC9C,MAAM,gBACF,WAAA,CAAY,EAAO,GACf,KAAK,MAAQ,EACb,KAAK,OAAS,CAClB,CACA,wBAAM,CAAmB,EAAY,EAAM,EAAc,EAAW,EAAe,EAAU,EAAU,EAAQ,GAC3G,KAAK,wBAAwB,GAC7B,MAAM,QAAe,KAAK,sBAAsB,EAAW,EAAc,EAAQ,GACjF,GAAmB,uBAAf,EAAqC,CACrC,KAAK,sCAAsC,EAAQ,GACnD,MAAM,QAAc,KAAK,MAAM,aAAa,EAAM,GAClD,OAAO,KAAK,MAAM,oBAAoB,EAAM,UAAW,EAAM,SAAU,EAAM,OAAQ,EACzF,CACK,GAAmB,aAAf,EAA2B,CAChC,MAAM,QAAyB,KAAK,MAAM,oBAAoB,EAAW,EAAU,EAAU,GAE7F,OADA,KAAK,0BAA0B,GACxB,KAAK,MAAM,oBAAoB,EAAW,EAAU,EAAQ,EACvE,CACJ,CACA,0BAAM,CAAqB,EAAe,EAAW,EAAc,EAAQ,EAAO,EAAU,EAAU,GAClG,KAAK,2BAA2B,SACX,KAAK,sBAAsB,EAAW,EAAc,EAAQ,GAAjF,MACM,QAAyB,KAAK,MAAM,oBAAoB,EAAW,EAAU,EAAU,GAE7F,OADA,KAAK,0BAA0B,GACvB,GACJ,IAAK,OACD,OAAO,KAAK,MAAM,aAAa,EAAW,EAAU,EAAQ,GAChE,IAAK,QACD,OAAO,KAAK,MAAM,oBAAoB,EAAW,EAAU,EAAQ,GAE/E,CACA,yBAAM,CAAoB,EAAc,GAEpC,cADoB,KAAK,MAAM,oBAAoB,EAAc,EAKrE,CACA,uBAAM,CAAkB,EAAc,GAClC,MAAM,QAAc,KAAK,MAAM,oBAAoB,EAAc,GACjE,OAAK,GACM,IAGf,CACA,2BAAM,CAAsB,EAAW,EAAU,EAAe,EAAc,EAAO,GACjF,MAAM,QAAe,KAAK,MAAM,WAAW,EAAW,GAEtD,GADA,KAAK,kBAAkB,IAClB,EAAO,oBACR,MAAM,IAAI,eAAe,qBAAqB,8BAA+B,qEAEjF,MAAM,EAAY,2BAA2B,eAA2B,kBAA0B,WAAsB,IAElH,EAAmB,yBADE,KAAK,2BAA2B,EAAW,EAAU,KAGhF,aADqB,KAAK,MAAM,wBAAwB,EAAW,EAAU,EAAkB,EAEnG,CACA,8BAAM,CAAyB,EAAO,GAClC,MAAM,QAAqB,KAAK,6BAA6B,GAC7D,IAAK,EACD,MAAM,IAAI,eAAe,qBAAqB,gBAAiB,iBAEnE,MAAM,QAAe,KAAK,MAAM,WAAW,EAAa,UAAW,GAEnE,GADA,KAAK,kBAAkB,IAClB,EAAO,cACR,MAAM,IAAI,eAAe,qBAAqB,uBAAwB,8DAG1E,aADqB,KAAK,MAAM,OAAO,EAAa,UAAW,EAAa,SAAU,EAE1F,CACA,qBAAM,CAAgB,EAAW,EAAc,EAAU,EAAU,EAAe,EAAc,EAAO,GACnG,MAAM,QAAe,KAAK,MAAM,WAAW,EAAW,GAEtD,GADA,KAAK,kBAAkB,IAClB,EAAO,cACR,MAAM,IAAI,eAAe,qBAAqB,uBAAwB,8DAE1E,MAAM,EAAY,2BAA2B,eAA2B,kBAA0B,WAAsB,IAElH,EAAuB,6BADE,KAAK,+BAA+B,EAAW,EAAU,KAElF,QAAe,KAAK,MAAM,SAAS,EAAW,EAAc,EAAU,EAAU,GACtF,GAAI,EAAQ,OACkB,KAAK,MAAM,sBAAsB,EAAW,EAAc,EAAU,EAAsB,EACxH,CACA,OAAO,CACX,CACA,0BAAM,CAAqB,EAAO,EAAU,GACxC,MAAM,QAAqB,KAAK,yBAAyB,GACzD,IAAK,EACD,MAAM,IAAI,eAAe,qBAAqB,gBAAiB,iBAEnE,MAAM,QAAe,KAAK,MAAM,WAAW,EAAa,UAAW,GAEnE,GADA,KAAK,kBAAkB,IAClB,EAAO,oBACR,MAAM,IAAI,eAAe,qBAAqB,8BAA+B,qEAGjF,aADqB,KAAK,MAAM,cAAc,EAAa,UAAW,EAAa,SAAU,EAAU,EAE3G,CACA,8BAAM,CAAyB,GAC3B,MAAM,QAAqB,KAAK,UAAU,GAC1C,OAAK,EAGqB,mBAAtB,EAAa,KACN,KAEJ,EALI,IAMf,CACA,kCAAM,CAA6B,GAC/B,MAAM,QAAqB,KAAK,UAAU,GAC1C,OAAK,EAGqB,uBAAtB,EAAa,KACN,KAEJ,EALI,IAMf,CACA,SAAA,CAAU,GACN,OAAO,IAAI,SAAQ,CAAC,EAAS,KACzB,aAAa,OAAO,EAAK,KAAK,QAAQ,CAAC,EAAK,KAEpC,EADA,EACQ,KAGJ,EAAY,GACtB,GAEV,CACA,2BAAM,CAAsB,EAAW,EAAc,EAAQ,GACzD,MAAM,QAAe,KAAK,MAAM,WAAW,EAAW,GAItD,OAHA,KAAK,kBAAkB,GACvB,KAAK,+BAA+B,EAAQ,GAC5C,KAAK,iCAAiC,EAAQ,GACvC,CACX,CACA,8BAAA,CAA+B,EAAW,EAAU,GAChD,OAAO,aAAa,KAAK,CACrB,YACA,aACA,KAAM,qBACN,YACD,KAAK,OAAQ,CACZ,UAAW,OAEnB,CACA,0BAAA,CAA2B,EAAW,EAAU,GAC5C,OAAO,aAAa,KAAK,CACrB,YACA,aACA,KAAM,iBACN,YACD,KAAK,OAAQ,CACZ,UAAW,OAEnB,CACA,gCAAA,CAAiC,EAAQ,GACrC,GAAsB,IAAlB,EAAO,QAAwF,IAAxE,EAAO,QAAQ,IAA2C,IAArC,EAAO,cAAc,QAAQ,KAAW,OACpF,MAAM,IAAI,eAAe,qBAAqB,iBAAkB,iBAExE,CACA,8BAAA,CAA+B,EAAQ,GACnC,IAA0C,IAAtC,EAAO,aAAa,QAAQ,GAC5B,MAAM,IAAI,eAAe,qBAAqB,uBAAwB,uBAE9E,CACA,qCAAA,CAAsC,EAAQ,GAC1C,GAAI,EAAO,SAAW,EAClB,MAAM,IAAI,eAAe,qBAAqB,wBAAyB,wBAE/E,CACA,iBAAA,CAAkB,GACd,IAAK,EACD,MAAM,IAAI,eAAe,qBAAqB,oBAAqB,oBAE3E,CACA,yBAAA,CAA0B,GACtB,IAAK,EACD,MAAM,IAAI,eAAe,qBAAqB,sBAAuB,sBAE7E,CACA,uBAAA,CAAwB,GACpB,GAAmB,uBAAf,GAAsD,aAAf,EACvC,MAAM,IAAI,eAAe,qBAAqB,qBAAsB,qBAE5E,CACA,0BAAA,CAA2B,GACvB,GAAsB,SAAlB,GAA8C,UAAlB,EAC5B,MAAM,IAAI,eAAe,qBAAqB,wBAAyB,wBAE/E,EAEJ,QAAQ,gBAAkB","file":"/npm/oauth2-framework@2.0.5/dist/index.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.39.0.\n * Original file: /npm/oauth2-framework@2.0.5/dist/index.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","\"use strict\";\r\nObject.defineProperty(exports, \"__esModule\", { value: true });\r\nconst jsonwebtoken = require(\"jsonwebtoken\");\r\nconst oauth2_error_1 = require(\"./models/oauth2-error\");\r\nvar client_1 = require(\"./models/client\");\r\nexports.Client = client_1.Client;\r\nvar token_1 = require(\"./models/token\");\r\nexports.Token = token_1.Token;\r\nvar router_1 = require(\"./router\");\r\nexports.OAuth2FrameworkRouter = router_1.OAuth2FrameworkRouter;\r\nvar oauth2_error_2 = require(\"./models/oauth2-error\");\r\nexports.OAuth2FrameworkError = oauth2_error_2.OAuth2FrameworkError;\r\nclass OAuth2Framework {\r\n    constructor(model, secret) {\r\n        this.model = model;\r\n        this.secret = secret;\r\n    }\r\n    async accessTokenRequest(grant_type, code, redirect_uri, client_id, client_secret, userName, password, scopes, request) {\r\n        this.throwIfInvalidGrantType(grant_type);\r\n        const client = await this.findClientAndValidate(client_id, redirect_uri, scopes, request);\r\n        if (grant_type === 'authorization_code') {\r\n            this.throwIfClientDoesNotMatchClientSecret(client, client_secret);\r\n            const token = await this.model.validateCode(code, request);\r\n            return this.model.generateAccessToken(token.client_id, token.userName, token.scopes, request);\r\n        }\r\n        else if (grant_type === 'password') {\r\n            const validCredentials = await this.model.validateCredentials(client_id, userName, password, request);\r\n            this.throwIfInvalidCredentials(validCredentials);\r\n            return this.model.generateAccessToken(client_id, userName, scopes, request);\r\n        }\r\n    }\r\n    async authorizationRequest(response_type, client_id, redirect_uri, scopes, state, userName, password, request) {\r\n        this.throwIfInvalidResponseType(response_type);\r\n        const client = await this.findClientAndValidate(client_id, redirect_uri, scopes, request);\r\n        const validCredentials = await this.model.validateCredentials(client_id, userName, password, request);\r\n        this.throwIfInvalidCredentials(validCredentials);\r\n        switch (response_type) {\r\n            case 'code':\r\n                return this.model.generateCode(client_id, userName, scopes, request);\r\n            case 'token':\r\n                return this.model.generateAccessToken(client_id, userName, scopes, request);\r\n        }\r\n    }\r\n    async validateAccessToken(access_token, request) {\r\n        const token = await this.model.validateAccessToken(access_token, request);\r\n        if (!token) {\r\n            return false;\r\n        }\r\n        return true;\r\n    }\r\n    async decodeAccessToken(access_token, request) {\r\n        const token = await this.model.validateAccessToken(access_token, request);\r\n        if (!token) {\r\n            return null;\r\n        }\r\n        return token;\r\n    }\r\n    async forgotPasswordRequest(client_id, userName, response_type, redirect_uri, state, request) {\r\n        const client = await this.model.findClient(client_id, request);\r\n        this.throwIfClientNull(client);\r\n        if (!client.allowForgotPassword) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('forgot_password_not_enabled', 'The forgot password functionality is not enabled for this client.');\r\n        }\r\n        const returnUrl = `authorize?response_type=${response_type}&client_id=${client_id}&redirect_uri=${redirect_uri}&state=${state}`;\r\n        const resetPasswordToken = this.generateResetPasswordToken(client_id, userName, returnUrl);\r\n        const resetPasswordUrl = `/reset-password?token=${resetPasswordToken}`;\r\n        const result = await this.model.sendForgotPasswordEmail(client_id, userName, resetPasswordUrl, request);\r\n        return result;\r\n    }\r\n    async emailVerificationRequest(token, request) {\r\n        const decodedToken = await this.decodeEmailVerificationToken(token);\r\n        if (!decodedToken) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_token', 'Invalid token');\r\n        }\r\n        const client = await this.model.findClient(decodedToken.client_id, request);\r\n        this.throwIfClientNull(client);\r\n        if (!client.allowRegister) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('register_not_enabled', 'The register functionality is not enabled for this client.');\r\n        }\r\n        const result = await this.model.verify(decodedToken.client_id, decodedToken.userName, request);\r\n        return result;\r\n    }\r\n    async registerRequest(client_id, emailAddress, userName, password, response_type, redirect_uri, state, request) {\r\n        const client = await this.model.findClient(client_id, request);\r\n        this.throwIfClientNull(client);\r\n        if (!client.allowRegister) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('register_not_enabled', 'The register functionality is not enabled for this client.');\r\n        }\r\n        const returnUrl = `authorize?response_type=${response_type}&client_id=${client_id}&redirect_uri=${redirect_uri}&state=${state}`;\r\n        const emailVerificationToken = this.generateEmailVerificationToken(client_id, userName, returnUrl);\r\n        const emailVerificationUrl = `/email-verification?token=${emailVerificationToken}`;\r\n        const result = await this.model.register(client_id, emailAddress, userName, password, request);\r\n        if (result) {\r\n            const emailResult = await this.model.sendVerificationEmail(client_id, emailAddress, userName, emailVerificationUrl, request);\r\n        }\r\n        return result;\r\n    }\r\n    async resetPasswordRequest(token, password, request) {\r\n        const decodedToken = await this.decodeResetPasswordToken(token);\r\n        if (!decodedToken) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_token', 'Invalid token');\r\n        }\r\n        const client = await this.model.findClient(decodedToken.client_id, request);\r\n        this.throwIfClientNull(client);\r\n        if (!client.allowForgotPassword) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('forgot_password_not_enabled', 'The forgot password functionality is not enabled for this client.');\r\n        }\r\n        const result = await this.model.resetPassword(decodedToken.client_id, decodedToken.userName, password, request);\r\n        return result;\r\n    }\r\n    async decodeResetPasswordToken(token) {\r\n        const decodedToken = await this.decodeJWT(token);\r\n        if (!decodedToken) {\r\n            return null;\r\n        }\r\n        if (decodedToken.type !== 'reset-password') {\r\n            return null;\r\n        }\r\n        return decodedToken;\r\n    }\r\n    async decodeEmailVerificationToken(token) {\r\n        const decodedToken = await this.decodeJWT(token);\r\n        if (!decodedToken) {\r\n            return null;\r\n        }\r\n        if (decodedToken.type !== 'email-verification') {\r\n            return null;\r\n        }\r\n        return decodedToken;\r\n    }\r\n    decodeJWT(jwt) {\r\n        return new Promise((resolve, reject) => {\r\n            jsonwebtoken.verify(jwt, this.secret, (err, decodedCode) => {\r\n                if (err) {\r\n                    resolve(null);\r\n                    return;\r\n                }\r\n                resolve(decodedCode);\r\n            });\r\n        });\r\n    }\r\n    async findClientAndValidate(client_id, redirect_uri, scopes, request) {\r\n        const client = await this.model.findClient(client_id, request);\r\n        this.throwIfClientNull(client);\r\n        this.throwIfClientDoesNotContainUri(client, redirect_uri);\r\n        this.throwIfClientDoesNotContainScope(client, scopes);\r\n        return client;\r\n    }\r\n    generateEmailVerificationToken(client_id, userName, return_url) {\r\n        return jsonwebtoken.sign({\r\n            client_id,\r\n            return_url,\r\n            type: 'email-verification',\r\n            userName,\r\n        }, this.secret, {\r\n            expiresIn: '60m',\r\n        });\r\n    }\r\n    generateResetPasswordToken(client_id, userName, return_url) {\r\n        return jsonwebtoken.sign({\r\n            client_id,\r\n            return_url,\r\n            type: 'reset-password',\r\n            userName,\r\n        }, this.secret, {\r\n            expiresIn: '60m',\r\n        });\r\n    }\r\n    throwIfClientDoesNotContainScope(client, scopes) {\r\n        if (scopes.length !== 0 && scopes.filter((x) => client.allowedScopes.indexOf(x) === -1).length !== 0) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_scopes', 'Invalid scopes');\r\n        }\r\n    }\r\n    throwIfClientDoesNotContainUri(client, uri) {\r\n        if (client.redirectUris.indexOf(uri) === -1) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_redirect_uri', 'Invalid redirect uri');\r\n        }\r\n    }\r\n    throwIfClientDoesNotMatchClientSecret(client, client_secret) {\r\n        if (client.secret !== client_secret) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_client_secret', 'Invalid client secret');\r\n        }\r\n    }\r\n    throwIfClientNull(client) {\r\n        if (!client) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_client_id', 'Invalid client id');\r\n        }\r\n    }\r\n    throwIfInvalidCredentials(validCredentials) {\r\n        if (!validCredentials) {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_credentials', 'Invalid credentials');\r\n        }\r\n    }\r\n    throwIfInvalidGrantType(grant_type) {\r\n        if (grant_type !== 'authorization_code' && grant_type !== 'password') {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_grant_type', 'Invalid grant type');\r\n        }\r\n    }\r\n    throwIfInvalidResponseType(response_type) {\r\n        if (response_type !== 'code' && response_type !== 'token') {\r\n            throw new oauth2_error_1.OAuth2FrameworkError('invalid_response_type', 'Invalid response type');\r\n        }\r\n    }\r\n}\r\nexports.OAuth2Framework = OAuth2Framework;\r\n"]}