{\n const response = await this.postTokenValidateRaw(requestParameters, initOverrides);\n return await response.value();\n }\n\n}\n","function getCenteredWindowParams() {\n const width = 400\n const height = 600\n const left = window.screenX + (window.innerWidth - width) / 2\n const top = window.screenY + (window.innerHeight - height) / 2\n\n return `width=${width},height=${height},top=${top},left=${left},resizable,scrollbars=yes,status=1`\n}\n\n/**\n * Opens a new window using the current URL. This retains the same origin so we have programmatic access\n * to that window's contents. We immediately replace the content of the window with a message.\n *\n * @returns {array} holding references to the new window and a callback that when called with a URL will\n * navigate the window to the new URL and focus the window immediately.\n */\nexport function createPopup(): [Window, (url: string) => Window | null] {\n const windowParams = getCenteredWindowParams()\n const myWindow = window.open(window.location.href, \"/id:popup\", windowParams)\n\n if (!myWindow) {\n // TODO standardise error handling\n throw new Error(\"SlashId: Popup blocked, please consider redirect instead\")\n }\n\n const redirectMessage =\n 'You will be redirected in a moment...
'\n try {\n myWindow?.document?.write(redirectMessage)\n } catch (e) {\n console.error(e)\n if (myWindow.document && myWindow.document.body) {\n myWindow.document.body.innerHTML = redirectMessage\n }\n } finally {\n myWindow.blur()\n }\n\n const setWindowUrl = (url: string) => {\n if (myWindow) {\n myWindow.location = url\n myWindow.focus()\n }\n return myWindow\n }\n\n return [myWindow, setWindowUrl]\n}\n","/**\n * Compare two complete URLs and check if they are the same looking only at the origin and the pathname.\n * This ignores query params and fragments.\n * @param {URL} base\n * @param {URL} comparison\n * @returns {boolean}\n */\nexport function compareURLsByOriginAndPathname(base: URL, comparison: URL): boolean {\n return base.origin + base.pathname === comparison.origin + comparison.pathname\n}\n\n/**\n * Tests if the given string is a valid URL.\n * @param {string} input\n * @returns {boolean}\n */\nexport function isValidHttpUrl(input: string) {\n let url\n try {\n url = new URL(input)\n } catch (_) {\n return false\n }\n\n return url.protocol === \"http:\" || url.protocol === \"https:\"\n}\n","export const ChallengesURLOption = \"challenges\"\nexport const ChallengePackURLOption = \"sidcp\"\nexport const StorageKeyCSRFToken = \"@SLASHID/CSRF_TOKEN\"\nexport const StorageKeyPKCECodeVerifier = \"@SLASHID/PKCE_CODE_VERIFIER\"\nexport const StorageKeyOIDCClientID = \"@SLASHID/OIDC_CLIENT_ID\"\nexport const StorageKeyOIDCRedirectUri = \"@SLASHID/OIDC_REDIRECT_URI\"\n","import * as api from \"../clients/slashid-api/index\"\nimport { SlashIDOptions } from \"./options\"\n\ninterface Message {\n id: number\n}\n\nexport interface RequestMessage extends Message {\n type: MessageType\n}\n\nexport interface ResponseMessage extends Message {\n error: any\n}\n\nexport enum MessageType {\n StorageGetItem = 0,\n StorageSetItem = 1,\n\n Ping = 2,\n\n ChallengeWebauthnCreate = 3,\n ChallengeWebauthnGet = 4,\n\n SSOChallenge = 5,\n}\n\nexport class PingRequestMessage implements RequestMessage {\n id: number = randomId()\n type: MessageType = MessageType.Ping\n}\n\nexport class PingResponseMessage implements ResponseMessage {\n id: number\n error: any\n\n constructor(id: number, error: any = undefined) {\n this.id = id\n this.error = error\n }\n}\n\nexport class WebAuthnCreateRequestMessage implements RequestMessage {\n type = MessageType.ChallengeWebauthnCreate\n id: number\n slashIDOptions: SlashIDOptions\n challenge: api.WebAuthnCreateChallenge\n\n constructor(options: SlashIDOptions, challenge: api.WebAuthnCreateChallenge) {\n this.id = randomId()\n this.slashIDOptions = options\n this.challenge = challenge\n }\n}\n\ntype SSOChallengeMessage = {\n type: MessageType.SSOChallenge\n urlParams: string\n}\n\nexport type MessageEventPayload =\n | WebAuthnCreateRequestMessage\n | WebAuthnGetRequestMessage\n | PingRequestMessage\n | SSOChallengeMessage\n | PingRequestMessage\n\nexport class WebAuthnCreateResponseMessage implements ResponseMessage {\n id: number\n attestation: api.WebAuthnCreateAttestation | null\n error: any\n\n constructor(id: number, attestation: api.WebAuthnCreateAttestation | null, error: any = undefined) {\n this.id = id\n this.attestation = attestation\n this.error = error\n }\n}\nexport class WebAuthnGetRequestMessage implements RequestMessage {\n type = MessageType.ChallengeWebauthnGet\n id: number\n slashIDOptions: SlashIDOptions\n challenge: api.WebAuthnGetChallenge\n\n constructor(options: SlashIDOptions, challenge: api.WebAuthnGetChallenge) {\n this.id = randomId()\n this.slashIDOptions = options\n this.challenge = challenge\n }\n}\n\nexport class WebAuthnGetResponseMessage implements ResponseMessage {\n id: number\n attestation: api.WebAuthnGetAttestation | null\n error: any\n\n constructor(id: number, attestation: api.WebAuthnGetAttestation | null, error: any = undefined) {\n this.id = id\n this.attestation = attestation\n this.error = error\n }\n}\n\nexport class GetItemRequestMessage implements RequestMessage {\n type: MessageType = MessageType.StorageGetItem\n id: number = randomId()\n\n // Storage.getItem args\n key: string\n\n constructor(key: string) {\n this.key = key\n }\n}\n\nexport class GetItemResponseMessage implements ResponseMessage {\n id: number\n error: any\n\n // Storage.getItem returns\n value: string | null\n\n constructor(id: number, value: string | null, error: any = undefined) {\n this.id = id\n this.value = value\n this.error = error\n }\n}\n\nexport class SetItemRequestMessage implements RequestMessage {\n id: number = randomId()\n type: MessageType = MessageType.StorageSetItem\n\n // Storage.setItem args\n key: string\n value: string\n\n constructor(key: string, value: string) {\n this.key = key\n this.value = value\n }\n}\n\nexport class SetItemResponseMessage implements ResponseMessage {\n id: number\n error: any\n\n constructor(id: number, error: any = undefined) {\n this.id = id\n this.error = error\n }\n}\n\nfunction randomId(): number {\n const rndArray = new Uint32Array(1)\n window.crypto.getRandomValues(rndArray)\n return rndArray[0]\n}\n\nexport type SSOChallengeParams = {\n ssoChallengeID: string\n ssoCode: string\n csrfToken: string\n}\n\nexport function getSSOChallengeFromURL(queryString: string): SSOChallengeParams | null {\n const urlParams = new URLSearchParams(queryString)\n const ssoChallengeID = urlParams.get(\"sso_challenge_id\")\n const ssoCode = urlParams.get(\"sso_code\")\n const csrfToken = urlParams.get(\"csrf_token\")\n\n if (!ssoChallengeID || !ssoCode || !csrfToken) {\n return null\n }\n\n return { ssoChallengeID, ssoCode, csrfToken }\n}\n\nexport function isWebAuthnCreateRequestMessage(message: MessageEventPayload): message is WebAuthnCreateRequestMessage {\n return message.type === MessageType.ChallengeWebauthnCreate\n}\n\nexport function isWebAuthnGetRequestMessage(message: MessageEventPayload): message is WebAuthnGetRequestMessage {\n return message.type === MessageType.ChallengeWebauthnGet\n}\n\nexport function isSSOChallengeMessage(message: MessageEventPayload): message is SSOChallengeMessage {\n return message && message.type === MessageType.SSOChallenge\n}\n\nexport function isPingMessage(message: MessageEventPayload): message is PingRequestMessage {\n return message.type === MessageType.Ping\n}\n","// Unique ID creation requires a high quality random # generator. In the browser we therefore\n// require the crypto API and do not support built-in fallback to lower quality random number\n// generators (like Math.random()).\nvar getRandomValues;\nvar rnds8 = new Uint8Array(16);\nexport default function rng() {\n // lazy load so that environments that need to polyfill have a chance to do so\n if (!getRandomValues) {\n // getRandomValues needs to be invoked in a context where \"this\" is a Crypto implementation. Also,\n // find the complete implementation of crypto (msCrypto) on IE11.\n getRandomValues = typeof crypto !== 'undefined' && crypto.getRandomValues && crypto.getRandomValues.bind(crypto) || typeof msCrypto !== 'undefined' && typeof msCrypto.getRandomValues === 'function' && msCrypto.getRandomValues.bind(msCrypto);\n\n if (!getRandomValues) {\n throw new Error('crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported');\n }\n }\n\n return getRandomValues(rnds8);\n}","import * as api from \"../clients/slashid-api/index\"\nimport { OTPMethodOptions, TOTPMethodOptions } from \"./options\"\n\n// Union of string values of the api.FactorMethod enum\ntype FactorMethodValues = `${Exclude}`\n\n// Map from the string values above to method option types\nclass FactorMethodOptionsTypeMap implements Record {\n \"webauthn\": api.WebAuthnMethodOptions\n \"oidc\": api.OIDCMethodOptions\n \"saml\": api.SAMLMethodOptions\n \"password\": never\n\n \"otp_via_sms\": OTPMethodOptions | undefined\n \"otp_via_email\": OTPMethodOptions | undefined\n\n \"totp\": TOTPMethodOptions | undefined\n\n \"email_link\": never\n \"sms_link\": never\n}\n\n// Make Factor a union of objects of the form\n// { method: X, options: [option type for X from FactorMethodOptionsTypeMap] }\ntype FactorTypeHelper = {\n [K in keyof T]: {\n method: K\n options?: Omit\n }\n}\n\n// Convenient for autocompletion - this type is more accurate when compared to api.FactorMethod\nexport type FactorMethod = keyof FactorMethodOptionsTypeMap\nexport type Factor = FactorTypeHelper[keyof FactorTypeHelper]\n\nexport type PopupExtras = {\n setPopupUrl?: (url: string) => Window | null\n popup?: Window\n}\n\nexport type OIDCWithExtras = {\n method: \"oidc\"\n options: Omit\n extras: PopupExtras\n}\n\nexport type SAMLWithExtras = {\n method: \"saml\"\n options: Omit\n extras: PopupExtras\n}\n\nexport type UserTokenText = string\nexport type TokenContainerText = string\nexport type OrganizationID = string\n\n// Used to type anything that can be serialized to JSON. Do not return directly - rather specify an interface that extends this\nexport type JsonObject = { [Key in string]: JsonValue } & { [Key in string]?: JsonValue | undefined }\nexport type JsonArray = JsonValue[] | readonly JsonValue[]\nexport type JsonPrimitive = string | number | boolean | null\nexport type JsonValue = JsonPrimitive | JsonObject | JsonArray\n\n/**\n * SlashID production environment name. Uses the following default values:\n *\n * const baseURL = \"https://api.slashid.com\"\n * const sdkURL = \"https://cdn.slashid.com/sdk.html\"\n */\nexport type ProductionEnvironment = \"production\"\n\n/**\n * SlashID sandbox environment name. Uses the following default values:\n *\n * const baseURL = \"https://api.sandbox.slashid.com\"\n * const sdkURL = \"https://cdn.sandbox.slashid.com/sdk.html\"\n */\nexport type SandboxEnvironment = \"sandbox\"\n\n/**\n * SlashID custom environment name. Values must be provided for baseURL and sdkURL.\n */\nexport type CustomEnvironment = {\n // API base URL\n baseURL: string\n // URL where the SDK is served\n sdkURL: string\n}\n\nexport function isCustomEnvironment(environment: SlashIDEnvironment): environment is CustomEnvironment {\n return typeof environment === \"object\" && Boolean(environment.baseURL) && Boolean(environment.sdkURL)\n}\n\nexport type SlashIDEnvironment = ProductionEnvironment | SandboxEnvironment | CustomEnvironment\n\n// TODO enhance this\nexport type UICustomization = {\n [key: string]: any\n}\n\nexport type ReachablePersonHandle = api.PersonHandle & { type: \"email_address\" | \"phone_number\" }\nexport type ReachablePersonHandleType = ReachablePersonHandle[\"type\"]\n\nexport function isReachablePersonHandleType(handleType: api.PersonHandleType): handleType is ReachablePersonHandleType {\n return handleType === \"email_address\" || handleType === \"phone_number\"\n}\n","export default /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;","import validate from './validate.js';\n/**\n * Convert array of 16 byte values to UUID string format of the form:\n * XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX\n */\n\nvar byteToHex = [];\n\nfor (var i = 0; i < 256; ++i) {\n byteToHex.push((i + 0x100).toString(16).substr(1));\n}\n\nfunction stringify(arr) {\n var offset = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;\n // Note: Be careful editing this code! It's been tuned for performance\n // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434\n var uuid = (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + '-' + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + '-' + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + '-' + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + '-' + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); // Consistency check for valid UUID. If this throws, it's likely due to one\n // of the following:\n // - One or more input array values don't map to a hex octet (leading to\n // \"undefined\" in the uuid)\n // - Invalid input values for the RFC `version` or `variant` fields\n\n if (!validate(uuid)) {\n throw TypeError('Stringified UUID is invalid');\n }\n\n return uuid;\n}\n\nexport default stringify;","import REGEX from './regex.js';\n\nfunction validate(uuid) {\n return typeof uuid === 'string' && REGEX.test(uuid);\n}\n\nexport default validate;","import rng from './rng.js';\nimport stringify from './stringify.js';\n\nfunction v4(options, buf, offset) {\n options = options || {};\n var rnds = options.random || (options.rng || rng)(); // Per 4.4, set bits for version and `clock_seq_hi_and_reserved`\n\n rnds[6] = rnds[6] & 0x0f | 0x40;\n rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided\n\n if (buf) {\n offset = offset || 0;\n\n for (var i = 0; i < 16; ++i) {\n buf[offset + i] = rnds[i];\n }\n\n return buf;\n }\n\n return stringify(rnds);\n}\n\nexport default v4;","/**\n * @ignore\n *\n * @param str Base64 string with URL-safe alphabet as described\n * in https://datatracker.ietf.org/doc/html/rfc4648#section-5, either\n * padded or unpadded.\n * @returns typed array of the decoded data\n */\nexport function decode(str: string): Uint8Array {\n const urlEncodedStr = str.replace(/_/g, \"/\").replace(/-/g, \"+\")\n const binStr = atob(urlEncodedStr)\n return Uint8Array.from(binStr, (c) => c.charCodeAt(0))\n}\n\n/**\n * @ignore\n *\n * @param data data to Base64-encode\n * @param urlSafe if false\n * @returns Base64-encoded string with URL-safe alphabet as described\n * in https://datatracker.ietf.org/doc/html/rfc4648#section-5, unpadded\n * as to make it safe to include in URLs without further processing.\n */\nexport function encode(data: Uint8Array, urlSafe: boolean = true): string {\n const binStr = String.fromCharCode(...data)\n const str = btoa(binStr)\n if (urlSafe) {\n return str.replace(/\\//g, \"_\").replace(/\\+/g, \"-\").replace(/=/g, \"\")\n } else {\n return str\n }\n}\n","import { v4 as uuid } from \"uuid\"\nimport * as base64 from \"../utils/base64\"\nimport {\n StorageKeyCSRFToken,\n StorageKeyOIDCClientID,\n StorageKeyOIDCRedirectUri,\n StorageKeyPKCECodeVerifier,\n} from \"./constants\"\n\nexport type LogInWithOAuthParams = {\n clientId: string\n redirectUri: string\n}\n\nexport function prepareRedirectFlow(params: LogInWithOAuthParams) {\n // set up the client ID and redirect URI in the session storage\n window.sessionStorage.setItem(StorageKeyOIDCClientID, params.clientId)\n window.sessionStorage.setItem(StorageKeyOIDCRedirectUri, params.redirectUri)\n}\n\nexport function getRedirectFlowParams(): LogInWithOAuthParams {\n const clientId = window.sessionStorage.getItem(StorageKeyOIDCClientID)\n const redirectUri = window.sessionStorage.getItem(StorageKeyOIDCRedirectUri)\n\n if (!clientId || !redirectUri) {\n // TODO make this a SlashID error\n throw new Error(\"Client ID or redirect URI not found in session storage\")\n }\n\n return { clientId, redirectUri }\n}\n\nexport function cleanUpRedirectFlow() {\n window.sessionStorage.removeItem(StorageKeyOIDCClientID)\n window.sessionStorage.removeItem(StorageKeyOIDCRedirectUri)\n}\n\n/**\n * Prepare a CSRF token and PKCE code challenge for use in the OAuth 2.0 authorization code flow.\n * This is required for public clients (e.g. single-page applications).\n */\nexport async function prepareCSRFToken() {\n const csrf_token = uuid()\n const pkce_code_verifier = uuid() + uuid() // recommended increased entropy\n const data = new TextEncoder().encode(pkce_code_verifier)\n const hash = await window.crypto.subtle.digest(\"SHA-256\", data)\n const pkce_code_challenge = base64.encode(new Uint8Array(hash))\n\n // TODO side effect, consider moving outside\n window.localStorage.setItem(StorageKeyCSRFToken, csrf_token)\n window.localStorage.setItem(StorageKeyPKCECodeVerifier, pkce_code_verifier)\n\n return { csrf_token, pkce_code_challenge }\n}\n\nexport type OAuthParams = {\n ssoCode: string\n csrfToken: string\n}\n\nexport function getOAuthParams(queryString: string) {\n const urlParams = new URLSearchParams(queryString)\n const ssoCode = urlParams.get(\"code\")\n // TODO this is specific to our flow\n const csrfToken = urlParams.get(\"state\")\n\n if (!ssoCode || !csrfToken) {\n return null\n }\n\n return { ssoCode, csrfToken }\n}\n\nexport type ObtainAccessTokenInput = LogInWithOAuthParams &\n OAuthParams & {\n apiBaseURL: string\n }\n\ntype PostOauth2TokensResponse = {\n access_token: string\n id_token: string\n token_type: string\n expires_in: number\n refresh_token: string\n scope: string\n}\n\n/**\n * Obtain the access token with the OAuth 2.0 authorization code flow.\n * Ensure security through PKCE (Proof Key for Code Exchange) and CSRF tokens.\n * CSRF goes through the state param.\n */\nexport async function obtainAccessToken(input: ObtainAccessTokenInput): Promise