{"version":3,"sources":["meteor://💻app/packages/oauth/oauth_server.js","meteor://💻app/packages/oauth/pending_credentials.js","meteor://💻app/packages/oauth/oauth_common.js"],"names":["bodyParser","module","link","default","v","OAuth","OAuthTest","RoutePolicy","declare","registeredServices","_requestHandlers","registerService","name","version","urls","handleOauthRequest","Error","serviceName","unregisterService","retrieveCredential","credentialToken","credentialSecret","_retrievePendingCredential","_generateState","loginStyle","redirectUrl","Buffer","from","JSON","stringify","toString","_stateFromQuery","query","string","state","e","Log","warn","parse","_loginStyleFromQuery","style","err","_credentialTokenFromQuery","_isCordovaFromQuery","isCordova","_checkRedirectUrlOrigin","appHost","Meteor","absoluteUrl","appHostReplacedLocalhost","undefined","replaceLocalhost","substr","length","middleware","req","res","next","requestData","oauthServiceName","service","ensureConfigured","handler","method","body","_storePendingCredential","stack","message","_endOfLoginResponse","error","WebApp","connectHandlers","use","json","urlencoded","extended","i","url","indexOf","barePath","substring","splitPath","split","ServiceConfiguration","configurations","findOne","ConfigError","isSafe","value","test","_renderOauthResults","only_credential_secret_for_test","writeHead","end","details","token","secret","credentials","_endOfPopupResponseTemplate","Assets","getText","_endOfRedirectResponseTemplate","renderEndOfLoginResponse","options","escape","s","replace","config","setCredentialToken","storagePrefix","_storageTokenPrefix","template","result","__meteor_runtime_config__","ROOT_URL_PATH_PREFIX","settings","packages","oauth","disableCheckRedirectUrlOrigin","OAuthEncryption","Package","usingOAuthEncryption","keyIsLoaded","sealSecret","plaintext","seal","openSecret","maybeSecret","userId","isSealed","open","openSecrets","serviceData","Object","keys","forEach","key","_pendingCredentials","Mongo","Collection","_preventAutopublish","createIndex","unique","_cleanStaleResults","timeCutoff","Date","setMinutes","getMinutes","remove","createdAt","$lt","_cleanupHandle","setInterval","credential","check","String","Match","Maybe","storableError","upsert","pendingCredential","_id","recreateError","plainObject","getOwnPropertyNames","errorDoc","meteorError","_objectSpread","_redirectUri","params","absoluteUrlOptions","isAndroid","cordova","android","isServer","Npm","require","rootUrl","process","env","MOBILE_ROOT_URL","ROOT_URL","parsedRootUrl","hostname","host","format","URL","_constructUrl"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAIA,UAAJ;AAAeC,MAAM,CAACC,IAAP,CAAY,aAAZ,EAA0B;AAACC,SAAO,CAACC,CAAD,EAAG;AAACJ,cAAU,GAACI,CAAX;AAAa;;AAAzB,CAA1B,EAAqD,CAArD;AAEfC,KAAK,GAAG,EAAR;AACAC,SAAS,GAAG,EAAZ;AAEAC,WAAW,CAACC,OAAZ,CAAoB,UAApB,EAAgC,SAAhC;AAEA,MAAMC,kBAAkB,GAAG,EAA3B,C,CAEA;AACA;AACA;;AACAJ,KAAK,CAACK,gBAAN,GAAyB,EAAzB;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACAL,KAAK,CAACM,eAAN,GAAwB,CAACC,IAAD,EAAOC,OAAP,EAAgBC,IAAhB,EAAsBC,kBAAtB,KAA6C;AACnE,MAAIN,kBAAkB,CAACG,IAAD,CAAtB,EACE,MAAM,IAAII,KAAJ,kCAAoCJ,IAApC,oBAAN;AAEFH,oBAAkB,CAACG,IAAD,CAAlB,GAA2B;AACzBK,eAAW,EAAEL,IADY;AAEzBC,WAFyB;AAGzBC,QAHyB;AAIzBC;AAJyB,GAA3B;AAMD,CAVD,C,CAYA;;;AACAT,SAAS,CAACY,iBAAV,GAA8BN,IAAI,IAAI;AACpC,SAAOH,kBAAkB,CAACG,IAAD,CAAzB;AACD,CAFD;;AAKAP,KAAK,CAACc,kBAAN,GAA2B,CAACC,eAAD,EAAkBC,gBAAlB,KACzBhB,KAAK,CAACiB,0BAAN,CAAiCF,eAAjC,EAAkDC,gBAAlD,CADF,C,CAIA;AACA;AACA;;;AACAhB,KAAK,CAACkB,cAAN,GAAuB,CAACC,UAAD,EAAaJ,eAAb,EAA8BK,WAA9B,KAA8C;AACnE,SAAOC,MAAM,CAACC,IAAP,CAAYC,IAAI,CAACC,SAAL,CAAe;AAChCL,cAAU,EAAEA,UADoB;AAEhCJ,mBAAe,EAAEA,eAFe;AAGhCK,eAAW,EAAEA;AAHmB,GAAf,CAAZ,EAGuBK,QAHvB,CAGgC,QAHhC,CAAP;AAID,CALD;;AAOAzB,KAAK,CAAC0B,eAAN,GAAwBC,KAAK,IAAI;AAC/B,MAAIC,MAAJ;;AACA,MAAI;AACFA,UAAM,GAAGP,MAAM,CAACC,IAAP,CAAYK,KAAK,CAACE,KAAlB,EAAyB,QAAzB,EAAmCJ,QAAnC,CAA4C,QAA5C,CAAT;AACD,GAFD,CAEE,OAAOK,CAAP,EAAU;AACVC,OAAG,CAACC,IAAJ,2DAA4DL,KAAK,CAACE,KAAlE;AACA,UAAMC,CAAN;AACD;;AAED,MAAI;AACF,WAAOP,IAAI,CAACU,KAAL,CAAWL,MAAX,CAAP;AACD,GAFD,CAEE,OAAOE,CAAP,EAAU;AACVC,OAAG,CAACC,IAAJ,mDAAoDJ,MAApD;AACA,UAAME,CAAN;AACD;AACF,CAfD;;AAiBA9B,KAAK,CAACkC,oBAAN,GAA6BP,KAAK,IAAI;AACpC,MAAIQ,KAAJ,CADoC,CAEpC;AACA;AACA;;AACA,MAAI;AACFA,SAAK,GAAGnC,KAAK,CAAC0B,eAAN,CAAsBC,KAAtB,EAA6BR,UAArC;AACD,GAFD,CAEE,OAAOiB,GAAP,EAAY;AACZD,SAAK,GAAG,OAAR;AACD;;AACD,MAAIA,KAAK,KAAK,OAAV,IAAqBA,KAAK,KAAK,UAAnC,EAA+C;AAC7C,UAAM,IAAIxB,KAAJ,qCAAuCwB,KAAvC,EAAN;AACD;;AACD,SAAOA,KAAP;AACD,CAdD;;AAgBAnC,KAAK,CAACqC,yBAAN,GAAkCV,KAAK,IAAI;AACzC,MAAIE,KAAJ,CADyC,CAEzC;AACA;AACA;AACA;;AACA,MAAI;AACFA,SAAK,GAAG7B,KAAK,CAAC0B,eAAN,CAAsBC,KAAtB,CAAR;AACD,GAFD,CAEE,OAAOS,GAAP,EAAY;AACZ,WAAOT,KAAK,CAACE,KAAb;AACD;;AACD,SAAOA,KAAK,CAACd,eAAb;AACD,CAZD;;AAcAf,KAAK,CAACsC,mBAAN,GAA4BX,KAAK,IAAI;AACnC,MAAI;AACF,WAAO,CAAC,CAAE3B,KAAK,CAAC0B,eAAN,CAAsBC,KAAtB,EAA6BY,SAAvC;AACD,GAFD,CAEE,OAAOH,GAAP,EAAY;AACZ;AACA;AACA;AACA;AACA,WAAO,KAAP;AACD;AACF,CAVD,C,CAYA;AACA;AACA;AACA;;;AACApC,KAAK,CAACwC,uBAAN,GAAgCpB,WAAW,IAAI;AAC7C,QAAMqB,OAAO,GAAGC,MAAM,CAACC,WAAP,EAAhB;AACA,QAAMC,wBAAwB,GAAGF,MAAM,CAACC,WAAP,CAAmBE,SAAnB,EAA8B;AAC7DC,oBAAgB,EAAE;AAD2C,GAA9B,CAAjC;AAGA,SACE1B,WAAW,CAAC2B,MAAZ,CAAmB,CAAnB,EAAsBN,OAAO,CAACO,MAA9B,MAA0CP,OAA1C,IACArB,WAAW,CAAC2B,MAAZ,CAAmB,CAAnB,EAAsBH,wBAAwB,CAACI,MAA/C,MAA2DJ,wBAF7D;AAID,CATD;;AAWA,MAAMK,UAAU,GAAG,CAACC,GAAD,EAAMC,GAAN,EAAWC,IAAX,KAAoB;AACrC,MAAIC,WAAJ,CADqC,CAGrC;AACA;;AACA,MAAI;AACF,UAAMzC,WAAW,GAAG0C,gBAAgB,CAACJ,GAAD,CAApC;;AACA,QAAI,CAACtC,WAAL,EAAkB;AAChB;AACAwC,UAAI;AACJ;AACD;;AAED,UAAMG,OAAO,GAAGnD,kBAAkB,CAACQ,WAAD,CAAlC,CARE,CAUF;;AACA,QAAI,CAAC2C,OAAL,EACE,MAAM,IAAI5C,KAAJ,oCAAsCC,WAAtC,EAAN,CAZA,CAcF;;AACA4C,oBAAgB,CAAC5C,WAAD,CAAhB;AAEA,UAAM6C,OAAO,GAAGzD,KAAK,CAACK,gBAAN,CAAuBkD,OAAO,CAAC/C,OAA/B,CAAhB;AACA,QAAI,CAACiD,OAAL,EACE,MAAM,IAAI9C,KAAJ,oCAAsC4C,OAAO,CAAC/C,OAA9C,EAAN;;AAEF,QAAI0C,GAAG,CAACQ,MAAJ,KAAe,KAAnB,EAA0B;AACxBL,iBAAW,GAAGH,GAAG,CAACvB,KAAlB;AACD,KAFD,MAEO;AACL0B,iBAAW,GAAGH,GAAG,CAACS,IAAlB;AACD;;AAEDF,WAAO,CAACF,OAAD,EAAUF,WAAV,EAAuBF,GAAvB,CAAP;AACD,GA5BD,CA4BE,OAAOf,GAAP,EAAY;AAAA;;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,QAAI,gBAAAiB,WAAW,UAAX,4CAAaxB,KAAb,IAAsBO,GAAG,YAAYzB,KAAzC,EAAgD;AAC9C,UAAI;AAAE;AACJX,aAAK,CAAC4D,uBAAN,CAA8B5D,KAAK,CAACqC,yBAAN,CAAgCgB,WAAhC,CAA9B,EAA4EjB,GAA5E;AACD,OAFD,CAEE,OAAOA,GAAP,EAAY;AACZ;AACA;AACAL,WAAG,CAACC,IAAJ,CAAS,gEACAI,GAAG,CAACyB,KADJ,IACazB,GAAG,CAAC0B,OAD1B;AAED;AACF,KAjBW,CAmBZ;AACA;AACA;AACA;;;AACA,QAAI;AACF9D,WAAK,CAAC+D,mBAAN,CAA0BZ,GAA1B,EAA+B;AAC7BxB,aAAK,EAAE0B,WADsB;AAE7BlC,kBAAU,EAAEnB,KAAK,CAACkC,oBAAN,CAA2BmB,WAA3B,CAFiB;AAG7BW,aAAK,EAAE5B;AAHsB,OAA/B;AAKD,KAND,CAME,OAAOA,GAAP,EAAY;AACZL,SAAG,CAACC,IAAJ,CAAS,8CACCI,GAAG,KAAKA,GAAG,CAACyB,KAAJ,IAAazB,GAAG,CAAC0B,OAAtB,CADJ,CAAT;AAED;AACF;AACF,CAnED,C,CAqEA;;;AACAG,MAAM,CAACC,eAAP,CAAuBC,GAAvB,CAA2B,SAA3B,EAAsCxE,UAAU,CAACyE,IAAX,EAAtC;AACAH,MAAM,CAACC,eAAP,CAAuBC,GAAvB,CAA2B,SAA3B,EAAsCxE,UAAU,CAAC0E,UAAX,CAAsB;AAAEC,UAAQ,EAAE;AAAZ,CAAtB,CAAtC;AACAL,MAAM,CAACC,eAAP,CAAuBC,GAAvB,CAA2BlB,UAA3B;AAEAhD,SAAS,CAACgD,UAAV,GAAuBA,UAAvB,C,CAEA;AACA;AACA;AACA;;AACA,MAAMK,gBAAgB,GAAGJ,GAAG,IAAI;AAC9B;AACA,QAAMqB,CAAC,GAAGrB,GAAG,CAACsB,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,CAAV;AACA,MAAIC,QAAJ;AACA,MAAIH,CAAC,KAAK,CAAC,CAAX,EACEG,QAAQ,GAAGxB,GAAG,CAACsB,GAAf,CADF,KAGEE,QAAQ,GAAGxB,GAAG,CAACsB,GAAJ,CAAQG,SAAR,CAAkB,CAAlB,EAAqBJ,CAArB,CAAX;AACF,QAAMK,SAAS,GAAGF,QAAQ,CAACG,KAAT,CAAe,GAAf,CAAlB,CAR8B,CAU9B;AACA;;AACA,MAAID,SAAS,CAAC,CAAD,CAAT,KAAiB,QAArB,EACE,OAAO,IAAP,CAb4B,CAe9B;;AACA,QAAMhE,WAAW,GAAGgE,SAAS,CAAC,CAAD,CAA7B;AACA,SAAOhE,WAAP;AACD,CAlBD,C,CAoBA;;;AACA,MAAM4C,gBAAgB,GAAG5C,WAAW,IAAI;AACtC,MAAI,CAACkE,oBAAoB,CAACC,cAArB,CAAoCC,OAApC,CAA4C;AAACzB,WAAO,EAAE3C;AAAV,GAA5C,CAAL,EAA0E;AACxE,UAAM,IAAIkE,oBAAoB,CAACG,WAAzB,EAAN;AACD;AACF,CAJD;;AAMA,MAAMC,MAAM,GAAGC,KAAK,IAAI;AACtB;AACA;AACA,SAAO,OAAOA,KAAP,KAAiB,QAAjB,IACL,oBAAoBC,IAApB,CAAyBD,KAAzB,CADF;AAED,CALD,C,CAOA;;;AACAnF,KAAK,CAACqF,mBAAN,GAA4B,CAAClC,GAAD,EAAMxB,KAAN,EAAaX,gBAAb,KAAkC;AAC5D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA,MAAIW,KAAK,CAAC2D,+BAAV,EAA2C;AACzCnC,OAAG,CAACoC,SAAJ,CAAc,GAAd,EAAmB;AAAC,sBAAgB;AAAjB,KAAnB;AACApC,OAAG,CAACqC,GAAJ,CAAQxE,gBAAR,EAA0B,OAA1B;AACD,GAHD,MAGO;AACL,UAAMyE,OAAO,GAAG;AACd9D,WADc;AAEdR,gBAAU,EAAEnB,KAAK,CAACkC,oBAAN,CAA2BP,KAA3B;AAFE,KAAhB;;AAIA,QAAIA,KAAK,CAACqC,KAAV,EAAiB;AACfyB,aAAO,CAACzB,KAAR,GAAgBrC,KAAK,CAACqC,KAAtB;AACD,KAFD,MAEO;AACL,YAAM0B,KAAK,GAAG1F,KAAK,CAACqC,yBAAN,CAAgCV,KAAhC,CAAd;;AACA,YAAMgE,MAAM,GAAG3E,gBAAf;;AACA,UAAI0E,KAAK,IAAIC,MAAT,IACAT,MAAM,CAACQ,KAAD,CADN,IACiBR,MAAM,CAACS,MAAD,CAD3B,EACqC;AACnCF,eAAO,CAACG,WAAR,GAAsB;AAAEF,eAAK,EAAEA,KAAT;AAAgBC,gBAAM,EAAEA;AAAxB,SAAtB;AACD,OAHD,MAGO;AACLF,eAAO,CAACzB,KAAR,GAAgB,oCAAhB;AACD;AACF;;AAEDhE,SAAK,CAAC+D,mBAAN,CAA0BZ,GAA1B,EAA+BsC,OAA/B;AACD;AACF,CAjCD,C,CAmCA;AACA;AACA;;;AACAzF,KAAK,CAAC6F,2BAAN,GAAoCC,MAAM,CAACC,OAAP,CAClC,4BADkC,CAApC;AAGA/F,KAAK,CAACgG,8BAAN,GAAuCF,MAAM,CAACC,OAAP,CACrC,+BADqC,CAAvC,C,CAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA,MAAME,wBAAwB,GAAGC,OAAO,IAAI;AAC1C;AACA;AACA;AACA;AAEA,QAAMC,MAAM,GAAGC,CAAC,IAAI;AAClB,QAAIA,CAAJ,EAAO;AACL,aAAOA,CAAC,CAACC,OAAF,CAAU,IAAV,EAAgB,OAAhB,EACLA,OADK,CACG,IADH,EACS,MADT,EAELA,OAFK,CAEG,IAFH,EAES,MAFT,EAGLA,OAHK,CAGG,KAHH,EAGU,QAHV,EAILA,OAJK,CAIG,KAJH,EAIU,QAJV,EAKLA,OALK,CAKG,KALH,EAKU,QALV,CAAP;AAMD,KAPD,MAOO;AACL,aAAOD,CAAP;AACD;AACF,GAXD,CAN0C,CAmB1C;AACA;;;AACA,QAAME,MAAM,GAAG;AACbC,sBAAkB,EAAE,CAAC,CAAEL,OAAO,CAACK,kBADlB;AAEbxF,mBAAe,EAAEoF,MAAM,CAACD,OAAO,CAACnF,eAAT,CAFV;AAGbC,oBAAgB,EAAEmF,MAAM,CAACD,OAAO,CAAClF,gBAAT,CAHX;AAIbwF,iBAAa,EAAEL,MAAM,CAACnG,KAAK,CAACyG,mBAAP,CAJR;AAKbrF,eAAW,EAAE+E,MAAM,CAACD,OAAO,CAAC9E,WAAT,CALN;AAMbmB,aAAS,EAAE,CAAC,CAAE2D,OAAO,CAAC3D;AANT,GAAf;AASA,MAAImE,QAAJ;;AACA,MAAIR,OAAO,CAAC/E,UAAR,KAAuB,OAA3B,EAAoC;AAClCuF,YAAQ,GAAG1G,KAAK,CAAC6F,2BAAjB;AACD,GAFD,MAEO,IAAIK,OAAO,CAAC/E,UAAR,KAAuB,UAA3B,EAAuC;AAC5CuF,YAAQ,GAAG1G,KAAK,CAACgG,8BAAjB;AACD,GAFM,MAEA;AACL,UAAM,IAAIrF,KAAJ,+BAAiCuF,OAAO,CAAC/E,UAAzC,EAAN;AACD;;AAED,QAAMwF,MAAM,GAAGD,QAAQ,CAACL,OAAT,CAAiB,YAAjB,EAA+B9E,IAAI,CAACC,SAAL,CAAe8E,MAAf,CAA/B,EACZD,OADY,CAEX,0BAFW,EAEiBO,yBAAyB,CAACC,oBAF3C,CAAf;AAKA,oCAA2BF,MAA3B;AACD,CA7CD,C,CA+CA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AACA3G,KAAK,CAAC+D,mBAAN,GAA4B,CAACZ,GAAD,EAAMsC,OAAN,KAAkB;AAC5CtC,KAAG,CAACoC,SAAJ,CAAc,GAAd,EAAmB;AAAC,oBAAgB;AAAjB,GAAnB;AAEA,MAAInE,WAAJ;;AACA,MAAIqE,OAAO,CAACtE,UAAR,KAAuB,UAA3B,EAAuC;AAAA;;AACrCC,eAAW,GAAGpB,KAAK,CAAC0B,eAAN,CAAsB+D,OAAO,CAAC9D,KAA9B,EAAqCP,WAAnD;AACA,UAAMqB,OAAO,GAAGC,MAAM,CAACC,WAAP,EAAhB;;AACA,QACE,sBAACD,MAAM,CAACoE,QAAR,sEAAC,iBAAiBC,QAAlB,4EAAC,sBAA2BC,KAA5B,mDAAC,uBAAkCC,6BAAnC,KACAjH,KAAK,CAACwC,uBAAN,CAA8BpB,WAA9B,CAFF,EAE8C;AAC5CqE,aAAO,CAACzB,KAAR,GAAgB,uBAAgB5C,WAAhB,oDAC2BqB,OAD3B,MAAhB;AAEArB,iBAAW,GAAGqB,OAAd;AACD;AACF;;AAED,QAAMF,SAAS,GAAGvC,KAAK,CAACsC,mBAAN,CAA0BmD,OAAO,CAAC9D,KAAlC,CAAlB;;AAEA,MAAI8D,OAAO,CAACzB,KAAZ,EAAmB;AACjBjC,OAAG,CAACC,IAAJ,CAAS,6BACCyD,OAAO,CAACzB,KAAR,YAAyBrD,KAAzB,GACA8E,OAAO,CAACzB,KAAR,CAAcF,OADd,GACwB2B,OAAO,CAACzB,KAFjC,CAAT;AAGAb,OAAG,CAACqC,GAAJ,CAAQS,wBAAwB,CAAC;AAC/B9E,gBAAU,EAAEsE,OAAO,CAACtE,UADW;AAE/BoF,wBAAkB,EAAE,KAFW;AAG/BnF,iBAH+B;AAI/BmB;AAJ+B,KAAD,CAAhC,EAKI,OALJ;AAMA;AACD,GA7B2C,CA+B5C;AACA;AACA;;;AACAY,KAAG,CAACqC,GAAJ,CAAQS,wBAAwB,CAAC;AAC/B9E,cAAU,EAAEsE,OAAO,CAACtE,UADW;AAE/BoF,sBAAkB,EAAE,IAFW;AAG/BxF,mBAAe,EAAE0E,OAAO,CAACG,WAAR,CAAoBF,KAHN;AAI/B1E,oBAAgB,EAAEyE,OAAO,CAACG,WAAR,CAAoBD,MAJP;AAK/BvE,eAL+B;AAM/BmB;AAN+B,GAAD,CAAhC,EAOI,OAPJ;AAQD,CA1CD;;AA6CA,MAAM2E,eAAe,GAAGC,OAAO,CAAC,kBAAD,CAAP,IAA+BA,OAAO,CAAC,kBAAD,CAAP,CAA4BD,eAAnF;;AAEA,MAAME,oBAAoB,GAAG,MAC3BF,eAAe,IAAIA,eAAe,CAACG,WAAhB,EADrB,C,CAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AACArH,KAAK,CAACsH,UAAN,GAAmBC,SAAS,IAAI;AAC9B,MAAIH,oBAAoB,EAAxB,EACE,OAAOF,eAAe,CAACM,IAAhB,CAAqBD,SAArB,CAAP,CADF,KAGE,OAAOA,SAAP;AACH,CALD,C,CAOA;AACA;AACA;AACA;AACA;AACA;;;AACAvH,KAAK,CAACyH,UAAN,GAAmB,CAACC,WAAD,EAAcC,MAAd,KAAyB;AAC1C,MAAI,CAACR,OAAO,CAAC,kBAAD,CAAR,IAAgC,CAACD,eAAe,CAACU,QAAhB,CAAyBF,WAAzB,CAArC,EACE,OAAOA,WAAP;AAEF,SAAOR,eAAe,CAACW,IAAhB,CAAqBH,WAArB,EAAkCC,MAAlC,CAAP;AACD,CALD,C,CAOA;AACA;;;AACA3H,KAAK,CAAC8H,WAAN,GAAoB,CAACC,WAAD,EAAcJ,MAAd,KAAyB;AAC3C,QAAMhB,MAAM,GAAG,EAAf;AACAqB,QAAM,CAACC,IAAP,CAAYF,WAAZ,EAAyBG,OAAzB,CAAiCC,GAAG,IAClCxB,MAAM,CAACwB,GAAD,CAAN,GAAcnI,KAAK,CAACyH,UAAN,CAAiBM,WAAW,CAACI,GAAD,CAA5B,EAAmCR,MAAnC,CADhB;AAGA,SAAOhB,MAAP;AACD,CAND,C;;;;;;;;;;;ACpdA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA;AACA;AACA3G,KAAK,CAACoI,mBAAN,GAA4B,IAAIC,KAAK,CAACC,UAAV,CAC1B,iCAD0B,EACS;AACjCC,qBAAmB,EAAE;AADY,CADT,CAA5B;;AAKAvI,KAAK,CAACoI,mBAAN,CAA0BI,WAA1B,CAAsC,KAAtC,EAA6C;AAAEC,QAAM,EAAE;AAAV,CAA7C;;AACAzI,KAAK,CAACoI,mBAAN,CAA0BI,WAA1B,CAAsC,kBAAtC;;AACAxI,KAAK,CAACoI,mBAAN,CAA0BI,WAA1B,CAAsC,WAAtC,E,CAIA;;;AACA,MAAME,kBAAkB,GAAG,MAAM;AAC/B;AACA,QAAMC,UAAU,GAAG,IAAIC,IAAJ,EAAnB;AACAD,YAAU,CAACE,UAAX,CAAsBF,UAAU,CAACG,UAAX,KAA0B,CAAhD;;AACA9I,OAAK,CAACoI,mBAAN,CAA0BW,MAA1B,CAAiC;AAAEC,aAAS,EAAE;AAAEC,SAAG,EAAEN;AAAP;AAAb,GAAjC;AACD,CALD;;AAMA,MAAMO,cAAc,GAAGxG,MAAM,CAACyG,WAAP,CAAmBT,kBAAnB,EAAuC,KAAK,IAA5C,CAAvB,C,CAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AACA1I,KAAK,CAAC4D,uBAAN,GAAgC,UAACuE,GAAD,EAAMiB,UAAN,EAA8C;AAAA,MAA5BpI,gBAA4B,uEAAT,IAAS;AAC5EqI,OAAK,CAAClB,GAAD,EAAMmB,MAAN,CAAL;AACAD,OAAK,CAACrI,gBAAD,EAAmBuI,KAAK,CAACC,KAAN,CAAYF,MAAZ,CAAnB,CAAL;;AAEA,MAAIF,UAAU,YAAYzI,KAA1B,EAAiC;AAC/ByI,cAAU,GAAGK,aAAa,CAACL,UAAD,CAA1B;AACD,GAFD,MAEO;AACLA,cAAU,GAAGpJ,KAAK,CAACsH,UAAN,CAAiB8B,UAAjB,CAAb;AACD,GAR2E,CAU5E;AACA;AACA;;;AACApJ,OAAK,CAACoI,mBAAN,CAA0BsB,MAA1B,CAAiC;AAC/BvB;AAD+B,GAAjC,EAEG;AACDA,OADC;AAEDiB,cAFC;AAGDpI,oBAHC;AAIDgI,aAAS,EAAE,IAAIJ,IAAJ;AAJV,GAFH;AAQD,CArBD,C,CAwBA;AACA;AACA;AACA;AACA;;;AACA5I,KAAK,CAACiB,0BAAN,GAAmC,UAACkH,GAAD,EAAkC;AAAA,MAA5BnH,gBAA4B,uEAAT,IAAS;AACnEqI,OAAK,CAAClB,GAAD,EAAMmB,MAAN,CAAL;;AAEA,QAAMK,iBAAiB,GAAG3J,KAAK,CAACoI,mBAAN,CAA0BpD,OAA1B,CAAkC;AAC1DmD,OAD0D;AAE1DnH;AAF0D,GAAlC,CAA1B;;AAKA,MAAI2I,iBAAJ,EAAuB;AACrB3J,SAAK,CAACoI,mBAAN,CAA0BW,MAA1B,CAAiC;AAAEa,SAAG,EAAED,iBAAiB,CAACC;AAAzB,KAAjC;;AACA,QAAID,iBAAiB,CAACP,UAAlB,CAA6BpF,KAAjC,EACE,OAAO6F,aAAa,CAACF,iBAAiB,CAACP,UAAlB,CAA6BpF,KAA9B,CAApB,CADF,KAGE,OAAOhE,KAAK,CAACyH,UAAN,CAAiBkC,iBAAiB,CAACP,UAAnC,CAAP;AACH,GAND,MAMO;AACL,WAAOvG,SAAP;AACD;AACF,CAjBD,C,CAoBA;AACA;AACA;AACA;;;AACA,MAAM4G,aAAa,GAAGzF,KAAK,IAAI;AAC7B,QAAM8F,WAAW,GAAG,EAApB;AACA9B,QAAM,CAAC+B,mBAAP,CAA2B/F,KAA3B,EAAkCkE,OAAlC,CACEC,GAAG,IAAI2B,WAAW,CAAC3B,GAAD,CAAX,GAAmBnE,KAAK,CAACmE,GAAD,CADjC,EAF6B,CAM7B;;AACA,MAAGnE,KAAK,YAAYtB,MAAM,CAAC/B,KAA3B,EAAkC;AAChCmJ,eAAW,CAAC,aAAD,CAAX,GAA6B,IAA7B;AACD;;AAED,SAAO;AAAE9F,SAAK,EAAE8F;AAAT,GAAP;AACD,CAZD,C,CAcA;;;AACA,MAAMD,aAAa,GAAGG,QAAQ,IAAI;AAChC,MAAIhG,KAAJ;;AAEA,MAAIgG,QAAQ,CAACC,WAAb,EAA0B;AACxBjG,SAAK,GAAG,IAAItB,MAAM,CAAC/B,KAAX,EAAR;AACA,WAAOqJ,QAAQ,CAACC,WAAhB;AACD,GAHD,MAGO;AACLjG,SAAK,GAAG,IAAIrD,KAAJ,EAAR;AACD;;AAEDqH,QAAM,CAAC+B,mBAAP,CAA2BC,QAA3B,EAAqC9B,OAArC,CAA6CC,GAAG,IAC9CnE,KAAK,CAACmE,GAAD,CAAL,GAAa6B,QAAQ,CAAC7B,GAAD,CADvB;AAIA,SAAOnE,KAAP;AACD,CAfD,C;;;;;;;;;;;AC9GA,IAAIkG,aAAJ;;AAAkBtK,MAAM,CAACC,IAAP,CAAY,sCAAZ,EAAmD;AAACC,SAAO,CAACC,CAAD,EAAG;AAACmK,iBAAa,GAACnK,CAAd;AAAgB;;AAA5B,CAAnD,EAAiF,CAAjF;AAAlBC,KAAK,CAACyG,mBAAN,GAA4B,gCAA5B;;AAEAzG,KAAK,CAACmK,YAAN,GAAqB,CAACvJ,WAAD,EAAc0F,MAAd,EAAsB8D,MAAtB,EAA8BC,kBAA9B,KAAqD;AACxE;AACA;AACA;AACA,MAAI9H,SAAS,GAAG,KAAhB;AACA,MAAI+H,SAAS,GAAG,KAAhB;;AACA,MAAIF,MAAJ,EAAY;AACVA,UAAM,qBAAQA,MAAR,CAAN;AACA7H,aAAS,GAAG6H,MAAM,CAACG,OAAnB;AACAD,aAAS,GAAGF,MAAM,CAACI,OAAnB;AACA,WAAOJ,MAAM,CAACG,OAAd;AACA,WAAOH,MAAM,CAACI,OAAd;;AACA,QAAIxC,MAAM,CAACC,IAAP,CAAYmC,MAAZ,EAAoBpH,MAApB,KAA+B,CAAnC,EAAsC;AACpCoH,YAAM,GAAGvH,SAAT;AACD;AACF;;AAED,MAAIH,MAAM,CAAC+H,QAAP,IAAmBlI,SAAvB,EAAkC;AAChC,UAAMiC,GAAG,GAAGkG,GAAG,CAACC,OAAJ,CAAY,KAAZ,CAAZ;;AACA,QAAIC,OAAO,GAAGC,OAAO,CAACC,GAAR,CAAYC,eAAZ,IACRnE,yBAAyB,CAACoE,QADhC;;AAGA,QAAIV,SAAJ,EAAe;AACb;AACA;AACA;AACA;AACA;AACA,YAAMW,aAAa,GAAGzG,GAAG,CAACvC,KAAJ,CAAU2I,OAAV,CAAtB;;AACA,UAAIK,aAAa,CAACC,QAAd,KAA2B,WAA/B,EAA4C;AAC1CD,qBAAa,CAACC,QAAd,GAAyB,UAAzB;AACA,eAAOD,aAAa,CAACE,IAArB;AACD;;AACDP,aAAO,GAAGpG,GAAG,CAAC4G,MAAJ,CAAWH,aAAX,CAAV;AACD;;AAEDZ,sBAAkB,mCACbA,kBADa;AAEhB;AACA;AACAO;AAJgB,MAAlB;AAMD;;AAED,SAAOS,GAAG,CAACC,aAAJ,CACL5I,MAAM,CAACC,WAAP,kBAA6B/B,WAA7B,GAA4CyJ,kBAA5C,CADK,EAEL,IAFK,EAGLD,MAHK,CAAP;AAID,CAhDD,C","file":"/packages/oauth.js","sourcesContent":["import bodyParser from 'body-parser';\n\nOAuth = {};\nOAuthTest = {};\n\nRoutePolicy.declare('/_oauth/', 'network');\n\nconst registeredServices = {};\n\n// Internal: Maps from service version to handler function. The\n// 'oauth1' and 'oauth2' packages manipulate this directly to register\n// for callbacks.\nOAuth._requestHandlers = {};\n\n\n/**\n/* Register a handler for an OAuth service. The handler will be called\n/* when we get an incoming http request on /_oauth/{serviceName}. This\n/* handler should use that information to fetch data about the user\n/* logging in.\n/*\n/* @param name {String} e.g. \"google\", \"facebook\"\n/* @param version {Number} OAuth version (1 or 2)\n/* @param urls   For OAuth1 only, specify the service's urls\n/* @param handleOauthRequest {Function(oauthBinding|query)}\n/*   - (For OAuth1 only) oauthBinding {OAuth1Binding} bound to the appropriate provider\n/*   - (For OAuth2 only) query {Object} parameters passed in query string\n/*   - return value is:\n/*     - {serviceData:, (optional options:)} where serviceData should end\n/*       up in the user's services[name] field\n/*     - `null` if the user declined to give permissions\n*/\nOAuth.registerService = (name, version, urls, handleOauthRequest) => {\n  if (registeredServices[name])\n    throw new Error(`Already registered the ${name} OAuth service`);\n\n  registeredServices[name] = {\n    serviceName: name,\n    version,\n    urls,\n    handleOauthRequest,\n  };\n};\n\n// For test cleanup.\nOAuthTest.unregisterService = name => {\n  delete registeredServices[name];\n};\n\n\nOAuth.retrieveCredential = (credentialToken, credentialSecret) =>\n  OAuth._retrievePendingCredential(credentialToken, credentialSecret);\n\n\n// The state parameter is normally generated on the client using\n// `btoa`, but for tests we need a version that runs on the server.\n//\nOAuth._generateState = (loginStyle, credentialToken, redirectUrl) => {\n  return Buffer.from(JSON.stringify({\n    loginStyle: loginStyle,\n    credentialToken: credentialToken,\n    redirectUrl: redirectUrl})).toString('base64');\n};\n\nOAuth._stateFromQuery = query => {\n  let string;\n  try {\n    string = Buffer.from(query.state, 'base64').toString('binary');\n  } catch (e) {\n    Log.warn(`Unable to base64 decode state from OAuth query: ${query.state}`);\n    throw e;\n  }\n\n  try {\n    return JSON.parse(string);\n  } catch (e) {\n    Log.warn(`Unable to parse state from OAuth query: ${string}`);\n    throw e;\n  }\n};\n\nOAuth._loginStyleFromQuery = query => {\n  let style;\n  // For backwards-compatibility for older clients, catch any errors\n  // that result from parsing the state parameter. If we can't parse it,\n  // set login style to popup by default.\n  try {\n    style = OAuth._stateFromQuery(query).loginStyle;\n  } catch (err) {\n    style = \"popup\";\n  }\n  if (style !== \"popup\" && style !== \"redirect\") {\n    throw new Error(`Unrecognized login style: ${style}`);\n  }\n  return style;\n};\n\nOAuth._credentialTokenFromQuery = query => {\n  let state;\n  // For backwards-compatibility for older clients, catch any errors\n  // that result from parsing the state parameter. If we can't parse it,\n  // assume that the state parameter's value is the credential token, as\n  // it used to be for older clients.\n  try {\n    state = OAuth._stateFromQuery(query);\n  } catch (err) {\n    return query.state;\n  }\n  return state.credentialToken;\n};\n\nOAuth._isCordovaFromQuery = query => {\n  try {\n    return !! OAuth._stateFromQuery(query).isCordova;\n  } catch (err) {\n    // For backwards-compatibility for older clients, catch any errors\n    // that result from parsing the state parameter. If we can't parse\n    // it, assume that we are not on Cordova, since older Meteor didn't\n    // do Cordova.\n    return false;\n  }\n};\n\n// Checks if the `redirectUrl` matches the app host.\n// We export this function so that developers can override this\n// behavior to allow apps from external domains to login using the\n// redirect OAuth flow.\nOAuth._checkRedirectUrlOrigin = redirectUrl => {\n  const appHost = Meteor.absoluteUrl();\n  const appHostReplacedLocalhost = Meteor.absoluteUrl(undefined, {\n    replaceLocalhost: true\n  });\n  return (\n    redirectUrl.substr(0, appHost.length) !== appHost &&\n    redirectUrl.substr(0, appHostReplacedLocalhost.length) !== appHostReplacedLocalhost\n  );\n};\n\nconst middleware = (req, res, next) => {\n  let requestData;\n\n  // Make sure to catch any exceptions because otherwise we'd crash\n  // the runner\n  try {\n    const serviceName = oauthServiceName(req);\n    if (!serviceName) {\n      // not an oauth request. pass to next middleware.\n      next();\n      return;\n    }\n\n    const service = registeredServices[serviceName];\n\n    // Skip everything if there's no service set by the oauth middleware\n    if (!service)\n      throw new Error(`Unexpected OAuth service ${serviceName}`);\n\n    // Make sure we're configured\n    ensureConfigured(serviceName);\n\n    const handler = OAuth._requestHandlers[service.version];\n    if (!handler)\n      throw new Error(`Unexpected OAuth version ${service.version}`);\n\n    if (req.method === 'GET') {\n      requestData = req.query;\n    } else {\n      requestData = req.body;\n    }\n\n    handler(service, requestData, res);\n  } catch (err) {\n    // if we got thrown an error, save it off, it will get passed to\n    // the appropriate login call (if any) and reported there.\n    //\n    // The other option would be to display it in the popup tab that\n    // is still open at this point, ignoring the 'close' or 'redirect'\n    // we were passed. But then the developer wouldn't be able to\n    // style the error or react to it in any way.\n    if (requestData?.state && err instanceof Error) {\n      try { // catch any exceptions to avoid crashing runner\n        OAuth._storePendingCredential(OAuth._credentialTokenFromQuery(requestData), err);\n      } catch (err) {\n        // Ignore the error and just give up. If we failed to store the\n        // error, then the login will just fail with a generic error.\n        Log.warn(\"Error in OAuth Server while storing pending login result.\\n\" +\n                 err.stack || err.message);\n      }\n    }\n\n    // close the popup. because nobody likes them just hanging\n    // there.  when someone sees this multiple times they might\n    // think to check server logs (we hope?)\n    // Catch errors because any exception here will crash the runner.\n    try {\n      OAuth._endOfLoginResponse(res, {\n        query: requestData,\n        loginStyle: OAuth._loginStyleFromQuery(requestData),\n        error: err\n      });\n    } catch (err) {\n      Log.warn(\"Error generating end of login response\\n\" +\n               (err && (err.stack || err.message)));\n    }\n  }\n};\n\n// Listen to incoming OAuth http requests\nWebApp.connectHandlers.use('/_oauth', bodyParser.json());\nWebApp.connectHandlers.use('/_oauth', bodyParser.urlencoded({ extended: false }));\nWebApp.connectHandlers.use(middleware);\n\nOAuthTest.middleware = middleware;\n\n// Handle /_oauth/* paths and extract the service name.\n//\n// @returns {String|null} e.g. \"facebook\", or null if this isn't an\n// oauth request\nconst oauthServiceName = req => {\n  // req.url will be \"/_oauth/<service name>\" with an optional \"?close\".\n  const i = req.url.indexOf('?');\n  let barePath;\n  if (i === -1)\n    barePath = req.url;\n  else\n    barePath = req.url.substring(0, i);\n  const splitPath = barePath.split('/');\n\n  // Any non-oauth request will continue down the default\n  // middlewares.\n  if (splitPath[1] !== '_oauth')\n    return null;\n\n  // Find service based on url\n  const serviceName = splitPath[2];\n  return serviceName;\n};\n\n// Make sure we're configured\nconst ensureConfigured = serviceName => {\n  if (!ServiceConfiguration.configurations.findOne({service: serviceName})) {\n    throw new ServiceConfiguration.ConfigError();\n  }\n};\n\nconst isSafe = value => {\n  // This matches strings generated by `Random.secret` and\n  // `Random.id`.\n  return typeof value === \"string\" &&\n    /^[a-zA-Z0-9\\-_]+$/.test(value);\n};\n\n// Internal: used by the oauth1 and oauth2 packages\nOAuth._renderOauthResults = (res, query, credentialSecret) => {\n  // For tests, we support the `only_credential_secret_for_test`\n  // parameter, which just returns the credential secret without any\n  // surrounding HTML. (The test needs to be able to easily grab the\n  // secret and use it to log in.)\n  //\n  // XXX only_credential_secret_for_test could be useful for other\n  // things beside tests, like command-line clients. We should give it a\n  // real name and serve the credential secret in JSON.\n\n  if (query.only_credential_secret_for_test) {\n    res.writeHead(200, {'Content-Type': 'text/html'});\n    res.end(credentialSecret, 'utf-8');\n  } else {\n    const details = {\n      query,\n      loginStyle: OAuth._loginStyleFromQuery(query)\n    };\n    if (query.error) {\n      details.error = query.error;\n    } else {\n      const token = OAuth._credentialTokenFromQuery(query);\n      const secret = credentialSecret;\n      if (token && secret &&\n          isSafe(token) && isSafe(secret)) {\n        details.credentials = { token: token, secret: secret};\n      } else {\n        details.error = \"invalid_credential_token_or_secret\";\n      }\n    }\n\n    OAuth._endOfLoginResponse(res, details);\n  }\n};\n\n// This \"template\" (not a real Spacebars template, just an HTML file\n// with some ##PLACEHOLDER##s) communicates the credential secret back\n// to the main window and then closes the popup.\nOAuth._endOfPopupResponseTemplate = Assets.getText(\n  \"end_of_popup_response.html\");\n\nOAuth._endOfRedirectResponseTemplate = Assets.getText(\n  \"end_of_redirect_response.html\");\n\n// Renders the end of login response template into some HTML and JavaScript\n// that closes the popup or redirects at the end of the OAuth flow.\n//\n// options are:\n//   - loginStyle (\"popup\" or \"redirect\")\n//   - setCredentialToken (boolean)\n//   - credentialToken\n//   - credentialSecret\n//   - redirectUrl\n//   - isCordova (boolean)\n//\nconst renderEndOfLoginResponse = options => {\n  // It would be nice to use Blaze here, but it's a little tricky\n  // because our mustaches would be inside a <script> tag, and Blaze\n  // would treat the <script> tag contents as text (e.g. encode '&' as\n  // '&amp;'). So we just do a simple replace.\n\n  const escape = s => {\n    if (s) {\n      return s.replace(/&/g, \"&amp;\").\n        replace(/</g, \"&lt;\").\n        replace(/>/g, \"&gt;\").\n        replace(/\\\"/g, \"&quot;\").\n        replace(/\\'/g, \"&#x27;\").\n        replace(/\\//g, \"&#x2F;\");\n    } else {\n      return s;\n    }\n  };\n\n  // Escape everything just to be safe (we've already checked that some\n  // of this data -- the token and secret -- are safe).\n  const config = {\n    setCredentialToken: !! options.setCredentialToken,\n    credentialToken: escape(options.credentialToken),\n    credentialSecret: escape(options.credentialSecret),\n    storagePrefix: escape(OAuth._storageTokenPrefix),\n    redirectUrl: escape(options.redirectUrl),\n    isCordova: !! options.isCordova\n  };\n\n  let template;\n  if (options.loginStyle === 'popup') {\n    template = OAuth._endOfPopupResponseTemplate;\n  } else if (options.loginStyle === 'redirect') {\n    template = OAuth._endOfRedirectResponseTemplate;\n  } else {\n    throw new Error(`invalid loginStyle: ${options.loginStyle}`);\n  }\n\n  const result = template.replace(/##CONFIG##/, JSON.stringify(config))\n    .replace(\n      /##ROOT_URL_PATH_PREFIX##/, __meteor_runtime_config__.ROOT_URL_PATH_PREFIX\n    );\n\n  return `<!DOCTYPE html>\\n${result}`;\n};\n\n// Writes an HTTP response to the popup window at the end of an OAuth\n// login flow. At this point, if the user has successfully authenticated\n// to the OAuth server and authorized this app, we communicate the\n// credentialToken and credentialSecret to the main window. The main\n// window must provide both these values to the DDP `login` method to\n// authenticate its DDP connection. After communicating these vaues to\n// the main window, we close the popup.\n//\n// We export this function so that developers can override this\n// behavior, which is particularly useful in, for example, some mobile\n// environments where popups and/or `window.opener` don't work. For\n// example, an app could override `OAuth._endOfPopupResponse` to put the\n// credential token and credential secret in the popup URL for the main\n// window to read them there instead of using `window.opener`. If you\n// override this function, you take responsibility for writing to the\n// request and calling `res.end()` to complete the request.\n//\n// Arguments:\n//   - res: the HTTP response object\n//   - details:\n//      - query: the query string on the HTTP request\n//      - credentials: { token: *, secret: * }. If present, this field\n//        indicates that the login was successful. Return these values\n//        to the client, who can use them to log in over DDP. If\n//        present, the values have been checked against a limited\n//        character set and are safe to include in HTML.\n//      - error: if present, a string or Error indicating an error that\n//        occurred during the login. This can come from the client and\n//        so shouldn't be trusted for security decisions or included in\n//        the response without sanitizing it first. Only one of `error`\n//        or `credentials` should be set.\nOAuth._endOfLoginResponse = (res, details) => {\n  res.writeHead(200, {'Content-Type': 'text/html'});\n\n  let redirectUrl;\n  if (details.loginStyle === 'redirect') {\n    redirectUrl = OAuth._stateFromQuery(details.query).redirectUrl;\n    const appHost = Meteor.absoluteUrl();\n    if (\n      !Meteor.settings?.packages?.oauth?.disableCheckRedirectUrlOrigin &&\n      OAuth._checkRedirectUrlOrigin(redirectUrl)) {\n      details.error = `redirectUrl (${redirectUrl}` +\n        `) is not on the same host as the app (${appHost})`;\n      redirectUrl = appHost;\n    }\n  }\n\n  const isCordova = OAuth._isCordovaFromQuery(details.query);\n\n  if (details.error) {\n    Log.warn(\"Error in OAuth Server: \" +\n             (details.error instanceof Error ?\n              details.error.message : details.error));\n    res.end(renderEndOfLoginResponse({\n      loginStyle: details.loginStyle,\n      setCredentialToken: false,\n      redirectUrl,\n      isCordova,\n    }), \"utf-8\");\n    return;\n  }\n\n  // If we have a credentialSecret, report it back to the parent\n  // window, with the corresponding credentialToken. The parent window\n  // uses the credentialToken and credentialSecret to log in over DDP.\n  res.end(renderEndOfLoginResponse({\n    loginStyle: details.loginStyle,\n    setCredentialToken: true,\n    credentialToken: details.credentials.token,\n    credentialSecret: details.credentials.secret,\n    redirectUrl,\n    isCordova,\n  }), \"utf-8\");\n};\n\n\nconst OAuthEncryption = Package[\"oauth-encryption\"] && Package[\"oauth-encryption\"].OAuthEncryption;\n\nconst usingOAuthEncryption = () =>\n  OAuthEncryption && OAuthEncryption.keyIsLoaded();\n\n// Encrypt sensitive service data such as access tokens if the\n// \"oauth-encryption\" package is loaded and the oauth secret key has\n// been specified.  Returns the unencrypted plaintext otherwise.\n//\n// The user id is not specified because the user isn't known yet at\n// this point in the oauth authentication process.  After the oauth\n// authentication process completes the encrypted service data fields\n// will be re-encrypted with the user id included before inserting the\n// service data into the user document.\n//\nOAuth.sealSecret = plaintext => {\n  if (usingOAuthEncryption())\n    return OAuthEncryption.seal(plaintext);\n  else\n    return plaintext;\n};\n\n// Unencrypt a service data field, if the \"oauth-encryption\"\n// package is loaded and the field is encrypted.\n//\n// Throws an error if the \"oauth-encryption\" package is loaded and the\n// field is encrypted, but the oauth secret key hasn't been specified.\n//\nOAuth.openSecret = (maybeSecret, userId) => {\n  if (!Package[\"oauth-encryption\"] || !OAuthEncryption.isSealed(maybeSecret))\n    return maybeSecret;\n\n  return OAuthEncryption.open(maybeSecret, userId);\n};\n\n// Unencrypt fields in the service data object.\n//\nOAuth.openSecrets = (serviceData, userId) => {\n  const result = {};\n  Object.keys(serviceData).forEach(key =>\n    result[key] = OAuth.openSecret(serviceData[key], userId)\n  );\n  return result;\n};\n","//\n// When an oauth request is made, Meteor receives oauth credentials\n// in one browser tab, and temporarily persists them while that\n// tab is closed, then retrieves them in the browser tab that\n// initiated the credential request.\n//\n// _pendingCredentials is the storage mechanism used to share the\n// credential between the 2 tabs\n//\n\n\n// Collection containing pending credentials of oauth credential requests\n// Has key, credential, and createdAt fields.\nOAuth._pendingCredentials = new Mongo.Collection(\n  \"meteor_oauth_pendingCredentials\", {\n    _preventAutopublish: true\n  });\n\nOAuth._pendingCredentials.createIndex('key', { unique: true });\nOAuth._pendingCredentials.createIndex('credentialSecret');\nOAuth._pendingCredentials.createIndex('createdAt');\n\n\n\n// Periodically clear old entries that were never retrieved\nconst _cleanStaleResults = () => {\n  // Remove credentials older than 1 minute\n  const timeCutoff = new Date();\n  timeCutoff.setMinutes(timeCutoff.getMinutes() - 1);\n  OAuth._pendingCredentials.remove({ createdAt: { $lt: timeCutoff } });\n};\nconst _cleanupHandle = Meteor.setInterval(_cleanStaleResults, 60 * 1000);\n\n\n// Stores the key and credential in the _pendingCredentials collection.\n// Will throw an exception if `key` is not a string.\n//\n// @param key {string}\n// @param credential {Object}   The credential to store\n// @param credentialSecret {string} A secret that must be presented in\n//   addition to the `key` to retrieve the credential\n//\nOAuth._storePendingCredential = (key, credential, credentialSecret = null) => {\n  check(key, String);\n  check(credentialSecret, Match.Maybe(String));\n\n  if (credential instanceof Error) {\n    credential = storableError(credential);\n  } else {\n    credential = OAuth.sealSecret(credential);\n  }\n\n  // We do an upsert here instead of an insert in case the user happens\n  // to somehow send the same `state` parameter twice during an OAuth\n  // login; we don't want a duplicate key error.\n  OAuth._pendingCredentials.upsert({\n    key,\n  }, {\n    key,\n    credential,\n    credentialSecret,\n    createdAt: new Date()\n  });\n};\n\n\n// Retrieves and removes a credential from the _pendingCredentials collection\n//\n// @param key {string}\n// @param credentialSecret {string}\n//\nOAuth._retrievePendingCredential = (key, credentialSecret = null) => {\n  check(key, String);\n\n  const pendingCredential = OAuth._pendingCredentials.findOne({\n    key,\n    credentialSecret,\n  });\n\n  if (pendingCredential) {\n    OAuth._pendingCredentials.remove({ _id: pendingCredential._id });\n    if (pendingCredential.credential.error)\n      return recreateError(pendingCredential.credential.error);\n    else\n      return OAuth.openSecret(pendingCredential.credential);\n  } else {\n    return undefined;\n  }\n};\n\n\n// Convert an Error into an object that can be stored in mongo\n// Note: A Meteor.Error is reconstructed as a Meteor.Error\n// All other error classes are reconstructed as a plain Error.\n// TODO: Can we do this more simply with EJSON?\nconst storableError = error => {\n  const plainObject = {};\n  Object.getOwnPropertyNames(error).forEach(\n    key => plainObject[key] = error[key]\n  );\n\n  // Keep track of whether it's a Meteor.Error\n  if(error instanceof Meteor.Error) {\n    plainObject['meteorError'] = true;\n  }\n\n  return { error: plainObject };\n};\n\n// Create an error from the error format stored in mongo\nconst recreateError = errorDoc => {\n  let error;\n\n  if (errorDoc.meteorError) {\n    error = new Meteor.Error();\n    delete errorDoc.meteorError;\n  } else {\n    error = new Error();\n  }\n\n  Object.getOwnPropertyNames(errorDoc).forEach(key =>\n    error[key] = errorDoc[key]\n  );\n\n  return error;\n};\n","OAuth._storageTokenPrefix = \"Meteor.oauth.credentialSecret-\";\n\nOAuth._redirectUri = (serviceName, config, params, absoluteUrlOptions) => {\n  // Clone because we're going to mutate 'params'. The 'cordova' and\n  // 'android' parameters are only used for picking the host of the\n  // redirect URL, and not actually included in the redirect URL itself.\n  let isCordova = false;\n  let isAndroid = false;\n  if (params) {\n    params = { ...params };\n    isCordova = params.cordova;\n    isAndroid = params.android;\n    delete params.cordova;\n    delete params.android;\n    if (Object.keys(params).length === 0) {\n      params = undefined;\n    }\n  }\n\n  if (Meteor.isServer && isCordova) {\n    const url = Npm.require('url');\n    let rootUrl = process.env.MOBILE_ROOT_URL ||\n          __meteor_runtime_config__.ROOT_URL;\n\n    if (isAndroid) {\n      // Match the replace that we do in cordova boilerplate\n      // (boilerplate-generator package).\n      // XXX Maybe we should put this in a separate package or something\n      // that is used here and by boilerplate-generator? Or maybe\n      // `Meteor.absoluteUrl` should know how to do this?\n      const parsedRootUrl = url.parse(rootUrl);\n      if (parsedRootUrl.hostname === \"localhost\") {\n        parsedRootUrl.hostname = \"10.0.2.2\";\n        delete parsedRootUrl.host;\n      }\n      rootUrl = url.format(parsedRootUrl);\n    }\n\n    absoluteUrlOptions = {\n      ...absoluteUrlOptions,\n      // For Cordova clients, redirect to the special Cordova root url\n      // (likely a local IP in development mode).\n      rootUrl,\n    };\n  }\n\n  return URL._constructUrl(\n    Meteor.absoluteUrl(`_oauth/${serviceName}`, absoluteUrlOptions),\n    null,\n    params);\n};\n"]}