var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var keyVaultAuthenticationPolicy_exports = {};
__export(keyVaultAuthenticationPolicy_exports, {
  keyVaultAuthenticationPolicy: () => keyVaultAuthenticationPolicy,
  keyVaultAuthenticationPolicyName: () => keyVaultAuthenticationPolicyName
});
module.exports = __toCommonJS(keyVaultAuthenticationPolicy_exports);
var import_parseWWWAuthenticate = require("./parseWWWAuthenticate.js");
var import_tokenCycler = require("./tokenCycler.js");
var import_logger = require("./logger.js");
function verifyChallengeResource(scope, request) {
  let scopeAsUrl;
  try {
    scopeAsUrl = new URL(scope);
  } catch (e) {
    throw new Error(`The challenge contains invalid scope '${scope}'`);
  }
  const requestUrl = new URL(request.url);
  if (!requestUrl.hostname.endsWith(`.${scopeAsUrl.hostname}`)) {
    throw new Error(
      `The challenge resource '${scopeAsUrl.hostname}' does not match the requested domain. Set disableChallengeResourceVerification to true in your client options to disable. See https://aka.ms/azsdk/blog/vault-uri for more information.`
    );
  }
}
const keyVaultAuthenticationPolicyName = "keyVaultAuthenticationPolicy";
function keyVaultAuthenticationPolicy(credential, options = {}) {
  const { disableChallengeResourceVerification } = options;
  let challengeState = { status: "none" };
  const getAccessToken = (0, import_tokenCycler.createTokenCycler)(credential);
  function requestToOptions(request) {
    return {
      abortSignal: request.abortSignal,
      requestOptions: {
        timeout: request.timeout > 0 ? request.timeout : void 0
      },
      tracingOptions: request.tracingOptions
    };
  }
  async function authorizeRequest(request) {
    const requestOptions = requestToOptions(request);
    switch (challengeState.status) {
      case "none":
        challengeState = {
          status: "started",
          originalBody: request.body
        };
        request.body = null;
        break;
      case "started":
        break;
      // Retry, we should not overwrite the original body
      case "complete": {
        const token = await getAccessToken(challengeState.scopes, {
          ...requestOptions,
          enableCae: true,
          tenantId: challengeState.tenantId
        });
        if (token) {
          request.headers.set("authorization", `Bearer ${token.token}`);
        }
        break;
      }
    }
  }
  async function handleChallenge(request, response, next) {
    if (response.status !== 401) {
      return response;
    }
    if (request.body === null && challengeState.status === "started") {
      request.body = challengeState.originalBody;
    }
    const getTokenOptions = requestToOptions(request);
    const challenge = response.headers.get("WWW-Authenticate");
    if (!challenge) {
      import_logger.logger.warning(
        "keyVaultAuthentication policy encountered a 401 response without a corresponding WWW-Authenticate header. This is unexpected. Not handling the 401 response."
      );
      return response;
    }
    const parsedChallenge = (0, import_parseWWWAuthenticate.parseWWWAuthenticateHeader)(challenge);
    const scope = parsedChallenge.resource ? parsedChallenge.resource + "/.default" : parsedChallenge.scope;
    if (!scope) {
      return response;
    }
    if (!disableChallengeResourceVerification) {
      verifyChallengeResource(scope, request);
    }
    const accessToken = await getAccessToken([scope], {
      ...getTokenOptions,
      enableCae: true,
      tenantId: parsedChallenge.tenantId
    });
    if (!accessToken) {
      return response;
    }
    request.headers.set("Authorization", `Bearer ${accessToken.token}`);
    challengeState = {
      status: "complete",
      scopes: [scope],
      tenantId: parsedChallenge.tenantId
    };
    return next(request);
  }
  async function handleCaeChallenge(request, response, next) {
    if (challengeState.status !== "complete") {
      return response;
    }
    if (response.status !== 401) {
      return response;
    }
    const getTokenOptions = requestToOptions(request);
    const challenge = response.headers.get("WWW-Authenticate");
    if (!challenge) {
      return response;
    }
    const { claims: base64EncodedClaims, error } = (0, import_parseWWWAuthenticate.parseWWWAuthenticateHeader)(challenge);
    if (error !== "insufficient_claims" || base64EncodedClaims === void 0) {
      return response;
    }
    const claims = atob(base64EncodedClaims);
    const accessToken = await getAccessToken(challengeState.scopes, {
      ...getTokenOptions,
      enableCae: true,
      tenantId: challengeState.tenantId,
      claims
    });
    request.headers.set("Authorization", `Bearer ${accessToken.token}`);
    return next(request);
  }
  async function sendRequest(request, next) {
    await authorizeRequest(request);
    let response = await next(request);
    response = await handleChallenge(request, response, next);
    response = await handleCaeChallenge(request, response, next);
    return response;
  }
  return {
    name: keyVaultAuthenticationPolicyName,
    sendRequest
  };
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  keyVaultAuthenticationPolicy,
  keyVaultAuthenticationPolicyName
});
//# sourceMappingURL=keyVaultAuthenticationPolicy.js.map