(() => {
var exports = {};
exports.id = 7805;
exports.ids = [7805];
exports.modules = {

/***/ 439491:
/***/ ((module) => {

"use strict";
module.exports = require("assert");

/***/ }),

/***/ 714300:
/***/ ((module) => {

"use strict";
module.exports = require("buffer");

/***/ }),

/***/ 706113:
/***/ ((module) => {

"use strict";
module.exports = require("crypto");

/***/ }),

/***/ 809523:
/***/ ((module) => {

"use strict";
module.exports = require("dns");

/***/ }),

/***/ 582361:
/***/ ((module) => {

"use strict";
module.exports = require("events");

/***/ }),

/***/ 657147:
/***/ ((module) => {

"use strict";
module.exports = require("fs");

/***/ }),

/***/ 113685:
/***/ ((module) => {

"use strict";
module.exports = require("http");

/***/ }),

/***/ 241808:
/***/ ((module) => {

"use strict";
module.exports = require("net");

/***/ }),

/***/ 822037:
/***/ ((module) => {

"use strict";
module.exports = require("os");

/***/ }),

/***/ 371017:
/***/ ((module) => {

"use strict";
module.exports = require("path");

/***/ }),

/***/ 677282:
/***/ ((module) => {

"use strict";
module.exports = require("process");

/***/ }),

/***/ 12781:
/***/ ((module) => {

"use strict";
module.exports = require("stream");

/***/ }),

/***/ 371576:
/***/ ((module) => {

"use strict";
module.exports = require("string_decoder");

/***/ }),

/***/ 924404:
/***/ ((module) => {

"use strict";
module.exports = require("tls");

/***/ }),

/***/ 76224:
/***/ ((module) => {

"use strict";
module.exports = require("tty");

/***/ }),

/***/ 257310:
/***/ ((module) => {

"use strict";
module.exports = require("url");

/***/ }),

/***/ 473837:
/***/ ((module) => {

"use strict";
module.exports = require("util");

/***/ }),

/***/ 340176:
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {

"use strict";
__webpack_require__.r(__webpack_exports__);
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
/* harmony export */   "default": () => (/* binding */ handle)
/* harmony export */ });
/* harmony import */ var _cocalc_server_auth_sso_unlink_strategy__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(693742);
/* harmony import */ var _cocalc_server_auth_sso_unlink_strategy__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(_cocalc_server_auth_sso_unlink_strategy__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var lib_account_get_account__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(559459);
/* harmony import */ var lib_api_get_params__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(26438);
/*
 *  This file is part of CoCalc: Copyright © 2022 Sagemath, Inc.
 *  License: AGPLv3 s.t. "Commons Clause" – see LICENSE.md for details
 */ /* api call to unlink a specific single sign on for the currently authenticated user */ 


async function handle(req, res) {
    try {
        const account_id = await (0,lib_account_get_account__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .Z)(req);
        if (!account_id) {
            throw Error("must be signed in");
        }
        const { name  } = (0,lib_api_get_params__WEBPACK_IMPORTED_MODULE_2__/* ["default"] */ .Z)(req);
        await _cocalc_server_auth_sso_unlink_strategy__WEBPACK_IMPORTED_MODULE_0___default()({
            account_id,
            name
        });
        res.json({
            status: "ok"
        });
    } catch (err) {
        res.json({
            error: err.message
        });
    }
}


/***/ }),

/***/ 693742:
/***/ (function(__unused_webpack_module, exports, __webpack_require__) {

"use strict";

/*
Function for unlinking a strategy from the user profile.

We provide this rather than just allowing the user to directly edit the
passports part of their account via a user_query entirely for security reasons.
I don't specifically know of any issues with allowing such editing, but it
seems potentially dangerous... and longterm it is nice to assume that we
can trust the contents of the passports field of accounts came from the
upstream SSO provider.
*/
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.isBlockedUnlinkStrategy = void 0;
const pool_1 = __importDefault(__webpack_require__(541808));
const misc_1 = __webpack_require__(854006);
const check_required_sso_1 = __webpack_require__(234894);
const get_strategies_1 = __importDefault(__webpack_require__(728351));
async function unlinkStrategy(opts) {
    const { account_id, name } = opts;
    if (typeof name !== "string" || name.length === 0) {
        throw new Error("name must be a nonempty string");
    }
    if (!(0, misc_1.is_valid_uuid_string)(account_id)) {
        throw new Error("account_id must be a valid uuid");
    }
    const strategyName = name.split("-")[0];
    const pool = (0, pool_1.default)();
    if (await isBlockedUnlinkStrategy({ strategyName, account_id })) {
        throw new Error("You are not allowed to unlink this SSO account");
    }
    // if we can't find the strategy, we still let users unlink it – maybe no longer available?
    await pool.query("UPDATE accounts SET passports = passports - $2 WHERE account_id=$1", [account_id, name]);
}
exports["default"] = unlinkStrategy;
async function isBlockedUnlinkStrategy(opts) {
    const { strategyName, account_id } = opts;
    // You're not allowed to unlink a strategy, if it is "exclusive" for your account.
    // Hence we check if your email addresses domain covered by in the info.exclusive_domains array of the strategy
    // Why is this blocked? This might make it possible for a user to detach their account from the control of that SSO provider.
    const pool = (0, pool_1.default)();
    const emailQuery = await pool.query("SELECT email_address FROM accounts WHERE account_id=$1", [account_id]);
    const email = emailQuery.rows[0].email_address;
    if (email) {
        const strategies = await (0, get_strategies_1.default)();
        const requiredStrategy = (0, check_required_sso_1.checkRequiredSSO)({
            email,
            strategies,
            specificStrategy: strategyName,
        });
        return requiredStrategy != null;
    }
    return false;
}
exports.isBlockedUnlinkStrategy = isBlockedUnlinkStrategy;
//# sourceMappingURL=unlink-strategy.js.map

/***/ }),

/***/ 630900:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {

var crypto = __webpack_require__(706113);

var rn = function(max) {
  var rnBytes = crypto.randomBytes(2);
  var randomNum = rnBytes.readUInt8(0) * 256 + rnBytes.readUInt8(1);
  return randomNum % max;
}

var digits = '0123456789'
var base62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz'
var base30 = '0123456789ABCDFHKLMNPQRSTUVWXYZ'  // 1-9, A-Z exclude(E, G, I, J, O) for human read

exports.generate = function(len, chars) {
  len = len || 16;
  chars = chars || base62;
  var key = '';
  var charsLen = chars.length;
  for (var i=0; i<len; i++) {
    key += chars[rn(charsLen)];
  }
  return key;
};

exports.generateDigits = function(len) {
  len = len || 16;
  return exports.generate(len, digits)
};

exports.generateBase30 = function(len) {
  len = len || 16;
  return exports.generate(len, base30)
}


/***/ })

};
;

// load runtime
var __webpack_require__ = require("../../../../webpack-api-runtime.js");
__webpack_require__.C(exports);
var __webpack_exec__ = (moduleId) => (__webpack_require__(__webpack_require__.s = moduleId))
var __webpack_exports__ = __webpack_require__.X(0, [8180,2921,9557,5245,1808,4006,8312,5710,9459,8351,4988], () => (__webpack_exec__(340176)));
module.exports = __webpack_exports__;

})();