/*!
 * Copyright (C) Microsoft Corporation. All rights reserved.
 */
/**
 * Parse a CAE (Continuous Access Evaluation) claims challenge from a
 * WWW-Authenticate header.
 *
 * Returns the decoded claims JSON string when a Bearer challenge with
 * `error="insufficient_claims"` is found, or `undefined` otherwise.
 */
export function parseCaeChallenge(wwwAuthenticate) {
    if (!wwwAuthenticate) {
        return undefined;
    }
    // Split on "Bearer " to handle multiple challenges in one header.
    const challenges = wwwAuthenticate.split('Bearer ');
    for (const challenge of challenges) {
        if (!challenge.includes('error="insufficient_claims"')) {
            continue;
        }
        const claimsMatch = challenge.match(/claims="([^"]+)"/);
        if (!claimsMatch) {
            continue;
        }
        try {
            return atob(claimsMatch[1]);
        }
        catch {
            // Malformed base64 — treat as no challenge.
            return undefined;
        }
    }
    return undefined;
}
//# sourceMappingURL=CaeUtils.js.map