@abp/ng.oauth 9.3.6 → 10.0.0-rc.2

package/fesm2022/abp-ng.oauth.mjs

@@ -1,13 +1,12 @@
 import * as i0 from '@angular/core';
-import { inject, Injectable, Inject, signal, provideAppInitializer, makeEnvironmentProviders, NgModule } from '@angular/core';
-import * as i2 from '@abp/ng.core';
-import { EnvironmentService, NAVIGATE_TO_MANAGE_PROFILE, AuthService, CORE_OPTIONS, IS_EXTERNAL_REQUEST, TENANT_KEY, AbpLocalStorageService, ConfigStateService, HttpErrorReporterService, SessionStateService, AbpWindowService, noop, AbstractAuthErrorFilter, AuthGuard, authGuard, ApiInterceptor, PIPE_TO_LOGIN_FN_KEY, CHECK_AUTHENTICATION_STATE_FN_KEY, AuthErrorFilterService } from '@abp/ng.core';
+import { inject, Injectable, PLATFORM_ID, RESPONSE_INIT, REQUEST, Optional, Inject, DOCUMENT, Injector, signal, provideAppInitializer, makeEnvironmentProviders, NgModule } from '@angular/core';
+import { EnvironmentService, NAVIGATE_TO_MANAGE_PROFILE, AuthService, CORE_OPTIONS, SessionStateService, HttpWaitService, TENANT_KEY, IS_EXTERNAL_REQUEST, APP_STARTED_WITH_SSR, AbpLocalStorageService, AbpCookieStorageService, ConfigStateService, HttpErrorReporterService, AbpWindowService, noop, AbstractAuthErrorFilter, AuthGuard, authGuard, asyncAuthGuard, ApiInterceptor, PIPE_TO_LOGIN_FN_KEY, CHECK_AUTHENTICATION_STATE_FN_KEY, AuthErrorFilterService } from '@abp/ng.core';
 import { HttpHeaders, HTTP_INTERCEPTORS } from '@angular/common/http';
-import * as i1 from 'angular-oauth2-oidc';
-import { OAuthService, OAuthErrorEvent, OAuthInfoEvent, OAuthModule, OAuthStorage } from 'angular-oauth2-oidc';
+import { OAuthService, OAuthStorage, OAuthErrorEvent, OAuthInfoEvent, OAuthModule } from 'angular-oauth2-oidc';
+import { firstValueFrom, timer, map, filter, take, timeout, catchError, of, pipe, tap as tap$1, from, lastValueFrom, EMPTY } from 'rxjs';
+import { isPlatformServer, isPlatformBrowser } from '@angular/common';
 import compare from 'just-compare';
-import { map, filter, finalize, switchMap, tap, take } from 'rxjs/operators';
-import { pipe, of, filter as filter$1, tap as tap$1, take as take$1, from, lastValueFrom, EMPTY } from 'rxjs';
+import { map as map$1, filter as filter$1, finalize, switchMap, tap, take as take$1 } from 'rxjs/operators';
 import { Router } from '@angular/router';
 
 const NavigateToManageProfileProvider = {
@@ -56,31 +55,84 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImpor
 const abpOAuthGuard = (route, state) => {
     const oAuthService = inject(OAuthService);
     const authService = inject(AuthService);
+    const platformId = inject(PLATFORM_ID);
+    const resInit = inject(RESPONSE_INIT);
+    const environmentService = inject(EnvironmentService);
     const hasValidAccessToken = oAuthService.hasValidAccessToken();
     if (hasValidAccessToken) {
         return true;
     }
     const params = { returnUrl: state.url };
+    if (isPlatformServer(platformId) && resInit) {
+        const ssrAuthorizationUrl = environmentService.getEnvironment().oAuthConfig.ssrAuthorizationUrl;
+        const url = buildLoginUrl(ssrAuthorizationUrl, params);
+        const headers = new Headers(resInit.headers);
+        headers.set('Location', url);
+        resInit.status = 302;
+        resInit.statusText = 'Found';
+        resInit.headers = headers;
+        return;
+    }
     authService.navigateToLogin(params);
     return false;
 };
+const buildLoginUrl = (path, params) => {
+    if (!params || Object.keys(params).length === 0)
+        return path;
+    const usp = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) {
+        if (v == null)
+            continue;
+        Array.isArray(v) ? v.forEach(x => usp.append(k, String(x))) : usp.set(k, String(v));
+    }
+    return `${path}?${usp.toString()}`;
+};
+const asyncAbpOAuthGuard = (route, state) => {
+    const oAuthService = inject(OAuthService);
+    const authService = inject(AuthService);
+    const environmentService = inject(EnvironmentService);
+    const platformId = inject(PLATFORM_ID);
+    const resInit = inject(RESPONSE_INIT);
+    const { oAuthConfig } = environmentService.getEnvironment();
+    if (oAuthConfig?.responseType === 'code') {
+        return firstValueFrom(timer(0, 100).pipe(map(() => oAuthService.hasValidAccessToken()), filter(Boolean), take(1), timeout(3000), catchError(() => {
+            if (isPlatformServer(platformId) && resInit) {
+                const ssrAuthorizationUrl = environmentService.getEnvironment().oAuthConfig.ssrAuthorizationUrl;
+                const url = buildLoginUrl(ssrAuthorizationUrl, { returnUrl: state.url });
+                const headers = new Headers(resInit.headers);
+                headers.set('Location', url);
+                resInit.status = 302;
+                resInit.statusText = 'Found';
+                resInit.headers = headers;
+                return;
+            }
+            authService.navigateToLogin({ returnUrl: state.url });
+            return of(false);
+        })));
+    }
+    if (oAuthService.hasValidAccessToken()) {
+        return true;
+    }
+    authService.navigateToLogin({ returnUrl: state.url });
+    return false;
+};
 
 class OAuthConfigurationHandler {
-    constructor(oAuthService, environmentService, options) {
-        this.oAuthService = oAuthService;
-        this.environmentService = environmentService;
-        this.options = options;
+    constructor() {
+        this.oAuthService = inject(OAuthService);
+        this.environmentService = inject(EnvironmentService);
+        this.options = inject(CORE_OPTIONS);
         this.listenToSetEnvironment();
     }
     listenToSetEnvironment() {
         this.environmentService
             .createOnUpdateStream(state => state)
-            .pipe(map(environment => environment.oAuthConfig), filter(config => !compare(config, this.options.environment.oAuthConfig)))
+            .pipe(map$1(environment => environment.oAuthConfig), filter$1(config => !compare(config, this.options.environment.oAuthConfig)))
             .subscribe((config) => {
             this.oAuthService.configure(config);
         });
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthConfigurationHandler, deps: [{ token: i1.OAuthService }, { token: i2.EnvironmentService }, { token: CORE_OPTIONS }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthConfigurationHandler, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthConfigurationHandler, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthConfigurationHandler, decorators: [{
@@ -88,17 +140,14 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImpor
             args: [{
                     providedIn: 'root',
                 }]
-        }], ctorParameters: () => [{ type: i1.OAuthService }, { type: i2.EnvironmentService }, { type: undefined, decorators: [{
-                    type: Inject,
-                    args: [CORE_OPTIONS]
-                }] }] });
+        }], ctorParameters: () => [] });
 
 class OAuthApiInterceptor {
-    constructor(oAuthService, sessionState, httpWaitService, tenantKey) {
-        this.oAuthService = oAuthService;
-        this.sessionState = sessionState;
-        this.httpWaitService = httpWaitService;
-        this.tenantKey = tenantKey;
+    constructor() {
+        this.oAuthService = inject(OAuthService);
+        this.sessionState = inject(SessionStateService);
+        this.httpWaitService = inject(HttpWaitService);
+        this.tenantKey = inject(TENANT_KEY);
     }
     intercept(request, next) {
         this.httpWaitService.addRequest(request);
@@ -129,7 +178,7 @@ class OAuthApiInterceptor {
         headers['X-Requested-With'] = 'XMLHttpRequest';
         return headers;
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthApiInterceptor, deps: [{ token: i1.OAuthService }, { token: i2.SessionStateService }, { token: i2.HttpWaitService }, { token: TENANT_KEY }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthApiInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthApiInterceptor, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: OAuthApiInterceptor, decorators: [{
@@ -137,14 +186,10 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImpor
             args: [{
                     providedIn: 'root',
                 }]
-        }], ctorParameters: () => [{ type: i1.OAuthService }, { type: i2.SessionStateService }, { type: i2.HttpWaitService }, { type: undefined, decorators: [{
-                    type: Inject,
-                    args: [TENANT_KEY]
-                }] }] });
-
-const oAuthStorage = localStorage;
+        }] });
 
-function clearOAuthStorage(storage = oAuthStorage) {
+function clearOAuthStorage(injector) {
+    const storage = injector.get(OAuthStorage);
     const keys = [
         'access_token',
         'id_token',
@@ -162,27 +207,109 @@ function clearOAuthStorage(storage = oAuthStorage) {
     keys.forEach(key => storage.removeItem(key));
 }
 
-function storageFactory() {
-    return oAuthStorage;
+class ServerTokenStorageService {
+    constructor(req) {
+        this.req = req;
+        this.cookies = new Map();
+        const cookieHeader = this.req?.headers.get('cookie') ?? '';
+        for (const part of cookieHeader.split(';')) {
+            const i = part.indexOf('=');
+            if (i > -1) {
+                const k = part.slice(0, i).trim();
+                const v = decodeURIComponent(part.slice(i + 1).trim());
+                this.cookies.set(k, v);
+            }
+        }
+    }
+    getItem(key) {
+        const fromCookie = this.cookies.get(key);
+        if (fromCookie) {
+            return fromCookie;
+        }
+        return '';
+    }
+    setItem(_k, _v) { }
+    removeItem(_k) { }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: ServerTokenStorageService, deps: [{ token: REQUEST, optional: true }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: ServerTokenStorageService, providedIn: null }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: ServerTokenStorageService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: null }]
+        }], ctorParameters: () => [{ type: Request, decorators: [{
+                    type: Optional
+                }, {
+                    type: Inject,
+                    args: [REQUEST]
+                }] }] });
+
+class MockStorage {
+    constructor() {
+        this.data = new Map();
+    }
+    get length() {
+        return this.data.size;
+    }
+    clear() {
+        this.data.clear();
+    }
+    getItem(key) {
+        return this.data.get(key) || null;
+    }
+    key(index) {
+        return Array.from(this.data.keys())[index] || null;
+    }
+    removeItem(key) {
+        this.data.delete(key);
+    }
+    setItem(key, value) {
+        this.data.set(key, value);
+    }
+}
+function oAuthStorageFactory() {
+    const platformId = inject(PLATFORM_ID);
+    const appStartedWithSSR = inject(APP_STARTED_WITH_SSR);
+    if (appStartedWithSSR) {
+        return isPlatformBrowser(platformId)
+            ? inject(BrowserTokenStorageService)
+            : inject(ServerTokenStorageService);
+    }
+    return inject(AbpLocalStorageService);
 }
 
 class RememberMeService {
     constructor() {
         this.#rememberMe = 'remember_me';
         this.localStorageService = inject(AbpLocalStorageService);
+        this.cookieStorageService = inject(AbpCookieStorageService);
+        this.appStartedWithSsr = inject(APP_STARTED_WITH_SSR, { optional: true });
     }
     #rememberMe;
     set(remember) {
+        if (this.appStartedWithSsr) {
+            this.cookieStorageService.setItem(this.#rememberMe, JSON.stringify(remember));
+            return;
+        }
         this.localStorageService.setItem(this.#rememberMe, JSON.stringify(remember));
     }
     remove() {
+        if (this.appStartedWithSsr) {
+            this.cookieStorageService.removeItem(this.#rememberMe);
+            return;
+        }
         this.localStorageService.removeItem(this.#rememberMe);
     }
     get() {
+        if (this.appStartedWithSsr) {
+            return Boolean(JSON.parse(this.cookieStorageService.getItem(this.#rememberMe) || 'false'));
+        }
         return Boolean(JSON.parse(this.localStorageService.getItem(this.#rememberMe) || 'false'));
     }
     getFromToken(accessToken) {
-        const tokenBody = accessToken.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        let tokenBody = accessToken.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        while (tokenBody.length % 4 !== 0) {
+            tokenBody += '=';
+        }
         try {
             const parsedToken = JSON.parse(atob(tokenBody));
             return Boolean(parsedToken[this.#rememberMe]);
@@ -224,7 +351,7 @@ const checkAccessToken = function (injector) {
     const configState = injector.get(ConfigStateService);
     const oAuth = injector.get(OAuthService);
     if (oAuth.hasValidAccessToken() && !configState.getDeep('currentUser.id')) {
-        clearOAuthStorage();
+        clearOAuthStorage(this.injector);
     }
 };
 
@@ -251,13 +378,13 @@ class AuthFlowStrategy {
     }
     async init() {
         if (this.oAuthConfig.clientId) {
-            const shouldClear = shouldStorageClear(this.oAuthConfig.clientId, oAuthStorage);
+            const shouldClear = shouldStorageClear(this.oAuthConfig.clientId, this.injector);
             if (shouldClear)
-                clearOAuthStorage(oAuthStorage);
+                clearOAuthStorage(this.injector);
         }
         this.oAuthService.configure(this.oAuthConfig);
         this.oAuthService.events
-            .pipe(filter(event => event.type === 'token_refresh_error'))
+            .pipe(filter$1(event => event.type === 'token_refresh_error'))
             .subscribe(() => this.navigateToLogin());
         this.navigateToPreviousUrl();
         return this.oAuthService
@@ -275,31 +402,32 @@ class AuthFlowStrategy {
         const { responseType } = this.oAuthConfig;
         if (responseType === 'code') {
             this.oAuthService.events
-                .pipe(filter(event => event.type === 'token_received' && !!this.oAuthService.state), take(1), map(() => {
+                .pipe(filter$1(event => event.type === 'token_received' && !!this.oAuthService.state), take$1(1), map$1(() => {
                 const redirectUri = decodeURIComponent(this.oAuthService.state);
                 if (redirectUri && redirectUri !== '/') {
                     return redirectUri;
                 }
                 return '/';
-            }), switchMap(redirectUri => this.configState.getOne$('currentUser').pipe(filter(user => !!user?.isAuthenticated), tap(() => this.router.navigateByUrl(redirectUri)))))
+            }), switchMap(redirectUri => this.configState.getOne$('currentUser').pipe(filter$1(user => !!user?.isAuthenticated), tap(() => this.router.navigateByUrl(redirectUri)))))
                 .subscribe();
         }
     }
     refreshToken() {
-        return this.oAuthService.refreshToken().catch(() => clearOAuthStorage());
+        return this.oAuthService.refreshToken().catch(() => clearOAuthStorage(this.injector));
     }
     listenToOauthErrors() {
         this.oAuthService.events
-            .pipe(filter(event => event instanceof OAuthErrorEvent), tap((err) => {
+            .pipe(filter$1(event => event instanceof OAuthErrorEvent), tap((err) => {
             const shouldSkip = this.oAuthErrorFilterService.run(err);
             if (!shouldSkip) {
-                clearOAuthStorage();
+                clearOAuthStorage(this.injector);
             }
         }), switchMap(() => this.configState.refreshAppState()))
             .subscribe();
     }
 }
-function shouldStorageClear(clientId, storage) {
+function shouldStorageClear(clientId, injector) {
+    const storage = injector.get(OAuthStorage);
     const key = 'abpOAuthClientId';
     if (!storage.getItem(key)) {
         storage.setItem(key, clientId);
@@ -312,17 +440,25 @@ function shouldStorageClear(clientId, storage) {
 }
 
 class AuthCodeFlowStrategy extends AuthFlowStrategy {
-    constructor() {
-        super(...arguments);
+    constructor(injector) {
+        super(injector);
+        this.injector = injector;
         this.isInternalAuth = false;
+        this.platformId = injector.get(PLATFORM_ID);
+        this.appStartedWithSSR = injector.get(APP_STARTED_WITH_SSR);
+        this.document = injector.get(DOCUMENT);
     }
     async init() {
         this.checkRememberMeOption();
         this.listenToTokenReceived();
-        return super
-            .init()
-            .then(() => this.oAuthService.tryLogin().catch(noop))
-            .then(() => this.oAuthService.setupAutomaticSilentRefresh());
+        if (!this.appStartedWithSSR && isPlatformBrowser(this.platformId)) {
+            return super
+                .init()
+                .then(() => this.oAuthService.tryLogin().catch(noop))
+                .then(() => {
+                this.oAuthService.setupAutomaticSilentRefresh();
+            });
+        }
     }
     checkRememberMeOption() {
         const accessToken = this.oAuthService.getAccessToken();
@@ -344,51 +480,78 @@ class AuthCodeFlowStrategy extends AuthFlowStrategy {
         return { ...(lang && culture), ...queryParams };
     }
     setUICulture() {
-        const urlParams = new URLSearchParams(window.location.search);
-        this.configState.uiCultureFromAuthCodeFlow = urlParams.get('ui-culture');
+        if (isPlatformBrowser(this.platformId)) {
+            const urlParams = new URLSearchParams(window.location.search);
+            this.configState.uiCultureFromAuthCodeFlow = urlParams.get('ui-culture');
+        }
     }
     replaceURLParams() {
-        const location = this.windowService.window.location;
-        const history = this.windowService.window.history;
-        const query = location.search
-            .replace(/([?&])iss=[^&]*&?/, '$1')
-            .replace(/([?&])culture=[^&]*&?/, '$1')
-            .replace(/([?&])ui-culture=[^&]*&?/, '$1')
-            .replace(/[?&]+$/, '');
-        const href = location.origin + location.pathname + query + location.hash;
-        history.replaceState(null, '', href);
+        if (isPlatformBrowser(this.platformId)) {
+            const location = this.windowService.window.location;
+            const history = this.windowService.window.history;
+            const query = location.search
+                .replace(/([?&])iss=[^&]*&?/, '$1')
+                .replace(/([?&])culture=[^&]*&?/, '$1')
+                .replace(/([?&])ui-culture=[^&]*&?/, '$1')
+                .replace(/[?&]+$/, '');
+            const href = location.origin + location.pathname + query + location.hash;
+            history.replaceState(null, '', href);
+        }
     }
     listenToTokenReceived() {
-        this.oAuthService.events
-            .pipe(filter$1(event => event.type === 'token_received'), tap$1(() => {
-            this.setUICulture();
-            this.replaceURLParams();
-        }), take$1(1))
-            .subscribe();
+        if (isPlatformBrowser(this.platformId) && !this.appStartedWithSSR) {
+            this.oAuthService.events
+                .pipe(filter(event => event.type === 'token_received'), tap$1(() => {
+                //TODO: Investigate how to handle with ssr
+                this.setUICulture();
+                this.replaceURLParams();
+            }), take(1))
+                .subscribe();
+        }
     }
     navigateToLogin(queryParams) {
-        let additionalState = '';
-        if (queryParams?.returnUrl) {
-            additionalState = queryParams.returnUrl;
+        if (isPlatformBrowser(this.platformId)) {
+            if (this.appStartedWithSSR) {
+                if (this.document.defaultView) {
+                    this.document.defaultView.location.replace('/authorize');
+                }
+            }
+            else {
+                let additionalState = '';
+                if (queryParams?.returnUrl) {
+                    additionalState = queryParams.returnUrl;
+                }
+                const cultureParams = this.getCultureParams(queryParams);
+                this.oAuthService.initCodeFlow(additionalState, cultureParams);
+            }
         }
-        const cultureParams = this.getCultureParams(queryParams);
-        this.oAuthService.initCodeFlow(additionalState, cultureParams);
     }
     checkIfInternalAuth(queryParams) {
-        this.oAuthService.initCodeFlow('', this.getCultureParams(queryParams));
-        return false;
+        if (isPlatformBrowser(this.platformId)) {
+            this.oAuthService.initCodeFlow('', this.getCultureParams(queryParams));
+            return false;
+        }
     }
     logout(queryParams) {
         this.rememberMeService.remove();
-        if (queryParams?.noRedirectToLogoutUrl) {
-            this.router.navigate(['/']);
-            return from(this.oAuthService.revokeTokenAndLogout(true));
+        if (this.appStartedWithSSR) {
+            if (this.document.defaultView) {
+                this.document.defaultView.location.replace('/logout');
+            }
+        }
+        else {
+            if (queryParams?.noRedirectToLogoutUrl) {
+                this.router.navigate(['/']);
+                return from(this.oAuthService.revokeTokenAndLogout(true));
+            }
+            return from(this.oAuthService.revokeTokenAndLogout(this.getCultureParams(queryParams)));
         }
-        return from(this.oAuthService.revokeTokenAndLogout(this.getCultureParams(queryParams)));
     }
     login(queryParams) {
-        this.oAuthService.initCodeFlow('', this.getCultureParams(queryParams));
-        return of(null);
+        if (isPlatformBrowser(this.platformId)) {
+            this.oAuthService.initCodeFlow('', this.getCultureParams(queryParams));
+            return of(null);
+        }
     }
 }
 
@@ -399,7 +562,7 @@ class AuthPasswordFlowStrategy extends AuthFlowStrategy {
     }
     listenToTokenExpiration() {
         this.oAuthService.events
-            .pipe(filter(event => event instanceof OAuthInfoEvent &&
+            .pipe(filter$1(event => event instanceof OAuthInfoEvent &&
             event.type === 'token_expires' &&
             event.info === 'access_token'))
             .subscribe(() => {
@@ -447,7 +610,7 @@ class AuthPasswordFlowStrategy extends AuthFlowStrategy {
     }
     refreshToken() {
         return this.oAuthService.refreshToken().catch(() => {
-            clearOAuthStorage();
+            clearOAuthStorage(this.injector);
             this.rememberMeService.remove();
         });
     }
@@ -472,18 +635,21 @@ class AbpOAuthService {
     get isInternalAuth() {
         return this.strategy.isInternalAuth;
     }
-    constructor(injector) {
-        this.injector = injector;
+    constructor() {
+        this.injector = inject(Injector);
+        this.appStartedWithSsr = this.injector.get(APP_STARTED_WITH_SSR);
+        this.platformId = this.injector.get(PLATFORM_ID);
+        this.document = this.injector.get(DOCUMENT);
         this.oAuthService = this.injector.get(OAuthService);
     }
     async init() {
         const environmentService = this.injector.get(EnvironmentService);
-        const result$ = environmentService.getEnvironment$().pipe(map(env => env?.oAuthConfig), filter(Boolean), tap(oAuthConfig => {
+        const result$ = environmentService.getEnvironment$().pipe(map$1(env => env?.oAuthConfig), filter$1(Boolean), tap(oAuthConfig => {
             this.strategy =
                 oAuthConfig.responseType === 'code'
                     ? AUTH_FLOW_STRATEGY.Code(this.injector)
                     : AUTH_FLOW_STRATEGY.Password(this.injector);
-        }), switchMap(() => from(this.strategy.init())), take(1));
+        }), switchMap(() => from(this.strategy.init())), take$1(1));
         return await lastValueFrom(result$);
     }
     logout(queryParams) {
@@ -522,12 +688,16 @@ class AbpOAuthService {
         return this.oAuthService.getAccessToken();
     }
     refreshToken() {
+        if (isPlatformBrowser(this.platformId) && this.appStartedWithSsr) {
+            this.document.defaultView?.location.replace('/authorize');
+            return Promise.resolve();
+        }
         return this.oAuthService.refreshToken();
     }
     getAccessTokenExpiration() {
         return this.oAuthService.getAccessTokenExpiration();
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: AbpOAuthService, deps: [{ token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: AbpOAuthService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: AbpOAuthService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: AbpOAuthService, decorators: [{
@@ -535,7 +705,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImpor
             args: [{
                     providedIn: 'root',
                 }]
-        }], ctorParameters: () => [{ type: i0.Injector }] });
+        }], ctorParameters: () => [] });
 
 class OAuthErrorFilterService extends AbstractAuthErrorFilter {
     constructor() {
@@ -577,6 +747,43 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImpor
             args: [{ providedIn: 'root' }]
         }] });
 
+class BrowserTokenStorageService {
+    getItem(key) {
+        return this.readCookie(key);
+    }
+    removeItem(key) {
+        this.removeCookie(key);
+    }
+    setItem(key, data) {
+        this.writeCookie(key, data);
+    }
+    readCookie(name) {
+        if (typeof document === 'undefined')
+            return null;
+        const match = document.cookie.match(new RegExp('(^| )' + name + '=([^;]+)'));
+        return match ? decodeURIComponent(match[2]) : null;
+    }
+    writeCookie(name, value, days = 7) {
+        if (typeof document === 'undefined')
+            return;
+        const expires = new Date(Date.now() + days * 86400000).toUTCString();
+        document.cookie = `${name}=${encodeURIComponent(value)}; expires=${expires}; path=/; Secure; SameSite=Lax`;
+    }
+    removeCookie(name) {
+        if (typeof document === 'undefined')
+            return;
+        document.cookie = `${name}=; Max-Age=0; path=/;`;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: BrowserTokenStorageService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: BrowserTokenStorageService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImport: i0, type: BrowserTokenStorageService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
+        }] });
+
 function provideAbpOAuth() {
     const providers = [
         {
@@ -591,6 +798,10 @@ function provideAbpOAuth() {
             provide: authGuard,
             useValue: abpOAuthGuard,
         },
+        {
+            provide: asyncAuthGuard,
+            useValue: asyncAbpOAuthGuard,
+        },
         {
             provide: ApiInterceptor,
             useClass: OAuthApiInterceptor,
@@ -613,7 +824,12 @@ function provideAbpOAuth() {
             inject(OAuthConfigurationHandler);
         }),
         OAuthModule.forRoot().providers,
-        { provide: OAuthStorage, useClass: AbpLocalStorageService },
+        ServerTokenStorageService,
+        BrowserTokenStorageService,
+        {
+            provide: OAuthStorage,
+            useFactory: oAuthStorageFactory,
+        },
         { provide: AuthErrorFilterService, useExisting: OAuthErrorFilterService },
     ];
     return makeEnvironmentProviders(providers);
@@ -641,5 +857,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.0.7", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_FLOW_STRATEGY, AbpOAuthGuard, AbpOAuthModule, AbpOAuthService, AuthCodeFlowStrategy, AuthFlowStrategy, AuthPasswordFlowStrategy, NavigateToManageProfileProvider, OAuthApiInterceptor, OAuthConfigurationHandler, OAuthErrorFilterService, RememberMeService, abpOAuthGuard, checkAccessToken, clearOAuthStorage, isTokenExpired, oAuthStorage, pipeToLogin, provideAbpOAuth, storageFactory };
+export { AUTH_FLOW_STRATEGY, AbpOAuthGuard, AbpOAuthModule, AbpOAuthService, AuthCodeFlowStrategy, AuthFlowStrategy, AuthPasswordFlowStrategy, BrowserTokenStorageService, MockStorage, NavigateToManageProfileProvider, OAuthApiInterceptor, OAuthConfigurationHandler, OAuthErrorFilterService, RememberMeService, ServerTokenStorageService, abpOAuthGuard, asyncAbpOAuthGuard, buildLoginUrl, checkAccessToken, clearOAuthStorage, isTokenExpired, oAuthStorageFactory, pipeToLogin, provideAbpOAuth };
 //# sourceMappingURL=abp-ng.oauth.mjs.map