@acorex-platform/framework-client 0.0.59 → 0.0.61

package/fesm2022/acorex-platform-framework-client-auth.mjs

@@ -1,6 +1,6 @@
 import * as i0 from '@angular/core';
 import { InjectionToken, Injector, Injectable, signal, inject, Input, Directive, Optional, Inject, NgModule, input, output, ChangeDetectionStrategy, Component } from '@angular/core';
-import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, distinctUntilChanged, of, from, combineLatest, first } from 'rxjs';
+import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, distinctUntilChanged, combineLatest, of, from, first } from 'rxjs';
 import { AXPDebugService, AXPBroadcastEventService, AXP_SESSION_SERVICE, AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, provideAppStartUpTask, AXP_APP_STARTUP_PRIORITY } from '@acorex-platform/framework-client/core';
 import { Router } from '@angular/router';
 import { isEmpty } from 'lodash-es';
@@ -445,82 +445,136 @@ function withMemoryRefreshLock(run) {
 }
 //#endregion
 
-//#region ---- Max active device sessions (client) ----
-/** Stable API / ForbiddenException code from AuthService. */
-const MAX_ACTIVE_DEVICE_SESSIONS_CODE = 'MAX_ACTIVE_DEVICE_SESSIONS';
-const PENDING_TENANT_STORAGE_KEY = 'axp.auth.sessionLimit.pendingTenant';
-function textContainsMaxSessionsCode(value) {
-    if (typeof value === 'string') {
-        return value === MAX_ACTIVE_DEVICE_SESSIONS_CODE || value.includes(MAX_ACTIVE_DEVICE_SESSIONS_CODE);
-    }
-    if (Array.isArray(value)) {
-        return value.some((item) => textContainsMaxSessionsCode(item));
-    }
-    return false;
-}
+//#region ----- Auth refresh failure classification -----
 /**
- * Detects tenant max concurrent device-session rejection from command / HTTP shapes.
- * Must recognize {@link Error} subclasses (e.g. AuthApiError) via `.message`.
+ * Stable server codes for definitive refresh/session death (prefer over message text).
+ * Keep in sync with `AUTH_REFRESH_ERROR_CODES` / `SESSION_MEMBERSHIP_DENIED` on the server.
  */
-function isMaxActiveDeviceSessionsError(error) {
+const DEFINITIVE_AUTH_REFRESH_CODES = [
+    'REFRESH_MISSING',
+    'REFRESH_EXPIRED',
+    'REFRESH_REVOKED',
+    'REFRESH_REUSE',
+    'SESSION_REVOKED',
+    'USER_NOT_FOUND',
+    'SESSION_MEMBERSHIP_DENIED',
+];
+/**
+ * Backward-compatible message patterns when older servers omit `code`.
+ * Do NOT treat bare HTTP 401/403 / Redis unavailable / 5xx as definitive.
+ */
+const DEFINITIVE_AUTH_REFRESH_PATTERNS = [
+    /refresh token reuse detected/i,
+    /refresh token has been revoked/i,
+    /refreshToken is required/i,
+    /invalid or expired refresh token/i,
+    /invalid refresh token/i,
+    /session has been revoked/i,
+    /user not found/i,
+    /SESSION_MEMBERSHIP_DENIED/i,
+    /you do not have access to this organization/i,
+    /you do not have access to this application/i,
+];
+function collectErrorText(error) {
     if (error == null) {
-        return false;
+        return '';
     }
     if (typeof error === 'string') {
-        return textContainsMaxSessionsCode(error);
+        return error;
     }
-    if (typeof error !== 'object') {
-        return false;
+    if (error instanceof Error) {
+        return error.message;
     }
-    // Error.message is reliable for AuthApiError / Error thrown from UpdateSession.
-    if (error instanceof Error && textContainsMaxSessionsCode(error.message)) {
-        return true;
+    if (typeof error !== 'object') {
+        return String(error);
     }
     const err = error;
-    const candidates = [err['message'], err['error'], err['code']];
-    const nestedError = err['error'];
-    if (nestedError && typeof nestedError === 'object') {
-        const nested = nestedError;
-        candidates.push(nested['message'], nested['error'], nested['code']);
+    const parts = [];
+    for (const key of ['message', 'error', 'code', 'statusText']) {
+        const value = err[key];
+        if (typeof value === 'string') {
+            parts.push(value);
+        }
+    }
+    const nested = err['error'];
+    if (nested && typeof nested === 'object') {
+        parts.push(collectErrorText(nested));
     }
     const apiError = err['apiError'];
     if (apiError && typeof apiError === 'object') {
-        const api = apiError;
-        candidates.push(api['message'], api['error'], api['code']);
+        parts.push(collectErrorText(apiError));
     }
-    return candidates.some((value) => textContainsMaxSessionsCode(value));
+    return parts.filter(Boolean).join(' ');
 }
-function storeSessionLimitPendingTenant(tenant) {
-    try {
-        sessionStorage.setItem(PENDING_TENANT_STORAGE_KEY, JSON.stringify(tenant));
+function collectErrorCodes(error) {
+    if (error == null || typeof error !== 'object') {
+        return typeof error === 'string' && DEFINITIVE_AUTH_REFRESH_CODES.includes(error)
+            ? [error]
+            : [];
     }
-    catch {
-        // Ignore quota / private-mode failures; route state may still carry the tenant.
+    const err = error;
+    const codes = [];
+    for (const key of ['code', 'error']) {
+        const value = err[key];
+        if (typeof value === 'string' && value.trim()) {
+            codes.push(value.trim());
+        }
+    }
+    const apiError = err['apiError'];
+    if (apiError && typeof apiError === 'object') {
+        codes.push(...collectErrorCodes(apiError));
+    }
+    const nested = err['error'];
+    if (nested && typeof nested === 'object') {
+        codes.push(...collectErrorCodes(nested));
     }
+    const details = err['details'];
+    if (details && typeof details === 'object') {
+        codes.push(...collectErrorCodes(details));
+    }
+    return codes;
 }
-function readSessionLimitPendingTenant() {
-    try {
-        const raw = sessionStorage.getItem(PENDING_TENANT_STORAGE_KEY);
-        if (!raw) {
-            return null;
-        }
-        const parsed = JSON.parse(raw);
-        if (!parsed?.id || typeof parsed.id !== 'string') {
-            return null;
-        }
-        return parsed;
+/**
+ * True only when refresh failed because the refresh cookie / session family is dead.
+ * Network / 5xx / Redis unavailable / empty transient results → false.
+ */
+function isDefinitiveAuthRefreshFailure(error) {
+    const codes = collectErrorCodes(error);
+    if (codes.some((code) => DEFINITIVE_AUTH_REFRESH_CODES.includes(code))) {
+        return true;
     }
-    catch {
-        return null;
+    const text = collectErrorText(error);
+    if (!text.trim()) {
+        return false;
+    }
+    // Do not treat generic "Authentication failed" / Redis unavailable as definitive.
+    if (/session store \(redis\) is unavailable/i.test(text)) {
+        return false;
     }
+    return DEFINITIVE_AUTH_REFRESH_PATTERNS.some((pattern) => pattern.test(text));
 }
-function clearSessionLimitPendingTenant() {
-    try {
-        sessionStorage.removeItem(PENDING_TENANT_STORAGE_KEY);
+//#endregion
+
+//#region ----- Soft restore authorization status -----
+/**
+ * After soft restore: keep identity without promoting to Authorized when
+ * access policy could not be loaded (transient API/refresh failure).
+ */
+function resolveStatusAfterSoftRestore(options) {
+    if (!options.hasUser) {
+        return AXPSessionStatus.Unauthenticated;
     }
-    catch {
-        // ignore
+    if (options.hasCompleteWorkspace && options.policyLoadSucceeded) {
+        return AXPSessionStatus.Authorized;
     }
+    return AXPSessionStatus.Authenticated;
+}
+/**
+ * Soft-restore left the session Authenticated (policy unavailable).
+ * Retry access-policy load after connectivity / successful token refresh recovers.
+ */
+function shouldRetryAccessPolicyAuthorization(status) {
+    return status === AXPSessionStatus.Authenticated;
 }
 //#endregion
 
@@ -539,7 +593,13 @@ class AXPSessionService {
         /** In-memory catalog caches — shared by guards and chooser UI (one List* per bind). */
         this.tenantsListCache = null;
         this.applicationsListCache = null;
+        /** Bumps when catalogs must re-fetch (e.g. after tenant-request approve). */
+        this.catalogEpoch$ = new BehaviorSubject(0);
         this.signoutInFlight = null;
+        /** Coalesces soft-restore → Authorized promotion after connectivity recovers. */
+        this.accessPolicyRetryInFlight = null;
+        this.softRestoreOnlineRecoveryAttached = false;
+        this.softRestoreOnlineRecoveryHandler = null;
         this.status = new BehaviorSubject(AXPSessionStatus.Unauthenticated);
         this.status$ = this.status.asObservable().pipe(shareReplay(1));
         // Add loading state to prevent premature redirects
@@ -568,7 +628,10 @@ class AXPSessionService {
         this.isAuthorized$ = this.status$.pipe(map((status) => status === AXPSessionStatus.Authorized), shareReplay(1));
         this.isReadyForAppScopedApi$ = this.isAuthorized$.pipe(map((authorized) => authorized && this.hasSessionCredentials()), distinctUntilChanged(), shareReplay(1));
         /** Tenant list for the signed-in user; skips the API when there is no cookie session. */
-        this.tenants$ = this.isAuthenticated$.pipe(distinctUntilChanged(), switchMap((authenticated) => {
+        this.tenants$ = combineLatest([
+            this.isAuthenticated$,
+            this.catalogEpoch$,
+        ]).pipe(switchMap(([authenticated]) => {
             if (!authenticated || !this.hasSessionCredentials()) {
                 return of([]);
             }
@@ -658,9 +721,12 @@ class AXPSessionService {
             const strategyName = sessionData.strategy;
             const strategy = strategyName ? this.authStrategyRegistry.get(strategyName) : null;
             if (!strategy) {
-                this.clearSession();
-                this.status.next(AXPSessionStatus.Unauthorized);
-                traceAuthRestore('Strategy missing — cleared', () => ({ strategyName }));
+                // Keep AXP_SESSION — wiping here permanently logs the user out on a
+                // registry timing race. Soft-restore; interceptor can refresh later.
+                warnAuthLifecycle('Restore strategy missing — soft restore (kept session)', () => ({
+                    strategyName,
+                }));
+                await this.softRestoreFromStoredSession(sessionData);
                 return;
             }
             // Keep subjects warm for refresh context, but do NOT mark Authenticated yet —
@@ -674,23 +740,48 @@ class AXPSessionService {
                 applicationId: sessionData.application?.id,
                 strategy: strategyName,
             }));
-            // Cross-tab exclusive refresh — avoids concurrent jti reuse / sid revoke.
-            const refreshResult = await this.refreshCookieSessionExclusive(strategyName, strategy);
-            if (!refreshResult?.succeed || !refreshResult.data?.user) {
-                this.clearSession();
-                this.status.next(AXPSessionStatus.Unauthorized);
-                traceAuthRestore('Refresh failed — cleared');
-                return;
+            try {
+                // Cross-tab exclusive refresh — avoids concurrent jti reuse / sid revoke.
+                const refreshResult = await this.refreshCookieSessionExclusive(strategyName, strategy);
+                if (refreshResult?.succeed && refreshResult.data?.user) {
+                    await this.applySignInResult(strategyName, refreshResult);
+                    traceAuthRestore('Restore complete', () => ({
+                        ms: Date.now() - startedAt,
+                        status: this.status.value,
+                        tenantId: this.tenant?.id,
+                        applicationId: this.application?.id,
+                    }));
+                    return;
+                }
+                // succeed:false without throw — usually lock/metadata race; do not kick out.
+                warnAuthLifecycle('Restore refresh returned empty — soft restore (kept session)');
+                await this.softRestoreFromStoredSession(sessionData);
+            }
+            catch (error) {
+                if (isDefinitiveAuthRefreshFailure(error)) {
+                    this.clearSession();
+                    this.status.next(AXPSessionStatus.Unauthorized);
+                    traceAuthRestore('Restore refresh rejected — cleared', () => ({
+                        error: error instanceof Error ? error.message : String(error),
+                    }));
+                    return;
+                }
+                // Network / 5xx / aborted XHR after HMR reload — keep local session.
+                warnAuthLifecycle('Restore refresh transient failure — soft restore (kept session)', () => ({
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+                await this.softRestoreFromStoredSession(sessionData);
             }
-            await this.applySignInResult(strategyName, refreshResult);
-            traceAuthRestore('Restore complete', () => ({
-                ms: Date.now() - startedAt,
-                status: this.status.value,
-                tenantId: this.tenant?.id,
-                applicationId: this.application?.id,
-            }));
         }
         catch (error) {
+            const sessionData = this.getSessionData();
+            if (sessionData?.user && sessionData.cookieSession && !isDefinitiveAuthRefreshFailure(error)) {
+                warnAuthLifecycle('Restore error — soft restore (kept session)', () => ({
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+                await this.softRestoreFromStoredSession(sessionData);
+                return;
+            }
             this.clearSession();
             this.status.next(AXPSessionStatus.Unauthorized);
             traceAuthRestore('Restore error — cleared', () => ({
@@ -701,6 +792,122 @@ class AXPSessionService {
             this.isLoading.next(false);
         }
     }
+    /**
+     * Trust persisted AXP_SESSION after a non-definitive restore refresh failure.
+     * Keeps identity; promotes to Authorized only when access policy load succeeds.
+     */
+    async softRestoreFromStoredSession(sessionData) {
+        this.currentUserSubject.next(sessionData.user ?? null);
+        this.currentTenantSubject.next(sessionData.tenant ?? null);
+        this.currentApplicationSubject.next(sessionData.application ?? null);
+        const policyLoadSucceeded = await this.tryLoadAccessPolicyForSoftRestore();
+        const nextStatus = resolveStatusAfterSoftRestore({
+            hasUser: !!sessionData.user,
+            hasCompleteWorkspace: this.hasCompleteSessionContext(),
+            policyLoadSucceeded,
+        });
+        this.status.next(nextStatus);
+        traceAuthRestore('Soft restore status', () => ({
+            status: nextStatus,
+            policyLoadSucceeded,
+            tenantId: sessionData.tenant?.id ?? null,
+            applicationId: sessionData.application?.id ?? null,
+        }));
+        if (shouldRetryAccessPolicyAuthorization(nextStatus)) {
+            this.armSoftRestorePolicyRecovery();
+        }
+    }
+    /**
+     * Soft-restore policy load: success = both loaders completed without throw
+     * (empty permission/feature lists still count as a successful load).
+     */
+    async tryLoadAccessPolicyForSoftRestore() {
+        if (!this.hasCompleteSessionContext()) {
+            this.permissionsSubject.next([]);
+            this.featuresSubject.next([]);
+            return false;
+        }
+        let permissionsOk = false;
+        let featuresOk = false;
+        try {
+            const permissions = await this.permissionLoader.getList(this.getContext());
+            this.permissionsSubject.next(permissions ?? []);
+            permissionsOk = true;
+        }
+        catch (error) {
+            warnAuthLifecycle('Soft restore permissions load failed — stay Authenticated', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
+            this.permissionsSubject.next([]);
+        }
+        try {
+            const features = await this.featureLoader.getList(this.getContext());
+            this.featuresSubject.next(features ?? []);
+            featuresOk = true;
+        }
+        catch (error) {
+            warnAuthLifecycle('Soft restore features load failed — stay Authenticated', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
+            this.featuresSubject.next([]);
+        }
+        return permissionsOk && featuresOk;
+    }
+    /**
+     * Retries access-policy load after a soft restore that stayed Authenticated.
+     * On success with complete workspace, promotes to Authorized (no logout on failure).
+     * Coalesces concurrent callers (refresh / online / successful API).
+     */
+    async retryAccessPolicyAuthorization() {
+        if (!this.user) {
+            return false;
+        }
+        if (!shouldRetryAccessPolicyAuthorization(this.status.value)) {
+            return this.status.value === AXPSessionStatus.Authorized;
+        }
+        if (this.accessPolicyRetryInFlight) {
+            return this.accessPolicyRetryInFlight;
+        }
+        this.accessPolicyRetryInFlight = (async () => {
+            const policyLoadSucceeded = await this.tryLoadAccessPolicyForSoftRestore();
+            const nextStatus = resolveStatusAfterSoftRestore({
+                hasUser: true,
+                hasCompleteWorkspace: this.hasCompleteSessionContext(),
+                policyLoadSucceeded,
+            });
+            this.status.next(nextStatus);
+            if (nextStatus === AXPSessionStatus.Authorized) {
+                this.disarmSoftRestorePolicyRecovery();
+            }
+            return nextStatus === AXPSessionStatus.Authorized;
+        })().finally(() => {
+            this.accessPolicyRetryInFlight = null;
+        });
+        return this.accessPolicyRetryInFlight;
+    }
+    /**
+     * Bounded recovery after soft-restore Authenticated: browser `online` once per arm.
+     * Successful token refresh also retries (see {@link refreshToken}).
+     */
+    armSoftRestorePolicyRecovery() {
+        if (this.softRestoreOnlineRecoveryAttached || typeof window === 'undefined') {
+            return;
+        }
+        this.softRestoreOnlineRecoveryAttached = true;
+        this.softRestoreOnlineRecoveryHandler = () => {
+            void this.retryAccessPolicyAuthorization();
+        };
+        window.addEventListener('online', this.softRestoreOnlineRecoveryHandler);
+    }
+    disarmSoftRestorePolicyRecovery() {
+        if (this.softRestoreOnlineRecoveryAttached &&
+            this.softRestoreOnlineRecoveryHandler &&
+            typeof window !== 'undefined') {
+            window.removeEventListener('online', this.softRestoreOnlineRecoveryHandler);
+        }
+        this.softRestoreOnlineRecoveryAttached = false;
+        this.softRestoreOnlineRecoveryHandler = null;
+    }
     async signin(credentials) {
         this.isLoading.next(true);
         const startedAt = Date.now();
@@ -835,6 +1042,7 @@ class AXPSessionService {
             const result = await withAuthRefreshLock(() => strategy.updateToken(params));
             if (result?.succeed) {
                 if (params?.['code']) {
+                    // OAuth code exchange replaces identity metadata; wipe stale local fields first.
                     this.clearSession();
                     clearOAuthPendingStrategy();
                 }
@@ -863,30 +1071,28 @@ class AXPSessionService {
                 }));
             }
             else {
-                this.status.next(AXPSessionStatus.Unauthenticated);
-                throw new Error(`Invalid Username or Password`);
+                throw new Error('UpdateSession failed');
             }
         }
         catch (error) {
             traceAuthLifecycleError('UpdateSession failed', () => ({
                 error: error instanceof Error ? error.message : String(error),
             }));
-            warnAuthWorkspace('UpdateSession failed — clearing session (logout UX)', () => ({
+            warnAuthWorkspace('UpdateSession failed — identity session kept', () => ({
                 error: error instanceof Error ? error.message : String(error),
                 tenantId: params?.['tenant']?.id ?? params?.['tenantId'] ?? null,
                 applicationId: params?.['application']?.id ?? params?.['applicationId'] ?? null,
             }));
-            // Failed workspace bind must not leave a half-authenticated cookie session
-            // (that causes splash restore loops after refresh).
-            // Exception: max device sessions — keep identity session so the user can
-            // terminate another device and retry tenant bind.
-            if (isMaxActiveDeviceSessionsError(error)) {
-                throw error;
-            }
             if (params?.['code']) {
                 clearOAuthPendingStrategy();
             }
-            this.clearSession();
+            // Workspace bind failure (tenant/app/network/membership) must not log the user out.
+            // Restore subjects from AXP_SESSION after the optimistic application clear above.
+            this.syncContextSubjectsFromStorage();
+            const stored = this.getSessionData();
+            if (stored?.user && stored.cookieSession) {
+                await this.syncSessionAuthorization();
+            }
             throw error;
         }
         finally {
@@ -954,21 +1160,31 @@ class AXPSessionService {
         try {
             const result = await this.refreshCookieSessionExclusive(strategyName, strategy);
             if (!result.succeed || !result.data?.user) {
-                warnAuthLifecycle('Token refresh failed — clearing session', () => ({
+                // Empty result is usually a lock/metadata race — not proof the cookie is dead.
+                warnAuthLifecycle('Token refresh returned empty — session kept', () => ({
                     strategy: strategyName,
                 }));
-                this.clearSession();
-                this.status.next(AXPSessionStatus.Expired);
                 throw new Error('Token refresh failed');
             }
+            // Soft restore may have left Authenticated; promote once API/refresh works again.
+            if (shouldRetryAccessPolicyAuthorization(this.status.value)) {
+                await this.retryAccessPolicyAuthorization();
+            }
             return true;
         }
         catch (error) {
-            warnAuthLifecycle('Token refresh error — clearing session', () => ({
-                error: error instanceof Error ? error.message : String(error),
-            }));
-            this.clearSession();
-            this.status.next(AXPSessionStatus.Expired);
+            if (isDefinitiveAuthRefreshFailure(error)) {
+                warnAuthLifecycle('Token refresh definitive failure — clearing session', () => ({
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+                this.clearSession();
+                this.status.next(AXPSessionStatus.Expired);
+            }
+            else {
+                warnAuthLifecycle('Token refresh transient error — session kept', () => ({
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+            }
             throw error;
         }
     }
@@ -1128,6 +1344,14 @@ class AXPSessionService {
         this.tenantsListCache = null;
         this.applicationsListCache = null;
     }
+    /**
+     * Drops ListTenants / ListApplications caches and re-emits {@link tenants$}.
+     * Call after membership/tenant availability changes (e.g. approve tenant request).
+     */
+    invalidateCatalogCaches() {
+        this.clearCatalogCaches();
+        this.catalogEpoch$.next(this.catalogEpoch$.value + 1);
+    }
     async signInComplete() {
         // Ensure we have the required data
         if (!this.user) {
@@ -1222,6 +1446,7 @@ class AXPSessionService {
         }
     }
     clearSession() {
+        this.disarmSoftRestorePolicyRecovery();
         this.invalidateAccessPolicyCache();
         this.clearCatalogCaches();
         this.status.next(AXPSessionStatus.Unauthenticated);
@@ -2246,6 +2471,85 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImpor
             args: [{ providedIn: 'root' }]
         }] });
 
+//#region ---- Max active device sessions (client) ----
+/** Stable API / ForbiddenException code from AuthService. */
+const MAX_ACTIVE_DEVICE_SESSIONS_CODE = 'MAX_ACTIVE_DEVICE_SESSIONS';
+const PENDING_TENANT_STORAGE_KEY = 'axp.auth.sessionLimit.pendingTenant';
+function textContainsMaxSessionsCode(value) {
+    if (typeof value === 'string') {
+        return value === MAX_ACTIVE_DEVICE_SESSIONS_CODE || value.includes(MAX_ACTIVE_DEVICE_SESSIONS_CODE);
+    }
+    if (Array.isArray(value)) {
+        return value.some((item) => textContainsMaxSessionsCode(item));
+    }
+    return false;
+}
+/**
+ * Detects tenant max concurrent device-session rejection from command / HTTP shapes.
+ * Must recognize {@link Error} subclasses (e.g. AuthApiError) via `.message`.
+ */
+function isMaxActiveDeviceSessionsError(error) {
+    if (error == null) {
+        return false;
+    }
+    if (typeof error === 'string') {
+        return textContainsMaxSessionsCode(error);
+    }
+    if (typeof error !== 'object') {
+        return false;
+    }
+    // Error.message is reliable for AuthApiError / Error thrown from UpdateSession.
+    if (error instanceof Error && textContainsMaxSessionsCode(error.message)) {
+        return true;
+    }
+    const err = error;
+    const candidates = [err['message'], err['error'], err['code']];
+    const nestedError = err['error'];
+    if (nestedError && typeof nestedError === 'object') {
+        const nested = nestedError;
+        candidates.push(nested['message'], nested['error'], nested['code']);
+    }
+    const apiError = err['apiError'];
+    if (apiError && typeof apiError === 'object') {
+        const api = apiError;
+        candidates.push(api['message'], api['error'], api['code']);
+    }
+    return candidates.some((value) => textContainsMaxSessionsCode(value));
+}
+function storeSessionLimitPendingTenant(tenant) {
+    try {
+        sessionStorage.setItem(PENDING_TENANT_STORAGE_KEY, JSON.stringify(tenant));
+    }
+    catch {
+        // Ignore quota / private-mode failures; route state may still carry the tenant.
+    }
+}
+function readSessionLimitPendingTenant() {
+    try {
+        const raw = sessionStorage.getItem(PENDING_TENANT_STORAGE_KEY);
+        if (!raw) {
+            return null;
+        }
+        const parsed = JSON.parse(raw);
+        if (!parsed?.id || typeof parsed.id !== 'string') {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function clearSessionLimitPendingTenant() {
+    try {
+        sessionStorage.removeItem(PENDING_TENANT_STORAGE_KEY);
+    }
+    catch {
+        // ignore
+    }
+}
+//#endregion
+
 const AXP_USER_AVATAR_CACHE_PORT = new InjectionToken('AXP_USER_AVATAR_CACHE_PORT');
 
 //#region ---- User profile identity service ----
@@ -2495,5 +2799,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace, warnAuthAccessPolicy, warnAuthLifecycle, warnAuthWorkspace };
+export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, DEFINITIVE_AUTH_REFRESH_CODES, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isDefinitiveAuthRefreshFailure, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, resolveStatusAfterSoftRestore, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, shouldRetryAccessPolicyAuthorization, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace, warnAuthAccessPolicy, warnAuthLifecycle, warnAuthWorkspace };
 //# sourceMappingURL=acorex-platform-framework-client-auth.mjs.map