@cleavelandprice/ngx-lib 4.7.3 → 4.7.4

package/fesm2022/cleavelandprice-ngx-lib-authentication-sso.mjs

@@ -0,0 +1,468 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, EventEmitter, Output, Optional, Inject, Injectable, SkipSelf, NgModule, inject } from '@angular/core';
+import { NgxLibServiceBase } from '@cleavelandprice/ngx-lib';
+import { BrowserCacheLocation, PublicClientApplication } from '@azure/msal-browser';
+import { CommonModule } from '@angular/common';
+import { Router } from '@angular/router';
+import { take, map } from 'rxjs/operators';
+
+// What is a InjectionToken?
+// An InjectionToken is a way to create a token that can be used to inject a dependency into an Angular service or component.
+// It allows you to define a unique identifier for a dependency, which can then be used to retrieve the dependency from the Angular dependency injection system.
+// This is particularly useful when you want to inject a value that is not a class, such as a configuration object or a string.
+// Great explaination of InjectionToken: https://youtu.be/GvA7xnBmEto?si=_Nc2DTzdsb0jdvuk
+const AuthenticationSSOServiceOptionsToken = new InjectionToken('AuthenticationSSOServiceOptions');
+
+// This service implements authentication using Microsoft Entra ID (formerly Azure AD) via the Microsoft Authentication Library (MSAL).
+// It provides methods for logging in, logging out, and validating the authenticated user, while managing token storage and refresh.
+// It also supports cross-tab synchronization of authentication state using the BroadcastChannel API.
+// It also supports revalidating authentication state when the user returns to a tab after it has been backgrounded for a period of time.
+// It also supports storing the token in either localStorage or sessionStorage, based on the user's preference.
+// It also supports determining if the token is expired and refreshing it if necessary, or logging the user out if the token cannot be refreshed.
+class AuthenticationSSOService extends NgxLibServiceBase {
+    // Microsoft Authentication Library (MSAL) instance for handling authentication
+    #msal;
+    // Tracks one-time MSAL initialize() completion.
+    #initialized;
+    // Cross-tab messaging channel (same-origin tabs only).
+    #channel;
+    // Broadcast payload sent between tabs to synchronize logout.
+    #logoutMessage;
+    // Coalescing flags used when syncing auth after tab visibility/focus resumes.
+    #resumeCheckInProgress;
+    #lastResumeCheckAt;
+    // Timer id used to refresh tokens before expiry.
+    #tokenRefreshTimeoutId;
+    //#endregion
+    //#region Properties
+    // I don't agree with these properties being required in the AbstractAuthenticationService interface
+    // I think this should be set in the options passed to the service.
+    // I know this is used in the login components under material but a developer who wants to use their own login with sessionStorage would need to know that they need to create a localStorage item called 'storeTokenInSession' and set it to true
+    // I have added a cacheLocation option to the AuthenticationSSOServiceOptions interface but if the users don't set it, they can use these properties to set the storage location
+    get useSessionStorage() {
+        return !!localStorage.getItem('storeTokenInSession');
+    }
+    get storage() {
+        return this.useSessionStorage ?
+            sessionStorage :
+            localStorage;
+    }
+    //#endregion
+    //#region Lifecycle
+    constructor(options) {
+        super(options);
+        this.options = options;
+        //#region Fields
+        this.authenticating = false; // Flag set to true while the service is attempting to authenticate the user
+        this.authenticated = false; // Flag set to true when the user is successfully authenticated
+        // error NG8110: Unsupported call to the output function. This function can only be used as the initializer of a property on a @Component or @Directive class.
+        /*authenticatedChanged = output<boolean>();
+        authenticatingChanged = output<boolean>();
+        authenticationError = output();*/
+        this.authenticatedChanged = new EventEmitter();
+        this.authenticatingChanged = new EventEmitter();
+        this.authenticationError = new EventEmitter();
+        // Tracks one-time MSAL initialize() completion.
+        this.#initialized = false;
+        // Broadcast payload sent between tabs to synchronize logout.
+        this.#logoutMessage = 'logout';
+        // Coalescing flags used when syncing auth after tab visibility/focus resumes.
+        this.#resumeCheckInProgress = false;
+        this.#lastResumeCheckAt = 0;
+        const authenticationEndpoint = options.authenticationEndpoint ?? `https://login.microsoftonline.com/${options.tenantId}`;
+        this.options = {
+            ...options,
+            tokenName: options.tokenName ?? options.clientId + '-token',
+            authenticationEndpoint
+        };
+        // if the user didn't set the cacheLocation in the options, we will set it to sessionStorage if useSessionStorage is true, otherwise we will set it to localStorage
+        this.options.cacheLocation = this.options.cacheLocation ?? (this.useSessionStorage ? 'sessionStorage' : 'localStorage');
+        // MSAL configuration for this SPA.
+        // Cache remains in sessionStorage so each tab has isolated auth cache.
+        const msalConfig = {
+            auth: {
+                clientId: this.options.clientId,
+                authority: this.options.authenticationEndpoint,
+                redirectUri: this.options.redirectUri,
+                postLogoutRedirectUri: this.options.postLogoutRedirectUri
+            },
+            cache: {
+                cacheLocation: this.options.cacheLocation === 'sessionStorage' ? BrowserCacheLocation.SessionStorage : BrowserCacheLocation.LocalStorage
+            }
+        };
+        // Create MSAL client based on the configuration.
+        // We still need to call initialize() before using it, but this ensures that we only create one instance of the client.
+        this.#msal = new PublicClientApplication(msalConfig);
+        // Initialize the BroadcastChannel for cross-tab communication
+        this.#initializeBroadcastChannel();
+        // Register resume listeners so returning to a tab revalidates auth state.
+        this.#registerResumeListeners();
+        // Attempt to restore authenticated state from any existing Microsoft session.
+        this.checkForExistingToken();
+    }
+    //#endregion
+    //#region Utilities
+    //Authenticate the user and store the token in Local Storage or Session Storage
+    login() {
+        this.authenticating = true;
+        this.authenticatingChanged.emit(this.authenticating);
+        console.log('AuthenticationSSOService: login() called. Authenticating user...');
+        // Initialize MSAL and then perform login via popup, followed by user validation.
+        this.#initializeMsal()
+            .then(() => this.#msal.loginPopup({
+            scopes: this.options.scopes,
+            authority: this.options.authenticationEndpoint,
+            prompt: 'select_account'
+        }))
+            .then((result) => this.validateUser(result))
+            .catch((error) => {
+            this.authenticating = false;
+            this.authenticatingChanged.emit(this.authenticating);
+            this.authenticationError.emit(error);
+        });
+    }
+    // Primary logout flow:
+    // 1) clear local state in this tab,
+    // 2) notify other tabs to clear their local state,
+    // 3) initiate Entra sign-out redirect from this initiating tab.
+    logout() {
+        this.#logoutLocalOnly(false);
+        this.#publishLogout();
+        // Only the initiating tab should call identity-provider logout.
+        this.#clearTokenRefreshTimer();
+        this.#initializeMsal()
+            .then(() => this.#msal.logoutRedirect({
+            postLogoutRedirectUri: this.options.postLogoutRedirectUri
+        }))
+            .catch((error) => {
+            console.log('ERROR: Microsoft logout failed.', error);
+        });
+    }
+    tokenExists() {
+        const token = this.storage.getItem(this.options.tokenName ?? '');
+        return !!token;
+    }
+    // validateUser() = setAuthenticatedUser()
+    // Resolves current user and token claims into the app's authenticated model.
+    // Also validates/refreshes token when needed and schedules proactive refresh.
+    async validateUser(result, account) {
+        // Resolve account from auth result or fallback account.
+        let resolvedAccount = result?.account ?? account;
+        // No account means app should be considered logged out.
+        if (!resolvedAccount) {
+            this.logout();
+            return;
+        }
+        // Keep MSAL active account in sync with resolved account context.
+        this.#msal.setActiveAccount(resolvedAccount);
+        let resolvedResult = result;
+        let claims = (resolvedResult?.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {});
+        // If token appears expired, attempt silent refresh before setting user state.
+        if (this.#isTokenExpired(claims.exp)) {
+            const refreshedResult = await this.#refreshToken(resolvedAccount);
+            // Refresh failure means we should end the session.
+            if (!refreshedResult?.account) {
+                this.logout();
+                return;
+            }
+            resolvedResult = refreshedResult;
+            resolvedAccount = refreshedResult.account;
+            claims = (resolvedResult.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {});
+            // Still expired after refresh; terminate session to avoid stale auth.
+            if (this.#isTokenExpired(claims.exp)) {
+                this.logout();
+                return;
+            }
+        }
+        // Derive a stable account name from available claims.
+        const preferredUsername = String(claims.preferred_username ?? resolvedAccount.username ?? claims.upn ?? claims.email ?? '');
+        const accountName = preferredUsername.includes('@') ? preferredUsername.split('@')[0] : preferredUsername;
+        // Map Entra claims to the app's authenticated user shape.
+        this.authenticatedUser = {
+            admin: false,
+            accountName: claims.accountName ?? accountName,
+            department: claims.department ?? '',
+            displayName: claims.displayName ?? '',
+            distinguishedName: claims.distinguishedName ?? '',
+            email: claims.mail,
+            employeeNumber: claims.employeeNumber,
+            firstName: claims.firstName ?? '',
+            hireDate: claims.hireDate ?? '',
+            lastName: claims.lastName ?? '',
+            manager: claims.manager,
+            memberOf: claims.memberOf,
+            phone: claims.phone,
+            photoUrl: claims.photoUrl,
+            sid: claims.securityIdentifier ?? '',
+            title: claims.title,
+            workShift: claims.workShift
+        };
+        // Persist id token into shared auth storage key when configured.
+        if (this.options.tokenName) {
+            const token = resolvedAccount?.idToken;
+            if (token) {
+                this.storage.setItem(this.options.tokenName, token);
+            }
+            else {
+                this.storage.removeItem(this.options.tokenName);
+            }
+        }
+        // Schedule refresh before expiration to keep session uninterrupted.
+        this.#scheduleTokenRefresh(claims.exp, resolvedAccount);
+        // Publish authenticated state changes for the rest of the app.
+        this.authenticated = true;
+        this.authenticatedChanged.emit(this.authenticated);
+        this.authenticating = false;
+        this.authenticatingChanged.emit(this.authenticating);
+    }
+    // Rehydrates auth state from existing cached account on startup.
+    // We intentionally avoid handleRedirectPromise() because this service uses popup login.
+    checkForExistingToken() {
+        this.#initializeMsal()
+            .then(() => {
+            const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];
+            if (account)
+                return this.validateUser(undefined, account);
+            return undefined;
+        })
+            .catch((error) => {
+            console.log('ERROR: Failed to hydrate Microsoft auth state.', error);
+        });
+    }
+    // Initialize MSAL if it hasn't been initialized yet
+    // This ensures that we only initialize MSAL once, even if multiple login attempts are made
+    // This is important because there is startup work that must be completed by MSAL before it can be used, and we don't want to repeat that work unnecessarily
+    async #initializeMsal() {
+        if (this.#initialized) {
+            return;
+        }
+        await this.#msal.initialize();
+        this.#initialized = true;
+    }
+    // Sets up same-origin cross-tab messaging used to fan out logout events.
+    #initializeBroadcastChannel() {
+        if (typeof BroadcastChannel === 'undefined') {
+            // Some runtimes may not support BroadcastChannel.
+            return;
+        }
+        // Create a new BroadcastChannel for cross-tab communication
+        this.#channel = new BroadcastChannel('sso-authentication-channel');
+        // Listen for messages from other tabs for logout events.
+        // When a logout message is received, the current tab will clear its local state and reload the page.
+        this.#channel.onmessage = (event) => {
+            if (event.data === this.#logoutMessage) {
+                console.log('Received logout message from another tab.');
+                // Receiving tabs clear local state and reload so route guards re-evaluate immediately.
+                this.#logoutLocalOnly(true);
+            }
+        };
+    }
+    // Registers visibility/focus listeners to re-check auth when user returns to the tab.
+    // Tabs can be backgrounded for long periods, and the user may have logged out in another tab or session.
+    #registerResumeListeners() {
+        const handleResume = () => {
+            void this.#syncAuthOnResume();
+        };
+        if (typeof document !== 'undefined') {
+            document.addEventListener('visibilitychange', () => {
+                if (document.visibilityState === 'visible') {
+                    handleResume();
+                }
+            });
+        }
+        if (typeof window !== 'undefined') {
+            window.addEventListener('focus', handleResume);
+        }
+    }
+    // Syncs auth state after resume while preventing duplicate checks from rapid events.
+    async #syncAuthOnResume() {
+        const now = Date.now();
+        // visibilitychange and focus often fire back-to-back; coalesce to one check.
+        // if now was less than 1 second since last check, skip this one.
+        if (this.#resumeCheckInProgress || now - this.#lastResumeCheckAt < 1000) {
+            return;
+        }
+        this.#resumeCheckInProgress = true;
+        this.#lastResumeCheckAt = now;
+        try {
+            await this.#initializeMsal();
+            const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];
+            if (!account)
+                return;
+            await this.validateUser(undefined, account);
+        }
+        catch (error) {
+            console.log('Error: Resume auth sync failed.', error);
+        }
+        finally {
+            this.#resumeCheckInProgress = false;
+        }
+    }
+    // Sends logout signal to other open tabs.
+    #publishLogout() {
+        this.#channel?.postMessage(this.#logoutMessage);
+    }
+    // Clears app/MSAL state in current tab without invoking provider-side logout.
+    // reloadAfterLogout is intended for non-initiating tabs to force UI reset to auth route.
+    async #logoutLocalOnly(reloadAfterLogout) {
+        this.#clearTokenRefreshTimer();
+        if (this.options.tokenName && this.storage.getItem(this.options.tokenName)) {
+            this.storage.removeItem(this.options.tokenName);
+        }
+        this.authenticatedUser = undefined;
+        this.authenticated = false;
+        this.authenticatedChanged.emit(false);
+        try {
+            await this.#initializeMsal();
+            await this.#msal.clearCache();
+            this.#msal.setActiveAccount(null);
+            // Secondary tabs should hard-refresh to guarantee route guards and app state reset.
+            if (reloadAfterLogout && typeof window !== 'undefined') {
+                window.location.reload();
+            }
+        }
+        catch (error) {
+            console.log('WARN: Local MSAL cache clear failed.', error);
+        }
+    }
+    // Returns true when token expiration is absent or in the past.
+    #isTokenExpired(expirationEpochSeconds) {
+        if (!expirationEpochSeconds) {
+            return true;
+        }
+        return Date.now() >= expirationEpochSeconds * 1000;
+    }
+    // Attempts silent token acquisition for the current account.
+    async #refreshToken(account) {
+        try {
+            return await this.#msal.acquireTokenSilent({
+                account,
+                scopes: this.options.scopes
+            });
+        }
+        catch (error) {
+            console.log('Error: Silent token refresh failed.', error);
+            return undefined;
+        }
+    }
+    // Schedules token refresh shortly before expiration.
+    // If refresh fails, session is terminated to avoid inconsistent auth state.
+    #scheduleTokenRefresh(expirationEpochSeconds, account) {
+        this.#clearTokenRefreshTimer();
+        if (!expirationEpochSeconds) {
+            return;
+        }
+        const refreshLeadTimeMs = 60_000;
+        const millisecondsUntilRefresh = expirationEpochSeconds * 1000 - Date.now() - refreshLeadTimeMs;
+        const delay = Math.max(millisecondsUntilRefresh, 0);
+        this.#tokenRefreshTimeoutId = setTimeout(() => {
+            this.#refreshToken(account)
+                .then((result) => {
+                if (result?.account) {
+                    return this.validateUser(result, result.account);
+                }
+                // No account after refresh implies invalid session.
+                this.logout();
+                return undefined;
+            })
+                .catch(() => {
+                // Any refresh exception falls back to logout for safety.
+                this.logout();
+            });
+        }, delay);
+    }
+    // Cancels any pending token refresh timer.
+    #clearTokenRefreshTimer() {
+        if (!this.#tokenRefreshTimeoutId) {
+            return;
+        }
+        clearTimeout(this.#tokenRefreshTimeoutId);
+        this.#tokenRefreshTimeoutId = undefined;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.0.0", ngImport: i0, type: AuthenticationSSOService, deps: [{ token: AuthenticationSSOServiceOptionsToken, optional: true }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.0.0", ngImport: i0, type: AuthenticationSSOService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.0.0", ngImport: i0, type: AuthenticationSSOService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: undefined, decorators: [{
+                    type: Optional
+                }, {
+                    type: Inject,
+                    args: [AuthenticationSSOServiceOptionsToken]
+                }] }], propDecorators: { authenticatedChanged: [{
+                type: Output
+            }], authenticatingChanged: [{
+                type: Output
+            }], authenticationError: [{
+                type: Output
+            }] } });
+
+class AuthenticationSSOModule {
+    static forRoot(options) {
+        return {
+            ngModule: AuthenticationSSOModule,
+            providers: [
+                {
+                    provide: AuthenticationSSOServiceOptionsToken,
+                    useValue: options
+                }
+            ]
+        };
+    }
+    constructor(parentModule) {
+        if (parentModule) {
+            throw new Error('AuthenticationSSOModule is already loaded. Import it in the AppModule only');
+        }
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.0.0", ngImport: i0, type: AuthenticationSSOModule, deps: [{ token: AuthenticationSSOModule, optional: true, skipSelf: true }], target: i0.ɵɵFactoryTarget.NgModule }); }
+    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "21.0.0", ngImport: i0, type: AuthenticationSSOModule, imports: [CommonModule] }); }
+    static { this.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "21.0.0", ngImport: i0, type: AuthenticationSSOModule, imports: [CommonModule] }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.0.0", ngImport: i0, type: AuthenticationSSOModule, decorators: [{
+            type: NgModule,
+            args: [{
+                    declarations: [],
+                    imports: [
+                        CommonModule
+                    ],
+                    exports: []
+                }]
+        }], ctorParameters: () => [{ type: AuthenticationSSOModule, decorators: [{
+                    type: Optional
+                }, {
+                    type: SkipSelf
+                }] }] });
+
+const authenticationSSOGuard = (_route, _state) => {
+    const authenticationService = inject(AuthenticationSSOService);
+    const router = inject(Router);
+    // if the user is already authenticated, allow access to the route
+    if (authenticationService.authenticated) {
+        return true;
+    }
+    if (authenticationService.tokenExists()) {
+        // we're doing this because we could've opened a new tab and the user is already logged in, so we need to check for an existing token
+        authenticationService.checkForExistingToken();
+        return authenticationService.authenticatedChanged.pipe(take(1), map(() => {
+            if (!authenticationService.authenticated) {
+                router.navigate(['']);
+                return false;
+            }
+            return true;
+        }));
+    }
+    else {
+        router.navigate(['']);
+        return false;
+    }
+};
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { AuthenticationSSOModule, AuthenticationSSOService, AuthenticationSSOServiceOptionsToken, authenticationSSOGuard };
+//# sourceMappingURL=cleavelandprice-ngx-lib-authentication-sso.mjs.map

package/fesm2022/cleavelandprice-ngx-lib-authentication-sso.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleavelandprice-ngx-lib-authentication-sso.mjs","sources":["../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/model/authentication-sso-service-options-token.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/services/authentication-sso.service.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/authentication-sso.module.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/guards/authentication-sso.guard.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/cleavelandprice-ngx-lib-authentication-sso.ts"],"sourcesContent":["import { InjectionToken } from \"@angular/core\";\r\nimport { AuthenticationSSOServiceOptions } from \"./authentication-sso-service-options\";\r\n\r\n// What is a InjectionToken?\r\n// An InjectionToken is a way to create a token that can be used to inject a dependency into an Angular service or component.\r\n// It allows you to define a unique identifier for a dependency, which can then be used to retrieve the dependency from the Angular dependency injection system.\r\n// This is particularly useful when you want to inject a value that is not a class, such as a configuration object or a string.\r\n// Great explaination of InjectionToken: https://youtu.be/GvA7xnBmEto?si=_Nc2DTzdsb0jdvuk\r\nexport const AuthenticationSSOServiceOptionsToken = new InjectionToken<AuthenticationSSOServiceOptions>('AuthenticationSSOServiceOptions');\r\n","import { EventEmitter, Inject, Injectable, Optional, Output } from '@angular/core';\r\n\r\nimport { AbstractAuthenticationService, AuthenticatedUser } from '@cleavelandprice/ngx-lib/authentication';\r\n\r\nimport { NgxLibServiceBase } from '@cleavelandprice/ngx-lib';\r\n\r\nimport { AuthenticationSSOServiceOptions } from '../model/authentication-sso-service-options';\r\nimport { AuthenticationSSOServiceOptionsToken } from './../model/authentication-sso-service-options-token';\r\nimport { AuthenticationSSOClaims } from '../model/authentication-sso-claims';\r\n\r\nimport {\r\n  AccountInfo,\r\n  AuthenticationResult,\r\n  BrowserCacheLocation,\r\n  PublicClientApplication,\r\n  type Configuration\r\n} from '@azure/msal-browser';\r\n\r\n// This service implements authentication using Microsoft Entra ID (formerly Azure AD) via the Microsoft Authentication Library (MSAL).\r\n// It provides methods for logging in, logging out, and validating the authenticated user, while managing token storage and refresh.\r\n// It also supports cross-tab synchronization of authentication state using the BroadcastChannel API.\r\n// It also supports revalidating authentication state when the user returns to a tab after it has been backgrounded for a period of time.\r\n// It also supports storing the token in either localStorage or sessionStorage, based on the user's preference.\r\n// It also supports determining if the token is expired and refreshing it if necessary, or logging the user out if the token cannot be refreshed.\r\n@Injectable({\r\n  providedIn: 'root'\r\n})\r\nexport class AuthenticationSSOService extends NgxLibServiceBase implements AbstractAuthenticationService {\r\n  //#region Fields\r\n  authenticating = false; // Flag set to true while the service is attempting to authenticate the user\r\n  authenticated = false; // Flag set to true when the user is successfully authenticated\r\n  authenticatedUser?: AuthenticatedUser; // Object representing the authenticated user\r\n\r\n  // error NG8110: Unsupported call to the output function. This function can only be used as the initializer of a property on a @Component or @Directive class.\r\n  /*authenticatedChanged = output<boolean>();\r\n  authenticatingChanged = output<boolean>();\r\n  authenticationError = output();*/\r\n  @Output() authenticatedChanged = new EventEmitter<boolean>();\r\n  @Output() authenticatingChanged = new EventEmitter<boolean>();\r\n  @Output() authenticationError = new EventEmitter();\r\n\r\n  // Microsoft Authentication Library (MSAL) instance for handling authentication\r\n  #msal: PublicClientApplication;\r\n  // Tracks one-time MSAL initialize() completion.\r\n  #initialized = false;\r\n\r\n  // Cross-tab messaging channel (same-origin tabs only).\r\n  #channel?: BroadcastChannel;\r\n  // Broadcast payload sent between tabs to synchronize logout.\r\n  #logoutMessage = 'logout';\r\n\r\n  // Coalescing flags used when syncing auth after tab visibility/focus resumes.\r\n  #resumeCheckInProgress = false;\r\n  #lastResumeCheckAt = 0;\r\n\r\n  // Timer id used to refresh tokens before expiry.\r\n  #tokenRefreshTimeoutId?: ReturnType<typeof setTimeout>;\r\n  //#endregion\r\n\r\n  //#region Properties\r\n\r\n  // I don't agree with these properties being required in the AbstractAuthenticationService interface\r\n  // I think this should be set in the options passed to the service.\r\n  // I know this is used in the login components under material but a developer who wants to use their own login with sessionStorage would need to know that they need to create a localStorage item called 'storeTokenInSession' and set it to true\r\n  // I have added a cacheLocation option to the AuthenticationSSOServiceOptions interface but if the users don't set it, they can use these properties to set the storage location\r\n\r\n  get useSessionStorage(): boolean {\r\n    return !!localStorage.getItem('storeTokenInSession');\r\n  }\r\n\r\n  get storage(): Storage {\r\n    return this.useSessionStorage ?\r\n      sessionStorage:\r\n      localStorage;\r\n  }\r\n\r\n  //#endregion\r\n\r\n  //#region Lifecycle\r\n  constructor(@Optional() @Inject(AuthenticationSSOServiceOptionsToken) protected options: AuthenticationSSOServiceOptions) {\r\n    super(options);\r\n\r\n    const authenticationEndpoint = options.authenticationEndpoint ?? `https://login.microsoftonline.com/${options.tenantId}`;\r\n\r\n    this.options = {\r\n      ...options,\r\n\r\n      tokenName: options.tokenName ?? options.clientId + '-token',\r\n      authenticationEndpoint\r\n    };\r\n\r\n    // if the user didn't set the cacheLocation in the options, we will set it to sessionStorage if useSessionStorage is true, otherwise we will set it to localStorage\r\n    this.options.cacheLocation = this.options.cacheLocation ?? (this.useSessionStorage ? 'sessionStorage' : 'localStorage');\r\n\r\n    // MSAL configuration for this SPA.\r\n    // Cache remains in sessionStorage so each tab has isolated auth cache.\r\n    const msalConfig: Configuration = {\r\n      auth: {\r\n        clientId: this.options.clientId,\r\n        authority: this.options.authenticationEndpoint,\r\n        redirectUri: this.options.redirectUri,\r\n        postLogoutRedirectUri: this.options.postLogoutRedirectUri\r\n      },\r\n      cache: {\r\n        cacheLocation: this.options.cacheLocation === 'sessionStorage' ? BrowserCacheLocation.SessionStorage : BrowserCacheLocation.LocalStorage\r\n      }\r\n    };\r\n\r\n    // Create MSAL client based on the configuration.\r\n    // We still need to call initialize() before using it, but this ensures that we only create one instance of the client.\r\n    this.#msal = new PublicClientApplication(msalConfig);\r\n\r\n    // Initialize the BroadcastChannel for cross-tab communication\r\n    this.#initializeBroadcastChannel();\r\n\r\n    // Register resume listeners so returning to a tab revalidates auth state.\r\n    this.#registerResumeListeners();\r\n\r\n    // Attempt to restore authenticated state from any existing Microsoft session.\r\n    this.checkForExistingToken();\r\n  }\r\n  //#endregion\r\n\r\n  //#region Utilities\r\n\r\n  //Authenticate the user and store the token in Local Storage or Session Storage\r\n  login(): void {\r\n    this.authenticating = true;\r\n    this.authenticatingChanged.emit(this.authenticating);\r\n\r\n    console.log('AuthenticationSSOService: login() called. Authenticating user...');\r\n\r\n    // Initialize MSAL and then perform login via popup, followed by user validation.\r\n    this.#initializeMsal()\r\n      .then(() => this.#msal.loginPopup({\r\n        scopes: this.options.scopes,\r\n        authority: this.options.authenticationEndpoint,\r\n        prompt: 'select_account'\r\n      }))\r\n      .then((result) => this.validateUser(result))\r\n      .catch((error: unknown) => {\r\n        this.authenticating = false;\r\n        this.authenticatingChanged.emit(this.authenticating);\r\n        this.authenticationError.emit(error);\r\n      });\r\n  }\r\n\r\n  // Primary logout flow:\r\n  // 1) clear local state in this tab,\r\n  // 2) notify other tabs to clear their local state,\r\n  // 3) initiate Entra sign-out redirect from this initiating tab.\r\n  logout(): void {\r\n    this.#logoutLocalOnly(false);\r\n    this.#publishLogout();\r\n\r\n    // Only the initiating tab should call identity-provider logout.\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    this.#initializeMsal()\r\n      .then(() => this.#msal.logoutRedirect({\r\n        postLogoutRedirectUri: this.options.postLogoutRedirectUri\r\n      }))\r\n      .catch((error) => {\r\n        console.log('ERROR: Microsoft logout failed.', error);\r\n      });\r\n  }\r\n\r\n  tokenExists(): boolean {\r\n    const token = this.storage.getItem(this.options.tokenName ?? '');\r\n    return !!token;\r\n  }\r\n\r\n  // validateUser() = setAuthenticatedUser()\r\n  // Resolves current user and token claims into the app's authenticated model.\r\n  // Also validates/refreshes token when needed and schedules proactive refresh.\r\n  async validateUser(result?: AuthenticationResult, account?: AccountInfo): Promise<void> {\r\n    // Resolve account from auth result or fallback account.\r\n    let resolvedAccount = result?.account ?? account;\r\n\r\n    // No account means app should be considered logged out.\r\n    if (!resolvedAccount) {\r\n      this.logout();\r\n      return;\r\n    }\r\n\r\n    // Keep MSAL active account in sync with resolved account context.\r\n    this.#msal.setActiveAccount(resolvedAccount);\r\n\r\n    let resolvedResult = result;\r\n    let claims = (resolvedResult?.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {}) as AuthenticationSSOClaims;\r\n\r\n    // If token appears expired, attempt silent refresh before setting user state.\r\n    if (this.#isTokenExpired(claims.exp)) {\r\n      const refreshedResult = await this.#refreshToken(resolvedAccount);\r\n\r\n      // Refresh failure means we should end the session.\r\n      if (!refreshedResult?.account) {\r\n        this.logout();\r\n        return;\r\n      }\r\n\r\n      resolvedResult = refreshedResult;\r\n      resolvedAccount = refreshedResult.account;\r\n      claims = (resolvedResult.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {}) as AuthenticationSSOClaims;\r\n\r\n      // Still expired after refresh; terminate session to avoid stale auth.\r\n      if (this.#isTokenExpired(claims.exp)) {\r\n        this.logout();\r\n        return;\r\n      }\r\n    }\r\n\r\n    // Derive a stable account name from available claims.\r\n    const preferredUsername = String(claims.preferred_username ?? resolvedAccount.username ?? claims.upn ?? claims.email ?? '');\r\n    const accountName = preferredUsername.includes('@') ? preferredUsername.split('@')[0] : preferredUsername;\r\n\r\n    // Map Entra claims to the app's authenticated user shape.\r\n    this.authenticatedUser = {\r\n      admin: false,\r\n      accountName: claims.accountName ?? accountName,\r\n      department: claims.department ?? '',\r\n      displayName: claims.displayName ?? '',\r\n      distinguishedName: claims.distinguishedName ?? '',\r\n      email: claims.mail,\r\n      employeeNumber: claims.employeeNumber,\r\n      firstName: claims.firstName ?? '',\r\n      hireDate: claims.hireDate ?? '',\r\n      lastName: claims.lastName ?? '',\r\n      manager: claims.manager,\r\n      memberOf: claims.memberOf,\r\n      phone: claims.phone,\r\n      photoUrl: claims.photoUrl,\r\n      sid: claims.securityIdentifier ?? '',\r\n      title: claims.title,\r\n      workShift: claims.workShift\r\n    } as AuthenticatedUser;\r\n\r\n    // Persist id token into shared auth storage key when configured.\r\n    if (this.options.tokenName) {\r\n      const token = resolvedAccount?.idToken;\r\n      if (token) {\r\n        this.storage.setItem(this.options.tokenName, token);\r\n      } else {\r\n        this.storage.removeItem(this.options.tokenName);\r\n      }\r\n    }\r\n\r\n    // Schedule refresh before expiration to keep session uninterrupted.\r\n    this.#scheduleTokenRefresh(claims.exp, resolvedAccount);\r\n\r\n    // Publish authenticated state changes for the rest of the app.\r\n    this.authenticated = true;\r\n    this.authenticatedChanged.emit(this.authenticated);\r\n\r\n    this.authenticating = false;\r\n    this.authenticatingChanged.emit(this.authenticating);\r\n  }\r\n\r\n  // Rehydrates auth state from existing cached account on startup.\r\n  // We intentionally avoid handleRedirectPromise() because this service uses popup login.\r\n  checkForExistingToken(): void {\r\n    this.#initializeMsal()\r\n      .then(() => {\r\n        const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];\r\n        if (account)\r\n          return this.validateUser(undefined, account);\r\n\r\n        return undefined;\r\n      })\r\n      .catch((error: unknown) => {\r\n        console.log('ERROR: Failed to hydrate Microsoft auth state.', error);\r\n      });\r\n  }\r\n\r\n  // Initialize MSAL if it hasn't been initialized yet\r\n  // This ensures that we only initialize MSAL once, even if multiple login attempts are made\r\n  // This is important because there is startup work that must be completed by MSAL before it can be used, and we don't want to repeat that work unnecessarily\r\n  async #initializeMsal(): Promise<void> {\r\n    if (this.#initialized) {\r\n      return;\r\n    }\r\n\r\n\r\n    await this.#msal.initialize();\r\n    this.#initialized = true;\r\n  }\r\n\r\n  // Sets up same-origin cross-tab messaging used to fan out logout events.\r\n  #initializeBroadcastChannel(): void {\r\n    if (typeof BroadcastChannel === 'undefined') {\r\n      // Some runtimes may not support BroadcastChannel.\r\n      return;\r\n    }\r\n\r\n    // Create a new BroadcastChannel for cross-tab communication\r\n    this.#channel = new BroadcastChannel('sso-authentication-channel');\r\n\r\n    // Listen for messages from other tabs for logout events.\r\n    // When a logout message is received, the current tab will clear its local state and reload the page.\r\n    this.#channel.onmessage = (event) => {\r\n      if (event.data === this.#logoutMessage) {\r\n        console.log('Received logout message from another tab.');\r\n        // Receiving tabs clear local state and reload so route guards re-evaluate immediately.\r\n        this.#logoutLocalOnly(true);\r\n      }\r\n    };\r\n  }\r\n\r\n  // Registers visibility/focus listeners to re-check auth when user returns to the tab.\r\n  // Tabs can be backgrounded for long periods, and the user may have logged out in another tab or session.\r\n  #registerResumeListeners(): void {\r\n    const handleResume = () => {\r\n      void this.#syncAuthOnResume();\r\n    };\r\n\r\n    if (typeof document !== 'undefined') {\r\n      document.addEventListener('visibilitychange', () => {\r\n        if (document.visibilityState === 'visible') {\r\n          handleResume();\r\n        }\r\n      });\r\n    }\r\n\r\n    if (typeof window !== 'undefined') {\r\n      window.addEventListener('focus', handleResume);\r\n    }\r\n  }\r\n\r\n  // Syncs auth state after resume while preventing duplicate checks from rapid events.\r\n  async #syncAuthOnResume(): Promise<void> {\r\n    const now = Date.now();\r\n\r\n    // visibilitychange and focus often fire back-to-back; coalesce to one check.\r\n    // if now was less than 1 second since last check, skip this one.\r\n    if (this.#resumeCheckInProgress || now - this.#lastResumeCheckAt < 1000) {\r\n      return;\r\n    }\r\n\r\n    this.#resumeCheckInProgress = true;\r\n    this.#lastResumeCheckAt = now;\r\n\r\n    try {\r\n      await this.#initializeMsal();\r\n\r\n      const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];\r\n\r\n      if (!account)\r\n        return;\r\n\r\n      await this.validateUser(undefined, account);\r\n    }\r\n    catch (error) {\r\n      console.log('Error: Resume auth sync failed.', error);\r\n    }\r\n    finally {\r\n      this.#resumeCheckInProgress = false;\r\n    }\r\n  }\r\n\r\n  // Sends logout signal to other open tabs.\r\n  #publishLogout(): void {\r\n    this.#channel?.postMessage(this.#logoutMessage);\r\n  }\r\n\r\n  // Clears app/MSAL state in current tab without invoking provider-side logout.\r\n  // reloadAfterLogout is intended for non-initiating tabs to force UI reset to auth route.\r\n  async #logoutLocalOnly(reloadAfterLogout: boolean): Promise<void> {\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    if (this.options.tokenName && this.storage.getItem(this.options.tokenName)) {\r\n      this.storage.removeItem(this.options.tokenName);\r\n    }\r\n\r\n    this.authenticatedUser = undefined;\r\n    this.authenticated = false;\r\n    this.authenticatedChanged.emit(false);\r\n\r\n    try {\r\n      await this.#initializeMsal();\r\n      await this.#msal.clearCache();\r\n      this.#msal.setActiveAccount(null);\r\n\r\n      // Secondary tabs should hard-refresh to guarantee route guards and app state reset.\r\n      if (reloadAfterLogout && typeof window !== 'undefined') {\r\n        window.location.reload();\r\n      }\r\n    } catch (error) {\r\n      console.log('WARN: Local MSAL cache clear failed.', error);\r\n    }\r\n  }\r\n\r\n  // Returns true when token expiration is absent or in the past.\r\n  #isTokenExpired(expirationEpochSeconds?: number): boolean {\r\n    if (!expirationEpochSeconds) {\r\n      return true;\r\n    }\r\n\r\n    return Date.now() >= expirationEpochSeconds * 1000;\r\n  }\r\n\r\n  // Attempts silent token acquisition for the current account.\r\n  async #refreshToken(account: AccountInfo): Promise<AuthenticationResult | undefined> {\r\n    try {\r\n      return await this.#msal.acquireTokenSilent({\r\n        account,\r\n        scopes: this.options.scopes\r\n      });\r\n    }\r\n    catch (error) {\r\n      console.log('Error: Silent token refresh failed.', error);\r\n      return undefined;\r\n    }\r\n  }\r\n\r\n  // Schedules token refresh shortly before expiration.\r\n  // If refresh fails, session is terminated to avoid inconsistent auth state.\r\n  #scheduleTokenRefresh(expirationEpochSeconds: number | undefined, account: AccountInfo): void {\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    if (!expirationEpochSeconds) {\r\n      return;\r\n    }\r\n\r\n    const refreshLeadTimeMs = 60_000;\r\n    const millisecondsUntilRefresh = expirationEpochSeconds * 1000 - Date.now() - refreshLeadTimeMs;\r\n    const delay = Math.max(millisecondsUntilRefresh, 0);\r\n\r\n    this.#tokenRefreshTimeoutId = setTimeout(() => {\r\n      this.#refreshToken(account)\r\n        .then((result) => {\r\n          if (result?.account) {\r\n            return this.validateUser(result, result.account);\r\n          }\r\n\r\n          // No account after refresh implies invalid session.\r\n          this.logout();\r\n          return undefined;\r\n        })\r\n        .catch(() => {\r\n          // Any refresh exception falls back to logout for safety.\r\n          this.logout();\r\n        });\r\n    }, delay);\r\n  }\r\n\r\n  // Cancels any pending token refresh timer.\r\n  #clearTokenRefreshTimer(): void {\r\n    if (!this.#tokenRefreshTimeoutId) {\r\n      return;\r\n    }\r\n\r\n    clearTimeout(this.#tokenRefreshTimeoutId);\r\n    this.#tokenRefreshTimeoutId = undefined;\r\n  }\r\n  //#endregion\r\n}\r\n","import { CommonModule } from '@angular/common';\r\nimport { ModuleWithProviders, NgModule, Optional, SkipSelf } from '@angular/core';\r\n\r\nimport { AuthenticationSSOServiceOptions } from './model/authentication-sso-service-options';\r\nimport { AuthenticationSSOServiceOptionsToken } from './model/authentication-sso-service-options-token';\r\n\r\n@NgModule({\r\n  declarations: [],\r\n  imports: [\r\n    CommonModule\r\n  ],\r\n  exports: []\r\n})\r\nexport class AuthenticationSSOModule {\r\n  static forRoot(options: AuthenticationSSOServiceOptions): ModuleWithProviders<AuthenticationSSOModule> {\r\n    return {\r\n      ngModule: AuthenticationSSOModule,\r\n      providers: [\r\n        {\r\n          provide: AuthenticationSSOServiceOptionsToken,\r\n          useValue: options\r\n        }\r\n      ]\r\n    };\r\n  }\r\n\r\n  constructor(@Optional() @SkipSelf() parentModule: AuthenticationSSOModule) {\r\n    if (parentModule) {\r\n      throw new Error(\r\n        'AuthenticationSSOModule is already loaded. Import it in the AppModule only');\r\n    }\r\n  }\r\n}\r\n","import { inject } from '@angular/core';\r\nimport { CanActivateFn, Router } from '@angular/router';\r\nimport { map, take } from 'rxjs/operators';\r\nimport { AuthenticationSSOService } from '../authentication-sso.api';\r\n\r\nexport const authenticationSSOGuard: CanActivateFn = (_route, _state) => {\r\n  const authenticationService = inject(AuthenticationSSOService);\r\n  const router = inject(Router);\r\n\r\n  // if the user is already authenticated, allow access to the route\r\n  if (authenticationService.authenticated) {\r\n    return true;\r\n  }\r\n\r\n  if (authenticationService.tokenExists()) {\r\n    // we're doing this because we could've opened a new tab and the user is already logged in, so we need to check for an existing token\r\n    authenticationService.checkForExistingToken();\r\n\r\n    return authenticationService.authenticatedChanged.pipe(\r\n      take(1),\r\n      map(() => {\r\n        if (!authenticationService.authenticated) {\r\n          router.navigate(['']);\r\n          return false;\r\n        }\r\n\r\n        return true;\r\n      })\r\n    );\r\n  }\r\n  else {\r\n    router.navigate(['']);\r\n    return false;\r\n  }\r\n};\r\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './authentication-sso.api';\n"],"names":[],"mappings":";;;;;;;;AAGA;AACA;AACA;AACA;AACA;MACa,oCAAoC,GAAG,IAAI,cAAc,CAAkC,iCAAiC;;ACUzI;AACA;AACA;AACA;AACA;AACA;AAIM,MAAO,wBAAyB,SAAQ,iBAAiB,CAAA;;AAe7D,IAAA,KAAK;;AAEL,IAAA,YAAY;;AAGZ,IAAA,QAAQ;;AAER,IAAA,cAAc;;AAGd,IAAA,sBAAsB;AACtB,IAAA,kBAAkB;;AAGlB,IAAA,sBAAsB;;;;;;;AAUtB,IAAA,IAAI,iBAAiB,GAAA;QACnB,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,qBAAqB,CAAC;;AAGtD,IAAA,IAAI,OAAO,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,iBAAiB;AAC3B,YAAA,cAAc;AACd,YAAA,YAAY;;;;AAMhB,IAAA,WAAA,CAAgF,OAAwC,EAAA;QACtH,KAAK,CAAC,OAAO,CAAC;QADgE,IAAA,CAAA,OAAO,GAAP,OAAO;;AAlDvF,QAAA,IAAA,CAAA,cAAc,GAAG,KAAK,CAAC;AACvB,QAAA,IAAA,CAAA,aAAa,GAAG,KAAK,CAAC;;AAItB;;AAEiC;AACvB,QAAA,IAAA,CAAA,oBAAoB,GAAG,IAAI,YAAY,EAAW;AAClD,QAAA,IAAA,CAAA,qBAAqB,GAAG,IAAI,YAAY,EAAW;AACnD,QAAA,IAAA,CAAA,mBAAmB,GAAG,IAAI,YAAY,EAAE;;QAKlD,IAAA,CAAA,YAAY,GAAG,KAAK;;QAKpB,IAAA,CAAA,cAAc,GAAG,QAAQ;;QAGzB,IAAA,CAAA,sBAAsB,GAAG,KAAK;QAC9B,IAAA,CAAA,kBAAkB,GAAG,CAAC;QA6BpB,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,CAAA,kCAAA,EAAqC,OAAO,CAAC,QAAQ,CAAA,CAAE;QAExH,IAAI,CAAC,OAAO,GAAG;AACb,YAAA,GAAG,OAAO;YAEV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,GAAG,QAAQ;YAC3D;SACD;;QAGD,IAAI,CAAC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,CAAC;;;AAIvH,QAAA,MAAM,UAAU,GAAkB;AAChC,YAAA,IAAI,EAAE;AACJ,gBAAA,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;AAC/B,gBAAA,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB;AAC9C,gBAAA,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;AACrC,gBAAA,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC;AACrC,aAAA;AACD,YAAA,KAAK,EAAE;AACL,gBAAA,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,GAAG,oBAAoB,CAAC;AAC7H;SACF;;;QAID,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC;;QAGpD,IAAI,CAAC,2BAA2B,EAAE;;QAGlC,IAAI,CAAC,wBAAwB,EAAE;;QAG/B,IAAI,CAAC,qBAAqB,EAAE;;;;;IAO9B,KAAK,GAAA;AACH,QAAA,IAAI,CAAC,cAAc,GAAG,IAAI;QAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;AAEpD,QAAA,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC;;QAG/E,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;AAChC,YAAA,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;AAC3B,YAAA,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB;AAC9C,YAAA,MAAM,EAAE;AACT,SAAA,CAAC;AACD,aAAA,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;AAC1C,aAAA,KAAK,CAAC,CAAC,KAAc,KAAI;AACxB,YAAA,IAAI,CAAC,cAAc,GAAG,KAAK;YAC3B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;AACpD,YAAA,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;AACtC,SAAC,CAAC;;;;;;IAON,MAAM,GAAA;AACJ,QAAA,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,cAAc,EAAE;;QAGrB,IAAI,CAAC,uBAAuB,EAAE;QAE9B,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;AACpC,YAAA,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC;AACrC,SAAA,CAAC;AACD,aAAA,KAAK,CAAC,CAAC,KAAK,KAAI;AACf,YAAA,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC;AACvD,SAAC,CAAC;;IAGN,WAAW,GAAA;AACT,QAAA,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAChE,OAAO,CAAC,CAAC,KAAK;;;;;AAMhB,IAAA,MAAM,YAAY,CAAC,MAA6B,EAAE,OAAqB,EAAA;;AAErE,QAAA,IAAI,eAAe,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO;;QAGhD,IAAI,CAAC,eAAe,EAAE;YACpB,IAAI,CAAC,MAAM,EAAE;YACb;;;AAIF,QAAA,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,eAAe,CAAC;QAE5C,IAAI,cAAc,GAAG,MAAM;AAC3B,QAAA,IAAI,MAAM,IAAI,cAAc,EAAE,aAAa,IAAI,eAAe,CAAC,aAAa,IAAI,EAAE,CAA4B;;QAG9G,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;;AAGjE,YAAA,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE;gBAC7B,IAAI,CAAC,MAAM,EAAE;gBACb;;YAGF,cAAc,GAAG,eAAe;AAChC,YAAA,eAAe,GAAG,eAAe,CAAC,OAAO;AACzC,YAAA,MAAM,IAAI,cAAc,CAAC,aAAa,IAAI,eAAe,CAAC,aAAa,IAAI,EAAE,CAA4B;;YAGzG,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBACpC,IAAI,CAAC,MAAM,EAAE;gBACb;;;;QAKJ,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,IAAI,eAAe,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3H,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB;;QAGzG,IAAI,CAAC,iBAAiB,GAAG;AACvB,YAAA,KAAK,EAAE,KAAK;AACZ,YAAA,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;AAC9C,YAAA,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;AACnC,YAAA,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;AACrC,YAAA,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,cAAc,EAAE,MAAM,CAAC,cAAc;AACrC,YAAA,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;AACjC,YAAA,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;AAC/B,YAAA,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;AACzB,YAAA,GAAG,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE;YACpC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC;SACE;;AAGtB,QAAA,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;AAC1B,YAAA,MAAM,KAAK,GAAG,eAAe,EAAE,OAAO;YACtC,IAAI,KAAK,EAAE;AACT,gBAAA,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC;;iBAC9C;gBACL,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;;;;QAKnD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC;;AAGvD,QAAA,IAAI,CAAC,aAAa,GAAG,IAAI;QACzB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;AAElD,QAAA,IAAI,CAAC,cAAc,GAAG,KAAK;QAC3B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;;;;IAKtD,qBAAqB,GAAA;QACnB,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAK;AACT,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAC/E,YAAA,IAAI,OAAO;gBACT,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;AAE9C,YAAA,OAAO,SAAS;AAClB,SAAC;AACA,aAAA,KAAK,CAAC,CAAC,KAAc,KAAI;AACxB,YAAA,OAAO,CAAC,GAAG,CAAC,gDAAgD,EAAE,KAAK,CAAC;AACtE,SAAC,CAAC;;;;;AAMN,IAAA,MAAM,eAAe,GAAA;AACnB,QAAA,IAAI,IAAI,CAAC,YAAY,EAAE;YACrB;;AAIF,QAAA,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;AAC7B,QAAA,IAAI,CAAC,YAAY,GAAG,IAAI;;;IAI1B,2BAA2B,GAAA;AACzB,QAAA,IAAI,OAAO,gBAAgB,KAAK,WAAW,EAAE;;YAE3C;;;QAIF,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,4BAA4B,CAAC;;;QAIlE,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,KAAK,KAAI;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,cAAc,EAAE;AACtC,gBAAA,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC;;AAExD,gBAAA,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;;AAE/B,SAAC;;;;IAKH,wBAAwB,GAAA;QACtB,MAAM,YAAY,GAAG,MAAK;AACxB,YAAA,KAAK,IAAI,CAAC,iBAAiB,EAAE;AAC/B,SAAC;AAED,QAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,YAAA,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,MAAK;AACjD,gBAAA,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE;AAC1C,oBAAA,YAAY,EAAE;;AAElB,aAAC,CAAC;;AAGJ,QAAA,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACjC,YAAA,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC;;;;AAKlD,IAAA,MAAM,iBAAiB,GAAA;AACrB,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;;;AAItB,QAAA,IAAI,IAAI,CAAC,sBAAsB,IAAI,GAAG,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE;YACvE;;AAGF,QAAA,IAAI,CAAC,sBAAsB,GAAG,IAAI;AAClC,QAAA,IAAI,CAAC,kBAAkB,GAAG,GAAG;AAE7B,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,eAAe,EAAE;AAE5B,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAE/E,YAAA,IAAI,CAAC,OAAO;gBACV;YAEF,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;;QAE7C,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC;;gBAE/C;AACN,YAAA,IAAI,CAAC,sBAAsB,GAAG,KAAK;;;;IAKvC,cAAc,GAAA;QACZ,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;;;;IAKjD,MAAM,gBAAgB,CAAC,iBAA0B,EAAA;QAC/C,IAAI,CAAC,uBAAuB,EAAE;AAE9B,QAAA,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YAC1E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;;AAGjD,QAAA,IAAI,CAAC,iBAAiB,GAAG,SAAS;AAClC,QAAA,IAAI,CAAC,aAAa,GAAG,KAAK;AAC1B,QAAA,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;AAErC,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,eAAe,EAAE;AAC5B,YAAA,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;AAC7B,YAAA,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC;;AAGjC,YAAA,IAAI,iBAAiB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACtD,gBAAA,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;;;QAE1B,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,CAAC;;;;AAK9D,IAAA,eAAe,CAAC,sBAA+B,EAAA;QAC7C,IAAI,CAAC,sBAAsB,EAAE;AAC3B,YAAA,OAAO,IAAI;;QAGb,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,sBAAsB,GAAG,IAAI;;;IAIpD,MAAM,aAAa,CAAC,OAAoB,EAAA;AACtC,QAAA,IAAI;AACF,YAAA,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;gBACzC,OAAO;AACP,gBAAA,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;AACtB,aAAA,CAAC;;QAEJ,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,KAAK,CAAC;AACzD,YAAA,OAAO,SAAS;;;;;IAMpB,qBAAqB,CAAC,sBAA0C,EAAE,OAAoB,EAAA;QACpF,IAAI,CAAC,uBAAuB,EAAE;QAE9B,IAAI,CAAC,sBAAsB,EAAE;YAC3B;;QAGF,MAAM,iBAAiB,GAAG,MAAM;AAChC,QAAA,MAAM,wBAAwB,GAAG,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;AAEnD,QAAA,IAAI,CAAC,sBAAsB,GAAG,UAAU,CAAC,MAAK;AAC5C,YAAA,IAAI,CAAC,aAAa,CAAC,OAAO;AACvB,iBAAA,IAAI,CAAC,CAAC,MAAM,KAAI;AACf,gBAAA,IAAI,MAAM,EAAE,OAAO,EAAE;oBACnB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;;;gBAIlD,IAAI,CAAC,MAAM,EAAE;AACb,gBAAA,OAAO,SAAS;AAClB,aAAC;iBACA,KAAK,CAAC,MAAK;;gBAEV,IAAI,CAAC,MAAM,EAAE;AACf,aAAC,CAAC;SACL,EAAE,KAAK,CAAC;;;IAIX,uBAAuB,GAAA;AACrB,QAAA,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAChC;;AAGF,QAAA,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC;AACzC,QAAA,IAAI,CAAC,sBAAsB,GAAG,SAAS;;AAza9B,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,kBAoDH,oCAAoC,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AApDzD,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,cAFvB,MAAM,EAAA,CAAA,CAAA;;2FAEP,wBAAwB,EAAA,UAAA,EAAA,CAAA;kBAHpC,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;0BAqDc;;0BAAY,MAAM;2BAAC,oCAAoC;;sBA1CnE;;sBACA;;sBACA;;;MC1BU,uBAAuB,CAAA;IAClC,OAAO,OAAO,CAAC,OAAwC,EAAA;QACrD,OAAO;AACL,YAAA,QAAQ,EAAE,uBAAuB;AACjC,YAAA,SAAS,EAAE;AACT,gBAAA;AACE,oBAAA,OAAO,EAAE,oCAAoC;AAC7C,oBAAA,QAAQ,EAAE;AACX;AACF;SACF;;AAGH,IAAA,WAAA,CAAoC,YAAqC,EAAA;QACvE,IAAI,YAAY,EAAE;AAChB,YAAA,MAAM,IAAI,KAAK,CACb,4EAA4E,CAAC;;;8GAhBxE,uBAAuB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAA,uBAAA,EAAA,QAAA,EAAA,IAAA,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,QAAA,EAAA,CAAA,CAAA;AAAvB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,mBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,YAJhC,YAAY,CAAA,EAAA,CAAA,CAAA;AAIH,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,mBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,YAJhC,YAAY,CAAA,EAAA,CAAA,CAAA;;2FAIH,uBAAuB,EAAA,UAAA,EAAA,CAAA;kBAPnC,QAAQ;AAAC,YAAA,IAAA,EAAA,CAAA;AACR,oBAAA,YAAY,EAAE,EAAE;AAChB,oBAAA,OAAO,EAAE;wBACP;AACD,qBAAA;AACD,oBAAA,OAAO,EAAE;AACV,iBAAA;;0BAcc;;0BAAY;;;MCrBd,sBAAsB,GAAkB,CAAC,MAAM,EAAE,MAAM,KAAI;AACtE,IAAA,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC;AAC9D,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;;AAG7B,IAAA,IAAI,qBAAqB,CAAC,aAAa,EAAE;AACvC,QAAA,OAAO,IAAI;;AAGb,IAAA,IAAI,qBAAqB,CAAC,WAAW,EAAE,EAAE;;QAEvC,qBAAqB,CAAC,qBAAqB,EAAE;AAE7C,QAAA,OAAO,qBAAqB,CAAC,oBAAoB,CAAC,IAAI,CACpD,IAAI,CAAC,CAAC,CAAC,EACP,GAAG,CAAC,MAAK;AACP,YAAA,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE;AACxC,gBAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACrB,gBAAA,OAAO,KAAK;;AAGd,YAAA,OAAO,IAAI;SACZ,CAAC,CACH;;SAEE;AACH,QAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACrB,QAAA,OAAO,KAAK;;AAEhB;;AClCA;;AAEG;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "comment": "NGX-LIB primary entry point package.json",
   "name": "@cleavelandprice/ngx-lib",
-  "version": "4.7.3",
+  "version": "4.7.4",
   "description": "Angular library providing foundational functionality to Cleaveland-Price applications",
   "peerDependencies": {
     "@angular/common": "^21.0.0",
@@ -53,6 +53,10 @@
       "types": "./types/cleavelandprice-ngx-lib-authentication-object.d.ts",
       "default": "./fesm2022/cleavelandprice-ngx-lib-authentication-object.mjs"
     },
+    "./authentication/sso": {
+      "types": "./types/cleavelandprice-ngx-lib-authentication-sso.d.ts",
+      "default": "./fesm2022/cleavelandprice-ngx-lib-authentication-sso.mjs"
+    },
     "./authentication/token": {
       "types": "./types/cleavelandprice-ngx-lib-authentication-token.d.ts",
       "default": "./fesm2022/cleavelandprice-ngx-lib-authentication-token.mjs"

package/types/cleavelandprice-ngx-lib-authentication-sso.d.ts

@@ -0,0 +1,90 @@
+import { AuthenticationServiceOptions, AbstractAuthenticationService, AuthenticatedUser } from '@cleavelandprice/ngx-lib/authentication';
+import * as i0 from '@angular/core';
+import { InjectionToken, EventEmitter, ModuleWithProviders } from '@angular/core';
+import { NgxLibServiceBase } from '@cleavelandprice/ngx-lib';
+import { AuthenticationResult, AccountInfo } from '@azure/msal-browser';
+import * as i1 from '@angular/common';
+import { CanActivateFn } from '@angular/router';
+
+interface AuthenticationSSOServiceOptions extends AuthenticationServiceOptions {
+    clientId: string;
+    tenantId: string;
+    redirectUri: string;
+    postLogoutRedirectUri: string;
+    scopes: string[];
+    cacheLocation?: 'localStorage' | 'sessionStorage';
+}
+
+declare const AuthenticationSSOServiceOptionsToken: InjectionToken<AuthenticationSSOServiceOptions>;
+
+interface AuthenticationSSOClaims {
+    accountName?: string;
+    aud?: string;
+    department?: string;
+    displayName?: string;
+    distinguishedName?: string;
+    employeeNumber?: string;
+    exp?: number;
+    firstName?: string;
+    hireDate?: string;
+    iat?: number;
+    iss?: string;
+    lastName?: string;
+    mail?: string;
+    manager?: string;
+    memberOf?: string;
+    sid?: string;
+    oid?: string;
+    sub?: string;
+    name?: string;
+    nbf?: number;
+    nonce?: string;
+    phone?: string;
+    photoUrl?: string;
+    preferred_username?: string;
+    rh?: string;
+    securityIdentifier?: string;
+    title?: string;
+    given_name?: string;
+    family_name?: string;
+    email?: string;
+    upn?: string;
+    tid?: string;
+    uti?: string;
+    ver?: string;
+    workShift?: string;
+}
+
+declare class AuthenticationSSOService extends NgxLibServiceBase implements AbstractAuthenticationService {
+    #private;
+    protected options: AuthenticationSSOServiceOptions;
+    authenticating: boolean;
+    authenticated: boolean;
+    authenticatedUser?: AuthenticatedUser;
+    authenticatedChanged: EventEmitter<boolean>;
+    authenticatingChanged: EventEmitter<boolean>;
+    authenticationError: EventEmitter<any>;
+    get useSessionStorage(): boolean;
+    get storage(): Storage;
+    constructor(options: AuthenticationSSOServiceOptions);
+    login(): void;
+    logout(): void;
+    tokenExists(): boolean;
+    validateUser(result?: AuthenticationResult, account?: AccountInfo): Promise<void>;
+    checkForExistingToken(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthenticationSSOService, [{ optional: true; }]>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AuthenticationSSOService>;
+}
+
+declare class AuthenticationSSOModule {
+    static forRoot(options: AuthenticationSSOServiceOptions): ModuleWithProviders<AuthenticationSSOModule>;
+    constructor(parentModule: AuthenticationSSOModule);
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthenticationSSOModule, [{ optional: true; skipSelf: true; }]>;
+    static ɵmod: i0.ɵɵNgModuleDeclaration<AuthenticationSSOModule, never, [typeof i1.CommonModule], never>;
+    static ɵinj: i0.ɵɵInjectorDeclaration<AuthenticationSSOModule>;
+}
+
+declare const authenticationSSOGuard: CanActivateFn;
+
+export { AuthenticationSSOModule, AuthenticationSSOService, AuthenticationSSOServiceOptionsToken, authenticationSSOGuard };
+export type { AuthenticationSSOClaims, AuthenticationSSOServiceOptions };