@cleavelandprice/ngx-lib 4.7.7 → 4.7.9

package/fesm2022/cleavelandprice-ngx-lib-authentication-sso.mjs

@@ -105,6 +105,10 @@ class AuthenticationSSOService extends NgxLibServiceBase {
     //#region Utilities
     //Authenticate the user and store the token in Local Storage or Session Storage
     login() {
+        // There are times this item is left in sessionStorage after logout, which can cause MSAL to think a login is in progress and block future logins.
+        // This is a workaround to ensure that the item is removed after logout.
+        if (typeof sessionStorage !== 'undefined' && sessionStorage.getItem("msal.interaction.status"))
+            sessionStorage.removeItem("msal.interaction.status");
         this.authenticating = true;
         this.authenticatingChanged.emit(this.authenticating);
         console.log('AuthenticationSSOService: login() called. Authenticating user...');
@@ -149,6 +153,7 @@ class AuthenticationSSOService extends NgxLibServiceBase {
     async validateUser(result, account) {
         // Resolve account from auth result or fallback account.
         let resolvedAccount = result?.account ?? account;
+        console.log('AuthenticationSSOService: Validating user. Result:', result, 'Account:', account, 'ResolvedAccount:', resolvedAccount);
         // No account means app should be considered logged out.
         if (!resolvedAccount) {
             this.logout();
@@ -158,8 +163,12 @@ class AuthenticationSSOService extends NgxLibServiceBase {
         this.#msal.setActiveAccount(resolvedAccount);
         let resolvedResult = result;
         let claims = (resolvedResult?.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {});
+        // expiresOn comes over as a Date object if it exists, but exp is a number of seconds since epoch.
+        // therefore, if expiresOn exists convert it to seconds since epoch, otherwise use exp if it exists, otherwise undefined.
+        // expiresOn is only present when the token is acquired via acquireTokenSilent or acquireTokenPopup, but not when the token is acquired via loginPopup or loginRedirect.
+        let expirationEpochSeconds = resolvedResult?.expiresOn ? Math.floor(resolvedResult.expiresOn.getTime() / 1000) : claims.exp ?? undefined;
         // If token appears expired, attempt silent refresh before setting user state.
-        if (this.#isTokenExpired(claims.exp)) {
+        if (this.#isTokenExpired(expirationEpochSeconds)) {
             const refreshedResult = await this.#refreshToken(resolvedAccount);
             // Refresh failure means we should end the session.
             if (!refreshedResult?.account) {
@@ -169,8 +178,9 @@ class AuthenticationSSOService extends NgxLibServiceBase {
             resolvedResult = refreshedResult;
             resolvedAccount = refreshedResult.account;
             claims = (resolvedResult.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {});
+            expirationEpochSeconds = resolvedResult?.expiresOn ? Math.floor(resolvedResult.expiresOn.getTime() / 1000) : claims.exp ?? undefined;
             // Still expired after refresh; terminate session to avoid stale auth.
-            if (this.#isTokenExpired(claims.exp)) {
+            if (this.#isTokenExpired(expirationEpochSeconds)) {
                 this.logout();
                 return;
             }
@@ -208,8 +218,12 @@ class AuthenticationSSOService extends NgxLibServiceBase {
                 this.storage.removeItem(this.options.tokenName);
             }
         }
+        // console.log('AuthenticationSSOService: User validated successfully.', resolvedAccount);
+        // console.log('AuthenticationSSOService: User validated.', this.authenticatedUser);
+        // console.log('AuthenticationSSOService: Token claims.', claims);
+        // console.log('AuthenticationSSOService: Token expires at (epoch seconds).', claims.exp);
         // Schedule refresh before expiration to keep session uninterrupted.
-        this.#scheduleTokenRefresh(claims.exp, resolvedAccount);
+        this.#scheduleTokenRefresh(expirationEpochSeconds, resolvedAccount);
         // Publish authenticated state changes for the rest of the app.
         this.authenticated = true;
         this.authenticatedChanged.emit(this.authenticated);
@@ -356,12 +370,17 @@ class AuthenticationSSOService extends NgxLibServiceBase {
         if (!expirationEpochSeconds) {
             return;
         }
-        const refreshLeadTimeMs = 60_000;
-        const millisecondsUntilRefresh = expirationEpochSeconds * 1000 - Date.now() - refreshLeadTimeMs;
+        // Convert Unix epoch seconds to milliseconds for Date.now() comparison
+        const expirationEpochMilliseconds = expirationEpochSeconds * 1000;
+        // Schedule refresh 1 minute before expiration
+        const refreshLeadTimeMs = 60000;
+        // Calculate the delay until the refresh should occur, ensuring it's not negative
+        const millisecondsUntilRefresh = expirationEpochMilliseconds - Date.now() - refreshLeadTimeMs;
         const delay = Math.max(millisecondsUntilRefresh, 0);
         this.#tokenRefreshTimeoutId = setTimeout(() => {
             this.#refreshToken(account)
                 .then((result) => {
+                console.log('AuthenticationSSOService: Token refresh result.', result);
                 if (result?.account) {
                     return this.validateUser(result, result.account);
                 }

package/fesm2022/cleavelandprice-ngx-lib-authentication-sso.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cleavelandprice-ngx-lib-authentication-sso.mjs","sources":["../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/model/authentication-sso-service-options-token.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/services/authentication-sso.service.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/components/redirect/authentication-sso-redirect.component.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/authentication-sso.module.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/guards/authentication-sso.guard.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/cleavelandprice-ngx-lib-authentication-sso.ts"],"sourcesContent":["import { InjectionToken } from \"@angular/core\";\r\nimport { AuthenticationSSOServiceOptions } from \"./authentication-sso-service-options\";\r\n\r\n// What is a InjectionToken?\r\n// An InjectionToken is a way to create a token that can be used to inject a dependency into an Angular service or component.\r\n// It allows you to define a unique identifier for a dependency, which can then be used to retrieve the dependency from the Angular dependency injection system.\r\n// This is particularly useful when you want to inject a value that is not a class, such as a configuration object or a string.\r\n// Great explaination of InjectionToken: https://youtu.be/GvA7xnBmEto?si=_Nc2DTzdsb0jdvuk\r\nexport const AuthenticationSSOServiceOptionsToken = new InjectionToken<AuthenticationSSOServiceOptions>('AuthenticationSSOServiceOptions');\r\n","import { EventEmitter, Inject, Injectable, Optional, Output } from '@angular/core';\r\n\r\nimport { AbstractAuthenticationService, AuthenticatedUser } from '@cleavelandprice/ngx-lib/authentication';\r\n\r\nimport { NgxLibServiceBase } from '@cleavelandprice/ngx-lib';\r\n\r\nimport { AuthenticationSSOServiceOptions } from '../model/authentication-sso-service-options';\r\nimport { AuthenticationSSOServiceOptionsToken } from './../model/authentication-sso-service-options-token';\r\nimport { AuthenticationSSOClaims } from '../model/authentication-sso-claims';\r\n\r\nimport {\r\n  AccountInfo,\r\n  AuthenticationResult,\r\n  BrowserCacheLocation,\r\n  PublicClientApplication,\r\n  type Configuration\r\n} from '@azure/msal-browser';\r\n\r\n// This service implements authentication using Microsoft Entra ID (formerly Azure AD) via the Microsoft Authentication Library (MSAL).\r\n// It provides methods for logging in, logging out, and validating the authenticated user, while managing token storage and refresh.\r\n// It also supports cross-tab synchronization of authentication state using the BroadcastChannel API.\r\n// It also supports revalidating authentication state when the user returns to a tab after it has been backgrounded for a period of time.\r\n// It also supports storing the token in either localStorage or sessionStorage, based on the user's preference.\r\n// It also supports determining if the token is expired and refreshing it if necessary, or logging the user out if the token cannot be refreshed.\r\n@Injectable({\r\n  providedIn: 'root'\r\n})\r\nexport class AuthenticationSSOService extends NgxLibServiceBase implements AbstractAuthenticationService {\r\n  //#region Fields\r\n  authenticating = false; // Flag set to true while the service is attempting to authenticate the user\r\n  authenticated = false; // Flag set to true when the user is successfully authenticated\r\n  authenticatedUser?: AuthenticatedUser; // Object representing the authenticated user\r\n\r\n  // error NG8110: Unsupported call to the output function. This function can only be used as the initializer of a property on a @Component or @Directive class.\r\n  /*authenticatedChanged = output<boolean>();\r\n  authenticatingChanged = output<boolean>();\r\n  authenticationError = output();*/\r\n  @Output() authenticatedChanged = new EventEmitter<boolean>();\r\n  @Output() authenticatingChanged = new EventEmitter<boolean>();\r\n  @Output() authenticationError = new EventEmitter();\r\n\r\n  // Microsoft Authentication Library (MSAL) instance for handling authentication\r\n  #msal: PublicClientApplication;\r\n  // Tracks one-time MSAL initialize() completion.\r\n  #initialized = false;\r\n\r\n  // Cross-tab messaging channel (same-origin tabs only).\r\n  #channel?: BroadcastChannel;\r\n  // Broadcast payload sent between tabs to synchronize logout.\r\n  #logoutMessage = 'logout';\r\n\r\n  // Coalescing flags used when syncing auth after tab visibility/focus resumes.\r\n  #resumeCheckInProgress = false;\r\n  #lastResumeCheckAt = 0;\r\n\r\n  // Timer id used to refresh tokens before expiry.\r\n  #tokenRefreshTimeoutId?: ReturnType<typeof setTimeout>;\r\n  //#endregion\r\n\r\n  //#region Properties\r\n\r\n  // I don't agree with these properties being required in the AbstractAuthenticationService interface\r\n  // I think this should be set in the options passed to the service.\r\n  // I know this is used in the login components under material but a developer who wants to use their own login with sessionStorage would need to know that they need to create a localStorage item called 'storeTokenInSession' and set it to true\r\n  // I have added a cacheLocation option to the AuthenticationSSOServiceOptions interface but if the users don't set it, they can use these properties to set the storage location\r\n\r\n  get useSessionStorage(): boolean {\r\n    return !!localStorage.getItem('storeTokenInSession');\r\n  }\r\n\r\n  get storage(): Storage {\r\n    return this.useSessionStorage ?\r\n      sessionStorage:\r\n      localStorage;\r\n  }\r\n\r\n  //#endregion\r\n\r\n  //#region Lifecycle\r\n  constructor(@Optional() @Inject(AuthenticationSSOServiceOptionsToken) protected options: AuthenticationSSOServiceOptions) {\r\n    super(options);\r\n\r\n    const authenticationEndpoint = options.authenticationEndpoint ?? `https://login.microsoftonline.com/${options.tenantId}`;\r\n\r\n    this.options = {\r\n      ...options,\r\n\r\n      tokenName: options.tokenName ?? options.clientId + '-token',\r\n      authenticationEndpoint\r\n    };\r\n\r\n    // if the user didn't set the cacheLocation in the options, we will set it to sessionStorage if useSessionStorage is true, otherwise we will set it to localStorage\r\n    this.options.cacheLocation = this.options.cacheLocation ?? (this.useSessionStorage ? 'sessionStorage' : 'localStorage');\r\n\r\n    // MSAL configuration for this SPA.\r\n    // Cache remains in sessionStorage so each tab has isolated auth cache.\r\n    const msalConfig: Configuration = {\r\n      auth: {\r\n        clientId: this.options.clientId,\r\n        authority: this.options.authenticationEndpoint,\r\n        redirectUri: this.options.redirectUri,\r\n        postLogoutRedirectUri: this.options.postLogoutRedirectUri\r\n      },\r\n      cache: {\r\n        cacheLocation: this.options.cacheLocation === 'sessionStorage' ? BrowserCacheLocation.SessionStorage : BrowserCacheLocation.LocalStorage\r\n      }\r\n    };\r\n\r\n    // Create MSAL client based on the configuration.\r\n    // We still need to call initialize() before using it, but this ensures that we only create one instance of the client.\r\n    this.#msal = new PublicClientApplication(msalConfig);\r\n\r\n    // Initialize the BroadcastChannel for cross-tab communication\r\n    this.#initializeBroadcastChannel();\r\n\r\n    // Register resume listeners so returning to a tab revalidates auth state.\r\n    this.#registerResumeListeners();\r\n\r\n    // Attempt to restore authenticated state from any existing Microsoft session.\r\n    this.checkForExistingToken();\r\n  }\r\n  //#endregion\r\n\r\n  //#region Utilities\r\n\r\n  //Authenticate the user and store the token in Local Storage or Session Storage\r\n  login(): void {\r\n    this.authenticating = true;\r\n    this.authenticatingChanged.emit(this.authenticating);\r\n\r\n    console.log('AuthenticationSSOService: login() called. Authenticating user...');\r\n\r\n    // Initialize MSAL and then perform login via popup, followed by user validation.\r\n    this.#initializeMsal()\r\n      .then(() => this.#msal.loginPopup({\r\n        scopes: this.options.scopes,\r\n        authority: this.options.authenticationEndpoint,\r\n        prompt: 'select_account'\r\n      }))\r\n      .then((result) => this.validateUser(result))\r\n      .catch((error: unknown) => {\r\n        this.authenticating = false;\r\n        this.authenticatingChanged.emit(this.authenticating);\r\n        this.authenticationError.emit(error);\r\n      });\r\n  }\r\n\r\n  // Primary logout flow:\r\n  // 1) clear local state in this tab,\r\n  // 2) notify other tabs to clear their local state,\r\n  // 3) initiate Entra sign-out redirect from this initiating tab.\r\n  logout(): void {\r\n    this.#logoutLocalOnly(false);\r\n    this.#publishLogout();\r\n\r\n    // Only the initiating tab should call identity-provider logout.\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    this.#initializeMsal()\r\n      .then(() => this.#msal.logoutRedirect({\r\n        postLogoutRedirectUri: this.options.postLogoutRedirectUri\r\n      }))\r\n      .catch((error) => {\r\n        console.log('ERROR: Microsoft logout failed.', error);\r\n      });\r\n  }\r\n\r\n  tokenExists(): boolean {\r\n    const token = this.storage.getItem(this.options.tokenName ?? '');\r\n    return !!token;\r\n  }\r\n\r\n  // validateUser() = setAuthenticatedUser()\r\n  // Resolves current user and token claims into the app's authenticated model.\r\n  // Also validates/refreshes token when needed and schedules proactive refresh.\r\n  async validateUser(result?: AuthenticationResult, account?: AccountInfo): Promise<void> {\r\n    // Resolve account from auth result or fallback account.\r\n    let resolvedAccount = result?.account ?? account;\r\n\r\n    // No account means app should be considered logged out.\r\n    if (!resolvedAccount) {\r\n      this.logout();\r\n      return;\r\n    }\r\n\r\n    // Keep MSAL active account in sync with resolved account context.\r\n    this.#msal.setActiveAccount(resolvedAccount);\r\n\r\n    let resolvedResult = result;\r\n    let claims = (resolvedResult?.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {}) as AuthenticationSSOClaims;\r\n\r\n    // If token appears expired, attempt silent refresh before setting user state.\r\n    if (this.#isTokenExpired(claims.exp)) {\r\n      const refreshedResult = await this.#refreshToken(resolvedAccount);\r\n\r\n      // Refresh failure means we should end the session.\r\n      if (!refreshedResult?.account) {\r\n        this.logout();\r\n        return;\r\n      }\r\n\r\n      resolvedResult = refreshedResult;\r\n      resolvedAccount = refreshedResult.account;\r\n      claims = (resolvedResult.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {}) as AuthenticationSSOClaims;\r\n\r\n      // Still expired after refresh; terminate session to avoid stale auth.\r\n      if (this.#isTokenExpired(claims.exp)) {\r\n        this.logout();\r\n        return;\r\n      }\r\n    }\r\n\r\n    // Derive a stable account name from available claims.\r\n    const preferredUsername = String(claims.preferred_username ?? resolvedAccount.username ?? claims.upn ?? claims.email ?? '');\r\n    const accountName = preferredUsername.includes('@') ? preferredUsername.split('@')[0] : preferredUsername;\r\n\r\n    // Map Entra claims to the app's authenticated user shape.\r\n    this.authenticatedUser = {\r\n      admin: false,\r\n      accountName: claims.accountName ?? accountName,\r\n      department: claims.department ?? '',\r\n      displayName: claims.displayName ?? '',\r\n      distinguishedName: claims.distinguishedName ?? '',\r\n      email: claims.mail,\r\n      employeeNumber: claims.employeeNumber,\r\n      firstName: claims.firstName ?? '',\r\n      hireDate: claims.hireDate ?? '',\r\n      lastName: claims.lastName ?? '',\r\n      manager: claims.manager,\r\n      memberOf: claims.memberOf,\r\n      phone: claims.phone,\r\n      photoUrl: claims.photoUrl,\r\n      sid: claims.securityIdentifier ?? '',\r\n      title: claims.title,\r\n      workShift: claims.workShift\r\n    } as AuthenticatedUser;\r\n\r\n    // Persist id token into shared auth storage key when configured.\r\n    if (this.options.tokenName) {\r\n      const token = resolvedAccount?.idToken;\r\n      if (token) {\r\n        this.storage.setItem(this.options.tokenName, token);\r\n      } else {\r\n        this.storage.removeItem(this.options.tokenName);\r\n      }\r\n    }\r\n\r\n    // Schedule refresh before expiration to keep session uninterrupted.\r\n    this.#scheduleTokenRefresh(claims.exp, resolvedAccount);\r\n\r\n    // Publish authenticated state changes for the rest of the app.\r\n    this.authenticated = true;\r\n    this.authenticatedChanged.emit(this.authenticated);\r\n\r\n    this.authenticating = false;\r\n    this.authenticatingChanged.emit(this.authenticating);\r\n  }\r\n\r\n  // Rehydrates auth state from existing cached account on startup.\r\n  // We intentionally avoid handleRedirectPromise() because this service uses popup login.\r\n  checkForExistingToken(): void {\r\n    this.#initializeMsal()\r\n      .then(() => {\r\n        const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];\r\n        if (account)\r\n          return this.validateUser(undefined, account);\r\n\r\n        return undefined;\r\n      })\r\n      .catch((error: unknown) => {\r\n        console.log('ERROR: Failed to hydrate Microsoft auth state.', error);\r\n      });\r\n  }\r\n\r\n  // Initialize MSAL if it hasn't been initialized yet\r\n  // This ensures that we only initialize MSAL once, even if multiple login attempts are made\r\n  // This is important because there is startup work that must be completed by MSAL before it can be used, and we don't want to repeat that work unnecessarily\r\n  async #initializeMsal(): Promise<void> {\r\n    if (this.#initialized) {\r\n      return;\r\n    }\r\n\r\n\r\n    await this.#msal.initialize();\r\n    this.#initialized = true;\r\n  }\r\n\r\n  // Sets up same-origin cross-tab messaging used to fan out logout events.\r\n  #initializeBroadcastChannel(): void {\r\n    if (typeof BroadcastChannel === 'undefined') {\r\n      // Some runtimes may not support BroadcastChannel.\r\n      return;\r\n    }\r\n\r\n    // Create a new BroadcastChannel for cross-tab communication\r\n    this.#channel = new BroadcastChannel('sso-authentication-channel');\r\n\r\n    // Listen for messages from other tabs for logout events.\r\n    // When a logout message is received, the current tab will clear its local state and reload the page.\r\n    this.#channel.onmessage = (event) => {\r\n      if (event.data === this.#logoutMessage) {\r\n        console.log('Received logout message from another tab.');\r\n        // Receiving tabs clear local state and reload so route guards re-evaluate immediately.\r\n        this.#logoutLocalOnly(true);\r\n      }\r\n    };\r\n  }\r\n\r\n  // Registers visibility/focus listeners to re-check auth when user returns to the tab.\r\n  // Tabs can be backgrounded for long periods, and the user may have logged out in another tab or session.\r\n  #registerResumeListeners(): void {\r\n    const handleResume = () => {\r\n      void this.#syncAuthOnResume();\r\n    };\r\n\r\n    if (typeof document !== 'undefined') {\r\n      document.addEventListener('visibilitychange', () => {\r\n        if (document.visibilityState === 'visible') {\r\n          handleResume();\r\n        }\r\n      });\r\n    }\r\n\r\n    if (typeof window !== 'undefined') {\r\n      window.addEventListener('focus', handleResume);\r\n    }\r\n  }\r\n\r\n  // Syncs auth state after resume while preventing duplicate checks from rapid events.\r\n  async #syncAuthOnResume(): Promise<void> {\r\n    const now = Date.now();\r\n\r\n    // visibilitychange and focus often fire back-to-back; coalesce to one check.\r\n    // if now was less than 1 second since last check, skip this one.\r\n    if (this.#resumeCheckInProgress || now - this.#lastResumeCheckAt < 1000) {\r\n      return;\r\n    }\r\n\r\n    this.#resumeCheckInProgress = true;\r\n    this.#lastResumeCheckAt = now;\r\n\r\n    try {\r\n      await this.#initializeMsal();\r\n\r\n      const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];\r\n\r\n      if (!account)\r\n        return;\r\n\r\n      await this.validateUser(undefined, account);\r\n    }\r\n    catch (error) {\r\n      console.log('Error: Resume auth sync failed.', error);\r\n    }\r\n    finally {\r\n      this.#resumeCheckInProgress = false;\r\n    }\r\n  }\r\n\r\n  // Sends logout signal to other open tabs.\r\n  #publishLogout(): void {\r\n    this.#channel?.postMessage(this.#logoutMessage);\r\n  }\r\n\r\n  // Clears app/MSAL state in current tab without invoking provider-side logout.\r\n  // reloadAfterLogout is intended for non-initiating tabs to force UI reset to auth route.\r\n  async #logoutLocalOnly(reloadAfterLogout: boolean): Promise<void> {\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    if (this.options.tokenName && this.storage.getItem(this.options.tokenName)) {\r\n      this.storage.removeItem(this.options.tokenName);\r\n    }\r\n\r\n    this.authenticatedUser = undefined;\r\n    this.authenticated = false;\r\n    this.authenticatedChanged.emit(false);\r\n\r\n    try {\r\n      await this.#initializeMsal();\r\n      await this.#msal.clearCache();\r\n      this.#msal.setActiveAccount(null);\r\n\r\n      // There are times this item is left in sessionStorage after logout, which can cause MSAL to think a login is in progress and block future logins.\r\n      // This is a workaround to ensure that the item is removed after logout.\r\n      sessionStorage.removeItem(\"msal.interaction.status\");\r\n\r\n      // Secondary tabs should hard-refresh to guarantee route guards and app state reset.\r\n      if (reloadAfterLogout && typeof window !== 'undefined') {\r\n        window.location.reload();\r\n      }\r\n    } catch (error) {\r\n      console.log('WARN: Local MSAL cache clear failed.', error);\r\n    }\r\n  }\r\n\r\n  // Returns true when token expiration is absent or in the past.\r\n  #isTokenExpired(expirationEpochSeconds?: number): boolean {\r\n    if (!expirationEpochSeconds) {\r\n      return true;\r\n    }\r\n\r\n    return Date.now() >= expirationEpochSeconds * 1000;\r\n  }\r\n\r\n  // Attempts silent token acquisition for the current account.\r\n  async #refreshToken(account: AccountInfo): Promise<AuthenticationResult | undefined> {\r\n    try {\r\n      return await this.#msal.acquireTokenSilent({\r\n        account,\r\n        scopes: this.options.scopes\r\n      });\r\n    }\r\n    catch (error) {\r\n      console.log('Error: Silent token refresh failed.', error);\r\n      return undefined;\r\n    }\r\n  }\r\n\r\n  // Schedules token refresh shortly before expiration.\r\n  // If refresh fails, session is terminated to avoid inconsistent auth state.\r\n  #scheduleTokenRefresh(expirationEpochSeconds: number | undefined, account: AccountInfo): void {\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    if (!expirationEpochSeconds) {\r\n      return;\r\n    }\r\n\r\n    const refreshLeadTimeMs = 60_000;\r\n    const millisecondsUntilRefresh = expirationEpochSeconds * 1000 - Date.now() - refreshLeadTimeMs;\r\n    const delay = Math.max(millisecondsUntilRefresh, 0);\r\n\r\n    this.#tokenRefreshTimeoutId = setTimeout(() => {\r\n      this.#refreshToken(account)\r\n        .then((result) => {\r\n          if (result?.account) {\r\n            return this.validateUser(result, result.account);\r\n          }\r\n\r\n          // No account after refresh implies invalid session.\r\n          this.logout();\r\n          return undefined;\r\n        })\r\n        .catch(() => {\r\n          // Any refresh exception falls back to logout for safety.\r\n          this.logout();\r\n        });\r\n    }, delay);\r\n  }\r\n\r\n  // Cancels any pending token refresh timer.\r\n  #clearTokenRefreshTimer(): void {\r\n    if (!this.#tokenRefreshTimeoutId) {\r\n      return;\r\n    }\r\n\r\n    clearTimeout(this.#tokenRefreshTimeoutId);\r\n    this.#tokenRefreshTimeoutId = undefined;\r\n  }\r\n  //#endregion\r\n}\r\n","import { Component, OnInit } from \"@angular/core\";\r\nimport { broadcastResponseToMainFrame } from \"@azure/msal-browser/redirect-bridge\";\r\n\r\n@Component({\r\n  selector: \"app-authentication-sso-redirect\",\r\n  standalone: true,\r\n  template: \"<p>Processing authentication...</p>\",\r\n})\r\nexport class AuthenticationSSORedirectComponent implements OnInit {\r\n    ngOnInit(): void {\r\n        broadcastResponseToMainFrame().catch((error: Error) => {\r\n            console.error(\"Error broadcasting response to main frame:\", error);\r\n        });\r\n    }\r\n}\r\n","import { CommonModule } from '@angular/common';\r\nimport { ModuleWithProviders, NgModule, Optional, SkipSelf } from '@angular/core';\r\n\r\nimport { AuthenticationSSOServiceOptions } from './model/authentication-sso-service-options';\r\nimport { AuthenticationSSOServiceOptionsToken } from './model/authentication-sso-service-options-token';\r\nimport { AuthenticationSSORedirectComponent } from './components/redirect/authentication-sso-redirect.component';\r\n\r\n@NgModule({\r\n  declarations: [],\r\n  imports: [\r\n    CommonModule,\r\n    AuthenticationSSORedirectComponent\r\n  ],\r\n  exports: [\r\n    AuthenticationSSORedirectComponent\r\n  ]\r\n})\r\nexport class AuthenticationSSOModule {\r\n  static forRoot(options: AuthenticationSSOServiceOptions): ModuleWithProviders<AuthenticationSSOModule> {\r\n    return {\r\n      ngModule: AuthenticationSSOModule,\r\n      providers: [\r\n        {\r\n          provide: AuthenticationSSOServiceOptionsToken,\r\n          useValue: options\r\n        }\r\n      ]\r\n    };\r\n  }\r\n\r\n  constructor(@Optional() @SkipSelf() parentModule: AuthenticationSSOModule) {\r\n    if (parentModule) {\r\n      throw new Error(\r\n        'AuthenticationSSOModule is already loaded. Import it in the AppModule only');\r\n    }\r\n  }\r\n}\r\n","import { inject } from '@angular/core';\r\nimport { CanActivateFn, Router } from '@angular/router';\r\nimport { map, take } from 'rxjs/operators';\r\nimport { AuthenticationSSOService } from '../authentication-sso.api';\r\n\r\nexport const authenticationSSOGuard: CanActivateFn = (_route, _state) => {\r\n  const authenticationService = inject(AuthenticationSSOService);\r\n  const router = inject(Router);\r\n\r\n  // if the user is already authenticated, allow access to the route\r\n  if (authenticationService.authenticated) {\r\n    return true;\r\n  }\r\n\r\n  if (authenticationService.tokenExists()) {\r\n    // we're doing this because we could've opened a new tab and the user is already logged in, so we need to check for an existing token\r\n    authenticationService.checkForExistingToken();\r\n\r\n    return authenticationService.authenticatedChanged.pipe(\r\n      take(1),\r\n      map(() => {\r\n        if (!authenticationService.authenticated) {\r\n          router.navigate(['']);\r\n          return false;\r\n        }\r\n\r\n        return true;\r\n      })\r\n    );\r\n  }\r\n  else {\r\n    router.navigate(['']);\r\n    return false;\r\n  }\r\n};\r\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './authentication-sso.api';\n"],"names":[],"mappings":";;;;;;;;;AAGA;AACA;AACA;AACA;AACA;MACa,oCAAoC,GAAG,IAAI,cAAc,CAAkC,iCAAiC;;ACUzI;AACA;AACA;AACA;AACA;AACA;AAIM,MAAO,wBAAyB,SAAQ,iBAAiB,CAAA;;AAe7D,IAAA,KAAK;;AAEL,IAAA,YAAY;;AAGZ,IAAA,QAAQ;;AAER,IAAA,cAAc;;AAGd,IAAA,sBAAsB;AACtB,IAAA,kBAAkB;;AAGlB,IAAA,sBAAsB;;;;;;;AAUtB,IAAA,IAAI,iBAAiB,GAAA;QACnB,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,qBAAqB,CAAC;;AAGtD,IAAA,IAAI,OAAO,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,iBAAiB;AAC3B,YAAA,cAAc;AACd,YAAA,YAAY;;;;AAMhB,IAAA,WAAA,CAAgF,OAAwC,EAAA;QACtH,KAAK,CAAC,OAAO,CAAC;QADgE,IAAA,CAAA,OAAO,GAAP,OAAO;;AAlDvF,QAAA,IAAA,CAAA,cAAc,GAAG,KAAK,CAAC;AACvB,QAAA,IAAA,CAAA,aAAa,GAAG,KAAK,CAAC;;AAItB;;AAEiC;AACvB,QAAA,IAAA,CAAA,oBAAoB,GAAG,IAAI,YAAY,EAAW;AAClD,QAAA,IAAA,CAAA,qBAAqB,GAAG,IAAI,YAAY,EAAW;AACnD,QAAA,IAAA,CAAA,mBAAmB,GAAG,IAAI,YAAY,EAAE;;QAKlD,IAAA,CAAA,YAAY,GAAG,KAAK;;QAKpB,IAAA,CAAA,cAAc,GAAG,QAAQ;;QAGzB,IAAA,CAAA,sBAAsB,GAAG,KAAK;QAC9B,IAAA,CAAA,kBAAkB,GAAG,CAAC;QA6BpB,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,CAAA,kCAAA,EAAqC,OAAO,CAAC,QAAQ,CAAA,CAAE;QAExH,IAAI,CAAC,OAAO,GAAG;AACb,YAAA,GAAG,OAAO;YAEV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,GAAG,QAAQ;YAC3D;SACD;;QAGD,IAAI,CAAC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,CAAC;;;AAIvH,QAAA,MAAM,UAAU,GAAkB;AAChC,YAAA,IAAI,EAAE;AACJ,gBAAA,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;AAC/B,gBAAA,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB;AAC9C,gBAAA,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;AACrC,gBAAA,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC;AACrC,aAAA;AACD,YAAA,KAAK,EAAE;AACL,gBAAA,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,GAAG,oBAAoB,CAAC;AAC7H;SACF;;;QAID,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC;;QAGpD,IAAI,CAAC,2BAA2B,EAAE;;QAGlC,IAAI,CAAC,wBAAwB,EAAE;;QAG/B,IAAI,CAAC,qBAAqB,EAAE;;;;;IAO9B,KAAK,GAAA;AACH,QAAA,IAAI,CAAC,cAAc,GAAG,IAAI;QAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;AAEpD,QAAA,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC;;QAG/E,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;AAChC,YAAA,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;AAC3B,YAAA,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB;AAC9C,YAAA,MAAM,EAAE;AACT,SAAA,CAAC;AACD,aAAA,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;AAC1C,aAAA,KAAK,CAAC,CAAC,KAAc,KAAI;AACxB,YAAA,IAAI,CAAC,cAAc,GAAG,KAAK;YAC3B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;AACpD,YAAA,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;AACtC,SAAC,CAAC;;;;;;IAON,MAAM,GAAA;AACJ,QAAA,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,cAAc,EAAE;;QAGrB,IAAI,CAAC,uBAAuB,EAAE;QAE9B,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;AACpC,YAAA,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC;AACrC,SAAA,CAAC;AACD,aAAA,KAAK,CAAC,CAAC,KAAK,KAAI;AACf,YAAA,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC;AACvD,SAAC,CAAC;;IAGN,WAAW,GAAA;AACT,QAAA,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAChE,OAAO,CAAC,CAAC,KAAK;;;;;AAMhB,IAAA,MAAM,YAAY,CAAC,MAA6B,EAAE,OAAqB,EAAA;;AAErE,QAAA,IAAI,eAAe,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO;;QAGhD,IAAI,CAAC,eAAe,EAAE;YACpB,IAAI,CAAC,MAAM,EAAE;YACb;;;AAIF,QAAA,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,eAAe,CAAC;QAE5C,IAAI,cAAc,GAAG,MAAM;AAC3B,QAAA,IAAI,MAAM,IAAI,cAAc,EAAE,aAAa,IAAI,eAAe,CAAC,aAAa,IAAI,EAAE,CAA4B;;QAG9G,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;;AAGjE,YAAA,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE;gBAC7B,IAAI,CAAC,MAAM,EAAE;gBACb;;YAGF,cAAc,GAAG,eAAe;AAChC,YAAA,eAAe,GAAG,eAAe,CAAC,OAAO;AACzC,YAAA,MAAM,IAAI,cAAc,CAAC,aAAa,IAAI,eAAe,CAAC,aAAa,IAAI,EAAE,CAA4B;;YAGzG,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBACpC,IAAI,CAAC,MAAM,EAAE;gBACb;;;;QAKJ,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,IAAI,eAAe,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3H,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB;;QAGzG,IAAI,CAAC,iBAAiB,GAAG;AACvB,YAAA,KAAK,EAAE,KAAK;AACZ,YAAA,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;AAC9C,YAAA,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;AACnC,YAAA,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;AACrC,YAAA,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,cAAc,EAAE,MAAM,CAAC,cAAc;AACrC,YAAA,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;AACjC,YAAA,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;AAC/B,YAAA,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;AACzB,YAAA,GAAG,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE;YACpC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC;SACE;;AAGtB,QAAA,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;AAC1B,YAAA,MAAM,KAAK,GAAG,eAAe,EAAE,OAAO;YACtC,IAAI,KAAK,EAAE;AACT,gBAAA,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC;;iBAC9C;gBACL,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;;;;QAKnD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC;;AAGvD,QAAA,IAAI,CAAC,aAAa,GAAG,IAAI;QACzB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;AAElD,QAAA,IAAI,CAAC,cAAc,GAAG,KAAK;QAC3B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;;;;IAKtD,qBAAqB,GAAA;QACnB,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAK;AACT,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAC/E,YAAA,IAAI,OAAO;gBACT,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;AAE9C,YAAA,OAAO,SAAS;AAClB,SAAC;AACA,aAAA,KAAK,CAAC,CAAC,KAAc,KAAI;AACxB,YAAA,OAAO,CAAC,GAAG,CAAC,gDAAgD,EAAE,KAAK,CAAC;AACtE,SAAC,CAAC;;;;;AAMN,IAAA,MAAM,eAAe,GAAA;AACnB,QAAA,IAAI,IAAI,CAAC,YAAY,EAAE;YACrB;;AAIF,QAAA,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;AAC7B,QAAA,IAAI,CAAC,YAAY,GAAG,IAAI;;;IAI1B,2BAA2B,GAAA;AACzB,QAAA,IAAI,OAAO,gBAAgB,KAAK,WAAW,EAAE;;YAE3C;;;QAIF,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,4BAA4B,CAAC;;;QAIlE,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,KAAK,KAAI;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,cAAc,EAAE;AACtC,gBAAA,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC;;AAExD,gBAAA,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;;AAE/B,SAAC;;;;IAKH,wBAAwB,GAAA;QACtB,MAAM,YAAY,GAAG,MAAK;AACxB,YAAA,KAAK,IAAI,CAAC,iBAAiB,EAAE;AAC/B,SAAC;AAED,QAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,YAAA,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,MAAK;AACjD,gBAAA,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE;AAC1C,oBAAA,YAAY,EAAE;;AAElB,aAAC,CAAC;;AAGJ,QAAA,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACjC,YAAA,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC;;;;AAKlD,IAAA,MAAM,iBAAiB,GAAA;AACrB,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;;;AAItB,QAAA,IAAI,IAAI,CAAC,sBAAsB,IAAI,GAAG,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE;YACvE;;AAGF,QAAA,IAAI,CAAC,sBAAsB,GAAG,IAAI;AAClC,QAAA,IAAI,CAAC,kBAAkB,GAAG,GAAG;AAE7B,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,eAAe,EAAE;AAE5B,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAE/E,YAAA,IAAI,CAAC,OAAO;gBACV;YAEF,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;;QAE7C,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC;;gBAE/C;AACN,YAAA,IAAI,CAAC,sBAAsB,GAAG,KAAK;;;;IAKvC,cAAc,GAAA;QACZ,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;;;;IAKjD,MAAM,gBAAgB,CAAC,iBAA0B,EAAA;QAC/C,IAAI,CAAC,uBAAuB,EAAE;AAE9B,QAAA,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YAC1E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;;AAGjD,QAAA,IAAI,CAAC,iBAAiB,GAAG,SAAS;AAClC,QAAA,IAAI,CAAC,aAAa,GAAG,KAAK;AAC1B,QAAA,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;AAErC,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,eAAe,EAAE;AAC5B,YAAA,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;AAC7B,YAAA,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC;;;AAIjC,YAAA,cAAc,CAAC,UAAU,CAAC,yBAAyB,CAAC;;AAGpD,YAAA,IAAI,iBAAiB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACtD,gBAAA,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;;;QAE1B,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,CAAC;;;;AAK9D,IAAA,eAAe,CAAC,sBAA+B,EAAA;QAC7C,IAAI,CAAC,sBAAsB,EAAE;AAC3B,YAAA,OAAO,IAAI;;QAGb,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,sBAAsB,GAAG,IAAI;;;IAIpD,MAAM,aAAa,CAAC,OAAoB,EAAA;AACtC,QAAA,IAAI;AACF,YAAA,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;gBACzC,OAAO;AACP,gBAAA,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;AACtB,aAAA,CAAC;;QAEJ,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,KAAK,CAAC;AACzD,YAAA,OAAO,SAAS;;;;;IAMpB,qBAAqB,CAAC,sBAA0C,EAAE,OAAoB,EAAA;QACpF,IAAI,CAAC,uBAAuB,EAAE;QAE9B,IAAI,CAAC,sBAAsB,EAAE;YAC3B;;QAGF,MAAM,iBAAiB,GAAG,MAAM;AAChC,QAAA,MAAM,wBAAwB,GAAG,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;AAEnD,QAAA,IAAI,CAAC,sBAAsB,GAAG,UAAU,CAAC,MAAK;AAC5C,YAAA,IAAI,CAAC,aAAa,CAAC,OAAO;AACvB,iBAAA,IAAI,CAAC,CAAC,MAAM,KAAI;AACf,gBAAA,IAAI,MAAM,EAAE,OAAO,EAAE;oBACnB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;;;gBAIlD,IAAI,CAAC,MAAM,EAAE;AACb,gBAAA,OAAO,SAAS;AAClB,aAAC;iBACA,KAAK,CAAC,MAAK;;gBAEV,IAAI,CAAC,MAAM,EAAE;AACf,aAAC,CAAC;SACL,EAAE,KAAK,CAAC;;;IAIX,uBAAuB,GAAA;AACrB,QAAA,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAChC;;AAGF,QAAA,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC;AACzC,QAAA,IAAI,CAAC,sBAAsB,GAAG,SAAS;;AA7a9B,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,kBAoDH,oCAAoC,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AApDzD,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,cAFvB,MAAM,EAAA,CAAA,CAAA;;2FAEP,wBAAwB,EAAA,UAAA,EAAA,CAAA;kBAHpC,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;0BAqDc;;0BAAY,MAAM;2BAAC,oCAAoC;;sBA1CnE;;sBACA;;sBACA;;;MC/BU,kCAAkC,CAAA;IAC3C,QAAQ,GAAA;AACJ,QAAA,4BAA4B,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,KAAI;AAClD,YAAA,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC;AACtE,SAAC,CAAC;;8GAJG,kCAAkC,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA,CAAA;AAAlC,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,kCAAkC,2FAFnC,qCAAqC,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,CAAA;;2FAEpC,kCAAkC,EAAA,UAAA,EAAA,CAAA;kBAL9C,SAAS;AAAC,YAAA,IAAA,EAAA,CAAA;AACT,oBAAA,QAAQ,EAAE,iCAAiC;AAC3C,oBAAA,UAAU,EAAE,IAAI;AAChB,oBAAA,QAAQ,EAAE,qCAAqC;AAChD,iBAAA;;;MCUY,uBAAuB,CAAA;IAClC,OAAO,OAAO,CAAC,OAAwC,EAAA;QACrD,OAAO;AACL,YAAA,QAAQ,EAAE,uBAAuB;AACjC,YAAA,SAAS,EAAE;AACT,gBAAA;AACE,oBAAA,OAAO,EAAE,oCAAoC;AAC7C,oBAAA,QAAQ,EAAE;AACX;AACF;SACF;;AAGH,IAAA,WAAA,CAAoC,YAAqC,EAAA;QACvE,IAAI,YAAY,EAAE;AAChB,YAAA,MAAM,IAAI,KAAK,CACb,4EAA4E,CAAC;;;8GAhBxE,uBAAuB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAA,uBAAA,EAAA,QAAA,EAAA,IAAA,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,QAAA,EAAA,CAAA,CAAA;AAAvB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,mBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,YAPhC,YAAY;AACZ,YAAA,kCAAkC,aAGlC,kCAAkC,CAAA,EAAA,CAAA,CAAA;AAGzB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,mBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,YAPhC,YAAY,CAAA,EAAA,CAAA,CAAA;;2FAOH,uBAAuB,EAAA,UAAA,EAAA,CAAA;kBAVnC,QAAQ;AAAC,YAAA,IAAA,EAAA,CAAA;AACR,oBAAA,YAAY,EAAE,EAAE;AAChB,oBAAA,OAAO,EAAE;wBACP,YAAY;wBACZ;AACD,qBAAA;AACD,oBAAA,OAAO,EAAE;wBACP;AACD;AACF,iBAAA;;0BAcc;;0BAAY;;;MCzBd,sBAAsB,GAAkB,CAAC,MAAM,EAAE,MAAM,KAAI;AACtE,IAAA,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC;AAC9D,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;;AAG7B,IAAA,IAAI,qBAAqB,CAAC,aAAa,EAAE;AACvC,QAAA,OAAO,IAAI;;AAGb,IAAA,IAAI,qBAAqB,CAAC,WAAW,EAAE,EAAE;;QAEvC,qBAAqB,CAAC,qBAAqB,EAAE;AAE7C,QAAA,OAAO,qBAAqB,CAAC,oBAAoB,CAAC,IAAI,CACpD,IAAI,CAAC,CAAC,CAAC,EACP,GAAG,CAAC,MAAK;AACP,YAAA,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE;AACxC,gBAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACrB,gBAAA,OAAO,KAAK;;AAGd,YAAA,OAAO,IAAI;SACZ,CAAC,CACH;;SAEE;AACH,QAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACrB,QAAA,OAAO,KAAK;;AAEhB;;AClCA;;AAEG;;;;"}
+{"version":3,"file":"cleavelandprice-ngx-lib-authentication-sso.mjs","sources":["../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/model/authentication-sso-service-options-token.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/services/authentication-sso.service.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/components/redirect/authentication-sso-redirect.component.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/authentication-sso.module.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/guards/authentication-sso.guard.ts","../../../../projects/cleavelandprice/ngx-lib/authentication/sso/src/cleavelandprice-ngx-lib-authentication-sso.ts"],"sourcesContent":["import { InjectionToken } from \"@angular/core\";\r\nimport { AuthenticationSSOServiceOptions } from \"./authentication-sso-service-options\";\r\n\r\n// What is a InjectionToken?\r\n// An InjectionToken is a way to create a token that can be used to inject a dependency into an Angular service or component.\r\n// It allows you to define a unique identifier for a dependency, which can then be used to retrieve the dependency from the Angular dependency injection system.\r\n// This is particularly useful when you want to inject a value that is not a class, such as a configuration object or a string.\r\n// Great explaination of InjectionToken: https://youtu.be/GvA7xnBmEto?si=_Nc2DTzdsb0jdvuk\r\nexport const AuthenticationSSOServiceOptionsToken = new InjectionToken<AuthenticationSSOServiceOptions>('AuthenticationSSOServiceOptions');\r\n","import { EventEmitter, Inject, Injectable, Optional, Output } from '@angular/core';\r\n\r\nimport { AbstractAuthenticationService, AuthenticatedUser } from '@cleavelandprice/ngx-lib/authentication';\r\n\r\nimport { NgxLibServiceBase } from '@cleavelandprice/ngx-lib';\r\n\r\nimport { AuthenticationSSOServiceOptions } from '../model/authentication-sso-service-options';\r\nimport { AuthenticationSSOServiceOptionsToken } from './../model/authentication-sso-service-options-token';\r\nimport { AuthenticationSSOClaims } from '../model/authentication-sso-claims';\r\n\r\nimport {\r\n  AccountInfo,\r\n  AuthenticationResult,\r\n  BrowserCacheLocation,\r\n  PublicClientApplication,\r\n  type Configuration\r\n} from '@azure/msal-browser';\r\n\r\n// This service implements authentication using Microsoft Entra ID (formerly Azure AD) via the Microsoft Authentication Library (MSAL).\r\n// It provides methods for logging in, logging out, and validating the authenticated user, while managing token storage and refresh.\r\n// It also supports cross-tab synchronization of authentication state using the BroadcastChannel API.\r\n// It also supports revalidating authentication state when the user returns to a tab after it has been backgrounded for a period of time.\r\n// It also supports storing the token in either localStorage or sessionStorage, based on the user's preference.\r\n// It also supports determining if the token is expired and refreshing it if necessary, or logging the user out if the token cannot be refreshed.\r\n@Injectable({\r\n  providedIn: 'root'\r\n})\r\nexport class AuthenticationSSOService extends NgxLibServiceBase implements AbstractAuthenticationService {\r\n  //#region Fields\r\n  authenticating = false; // Flag set to true while the service is attempting to authenticate the user\r\n  authenticated = false; // Flag set to true when the user is successfully authenticated\r\n  authenticatedUser?: AuthenticatedUser; // Object representing the authenticated user\r\n\r\n  // error NG8110: Unsupported call to the output function. This function can only be used as the initializer of a property on a @Component or @Directive class.\r\n  /*authenticatedChanged = output<boolean>();\r\n  authenticatingChanged = output<boolean>();\r\n  authenticationError = output();*/\r\n  @Output() authenticatedChanged = new EventEmitter<boolean>();\r\n  @Output() authenticatingChanged = new EventEmitter<boolean>();\r\n  @Output() authenticationError = new EventEmitter();\r\n\r\n  // Microsoft Authentication Library (MSAL) instance for handling authentication\r\n  #msal: PublicClientApplication;\r\n  // Tracks one-time MSAL initialize() completion.\r\n  #initialized = false;\r\n\r\n  // Cross-tab messaging channel (same-origin tabs only).\r\n  #channel?: BroadcastChannel;\r\n  // Broadcast payload sent between tabs to synchronize logout.\r\n  #logoutMessage = 'logout';\r\n\r\n  // Coalescing flags used when syncing auth after tab visibility/focus resumes.\r\n  #resumeCheckInProgress = false;\r\n  #lastResumeCheckAt = 0;\r\n\r\n  // Timer id used to refresh tokens before expiry.\r\n  #tokenRefreshTimeoutId?: ReturnType<typeof setTimeout>;\r\n  //#endregion\r\n\r\n  //#region Properties\r\n\r\n  // I don't agree with these properties being required in the AbstractAuthenticationService interface\r\n  // I think this should be set in the options passed to the service.\r\n  // I know this is used in the login components under material but a developer who wants to use their own login with sessionStorage would need to know that they need to create a localStorage item called 'storeTokenInSession' and set it to true\r\n  // I have added a cacheLocation option to the AuthenticationSSOServiceOptions interface but if the users don't set it, they can use these properties to set the storage location\r\n\r\n  get useSessionStorage(): boolean {\r\n    return !!localStorage.getItem('storeTokenInSession');\r\n  }\r\n\r\n  get storage(): Storage {\r\n    return this.useSessionStorage ?\r\n      sessionStorage:\r\n      localStorage;\r\n  }\r\n\r\n  //#endregion\r\n\r\n  //#region Lifecycle\r\n  constructor(@Optional() @Inject(AuthenticationSSOServiceOptionsToken) protected options: AuthenticationSSOServiceOptions) {\r\n    super(options);\r\n\r\n    const authenticationEndpoint = options.authenticationEndpoint ?? `https://login.microsoftonline.com/${options.tenantId}`;\r\n\r\n    this.options = {\r\n      ...options,\r\n\r\n      tokenName: options.tokenName ?? options.clientId + '-token',\r\n      authenticationEndpoint\r\n    };\r\n\r\n    // if the user didn't set the cacheLocation in the options, we will set it to sessionStorage if useSessionStorage is true, otherwise we will set it to localStorage\r\n    this.options.cacheLocation = this.options.cacheLocation ?? (this.useSessionStorage ? 'sessionStorage' : 'localStorage');\r\n\r\n    // MSAL configuration for this SPA.\r\n    // Cache remains in sessionStorage so each tab has isolated auth cache.\r\n    const msalConfig: Configuration = {\r\n      auth: {\r\n        clientId: this.options.clientId,\r\n        authority: this.options.authenticationEndpoint,\r\n        redirectUri: this.options.redirectUri,\r\n        postLogoutRedirectUri: this.options.postLogoutRedirectUri\r\n      },\r\n      cache: {\r\n        cacheLocation: this.options.cacheLocation === 'sessionStorage' ? BrowserCacheLocation.SessionStorage : BrowserCacheLocation.LocalStorage\r\n      }\r\n    };\r\n\r\n    // Create MSAL client based on the configuration.\r\n    // We still need to call initialize() before using it, but this ensures that we only create one instance of the client.\r\n    this.#msal = new PublicClientApplication(msalConfig);\r\n\r\n    // Initialize the BroadcastChannel for cross-tab communication\r\n    this.#initializeBroadcastChannel();\r\n\r\n    // Register resume listeners so returning to a tab revalidates auth state.\r\n    this.#registerResumeListeners();\r\n\r\n    // Attempt to restore authenticated state from any existing Microsoft session.\r\n    this.checkForExistingToken();\r\n  }\r\n  //#endregion\r\n\r\n  //#region Utilities\r\n\r\n  //Authenticate the user and store the token in Local Storage or Session Storage\r\n  login(): void {\r\n    // There are times this item is left in sessionStorage after logout, which can cause MSAL to think a login is in progress and block future logins.\r\n    // This is a workaround to ensure that the item is removed after logout.\r\n    if (typeof sessionStorage !== 'undefined' && sessionStorage.getItem(\"msal.interaction.status\"))\r\n      sessionStorage.removeItem(\"msal.interaction.status\");\r\n\r\n    this.authenticating = true;\r\n    this.authenticatingChanged.emit(this.authenticating);\r\n\r\n    console.log('AuthenticationSSOService: login() called. Authenticating user...');\r\n\r\n    // Initialize MSAL and then perform login via popup, followed by user validation.\r\n    this.#initializeMsal()\r\n      .then(() => this.#msal.loginPopup({\r\n        scopes: this.options.scopes,\r\n        authority: this.options.authenticationEndpoint,\r\n        prompt: 'select_account'\r\n      }))\r\n      .then((result) => this.validateUser(result))\r\n      .catch((error: unknown) => {\r\n        this.authenticating = false;\r\n        this.authenticatingChanged.emit(this.authenticating);\r\n        this.authenticationError.emit(error);\r\n      });\r\n  }\r\n\r\n  // Primary logout flow:\r\n  // 1) clear local state in this tab,\r\n  // 2) notify other tabs to clear their local state,\r\n  // 3) initiate Entra sign-out redirect from this initiating tab.\r\n  logout(): void {\r\n    this.#logoutLocalOnly(false);\r\n    this.#publishLogout();\r\n\r\n    // Only the initiating tab should call identity-provider logout.\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    this.#initializeMsal()\r\n      .then(() => this.#msal.logoutRedirect({\r\n        postLogoutRedirectUri: this.options.postLogoutRedirectUri\r\n      }))\r\n      .catch((error) => {\r\n        console.log('ERROR: Microsoft logout failed.', error);\r\n      });\r\n  }\r\n\r\n  tokenExists(): boolean {\r\n    const token = this.storage.getItem(this.options.tokenName ?? '');\r\n    return !!token;\r\n  }\r\n\r\n  // validateUser() = setAuthenticatedUser()\r\n  // Resolves current user and token claims into the app's authenticated model.\r\n  // Also validates/refreshes token when needed and schedules proactive refresh.\r\n  async validateUser(result?: AuthenticationResult, account?: AccountInfo): Promise<void> {\r\n    // Resolve account from auth result or fallback account.\r\n    let resolvedAccount = result?.account ?? account;\r\n\r\n    console.log('AuthenticationSSOService: Validating user. Result:', result, 'Account:', account, 'ResolvedAccount:', resolvedAccount);\r\n\r\n    // No account means app should be considered logged out.\r\n    if (!resolvedAccount) {\r\n      this.logout();\r\n      return;\r\n    }\r\n\r\n    // Keep MSAL active account in sync with resolved account context.\r\n    this.#msal.setActiveAccount(resolvedAccount);\r\n\r\n    let resolvedResult = result;\r\n    let claims = (resolvedResult?.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {}) as AuthenticationSSOClaims;\r\n\r\n    // expiresOn comes over as a Date object if it exists, but exp is a number of seconds since epoch.\r\n    // therefore, if expiresOn exists convert it to seconds since epoch, otherwise use exp if it exists, otherwise undefined.\r\n    // expiresOn is only present when the token is acquired via acquireTokenSilent or acquireTokenPopup, but not when the token is acquired via loginPopup or loginRedirect.\r\n    let expirationEpochSeconds = resolvedResult?.expiresOn ? Math.floor(resolvedResult.expiresOn.getTime() / 1000) : claims.exp ?? undefined;\r\n\r\n    // If token appears expired, attempt silent refresh before setting user state.\r\n    if (this.#isTokenExpired(expirationEpochSeconds)) {\r\n      const refreshedResult = await this.#refreshToken(resolvedAccount);\r\n\r\n      // Refresh failure means we should end the session.\r\n      if (!refreshedResult?.account) {\r\n        this.logout();\r\n        return;\r\n      }\r\n\r\n      resolvedResult = refreshedResult;\r\n      resolvedAccount = refreshedResult.account;\r\n      claims = (resolvedResult.idTokenClaims ?? resolvedAccount.idTokenClaims ?? {}) as AuthenticationSSOClaims;\r\n      expirationEpochSeconds = resolvedResult?.expiresOn ? Math.floor(resolvedResult.expiresOn.getTime() / 1000) : claims.exp ?? undefined;\r\n\r\n      // Still expired after refresh; terminate session to avoid stale auth.\r\n      if (this.#isTokenExpired(expirationEpochSeconds)) {\r\n        this.logout();\r\n        return;\r\n      }\r\n    }\r\n\r\n    // Derive a stable account name from available claims.\r\n    const preferredUsername = String(claims.preferred_username ?? resolvedAccount.username ?? claims.upn ?? claims.email ?? '');\r\n    const accountName = preferredUsername.includes('@') ? preferredUsername.split('@')[0] : preferredUsername;\r\n\r\n    // Map Entra claims to the app's authenticated user shape.\r\n    this.authenticatedUser = {\r\n      admin: false,\r\n      accountName: claims.accountName ?? accountName,\r\n      department: claims.department ?? '',\r\n      displayName: claims.displayName ?? '',\r\n      distinguishedName: claims.distinguishedName ?? '',\r\n      email: claims.mail,\r\n      employeeNumber: claims.employeeNumber,\r\n      firstName: claims.firstName ?? '',\r\n      hireDate: claims.hireDate ?? '',\r\n      lastName: claims.lastName ?? '',\r\n      manager: claims.manager,\r\n      memberOf: claims.memberOf,\r\n      phone: claims.phone,\r\n      photoUrl: claims.photoUrl,\r\n      sid: claims.securityIdentifier ?? '',\r\n      title: claims.title,\r\n      workShift: claims.workShift\r\n    } as AuthenticatedUser;\r\n\r\n    // Persist id token into shared auth storage key when configured.\r\n    if (this.options.tokenName) {\r\n      const token = resolvedAccount?.idToken;\r\n      if (token) {\r\n        this.storage.setItem(this.options.tokenName, token);\r\n      } else {\r\n        this.storage.removeItem(this.options.tokenName);\r\n      }\r\n    }\r\n\r\n    // console.log('AuthenticationSSOService: User validated successfully.', resolvedAccount);\r\n    // console.log('AuthenticationSSOService: User validated.', this.authenticatedUser);\r\n    // console.log('AuthenticationSSOService: Token claims.', claims);\r\n    // console.log('AuthenticationSSOService: Token expires at (epoch seconds).', claims.exp);\r\n\r\n    // Schedule refresh before expiration to keep session uninterrupted.\r\n    this.#scheduleTokenRefresh(expirationEpochSeconds, resolvedAccount);\r\n\r\n    // Publish authenticated state changes for the rest of the app.\r\n    this.authenticated = true;\r\n    this.authenticatedChanged.emit(this.authenticated);\r\n\r\n    this.authenticating = false;\r\n    this.authenticatingChanged.emit(this.authenticating);\r\n  }\r\n\r\n  // Rehydrates auth state from existing cached account on startup.\r\n  // We intentionally avoid handleRedirectPromise() because this service uses popup login.\r\n  checkForExistingToken(): void {\r\n    this.#initializeMsal()\r\n      .then(() => {\r\n        const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];\r\n        if (account)\r\n          return this.validateUser(undefined, account);\r\n\r\n        return undefined;\r\n      })\r\n      .catch((error: unknown) => {\r\n        console.log('ERROR: Failed to hydrate Microsoft auth state.', error);\r\n      });\r\n  }\r\n\r\n  // Initialize MSAL if it hasn't been initialized yet\r\n  // This ensures that we only initialize MSAL once, even if multiple login attempts are made\r\n  // This is important because there is startup work that must be completed by MSAL before it can be used, and we don't want to repeat that work unnecessarily\r\n  async #initializeMsal(): Promise<void> {\r\n    if (this.#initialized) {\r\n      return;\r\n    }\r\n\r\n\r\n    await this.#msal.initialize();\r\n    this.#initialized = true;\r\n  }\r\n\r\n  // Sets up same-origin cross-tab messaging used to fan out logout events.\r\n  #initializeBroadcastChannel(): void {\r\n    if (typeof BroadcastChannel === 'undefined') {\r\n      // Some runtimes may not support BroadcastChannel.\r\n      return;\r\n    }\r\n\r\n    // Create a new BroadcastChannel for cross-tab communication\r\n    this.#channel = new BroadcastChannel('sso-authentication-channel');\r\n\r\n    // Listen for messages from other tabs for logout events.\r\n    // When a logout message is received, the current tab will clear its local state and reload the page.\r\n    this.#channel.onmessage = (event) => {\r\n      if (event.data === this.#logoutMessage) {\r\n        console.log('Received logout message from another tab.');\r\n        // Receiving tabs clear local state and reload so route guards re-evaluate immediately.\r\n        this.#logoutLocalOnly(true);\r\n      }\r\n    };\r\n  }\r\n\r\n  // Registers visibility/focus listeners to re-check auth when user returns to the tab.\r\n  // Tabs can be backgrounded for long periods, and the user may have logged out in another tab or session.\r\n  #registerResumeListeners(): void {\r\n    const handleResume = () => {\r\n      void this.#syncAuthOnResume();\r\n    };\r\n\r\n    if (typeof document !== 'undefined') {\r\n      document.addEventListener('visibilitychange', () => {\r\n        if (document.visibilityState === 'visible') {\r\n          handleResume();\r\n        }\r\n      });\r\n    }\r\n\r\n    if (typeof window !== 'undefined') {\r\n      window.addEventListener('focus', handleResume);\r\n    }\r\n  }\r\n\r\n  // Syncs auth state after resume while preventing duplicate checks from rapid events.\r\n  async #syncAuthOnResume(): Promise<void> {\r\n    const now = Date.now();\r\n\r\n    // visibilitychange and focus often fire back-to-back; coalesce to one check.\r\n    // if now was less than 1 second since last check, skip this one.\r\n    if (this.#resumeCheckInProgress || now - this.#lastResumeCheckAt < 1000) {\r\n      return;\r\n    }\r\n\r\n    this.#resumeCheckInProgress = true;\r\n    this.#lastResumeCheckAt = now;\r\n\r\n    try {\r\n      await this.#initializeMsal();\r\n\r\n      const account = this.#msal.getActiveAccount() ?? this.#msal.getAllAccounts()[0];\r\n\r\n      if (!account)\r\n        return;\r\n\r\n      await this.validateUser(undefined, account);\r\n    }\r\n    catch (error) {\r\n      console.log('Error: Resume auth sync failed.', error);\r\n    }\r\n    finally {\r\n      this.#resumeCheckInProgress = false;\r\n    }\r\n  }\r\n\r\n  // Sends logout signal to other open tabs.\r\n  #publishLogout(): void {\r\n    this.#channel?.postMessage(this.#logoutMessage);\r\n  }\r\n\r\n  // Clears app/MSAL state in current tab without invoking provider-side logout.\r\n  // reloadAfterLogout is intended for non-initiating tabs to force UI reset to auth route.\r\n  async #logoutLocalOnly(reloadAfterLogout: boolean): Promise<void> {\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    if (this.options.tokenName && this.storage.getItem(this.options.tokenName)) {\r\n      this.storage.removeItem(this.options.tokenName);\r\n    }\r\n\r\n    this.authenticatedUser = undefined;\r\n    this.authenticated = false;\r\n    this.authenticatedChanged.emit(false);\r\n\r\n    try {\r\n      await this.#initializeMsal();\r\n      await this.#msal.clearCache();\r\n      this.#msal.setActiveAccount(null);\r\n\r\n      // There are times this item is left in sessionStorage after logout, which can cause MSAL to think a login is in progress and block future logins.\r\n      // This is a workaround to ensure that the item is removed after logout.\r\n      sessionStorage.removeItem(\"msal.interaction.status\");\r\n\r\n      // Secondary tabs should hard-refresh to guarantee route guards and app state reset.\r\n      if (reloadAfterLogout && typeof window !== 'undefined') {\r\n        window.location.reload();\r\n      }\r\n    } catch (error) {\r\n      console.log('WARN: Local MSAL cache clear failed.', error);\r\n    }\r\n  }\r\n\r\n  // Returns true when token expiration is absent or in the past.\r\n  #isTokenExpired(expirationEpochSeconds?: number): boolean {\r\n    if (!expirationEpochSeconds) {\r\n      return true;\r\n    }\r\n\r\n    return Date.now() >= expirationEpochSeconds * 1000;\r\n  }\r\n\r\n  // Attempts silent token acquisition for the current account.\r\n  async #refreshToken(account: AccountInfo): Promise<AuthenticationResult | undefined> {\r\n    try {\r\n      return await this.#msal.acquireTokenSilent({\r\n        account,\r\n        scopes: this.options.scopes\r\n      });\r\n    }\r\n    catch (error) {\r\n      console.log('Error: Silent token refresh failed.', error);\r\n      return undefined;\r\n    }\r\n  }\r\n\r\n  // Schedules token refresh shortly before expiration.\r\n  // If refresh fails, session is terminated to avoid inconsistent auth state.\r\n  #scheduleTokenRefresh(expirationEpochSeconds: number | undefined, account: AccountInfo): void {\r\n    this.#clearTokenRefreshTimer();\r\n\r\n    if (!expirationEpochSeconds) {\r\n      return;\r\n    }\r\n\r\n    // Convert Unix epoch seconds to milliseconds for Date.now() comparison\r\n    const expirationEpochMilliseconds = expirationEpochSeconds * 1000;\r\n    // Schedule refresh 1 minute before expiration\r\n    const refreshLeadTimeMs = 60000;\r\n    // Calculate the delay until the refresh should occur, ensuring it's not negative\r\n    const millisecondsUntilRefresh = expirationEpochMilliseconds - Date.now() - refreshLeadTimeMs;\r\n    const delay = Math.max(millisecondsUntilRefresh, 0);\r\n\r\n    this.#tokenRefreshTimeoutId = setTimeout(() => {\r\n      this.#refreshToken(account)\r\n        .then((result) => {\r\n          console.log('AuthenticationSSOService: Token refresh result.', result);\r\n          if (result?.account) {\r\n            return this.validateUser(result, result.account);\r\n          }\r\n\r\n          // No account after refresh implies invalid session.\r\n          this.logout();\r\n          return undefined;\r\n        })\r\n        .catch(() => {\r\n          // Any refresh exception falls back to logout for safety.\r\n          this.logout();\r\n        });\r\n    }, delay);\r\n  }\r\n\r\n  // Cancels any pending token refresh timer.\r\n  #clearTokenRefreshTimer(): void {\r\n    if (!this.#tokenRefreshTimeoutId) {\r\n      return;\r\n    }\r\n\r\n    clearTimeout(this.#tokenRefreshTimeoutId);\r\n    this.#tokenRefreshTimeoutId = undefined;\r\n  }\r\n  //#endregion\r\n}\r\n","import { Component, OnInit } from \"@angular/core\";\r\nimport { broadcastResponseToMainFrame } from \"@azure/msal-browser/redirect-bridge\";\r\n\r\n@Component({\r\n  selector: \"app-authentication-sso-redirect\",\r\n  standalone: true,\r\n  template: \"<p>Processing authentication...</p>\",\r\n})\r\nexport class AuthenticationSSORedirectComponent implements OnInit {\r\n    ngOnInit(): void {\r\n        broadcastResponseToMainFrame().catch((error: Error) => {\r\n            console.error(\"Error broadcasting response to main frame:\", error);\r\n        });\r\n    }\r\n}\r\n","import { CommonModule } from '@angular/common';\r\nimport { ModuleWithProviders, NgModule, Optional, SkipSelf } from '@angular/core';\r\n\r\nimport { AuthenticationSSOServiceOptions } from './model/authentication-sso-service-options';\r\nimport { AuthenticationSSOServiceOptionsToken } from './model/authentication-sso-service-options-token';\r\nimport { AuthenticationSSORedirectComponent } from './components/redirect/authentication-sso-redirect.component';\r\n\r\n@NgModule({\r\n  declarations: [],\r\n  imports: [\r\n    CommonModule,\r\n    AuthenticationSSORedirectComponent\r\n  ],\r\n  exports: [\r\n    AuthenticationSSORedirectComponent\r\n  ]\r\n})\r\nexport class AuthenticationSSOModule {\r\n  static forRoot(options: AuthenticationSSOServiceOptions): ModuleWithProviders<AuthenticationSSOModule> {\r\n    return {\r\n      ngModule: AuthenticationSSOModule,\r\n      providers: [\r\n        {\r\n          provide: AuthenticationSSOServiceOptionsToken,\r\n          useValue: options\r\n        }\r\n      ]\r\n    };\r\n  }\r\n\r\n  constructor(@Optional() @SkipSelf() parentModule: AuthenticationSSOModule) {\r\n    if (parentModule) {\r\n      throw new Error(\r\n        'AuthenticationSSOModule is already loaded. Import it in the AppModule only');\r\n    }\r\n  }\r\n}\r\n","import { inject } from '@angular/core';\r\nimport { CanActivateFn, Router } from '@angular/router';\r\nimport { map, take } from 'rxjs/operators';\r\nimport { AuthenticationSSOService } from '../authentication-sso.api';\r\n\r\nexport const authenticationSSOGuard: CanActivateFn = (_route, _state) => {\r\n  const authenticationService = inject(AuthenticationSSOService);\r\n  const router = inject(Router);\r\n\r\n  // if the user is already authenticated, allow access to the route\r\n  if (authenticationService.authenticated) {\r\n    return true;\r\n  }\r\n\r\n  if (authenticationService.tokenExists()) {\r\n    // we're doing this because we could've opened a new tab and the user is already logged in, so we need to check for an existing token\r\n    authenticationService.checkForExistingToken();\r\n\r\n    return authenticationService.authenticatedChanged.pipe(\r\n      take(1),\r\n      map(() => {\r\n        if (!authenticationService.authenticated) {\r\n          router.navigate(['']);\r\n          return false;\r\n        }\r\n\r\n        return true;\r\n      })\r\n    );\r\n  }\r\n  else {\r\n    router.navigate(['']);\r\n    return false;\r\n  }\r\n};\r\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './authentication-sso.api';\n"],"names":[],"mappings":";;;;;;;;;AAGA;AACA;AACA;AACA;AACA;MACa,oCAAoC,GAAG,IAAI,cAAc,CAAkC,iCAAiC;;ACUzI;AACA;AACA;AACA;AACA;AACA;AAIM,MAAO,wBAAyB,SAAQ,iBAAiB,CAAA;;AAe7D,IAAA,KAAK;;AAEL,IAAA,YAAY;;AAGZ,IAAA,QAAQ;;AAER,IAAA,cAAc;;AAGd,IAAA,sBAAsB;AACtB,IAAA,kBAAkB;;AAGlB,IAAA,sBAAsB;;;;;;;AAUtB,IAAA,IAAI,iBAAiB,GAAA;QACnB,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,qBAAqB,CAAC;;AAGtD,IAAA,IAAI,OAAO,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,iBAAiB;AAC3B,YAAA,cAAc;AACd,YAAA,YAAY;;;;AAMhB,IAAA,WAAA,CAAgF,OAAwC,EAAA;QACtH,KAAK,CAAC,OAAO,CAAC;QADgE,IAAA,CAAA,OAAO,GAAP,OAAO;;AAlDvF,QAAA,IAAA,CAAA,cAAc,GAAG,KAAK,CAAC;AACvB,QAAA,IAAA,CAAA,aAAa,GAAG,KAAK,CAAC;;AAItB;;AAEiC;AACvB,QAAA,IAAA,CAAA,oBAAoB,GAAG,IAAI,YAAY,EAAW;AAClD,QAAA,IAAA,CAAA,qBAAqB,GAAG,IAAI,YAAY,EAAW;AACnD,QAAA,IAAA,CAAA,mBAAmB,GAAG,IAAI,YAAY,EAAE;;QAKlD,IAAA,CAAA,YAAY,GAAG,KAAK;;QAKpB,IAAA,CAAA,cAAc,GAAG,QAAQ;;QAGzB,IAAA,CAAA,sBAAsB,GAAG,KAAK;QAC9B,IAAA,CAAA,kBAAkB,GAAG,CAAC;QA6BpB,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,CAAA,kCAAA,EAAqC,OAAO,CAAC,QAAQ,CAAA,CAAE;QAExH,IAAI,CAAC,OAAO,GAAG;AACb,YAAA,GAAG,OAAO;YAEV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,GAAG,QAAQ;YAC3D;SACD;;QAGD,IAAI,CAAC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,CAAC;;;AAIvH,QAAA,MAAM,UAAU,GAAkB;AAChC,YAAA,IAAI,EAAE;AACJ,gBAAA,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;AAC/B,gBAAA,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB;AAC9C,gBAAA,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;AACrC,gBAAA,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC;AACrC,aAAA;AACD,YAAA,KAAK,EAAE;AACL,gBAAA,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,GAAG,oBAAoB,CAAC;AAC7H;SACF;;;QAID,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC;;QAGpD,IAAI,CAAC,2BAA2B,EAAE;;QAGlC,IAAI,CAAC,wBAAwB,EAAE;;QAG/B,IAAI,CAAC,qBAAqB,EAAE;;;;;IAO9B,KAAK,GAAA;;;QAGH,IAAI,OAAO,cAAc,KAAK,WAAW,IAAI,cAAc,CAAC,OAAO,CAAC,yBAAyB,CAAC;AAC5F,YAAA,cAAc,CAAC,UAAU,CAAC,yBAAyB,CAAC;AAEtD,QAAA,IAAI,CAAC,cAAc,GAAG,IAAI;QAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;AAEpD,QAAA,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC;;QAG/E,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;AAChC,YAAA,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;AAC3B,YAAA,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB;AAC9C,YAAA,MAAM,EAAE;AACT,SAAA,CAAC;AACD,aAAA,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;AAC1C,aAAA,KAAK,CAAC,CAAC,KAAc,KAAI;AACxB,YAAA,IAAI,CAAC,cAAc,GAAG,KAAK;YAC3B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;AACpD,YAAA,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;AACtC,SAAC,CAAC;;;;;;IAON,MAAM,GAAA;AACJ,QAAA,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,cAAc,EAAE;;QAGrB,IAAI,CAAC,uBAAuB,EAAE;QAE9B,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;AACpC,YAAA,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC;AACrC,SAAA,CAAC;AACD,aAAA,KAAK,CAAC,CAAC,KAAK,KAAI;AACf,YAAA,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC;AACvD,SAAC,CAAC;;IAGN,WAAW,GAAA;AACT,QAAA,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAChE,OAAO,CAAC,CAAC,KAAK;;;;;AAMhB,IAAA,MAAM,YAAY,CAAC,MAA6B,EAAE,OAAqB,EAAA;;AAErE,QAAA,IAAI,eAAe,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO;AAEhD,QAAA,OAAO,CAAC,GAAG,CAAC,oDAAoD,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,kBAAkB,EAAE,eAAe,CAAC;;QAGnI,IAAI,CAAC,eAAe,EAAE;YACpB,IAAI,CAAC,MAAM,EAAE;YACb;;;AAIF,QAAA,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,eAAe,CAAC;QAE5C,IAAI,cAAc,GAAG,MAAM;AAC3B,QAAA,IAAI,MAAM,IAAI,cAAc,EAAE,aAAa,IAAI,eAAe,CAAC,aAAa,IAAI,EAAE,CAA4B;;;;AAK9G,QAAA,IAAI,sBAAsB,GAAG,cAAc,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS;;AAGxI,QAAA,IAAI,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE;YAChD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;;AAGjE,YAAA,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE;gBAC7B,IAAI,CAAC,MAAM,EAAE;gBACb;;YAGF,cAAc,GAAG,eAAe;AAChC,YAAA,eAAe,GAAG,eAAe,CAAC,OAAO;AACzC,YAAA,MAAM,IAAI,cAAc,CAAC,aAAa,IAAI,eAAe,CAAC,aAAa,IAAI,EAAE,CAA4B;AACzG,YAAA,sBAAsB,GAAG,cAAc,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS;;AAGpI,YAAA,IAAI,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE;gBAChD,IAAI,CAAC,MAAM,EAAE;gBACb;;;;QAKJ,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,IAAI,eAAe,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3H,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB;;QAGzG,IAAI,CAAC,iBAAiB,GAAG;AACvB,YAAA,KAAK,EAAE,KAAK;AACZ,YAAA,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;AAC9C,YAAA,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;AACnC,YAAA,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;AACrC,YAAA,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,cAAc,EAAE,MAAM,CAAC,cAAc;AACrC,YAAA,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;AACjC,YAAA,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;AAC/B,YAAA,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;AACzB,YAAA,GAAG,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE;YACpC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC;SACE;;AAGtB,QAAA,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;AAC1B,YAAA,MAAM,KAAK,GAAG,eAAe,EAAE,OAAO;YACtC,IAAI,KAAK,EAAE;AACT,gBAAA,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC;;iBAC9C;gBACL,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;;;;;;;;AAUnD,QAAA,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,eAAe,CAAC;;AAGnE,QAAA,IAAI,CAAC,aAAa,GAAG,IAAI;QACzB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;AAElD,QAAA,IAAI,CAAC,cAAc,GAAG,KAAK;QAC3B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;;;;IAKtD,qBAAqB,GAAA;QACnB,IAAI,CAAC,eAAe;aACjB,IAAI,CAAC,MAAK;AACT,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAC/E,YAAA,IAAI,OAAO;gBACT,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;AAE9C,YAAA,OAAO,SAAS;AAClB,SAAC;AACA,aAAA,KAAK,CAAC,CAAC,KAAc,KAAI;AACxB,YAAA,OAAO,CAAC,GAAG,CAAC,gDAAgD,EAAE,KAAK,CAAC;AACtE,SAAC,CAAC;;;;;AAMN,IAAA,MAAM,eAAe,GAAA;AACnB,QAAA,IAAI,IAAI,CAAC,YAAY,EAAE;YACrB;;AAIF,QAAA,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;AAC7B,QAAA,IAAI,CAAC,YAAY,GAAG,IAAI;;;IAI1B,2BAA2B,GAAA;AACzB,QAAA,IAAI,OAAO,gBAAgB,KAAK,WAAW,EAAE;;YAE3C;;;QAIF,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,4BAA4B,CAAC;;;QAIlE,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,KAAK,KAAI;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,cAAc,EAAE;AACtC,gBAAA,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC;;AAExD,gBAAA,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;;AAE/B,SAAC;;;;IAKH,wBAAwB,GAAA;QACtB,MAAM,YAAY,GAAG,MAAK;AACxB,YAAA,KAAK,IAAI,CAAC,iBAAiB,EAAE;AAC/B,SAAC;AAED,QAAA,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE;AACnC,YAAA,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,MAAK;AACjD,gBAAA,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE;AAC1C,oBAAA,YAAY,EAAE;;AAElB,aAAC,CAAC;;AAGJ,QAAA,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACjC,YAAA,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC;;;;AAKlD,IAAA,MAAM,iBAAiB,GAAA;AACrB,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;;;AAItB,QAAA,IAAI,IAAI,CAAC,sBAAsB,IAAI,GAAG,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE;YACvE;;AAGF,QAAA,IAAI,CAAC,sBAAsB,GAAG,IAAI;AAClC,QAAA,IAAI,CAAC,kBAAkB,GAAG,GAAG;AAE7B,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,eAAe,EAAE;AAE5B,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAE/E,YAAA,IAAI,CAAC,OAAO;gBACV;YAEF,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;;QAE7C,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC;;gBAE/C;AACN,YAAA,IAAI,CAAC,sBAAsB,GAAG,KAAK;;;;IAKvC,cAAc,GAAA;QACZ,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;;;;IAKjD,MAAM,gBAAgB,CAAC,iBAA0B,EAAA;QAC/C,IAAI,CAAC,uBAAuB,EAAE;AAE9B,QAAA,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YAC1E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;;AAGjD,QAAA,IAAI,CAAC,iBAAiB,GAAG,SAAS;AAClC,QAAA,IAAI,CAAC,aAAa,GAAG,KAAK;AAC1B,QAAA,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;AAErC,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,eAAe,EAAE;AAC5B,YAAA,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;AAC7B,YAAA,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC;;;AAIjC,YAAA,cAAc,CAAC,UAAU,CAAC,yBAAyB,CAAC;;AAGpD,YAAA,IAAI,iBAAiB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACtD,gBAAA,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;;;QAE1B,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,CAAC;;;;AAK9D,IAAA,eAAe,CAAC,sBAA+B,EAAA;QAC7C,IAAI,CAAC,sBAAsB,EAAE;AAC3B,YAAA,OAAO,IAAI;;QAGb,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,sBAAsB,GAAG,IAAI;;;IAIpD,MAAM,aAAa,CAAC,OAAoB,EAAA;AACtC,QAAA,IAAI;AACF,YAAA,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;gBACzC,OAAO;AACP,gBAAA,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;AACtB,aAAA,CAAC;;QAEJ,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,KAAK,CAAC;AACzD,YAAA,OAAO,SAAS;;;;;IAMpB,qBAAqB,CAAC,sBAA0C,EAAE,OAAoB,EAAA;QACpF,IAAI,CAAC,uBAAuB,EAAE;QAE9B,IAAI,CAAC,sBAAsB,EAAE;YAC3B;;;AAIF,QAAA,MAAM,2BAA2B,GAAG,sBAAsB,GAAG,IAAI;;QAEjE,MAAM,iBAAiB,GAAG,KAAK;;QAE/B,MAAM,wBAAwB,GAAG,2BAA2B,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;QAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;AAEnD,QAAA,IAAI,CAAC,sBAAsB,GAAG,UAAU,CAAC,MAAK;AAC5C,YAAA,IAAI,CAAC,aAAa,CAAC,OAAO;AACvB,iBAAA,IAAI,CAAC,CAAC,MAAM,KAAI;AACf,gBAAA,OAAO,CAAC,GAAG,CAAC,iDAAiD,EAAE,MAAM,CAAC;AACtE,gBAAA,IAAI,MAAM,EAAE,OAAO,EAAE;oBACnB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;;;gBAIlD,IAAI,CAAC,MAAM,EAAE;AACb,gBAAA,OAAO,SAAS;AAClB,aAAC;iBACA,KAAK,CAAC,MAAK;;gBAEV,IAAI,CAAC,MAAM,EAAE;AACf,aAAC,CAAC;SACL,EAAE,KAAK,CAAC;;;IAIX,uBAAuB,GAAA;AACrB,QAAA,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAChC;;AAGF,QAAA,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC;AACzC,QAAA,IAAI,CAAC,sBAAsB,GAAG,SAAS;;AApc9B,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,kBAoDH,oCAAoC,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AApDzD,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,cAFvB,MAAM,EAAA,CAAA,CAAA;;2FAEP,wBAAwB,EAAA,UAAA,EAAA,CAAA;kBAHpC,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;0BAqDc;;0BAAY,MAAM;2BAAC,oCAAoC;;sBA1CnE;;sBACA;;sBACA;;;MC/BU,kCAAkC,CAAA;IAC3C,QAAQ,GAAA;AACJ,QAAA,4BAA4B,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,KAAI;AAClD,YAAA,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC;AACtE,SAAC,CAAC;;8GAJG,kCAAkC,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA,CAAA;AAAlC,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,kCAAkC,2FAFnC,qCAAqC,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,CAAA;;2FAEpC,kCAAkC,EAAA,UAAA,EAAA,CAAA;kBAL9C,SAAS;AAAC,YAAA,IAAA,EAAA,CAAA;AACT,oBAAA,QAAQ,EAAE,iCAAiC;AAC3C,oBAAA,UAAU,EAAE,IAAI;AAChB,oBAAA,QAAQ,EAAE,qCAAqC;AAChD,iBAAA;;;MCUY,uBAAuB,CAAA;IAClC,OAAO,OAAO,CAAC,OAAwC,EAAA;QACrD,OAAO;AACL,YAAA,QAAQ,EAAE,uBAAuB;AACjC,YAAA,SAAS,EAAE;AACT,gBAAA;AACE,oBAAA,OAAO,EAAE,oCAAoC;AAC7C,oBAAA,QAAQ,EAAE;AACX;AACF;SACF;;AAGH,IAAA,WAAA,CAAoC,YAAqC,EAAA;QACvE,IAAI,YAAY,EAAE;AAChB,YAAA,MAAM,IAAI,KAAK,CACb,4EAA4E,CAAC;;;8GAhBxE,uBAAuB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAA,uBAAA,EAAA,QAAA,EAAA,IAAA,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,QAAA,EAAA,CAAA,CAAA;AAAvB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,mBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,YAPhC,YAAY;AACZ,YAAA,kCAAkC,aAGlC,kCAAkC,CAAA,EAAA,CAAA,CAAA;AAGzB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,mBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,YAPhC,YAAY,CAAA,EAAA,CAAA,CAAA;;2FAOH,uBAAuB,EAAA,UAAA,EAAA,CAAA;kBAVnC,QAAQ;AAAC,YAAA,IAAA,EAAA,CAAA;AACR,oBAAA,YAAY,EAAE,EAAE;AAChB,oBAAA,OAAO,EAAE;wBACP,YAAY;wBACZ;AACD,qBAAA;AACD,oBAAA,OAAO,EAAE;wBACP;AACD;AACF,iBAAA;;0BAcc;;0BAAY;;;MCzBd,sBAAsB,GAAkB,CAAC,MAAM,EAAE,MAAM,KAAI;AACtE,IAAA,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC;AAC9D,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;;AAG7B,IAAA,IAAI,qBAAqB,CAAC,aAAa,EAAE;AACvC,QAAA,OAAO,IAAI;;AAGb,IAAA,IAAI,qBAAqB,CAAC,WAAW,EAAE,EAAE;;QAEvC,qBAAqB,CAAC,qBAAqB,EAAE;AAE7C,QAAA,OAAO,qBAAqB,CAAC,oBAAoB,CAAC,IAAI,CACpD,IAAI,CAAC,CAAC,CAAC,EACP,GAAG,CAAC,MAAK;AACP,YAAA,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE;AACxC,gBAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACrB,gBAAA,OAAO,KAAK;;AAGd,YAAA,OAAO,IAAI;SACZ,CAAC,CACH;;SAEE;AACH,QAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACrB,QAAA,OAAO,KAAK;;AAEhB;;AClCA;;AAEG;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "comment": "NGX-LIB primary entry point package.json",
   "name": "@cleavelandprice/ngx-lib",
-  "version": "4.7.7",
+  "version": "4.7.9",
   "description": "Angular library providing foundational functionality to Cleaveland-Price applications",
   "peerDependencies": {
     "@angular/common": "^21.0.0",