@kolektor/nucleus-identity 0.0.8-pre.5676 → 0.0.9-pre.5874

package/fesm2020/kolektor-nucleus-identity.mjs

@@ -0,0 +1,1054 @@
+import * as i0 from '@angular/core';
+import { Injectable, NgModule } from '@angular/core';
+import * as i1$1 from '@angular/common/http';
+import { HttpErrorResponse, HTTP_INTERCEPTORS } from '@angular/common/http';
+import { lastValueFrom, from, throwError } from 'rxjs';
+import { AppAuthError, AuthorizationNotifier, TokenResponse, Requestor, AuthorizationServiceConfiguration, JQueryRequestor, nowInSeconds, BaseTokenRequestHandler, BasicQueryStringUtils, TokenRequest, GRANT_TYPE_AUTHORIZATION_CODE, GRANT_TYPE_REFRESH_TOKEN, LocalStorageBackend, RedirectRequestHandler, AuthorizationRequest } from '@openid/appauth';
+import { App } from '@capacitor/app';
+import { Browser } from '@capacitor/browser';
+import { Device } from '@capacitor/device';
+import * as base64 from 'base64-js';
+import * as i1 from '@kolektor/nucleus-common';
+import { SecureStoragePlugin } from 'capacitor-secure-storage-plugin';
+import { mergeMap, catchError } from 'rxjs/operators';
+
+class NucleusIdentityConfig {
+    constructor() {
+        this.authority = null;
+        this.httpInterceptorUrls = [];
+        this.automaticLoginOnHttp401 = false;
+    }
+}
+
+const CHARSET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+class NucleusCrypto {
+    constructor() {
+        this.browserCrypto = window.crypto || window.msCrypto;
+    }
+    generateRandom(size) {
+        const buffer = new Uint8Array(size);
+        if (this.browserCrypto) {
+            this.browserCrypto.getRandomValues(buffer);
+        }
+        else {
+            // fall back to Math.random() if nothing else is available
+            for (let i = 0; i < size; i += 1) {
+                buffer[i] = Math.random();
+            }
+        }
+        return this.bufferToString(buffer);
+    }
+    deriveChallenge(code) {
+        if (code.length < 43 || code.length > 128) {
+            return Promise.reject(new AppAuthError('Invalid code length.'));
+        }
+        if (!this.browserCrypto.subtle) {
+            return Promise.reject(new AppAuthError('window.crypto.subtle is unavailable.'));
+        }
+        const ecode = this.textEncodeLite(code);
+        const op = this.browserCrypto.subtle.digest('SHA-256', ecode);
+        return new Promise((resolve, reject) => {
+            // if operation contains algorithm it means it is not a promise which means it is CryptoOperation from IE.
+            // We just return result as promise
+            if (op.algorithm) {
+                console.log('we have a CryptoOperation');
+                op.addEventListener('complete', () => {
+                    resolve(this.urlSafe(op.result));
+                });
+                op.addEventListener('error', () => {
+                    reject(op.result);
+                });
+            }
+            else { // the result is promise
+                op.then(buffer => resolve(this.urlSafe(buffer)), error => reject(error));
+            }
+        });
+    }
+    urlSafe(buffer) {
+        const encoded = base64.fromByteArray(new Uint8Array(buffer));
+        return encoded.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    }
+    textEncodeLite(str) {
+        const buf = new ArrayBuffer(str.length);
+        const bufView = new Uint8Array(buf);
+        for (let i = 0; i < str.length; i++) {
+            bufView[i] = str.charCodeAt(i);
+        }
+        return bufView;
+    }
+    bufferToString(buffer) {
+        const state = [];
+        for (let i = 0; i < buffer.byteLength; i += 1) {
+            const index = buffer[i] % CHARSET.length;
+            state.push(CHARSET[index]);
+        }
+        return state.join('');
+    }
+}
+
+class LocationService {
+    constructor(appService) {
+        this.appService = appService;
+    }
+    get hash() {
+        return window.location.hash;
+    }
+    set hash(v) {
+        window.location.hash = v;
+    }
+    get host() {
+        return window.location.host;
+    }
+    set host(v) {
+        window.location.host = v;
+    }
+    get origin() {
+        return window.location.origin;
+    }
+    get hostname() {
+        return window.location.hostname;
+    }
+    set hostname(v) {
+        window.location.hostname = v;
+    }
+    get pathname() {
+        return window.location.pathname;
+    }
+    set pathname(v) {
+        window.location.pathname = v;
+    }
+    get port() {
+        return window.location.port;
+    }
+    set port(v) {
+        window.location.port = v;
+    }
+    get protocol() {
+        return window.location.protocol;
+    }
+    set protocol(v) {
+        window.location.protocol = v;
+    }
+    get search() {
+        return window.location.search;
+    }
+    set search(v) {
+        window.location.search = v;
+    }
+    assign(url) {
+        if (this.appService.isNative) {
+            Browser.open({ url });
+        }
+        else {
+            window.location.assign(url);
+        }
+    }
+}
+LocationService.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: LocationService, deps: [{ token: i1.NucleusAppService }], target: i0.ɵɵFactoryTarget.Injectable });
+LocationService.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: LocationService, providedIn: 'root' });
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: LocationService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: function () { return [{ type: i1.NucleusAppService }]; } });
+
+class NucleusAuthorizationNotifier extends AuthorizationNotifier {
+    constructor() {
+        super();
+        this.setAuthorizationListener((request, response, error) => {
+            console.log('Authorization request complete ', request, response, error);
+            this.response = response;
+            this.request = request;
+            this.error = error;
+        });
+    }
+}
+
+class Claim {
+    constructor(name, values) {
+        this.name = name;
+        this.values = values;
+    }
+}
+class Identity {
+    constructor() {
+        this.claims = [];
+    }
+    static createFromResponse(res) {
+        const token = this.decodeToken(res.idToken);
+        const id = new Identity();
+        id.name = token.name;
+        id.subject = token.sub;
+        for (const key in token) {
+            if ({}.hasOwnProperty.call(token, key)) {
+                let vals = token[key];
+                if (!Array.isArray(vals)) {
+                    vals = [vals];
+                }
+                const claim = new Claim(key, vals);
+                id.claims.push(claim);
+            }
+        }
+        return id;
+    }
+    static decodeToken(jwt) {
+        if (!jwt) {
+            throw new Error('NucleusIdentity: There was no identity token in the response!');
+        }
+        try {
+            const arr = jwt.split('.');
+            // var header = arr[0];
+            const payload = this.b64DecodeUnicode(arr[1]);
+            // var signature = arr[2];
+            return JSON.parse(payload);
+        }
+        catch (error) {
+            console.error('Error while decoding identity token', error);
+            console.error('Error while decoding identity token JWT', jwt);
+        }
+    }
+    static b64DecodeUnicode(str) {
+        str = str.replace(/-/g, '+').replace(/_/g, '/'); // Qlector fix :)
+        return decodeURIComponent(atob(str).split('').map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2)).join(''));
+    }
+}
+
+class SecretsStore {
+    constructor(clientId) {
+        this._tokens = {};
+        this._identities = {};
+        // this specify which identity id is used by default, when If id is not specified in getToken or getIdentity
+        this._defaultIdentityId = null;
+        this._defaultIdentityIdStorageKey = null;
+        this._tokenStorageKeyPrefix = `Nucleus.Identity.${clientId}`; // do not change this or login with existing tokens will fail
+        this._servicePrincipalKey = `${this._tokenStorageKeyPrefix}.SvcP`;
+        this._defaultIdentityIdStorageKey = `${this._tokenStorageKeyPrefix}.IdId`;
+        this._defaultIdentityId = localStorage.getItem(this._defaultIdentityIdStorageKey);
+    }
+    removeServicePrincipal() {
+        this._servicePrincipal = null;
+        return this.clear(this._servicePrincipalKey);
+    }
+    async setServicePrincipal(servicePrincipal) {
+        this._servicePrincipal = servicePrincipal;
+        await this.save(this._servicePrincipalKey, servicePrincipal);
+    }
+    async getServicePrincipal() {
+        if (!this._servicePrincipal) {
+            this._servicePrincipal = await this.load(this._servicePrincipalKey);
+        }
+        return this._servicePrincipal;
+    }
+    setToken(token, id = null) {
+        return this.setTokenInternal(token, true, id);
+    }
+    getIdentity(id = null) {
+        const key = this.getTokenKey(id);
+        return this._identities[key];
+    }
+    setDefaultIdentityId(id) {
+        this._defaultIdentityId = id;
+        if (this._defaultIdentityId) {
+            localStorage.setItem(this._defaultIdentityIdStorageKey, this._defaultIdentityId);
+        }
+        else {
+            localStorage.removeItem(this._defaultIdentityIdStorageKey);
+        }
+    }
+    async getToken(id = null) {
+        const key = this.getTokenKey(id);
+        // if token is not there or it is invalid we check storage again before returning
+        if (!this._tokens[key] || !this._tokens[key].isValid()) {
+            await this.reloadTokenFromStorage(id);
+        }
+        return this._tokens[key];
+    }
+    removeToken(id = null) {
+        const key = this.getTokenKey(id);
+        delete this._tokens[key];
+        delete this._identities[key];
+        return this.clear(key);
+    }
+    async reloadTokenFromStorage(id) {
+        const key = this.getTokenKey(id);
+        const storedToken = await this.load(key);
+        if (storedToken) {
+            const res = new TokenResponse(storedToken);
+            if (res?.accessToken || res?.idToken) {
+                await this.setTokenInternal(res, false, id);
+            }
+        }
+        return null;
+    }
+    async setTokenInternal(token, save, id = null) {
+        const key = this.getTokenKey(id);
+        if (token == null) {
+            await this.removeToken(id);
+        }
+        else {
+            this._tokens[key] = token;
+            this._identities[key] = Identity.createFromResponse(token);
+            if (save) {
+                try {
+                    await this.save(key, token.toJson());
+                }
+                catch (e) {
+                    console.warn('Nucleus.Identity: Could not save to SecureStorage.');
+                }
+            }
+        }
+    }
+    getTokenKey(id = null) {
+        if (!id) {
+            id = this._defaultIdentityId;
+        }
+        return id ? `${this._tokenStorageKeyPrefix}.${id}` : this._tokenStorageKeyPrefix;
+    }
+    clear(key) {
+        return SecureStoragePlugin.remove({ key });
+    }
+    save(key, value) {
+        return SecureStoragePlugin.set({ key, value: JSON.stringify(value) });
+    }
+    async load(key) {
+        try {
+            const x = await SecureStoragePlugin.get({ key });
+            if (x?.value) {
+                return JSON.parse(x.value);
+            }
+            else {
+                return null;
+            }
+        }
+        catch {
+            return null;
+        }
+    }
+}
+
+class AngularRequestor extends Requestor {
+    constructor(http) {
+        super();
+        this.http = http;
+    }
+    // eslint-disable-next-line no-undef
+    xhr(settings) {
+        if (settings.method === undefined) {
+            settings.method = 'GET';
+        }
+        return new Promise((resolve, reject) => {
+            this.http.request(settings.method, settings.url, {
+                body: settings.data,
+                headers: settings.headers,
+            }).subscribe(res => resolve(res), err => {
+                let e = new AppAuthError(err);
+                if (err instanceof HttpErrorResponse) {
+                    e = new AppAuthError(err.error?.error || err.statusText);
+                }
+                reject(e);
+            });
+        });
+    }
+}
+AngularRequestor.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: AngularRequestor, deps: [{ token: i1$1.HttpClient }], target: i0.ɵɵFactoryTarget.Injectable });
+AngularRequestor.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: AngularRequestor, providedIn: 'root' });
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: AngularRequestor, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: function () { return [{ type: i1$1.HttpClient }]; } });
+
+const WELL_KNOWN_PATH = '.well-known';
+const OPENID_CONFIGURATION = 'openid-configuration';
+class NucleusAuthorizationServiceConfiguration extends AuthorizationServiceConfiguration {
+    constructor(request) {
+        super(request);
+        this.deviceAuthorizationEndpoint = request.device_authorization_endpoint;
+        this.registrationEndpoint = request.registration_endpoint;
+    }
+    static fetchFromIssuer(openIdIssuerUrl, requestor) {
+        const fullUrl = `${openIdIssuerUrl}/${WELL_KNOWN_PATH}/${OPENID_CONFIGURATION}`;
+        const requestorToUse = requestor || new JQueryRequestor();
+        return requestorToUse
+            .xhr({ url: fullUrl, dataType: 'json', method: 'GET' })
+            .then(json => new NucleusAuthorizationServiceConfiguration(json));
+    }
+    toJson() {
+        const res = super.toJson();
+        res.device_authorization_endpoint = this.deviceAuthorizationEndpoint;
+        return res;
+    }
+}
+
+class OidcConfigurationService {
+    constructor(requestor, config, appService) {
+        this.requestor = requestor;
+        this.config = config;
+        this.appService = appService;
+        this._configuration = null;
+    }
+    async getConfiguration() {
+        await this.assureConfiguration();
+        return this._configuration;
+    }
+    get clientId() {
+        return this.config.clientId;
+    }
+    get requestedScopes() {
+        return this.config.requestedScopes;
+    }
+    get servicePrincipalRequestedScopes() {
+        return this.config.servicePrincipalRequestedScopes;
+    }
+    get authProviderHint() {
+        return this.config.authProviderHint;
+    }
+    get redirectUrl() {
+        let uri = window.location.href;
+        const platform = this.appService.platform;
+        if (platform === 'android' && this.config.androidRedirectUri) {
+            uri = this.config.androidRedirectUri;
+        }
+        else if (platform === 'ios' && this.config.iOSRedirectUri) {
+            uri = this.config.iOSRedirectUri;
+        }
+        else if (this.config.redirectUri) {
+            uri = this.config.redirectUri;
+        }
+        return this.NormalizeRedirectUri(uri);
+    }
+    getServerUrl(relativeUri = null) {
+        let authority = this.config.authority;
+        if (!authority || authority === 'origin') {
+            authority = window.origin;
+        }
+        let url = new URL(authority);
+        if (relativeUri) {
+            url = new URL(relativeUri, url);
+        }
+        return url.href;
+    }
+    NormalizeRedirectUri(uri) {
+        const i = uri.indexOf('#');
+        if (i > 0) {
+            uri = uri.substring(0, i);
+        }
+        return uri;
+    }
+    async assureConfiguration() {
+        if (this._configuration != null) {
+            return;
+        }
+        let authority = this.getServerUrl();
+        if (authority[authority.length - 1] === '/') {
+            authority = authority.slice(0, -1);
+        }
+        try {
+            this._configuration = await NucleusAuthorizationServiceConfiguration.fetchFromIssuer(authority, this.requestor);
+        }
+        catch (e) {
+            console.error('Nucleus.Identity: Cannot load OIDC configuration: ' + e.message);
+            throw e;
+        }
+    }
+}
+OidcConfigurationService.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: OidcConfigurationService, deps: [{ token: AngularRequestor }, { token: NucleusIdentityConfig }, { token: i1.NucleusAppService }], target: i0.ɵɵFactoryTarget.Injectable });
+OidcConfigurationService.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: OidcConfigurationService, providedIn: 'root' });
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: OidcConfigurationService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: function () { return [{ type: AngularRequestor }, { type: NucleusIdentityConfig }, { type: i1.NucleusAppService }]; } });
+
+class DeviceCode {
+    constructor(response) {
+        this.deviceCode = response.device_code;
+        this.userCode = response.user_code;
+        this.verificationUrl = response.verification_uri;
+        this.verificationUrlComplete = response.verification_uri_complete;
+        this.expiresIn = parseInt(response.expires_in, 10);
+        this.issuedAt = nowInSeconds();
+    }
+    isExpired(buffer = 60) {
+        return this.secondsLeft(buffer) <= 0;
+    }
+    secondsLeft(buffer = 60) {
+        const now = nowInSeconds();
+        return (this.issuedAt + this.expiresIn - buffer) - now;
+    }
+}
+
+class ClientRegistrationResponse {
+    constructor(response) {
+        this.clientId = response.client_id;
+        this.clientSecret = response.client_secret;
+        this.secretExpirationDate = new Date(response.client_secret_expires_at * 1000);
+    }
+}
+
+class TokenClient {
+    constructor(requestor, config) {
+        this.requestor = requestor;
+        this.config = config;
+        this._tokenHandler = new BaseTokenRequestHandler(requestor);
+        this._utils = new BasicQueryStringUtils();
+    }
+    async getByAuthorizationCode(redirectUrl, code, codeVerifier) {
+        const config = await this.config.getConfiguration();
+        const redirectUri = redirectUrl;
+        const req = new TokenRequest({
+            client_id: this.config.clientId,
+            redirect_uri: redirectUri,
+            grant_type: GRANT_TYPE_AUTHORIZATION_CODE,
+            code,
+            extras: { code_verifier: codeVerifier }
+        });
+        return await this._tokenHandler.performTokenRequest(config, req);
+    }
+    async getByRefreshToken(refreshToken) {
+        const config = await this.config.getConfiguration();
+        const redirectUri = this.config.redirectUrl;
+        const req = new TokenRequest({
+            client_id: this.config.clientId,
+            redirect_uri: redirectUri,
+            grant_type: GRANT_TYPE_REFRESH_TOKEN,
+            refresh_token: refreshToken
+        });
+        return await this._tokenHandler.performTokenRequest(config, req);
+    }
+    async getByClientCredentials(clientId, clientSecret, scope) {
+        const config = await this.config.getConfiguration();
+        const req = new TokenRequest({
+            client_id: clientId,
+            redirect_uri: null,
+            grant_type: 'client_credentials',
+            extras: {
+                client_secret: clientSecret,
+                scope,
+            }
+        });
+        return await this._tokenHandler.performTokenRequest(config, req);
+    }
+    async getBySecret(provider, secret, assertionToken, scope) {
+        const config = await this.config.getConfiguration();
+        const req = new TokenRequest({
+            client_id: this.config.clientId,
+            redirect_uri: null,
+            grant_type: 'urn:kolektor:nucleus:secret',
+            extras: {
+                secret_provider: provider,
+                secret_value: secret,
+                client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+                client_assertion: assertionToken,
+                scope,
+            }
+        });
+        return await this._tokenHandler.performTokenRequest(config, req);
+    }
+    async getByDeviceCode(deviceCode) {
+        const config = await this.config.getConfiguration();
+        const req = new TokenRequest({
+            client_id: this.config.clientId,
+            redirect_uri: null,
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            extras: {
+                device_code: deviceCode
+            }
+        });
+        return await this._tokenHandler.performTokenRequest(config, req);
+    }
+    async registerServicePrincipal(token) {
+        const config = await this.config.getConfiguration();
+        const response = await this.requestor.xhr({
+            url: config.registrationEndpoint,
+            method: 'POST',
+            dataType: 'json',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`
+            }
+            // data: this._utils.stringify(map)
+        });
+        if (response.error === undefined) {
+            return new ClientRegistrationResponse(response);
+        }
+        else {
+            throw new AppAuthError(response.error);
+        }
+    }
+    async getRegistrationCode(existingServicePrincipalId = null) {
+        const params = {
+            custom_action: 'sp_register',
+            service_principal_id: existingServicePrincipalId
+        };
+        return this.getDeviceCodeInternal(params);
+    }
+    async getDeviceCode(scope) {
+        const params = {
+            scope,
+        };
+        return this.getDeviceCodeInternal(params);
+    }
+    async getDeviceCodeInternal(params) {
+        const config = await this.config.getConfiguration();
+        params['client_id'] = this.config.clientId;
+        const map = params;
+        const response = await this.requestor.xhr({
+            url: config.deviceAuthorizationEndpoint,
+            method: 'POST',
+            dataType: 'json',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            data: this._utils.stringify(map)
+        });
+        if (response.error === undefined) {
+            return new DeviceCode(response);
+        }
+        else {
+            throw new AppAuthError(response.error);
+        }
+    }
+}
+TokenClient.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: TokenClient, deps: [{ token: AngularRequestor }, { token: OidcConfigurationService }], target: i0.ɵɵFactoryTarget.Injectable });
+TokenClient.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: TokenClient, providedIn: 'root' });
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: TokenClient, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: function () { return [{ type: AngularRequestor }, { type: OidcConfigurationService }]; } });
+
+class ServicePrincipal {
+}
+class ServicePrincipalRegistrationStatus {
+    constructor(servicePrincipal) {
+        this.isRegistered = false;
+        if (servicePrincipal) {
+            this.isRegistered = true;
+            this.id = servicePrincipal.id;
+            this.expiresAt = servicePrincipal.expiresAt;
+        }
+    }
+    get isExpired() {
+        return false;
+    }
+}
+
+class NucleusIdentityService {
+    constructor(appService, location, http, config, tokenClient) {
+        this.appService = appService;
+        this.http = http;
+        this.config = config;
+        this.tokenClient = tokenClient;
+        this._authorizationNotifier = new NucleusAuthorizationNotifier();
+        this._initStarted = false;
+        this._initialized = false;
+        this._servicePrincipalTokenId = '_svcp';
+        const storage = new LocalStorageBackend();
+        this._crypto = new NucleusCrypto();
+        this._authorizationHandler = new RedirectRequestHandler(storage, new BasicQueryStringUtils(), location, this._crypto);
+        this._authorizationHandler.setAuthorizationNotifier(this._authorizationNotifier);
+        this._store = new SecretsStore(config.clientId);
+    }
+    get identity() {
+        return this._store.getIdentity();
+    }
+    get isAuthenticated() {
+        return this.identity != null;
+    }
+    get servicePrincipalIdentity() {
+        return this._store.getIdentity(this._servicePrincipalTokenId);
+    }
+    get isServicePrincipalAuthenticated() {
+        return this.servicePrincipalIdentity != null;
+    }
+    async init(startLogin = false) {
+        if (this._initStarted || this._initialized) {
+            console.warn('Nucleus.Identity: Auth initialization was already started. Don\'t call init() multiple times!');
+            return;
+        }
+        this._initStarted = true;
+        this.handleLaunchCodeHash();
+        await this._authorizationHandler.completeAuthorizationRequestIfPossible();
+        const authErr = this._authorizationNotifier.error;
+        if (authErr) {
+            throw new Error('Authorization err: ' + authErr.error + ': ' + authErr.errorDescription);
+        }
+        else if (this._authorizationNotifier.response) {
+            window.location.hash = '';
+            const request = this._authorizationNotifier.request;
+            const response = this._authorizationNotifier.response;
+            const res = await this.tokenClient.getByAuthorizationCode(request.redirectUri, response.code, request.internal['code_verifier']);
+            this._store.setDefaultIdentityId(null);
+            await this._store.setToken(res);
+        }
+        else {
+            const res = await this._store.getToken();
+            if (!res && startLogin) {
+                await this.login();
+            }
+        }
+        this._initialized = true;
+    }
+    async loginWithSecret(provider, secret) {
+        this._store.removeToken();
+        const assertionToken = await this.getServicePrincipalAccessToken();
+        const scope = this.prepareScope(true, this.config?.requestedScopes);
+        const res = await this.tokenClient.getBySecret(provider, secret, assertionToken, scope);
+        this._store.setDefaultIdentityId(null);
+        await this._store.setToken(res);
+    }
+    async login() {
+        this._store.removeToken();
+        const config = await this.config.getConfiguration();
+        const request = this.prepareAuthorizationRequest();
+        if (this.appService.isNative) {
+            const listener = App.addListener('appUrlOpen', data => {
+                if (this.appService.platform === 'ios') {
+                    Browser.close();
+                }
+                listener.remove();
+                const hash = this.getCodeHash(data.url);
+                if (hash) {
+                    const targetUrl = window.location.origin + window.location.pathname + '#' + hash;
+                    window.location.assign(targetUrl);
+                    window.location.reload();
+                }
+                else {
+                    console.warn('Nucleus.Identity: Redirect url did not contain authorization code!', data);
+                }
+            });
+        }
+        this._authorizationHandler.performAuthorizationRequest(config, request);
+    }
+    async logout() {
+        this._store.removeToken();
+        const config = await this.config.getConfiguration();
+        const redirectUrl = this.config.redirectUrl;
+        const logoutUrl = config.endSessionEndpoint + '?post_logout_redirect_uri=' + encodeURI(redirectUrl);
+        if (this.appService.isNative) {
+            const listener = App.addListener('appUrlOpen', () => {
+                Device.getInfo().then(info => {
+                    if (info.platform === 'ios') {
+                        Browser.close();
+                    }
+                });
+                listener.remove();
+            });
+            Browser.open({ url: logoutUrl });
+        }
+        else {
+            window.location.assign(logoutUrl);
+        }
+    }
+    async getAccessToken() {
+        if (!this._getTokenPromise) {
+            this._getTokenPromise = this.getAccessTokenInternal();
+        }
+        try {
+            return await this._getTokenPromise;
+        }
+        finally {
+            this._getTokenPromise = null;
+        }
+    }
+    async getServicePrincipalAccessToken() {
+        if (!this._getServicePrincipalTokenPromise) {
+            this._getServicePrincipalTokenPromise = this.getServicePrincipalAccessTokenInternal();
+        }
+        try {
+            return await this._getServicePrincipalTokenPromise;
+        }
+        finally {
+            this._getServicePrincipalTokenPromise = null;
+        }
+    }
+    async loginServicePrincipal() {
+        const sp = await this._store.getServicePrincipal();
+        if (sp) {
+            const scope = this.prepareScope(false, this.config.servicePrincipalRequestedScopes);
+            const res = await this.tokenClient.getByClientCredentials(sp.id, sp.secret, scope);
+            await this._store.setToken(res, this._servicePrincipalTokenId);
+            return res;
+        }
+        else {
+            throw Error('Service principal is not registered!');
+        }
+    }
+    async loginAsServicePrincipal() {
+        const token = await this._store.getToken(this._servicePrincipalTokenId);
+        if (!token) {
+            await this.loginServicePrincipal();
+        }
+        this._store.setDefaultIdentityId(this._servicePrincipalTokenId);
+    }
+    async getOtp(type, expiresIn = -1) {
+        let url = this.config.getServerUrl(`/otp/create?type=${type}`);
+        if (expiresIn > 0) {
+            url += `&expiresIn=${expiresIn}`;
+        }
+        return lastValueFrom(this.http.get(url));
+    }
+    async getOtpStatus(id) {
+        const url = this.config.getServerUrl(`/otp/status/${id}`);
+        return lastValueFrom(this.http.get(url));
+    }
+    getOtpUrl(redirectUrl, password) {
+        const encoded = encodeURIComponent(redirectUrl);
+        const url = `/otp/auth?otpValue=${password}&returnUrl=${encoded}`;
+        return this.config.getServerUrl(url);
+    }
+    async startServicePrincipalRegistration() {
+        const sp = await this._store.getServicePrincipal();
+        return await this.tokenClient.getRegistrationCode(sp?.id);
+    }
+    async completeServicePrincipalRegistration(deviceCode) {
+        const tokenRes = await this.waitForDeviceToken(deviceCode);
+        const regRes = await this.tokenClient.registerServicePrincipal(tokenRes.accessToken);
+        await this._store.setServicePrincipal({
+            id: regRes.clientId,
+            secret: regRes.clientSecret,
+            expiresAt: regRes.secretExpirationDate
+        });
+    }
+    removeServicePrincipalRegistration() {
+        return this._store.removeServicePrincipal();
+    }
+    async getServicePrincipalRegistrationStatus() {
+        const sp = await this._store.getServicePrincipal();
+        return new ServicePrincipalRegistrationStatus(sp);
+    }
+    async startDeviceCodeLogin() {
+        const scope = this.prepareScope(true, this.config.requestedScopes);
+        return await this.tokenClient.getDeviceCode(scope);
+    }
+    async completeDeviceCodeLogin(deviceCode) {
+        const res = await this.waitForDeviceToken(deviceCode);
+        await this._store.setToken(res);
+    }
+    async waitForDeviceToken(deviceCode) {
+        let res = null;
+        do {
+            if (deviceCode.isExpired()) {
+                throw Error('Device code is expired!');
+            }
+            try {
+                res = await this.tokenClient.getByDeviceCode(deviceCode.deviceCode);
+            }
+            catch (error) {
+                if (error instanceof AppAuthError && error.message === 'authorization_pending') {
+                    await this.delay(2000);
+                }
+                else {
+                    throw error;
+                }
+            }
+        } while (!res);
+        return res;
+    }
+    prepareAuthorizationRequest() {
+        const redirectUri = this.config.redirectUrl;
+        const params = {
+            response_mode: 'fragment',
+            prompt: 'consent',
+            access_type: 'offline',
+            auth_provider_hint: this.config.authProviderHint
+        };
+        return new AuthorizationRequest({
+            client_id: this.config.clientId,
+            redirect_uri: redirectUri,
+            response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
+            scope: this.prepareScope(true, this.config.requestedScopes),
+            extras: params,
+        }, this._crypto, true);
+    }
+    async getServicePrincipalAccessTokenInternal() {
+        let token = await this._store.getToken(this._servicePrincipalTokenId);
+        if (!token?.isValid()) {
+            token = await this.loginServicePrincipal();
+        }
+        return token?.accessToken;
+    }
+    async getAccessTokenInternal() {
+        let token = await this._store.getToken();
+        if (token && !token.isValid()) {
+            token = await this.loginWithRefreshToken(token);
+        }
+        return token?.accessToken;
+    }
+    async loginWithRefreshToken(token) {
+        if (!this._refreshTokenPromise) {
+            this._refreshTokenPromise = this.loginWithRefreshTokenInternal(token);
+        }
+        try {
+            return await this._refreshTokenPromise;
+        }
+        finally {
+            this._refreshTokenPromise = null;
+        }
+    }
+    async loginWithRefreshTokenInternal(token) {
+        if (token?.refreshToken) {
+            try {
+                const res = await this.tokenClient.getByRefreshToken(token.refreshToken);
+                await this._store.setToken(res);
+                return res;
+            }
+            catch (err) {
+                console.warn('Nucleus.Identity: Failed to login with refresh token.', err);
+                if (err.message === 'invalid_grant') {
+                    await this.logout();
+                }
+            }
+        }
+        else {
+            console.warn('Nucleus.Identity: There is no refresh token available.');
+        }
+    }
+    getCodeHash(url) {
+        const arr = url.split('#');
+        if (arr.length > 1) {
+            const hash = arr[1];
+            if (hash.startsWith('code=')) {
+                return hash;
+            }
+        }
+        return null;
+    }
+    handleLaunchCodeHash() {
+        if (this.appService.isNative && this.appService.launchUrl) {
+            const hash = this.getCodeHash(this.appService.launchUrl);
+            if (hash) {
+                console.log('Nucleus.Identity: Got authorization code from launchUrl, will assign it to hash.');
+                window.location.hash = '#' + hash;
+            }
+        }
+    }
+    prepareScope(offlineAccess, aditionalScope) {
+        let scope = 'openid';
+        if (offlineAccess) {
+            scope += ' offline_access';
+        }
+        if (scope) {
+            scope += ' ' + aditionalScope;
+        }
+        return scope;
+    }
+    delay(miliseconds) {
+        return new Promise(resolve => {
+            setTimeout(() => {
+                resolve();
+            }, miliseconds);
+        });
+    }
+}
+NucleusIdentityService.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusIdentityService, deps: [{ token: i1.NucleusAppService }, { token: LocationService }, { token: i1$1.HttpClient }, { token: OidcConfigurationService }, { token: TokenClient }], target: i0.ɵɵFactoryTarget.Injectable });
+NucleusIdentityService.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusIdentityService, providedIn: 'root' });
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusIdentityService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: function () { return [{ type: i1.NucleusAppService }, { type: LocationService }, { type: i1$1.HttpClient }, { type: OidcConfigurationService }, { type: TokenClient }]; } });
+
+class NucleusTokenInterceptor {
+    constructor(auth, config) {
+        this.auth = auth;
+        this.config = config;
+        this._authorityInterceptPaths = ['/api', '/manage', '/otp/create', '/otp/status'];
+        this._authority = config.authority.toLowerCase();
+        this._interceptUrls = config.httpInterceptorUrls?.map(x => x.toLowerCase());
+    }
+    intercept(req, next) {
+        if (this.shouldIntercept(req.url)) {
+            const res = this.authorizeRequest(this.auth.getAccessToken(), req, next);
+            return this.checkUnauthorized(res);
+        }
+        return next.handle(req);
+    }
+    shouldIntercept(url) {
+        url = url.toLowerCase();
+        if (url.startsWith(this._authority)) {
+            const pathname = new URL(url).pathname;
+            return (this._authorityInterceptPaths.some(x => pathname.startsWith(x)));
+        }
+        if (this._interceptUrls?.length > 0) {
+            return this.config.httpInterceptorUrls.some(x => url.startsWith(x));
+        }
+        return false;
+    }
+    authorizeRequest(getToken, req, next) {
+        return from(getToken).pipe(mergeMap(token => {
+            if (token) {
+                const headers = req.headers.set('Authorization', `Bearer ${token}`);
+                req = req.clone({ headers });
+            }
+            return next.handle(req);
+        }));
+    }
+    checkUnauthorized(response) {
+        return response.pipe(catchError((err) => {
+            if (err instanceof HttpErrorResponse && err.status === 401) {
+                if (this.config.automaticLoginOnHttp401) {
+                    this.auth.login();
+                }
+            }
+            return throwError(err);
+        }));
+    }
+}
+NucleusTokenInterceptor.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusTokenInterceptor, deps: [{ token: NucleusIdentityService }, { token: NucleusIdentityConfig }], target: i0.ɵɵFactoryTarget.Injectable });
+NucleusTokenInterceptor.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusTokenInterceptor, providedIn: 'root' });
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusTokenInterceptor, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: function () { return [{ type: NucleusIdentityService }, { type: NucleusIdentityConfig }]; } });
+
+class NucleusIdentityModule {
+    static forRoot(config) {
+        return {
+            ngModule: NucleusIdentityModule,
+            providers: [
+                { provide: NucleusIdentityConfig, useValue: config },
+                { provide: HTTP_INTERCEPTORS, useClass: NucleusTokenInterceptor, multi: true },
+            ]
+        };
+    }
+}
+NucleusIdentityModule.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusIdentityModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
+NucleusIdentityModule.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusIdentityModule });
+NucleusIdentityModule.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusIdentityModule, imports: [[]] });
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "13.0.2", ngImport: i0, type: NucleusIdentityModule, decorators: [{
+            type: NgModule,
+            args: [{
+                    imports: [],
+                    declarations: [],
+                    exports: []
+                }]
+        }] });
+
+class OtpResponse {
+}
+class OtpStatus {
+}
+var OtpType;
+(function (OtpType) {
+    OtpType[OtpType["SimpleNumbers"] = 0] = "SimpleNumbers";
+    OtpType[OtpType["SimpleAlfanumeric"] = 1] = "SimpleAlfanumeric";
+    OtpType[OtpType["Complex"] = 2] = "Complex";
+})(OtpType || (OtpType = {}));
+
+/*
+ * Public API Surface of nucleus-identity
+ */
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { DeviceCode, Identity, NucleusIdentityConfig, NucleusIdentityModule, NucleusIdentityService, OtpResponse, OtpStatus, OtpType, ServicePrincipalRegistrationStatus };
+//# sourceMappingURL=kolektor-nucleus-identity.mjs.map