@masterteam/gateway-auth 0.0.1 → 0.0.3

package/fesm2022/masterteam-gateway-auth.mjs

@@ -1,3 +1,18 @@
+import { HttpClient, HttpContextToken, HttpBackend } from '@angular/common/http';
+import * as i0 from '@angular/core';
+import { InjectionToken, inject, Injectable, computed, ChangeDetectionStrategy, Component, signal, input } from '@angular/core';
+import { of, EMPTY, isObservable, from, map, tap as tap$1, shareReplay, finalize, switchMap, catchError as catchError$1, throwError } from 'rxjs';
+import { Action, Selector, State, Store, select } from '@ngxs/store';
+import { Router, ActivatedRoute } from '@angular/router';
+import { mergeMap, catchError, tap } from 'rxjs/operators';
+import * as i2 from '@angular/common';
+import { CommonModule } from '@angular/common';
+import * as i1 from '@angular/forms';
+import { FormBuilder, Validators, ReactiveFormsModule } from '@angular/forms';
+import { Button } from '@masterteam/components/button';
+import { TextField } from '@masterteam/components/text-field';
+import { Icon } from '@masterteam/icons';
+
 const GATEWAY_AUTH_DEVICE_TOKEN = 'web-app';
 const GATEWAY_AUTH_ENDPOINTS = {
     login: 'auth/login',
@@ -105,6 +120,97 @@ function createSecureClientState() {
     return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
 }
 
+class Login {
+    payload;
+    static type = '[Auth] Login';
+    constructor(payload) {
+        this.payload = payload;
+    }
+}
+class VerifyMfa {
+    code;
+    static type = '[Auth] Verify MFA';
+    constructor(code) {
+        this.code = code;
+    }
+}
+class ResendMfa {
+    static type = '[Auth] Resend MFA';
+}
+class LoadSsoProviders {
+    static type = '[Auth] Load SSO Providers';
+}
+class StartSso {
+    provider;
+    static type = '[Auth] Start SSO';
+    constructor(provider) {
+        this.provider = provider;
+    }
+}
+class ExchangeSsoCode {
+    code;
+    state;
+    static type = '[Auth] Exchange SSO Code';
+    constructor(code, state) {
+        this.code = code;
+        this.state = state;
+    }
+}
+class LoginSuccess {
+    session;
+    static type = '[Auth] Login Success';
+    constructor(session) {
+        this.session = session;
+    }
+}
+class LoginFailure {
+    error;
+    static type = '[Auth] Login Failure';
+    constructor(error) {
+        this.error = error;
+    }
+}
+class Logout {
+    remote;
+    static type = '[Auth] Logout';
+    constructor(remote = false) {
+        this.remote = remote;
+    }
+}
+class UpdateUserData {
+    user;
+    static type = '[Auth] Update User Data';
+    constructor(user) {
+        this.user = user;
+    }
+}
+class UpdateTokens {
+    tokens;
+    static type = '[Auth] Update Tokens';
+    constructor(tokens) {
+        this.tokens = tokens;
+    }
+}
+class ClearError {
+    static type = '[Auth] Clear Error';
+}
+class ClearPendingMfa {
+    static type = '[Auth] Clear Pending MFA';
+}
+
+const GATEWAY_AUTH_OPTIONS = new InjectionToken('GATEWAY_AUTH_OPTIONS', {
+    factory: () => ({
+        getGatewayApiBaseUrl: () => null,
+        deviceToken: 'web-app',
+        platform: 'web',
+        loginRoute: '/auth/login',
+        mfaRoute: '/auth/mfa',
+        ssoCallbackPath: '/auth/sso/callback',
+        defaultAuthenticatedRoute: '/',
+        preserveSsoProvidersOnLogout: true,
+    }),
+});
+
 const PENDING_SSO_STATE_KEY = 'gatewayAuth.pendingSsoState';
 class GatewaySsoSession {
     createAndStoreState() {
@@ -140,9 +246,825 @@ class GatewaySsoSession {
     }
 }
 
+const AUTH_STATE_DEFAULTS = {
+    user: null,
+    token: null,
+    refreshToken: null,
+    accessTokenExpiresAt: null,
+    refreshTokenExpiresAt: null,
+    loading: false,
+    mfaResendLoading: false,
+    ssoLoading: false,
+    ssoCallbackLoading: false,
+    error: null,
+    twoFactorRequired: false,
+    pendingMfa: null,
+    ssoProviders: [],
+};
+function sanitizePersistedAuthState(obj) {
+    return {
+        ...AUTH_STATE_DEFAULTS,
+        ...(obj ?? {}),
+        loading: false,
+        mfaResendLoading: false,
+        ssoLoading: false,
+        ssoCallbackLoading: false,
+        error: null,
+        twoFactorRequired: false,
+        pendingMfa: null,
+        ssoProviders: [],
+    };
+}
+
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+let GatewayAuthState = class GatewayAuthState {
+    http = inject(HttpClient);
+    options = inject(GATEWAY_AUTH_OPTIONS);
+    router = inject(Router);
+    ssoSession = new GatewaySsoSession();
+    static user(state) {
+        return state.user;
+    }
+    static loading(state) {
+        return state.loading;
+    }
+    static mfaResendLoading(state) {
+        return state.mfaResendLoading;
+    }
+    static ssoLoading(state) {
+        return state.ssoLoading;
+    }
+    static ssoCallbackLoading(state) {
+        return state.ssoCallbackLoading;
+    }
+    static error(state) {
+        return state.error;
+    }
+    static token(state) {
+        return state.token;
+    }
+    static refreshToken(state) {
+        return state.refreshToken;
+    }
+    static accessTokenExpiresAt(state) {
+        return state.accessTokenExpiresAt;
+    }
+    static refreshTokenExpiresAt(state) {
+        return state.refreshTokenExpiresAt;
+    }
+    static twoFactorRequired(state) {
+        return state.twoFactorRequired;
+    }
+    static pendingMfa(state) {
+        return state.pendingMfa;
+    }
+    static ssoProviders(state) {
+        return state.ssoProviders;
+    }
+    static isAdmin(state) {
+        return state.user?.isAdmin || false;
+    }
+    static userDetails(state) {
+        return state.user?.user || null;
+    }
+    login(ctx, action) {
+        ctx.patchState({
+            loading: true,
+            error: null,
+            pendingMfa: null,
+            twoFactorRequired: false,
+        });
+        return this.http
+            .post(this.gatewayUrl(GATEWAY_AUTH_ENDPOINTS.login), {
+            userName: action.payload.userName,
+            password: action.payload.password,
+            isEncrypted: action.payload.isEncrypted ?? false,
+            deviceToken: action.payload.deviceToken || this.deviceToken,
+            recaptchaToken: action.payload.recaptchaToken,
+            recaptchaAction: action.payload.recaptchaAction,
+        })
+            .pipe(mergeMap((response) => this.handleLoginResponse(ctx, response.data)), catchError((error) => {
+            ctx.dispatch(new LoginFailure(getGatewayErrorMessage(error, 'Login failed')));
+            return of(null);
+        }));
+    }
+    verifyMfa(ctx, action) {
+        const pendingMfa = ctx.getState().pendingMfa;
+        if (!pendingMfa) {
+            ctx.dispatch(new LoginFailure('The verification session expired.'));
+            this.navigateToLogin();
+            return EMPTY;
+        }
+        ctx.patchState({ loading: true, error: null });
+        return this.http
+            .post(this.gatewayUrl(GATEWAY_AUTH_ENDPOINTS.verifyMfa), {
+            userId: pendingMfa.userId,
+            tempSessionId: pendingMfa.tempSessionId,
+            code: action.code,
+            deviceToken: this.deviceToken,
+        })
+            .pipe(mergeMap((response) => this.handleLoginResponse(ctx, response.data)), catchError((error) => {
+            const message = getGatewayErrorMessage(error, 'Invalid verification code');
+            const shouldClearMfa = error?.status === 403;
+            ctx.patchState({
+                loading: false,
+                error: message,
+                pendingMfa: shouldClearMfa ? null : pendingMfa,
+                twoFactorRequired: !shouldClearMfa,
+            });
+            if (shouldClearMfa) {
+                this.navigateToLogin();
+            }
+            return of(null);
+        }));
+    }
+    resendMfa(ctx) {
+        const pendingMfa = ctx.getState().pendingMfa;
+        if (!pendingMfa) {
+            ctx.dispatch(new LoginFailure('The verification session expired.'));
+            this.navigateToLogin();
+            return EMPTY;
+        }
+        ctx.patchState({ mfaResendLoading: true, error: null });
+        return this.http
+            .post(this.gatewayUrl(GATEWAY_AUTH_ENDPOINTS.resendMfa), {
+            userId: pendingMfa.userId,
+            tempSessionId: pendingMfa.tempSessionId,
+        })
+            .pipe(tap((response) => {
+            ctx.patchState({
+                pendingMfa: response.data,
+                twoFactorRequired: true,
+                mfaResendLoading: false,
+                error: null,
+            });
+        }), catchError((error) => {
+            ctx.patchState({
+                mfaResendLoading: false,
+                error: getGatewayErrorMessage(error, 'Failed to resend code'),
+            });
+            return of(null);
+        }));
+    }
+    loadSsoProviders(ctx) {
+        ctx.patchState({ ssoLoading: true });
+        return this.http
+            .get(this.gatewayUrl(GATEWAY_AUTH_ENDPOINTS.ssoProviders), {
+            params: { platform: this.options.platform ?? 'web' },
+        })
+            .pipe(tap((response) => {
+            ctx.patchState({
+                ssoProviders: (response.data?.providers ?? []).filter((provider) => provider.enabled),
+                ssoLoading: false,
+            });
+        }), catchError(() => {
+            ctx.patchState({
+                ssoProviders: [],
+                ssoLoading: false,
+            });
+            return of(null);
+        }));
+    }
+    startSso(ctx, action) {
+        if (action.provider.flow !== 'browser_redirect') {
+            ctx.patchState({
+                error: 'This SSO provider is not available for browser sign-in.',
+            });
+            return;
+        }
+        const gatewayApiBaseUrl = this.options.getGatewayApiBaseUrl();
+        if (!gatewayApiBaseUrl || typeof window === 'undefined') {
+            ctx.patchState({ error: 'SSO is not configured.' });
+            return;
+        }
+        const clientState = this.ssoSession.createAndStoreState();
+        const callbackPath = this.options.ssoCallbackPath ?? '/auth/sso/callback';
+        const startUrl = buildSsoStartUrl({
+            gatewayApiBaseUrl,
+            provider: action.provider,
+            returnUrl: `${window.location.origin}${callbackPath}`,
+            clientState,
+            platform: this.options.platform ?? 'web',
+        });
+        window.location.assign(startUrl);
+    }
+    exchangeSsoCode(ctx, action) {
+        ctx.patchState({ ssoCallbackLoading: true, error: null });
+        return this.http
+            .post(this.gatewayUrl(GATEWAY_AUTH_ENDPOINTS.ssoExchange), {
+            code: action.code,
+            state: action.state,
+            deviceToken: this.deviceToken,
+        })
+            .pipe(mergeMap((response) => this.handleLoginResponse(ctx, response.data)), catchError((error) => {
+            ctx.patchState({
+                ssoCallbackLoading: false,
+                error: getGatewayErrorMessage(error, 'SSO sign-in failed. Please try again.'),
+            });
+            return of(null);
+        }));
+    }
+    loginSuccess(ctx, action) {
+        return this.handleLoginResponse(ctx, action.session);
+    }
+    loginFailure(ctx, action) {
+        ctx.patchState({
+            loading: false,
+            ssoCallbackLoading: false,
+            error: action.error,
+            user: null,
+            token: null,
+            refreshToken: null,
+            accessTokenExpiresAt: null,
+            refreshTokenExpiresAt: null,
+            pendingMfa: null,
+            twoFactorRequired: false,
+        });
+    }
+    logout(ctx, action) {
+        const { token, refreshToken, ssoProviders } = ctx.getState();
+        this.ssoSession.clearAll();
+        this.toObservable(this.options.beforeLocalLogout?.(ctx)).subscribe();
+        ctx.patchState({
+            ...AUTH_STATE_DEFAULTS,
+            ssoProviders: this.options.preserveSsoProvidersOnLogout
+                ? ssoProviders
+                : [],
+        });
+        this.navigateToLogin();
+        if (action.remote && token) {
+            this.http
+                .post(this.gatewayUrl(GATEWAY_AUTH_ENDPOINTS.logout), {
+                refreshToken,
+                deviceToken: this.deviceToken,
+            }, {
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    noMessage: 'true',
+                },
+            })
+                .pipe(catchError(() => EMPTY))
+                .subscribe();
+        }
+    }
+    updateUserData(ctx, action) {
+        ctx.patchState({
+            user: action.user,
+        });
+    }
+    updateTokens(ctx, action) {
+        const tokenData = mapGatewayTokens(action.tokens);
+        const state = ctx.getState();
+        const updatedUser = state.user
+            ? {
+                ...state.user,
+                token: tokenData.accessToken ?? state.user.token,
+                accessToken: tokenData.accessToken ?? state.user.accessToken,
+                refreshToken: tokenData.refreshToken ?? state.user.refreshToken,
+                accessTokenExpiresAt: tokenData.accessTokenExpiresAt ?? undefined,
+                refreshTokenExpiresAt: tokenData.refreshTokenExpiresAt ?? undefined,
+            }
+            : state.user;
+        ctx.patchState({
+            token: tokenData.accessToken,
+            refreshToken: tokenData.refreshToken,
+            accessTokenExpiresAt: tokenData.accessTokenExpiresAt,
+            refreshTokenExpiresAt: tokenData.refreshTokenExpiresAt,
+            user: updatedUser,
+        });
+    }
+    clearError(ctx) {
+        ctx.patchState({ error: null });
+    }
+    clearPendingMfa(ctx) {
+        ctx.patchState({ pendingMfa: null, twoFactorRequired: false });
+    }
+    handleLoginResponse(ctx, session) {
+        if (session.requiresTwoFactor) {
+            ctx.patchState({
+                user: null,
+                token: null,
+                refreshToken: null,
+                accessTokenExpiresAt: null,
+                refreshTokenExpiresAt: null,
+                pendingMfa: session.twoFactor,
+                twoFactorRequired: true,
+                loading: false,
+                ssoCallbackLoading: false,
+                error: null,
+            });
+            this.router.navigate([this.options.mfaRoute ?? '/auth/mfa'], {
+                replaceUrl: true,
+            });
+            return of(null);
+        }
+        if (!hasGatewayTokens(session.tokens)) {
+            ctx.dispatch(new LoginFailure('Login failed'));
+            return of(null);
+        }
+        const tokenData = mapGatewayTokens(session.tokens);
+        const user = mapGatewayUser(session.user, tokenData, session.delegations);
+        ctx.patchState({
+            user,
+            token: tokenData.accessToken,
+            refreshToken: tokenData.refreshToken,
+            accessTokenExpiresAt: tokenData.accessTokenExpiresAt,
+            refreshTokenExpiresAt: tokenData.refreshTokenExpiresAt,
+            loading: false,
+            ssoCallbackLoading: false,
+            error: null,
+            pendingMfa: null,
+            twoFactorRequired: false,
+        });
+        return this.toObservable(this.options.afterLogin?.(session, ctx)).pipe(tap(() => {
+            this.router.navigateByUrl(this.resolveAuthenticatedRoute(), {
+                replaceUrl: true,
+            });
+        }));
+    }
+    get deviceToken() {
+        return this.options.deviceToken ?? GATEWAY_AUTH_DEVICE_TOKEN;
+    }
+    gatewayUrl(path) {
+        return buildGatewayUrl(this.options.getGatewayApiBaseUrl(), path);
+    }
+    navigateToLogin() {
+        this.router.navigate([this.options.loginRoute ?? '/auth/login'], {
+            replaceUrl: true,
+        });
+    }
+    resolveAuthenticatedRoute() {
+        const tree = this.router.parseUrl(this.router.url);
+        const returnUrl = this.sanitizeLocalRoute(tree.queryParams['returnUrl']);
+        if (returnUrl !== null) {
+            return returnUrl;
+        }
+        const configuredRoute = typeof this.options.defaultAuthenticatedRoute === 'function'
+            ? this.options.defaultAuthenticatedRoute()
+            : this.options.defaultAuthenticatedRoute;
+        return this.sanitizeLocalRoute(configuredRoute) ?? '/';
+    }
+    sanitizeLocalRoute(route) {
+        if (!route) {
+            return null;
+        }
+        if (/^https?:\/\//i.test(route)) {
+            return null;
+        }
+        return route.startsWith('/') ? route : `/${route}`;
+    }
+    toObservable(result) {
+        if (!result) {
+            return of(null);
+        }
+        if (isObservable(result)) {
+            return result;
+        }
+        if (result instanceof Promise) {
+            return from(result);
+        }
+        return of(result);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayAuthState, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayAuthState });
+};
+__decorate([
+    Action(Login)
+], GatewayAuthState.prototype, "login", null);
+__decorate([
+    Action(VerifyMfa)
+], GatewayAuthState.prototype, "verifyMfa", null);
+__decorate([
+    Action(ResendMfa)
+], GatewayAuthState.prototype, "resendMfa", null);
+__decorate([
+    Action(LoadSsoProviders)
+], GatewayAuthState.prototype, "loadSsoProviders", null);
+__decorate([
+    Action(StartSso)
+], GatewayAuthState.prototype, "startSso", null);
+__decorate([
+    Action(ExchangeSsoCode)
+], GatewayAuthState.prototype, "exchangeSsoCode", null);
+__decorate([
+    Action(LoginSuccess)
+], GatewayAuthState.prototype, "loginSuccess", null);
+__decorate([
+    Action(LoginFailure)
+], GatewayAuthState.prototype, "loginFailure", null);
+__decorate([
+    Action(Logout)
+], GatewayAuthState.prototype, "logout", null);
+__decorate([
+    Action(UpdateUserData)
+], GatewayAuthState.prototype, "updateUserData", null);
+__decorate([
+    Action(UpdateTokens)
+], GatewayAuthState.prototype, "updateTokens", null);
+__decorate([
+    Action(ClearError)
+], GatewayAuthState.prototype, "clearError", null);
+__decorate([
+    Action(ClearPendingMfa)
+], GatewayAuthState.prototype, "clearPendingMfa", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "user", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "loading", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "mfaResendLoading", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "ssoLoading", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "ssoCallbackLoading", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "error", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "token", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "refreshToken", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "accessTokenExpiresAt", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "refreshTokenExpiresAt", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "twoFactorRequired", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "pendingMfa", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "ssoProviders", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "isAdmin", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "userDetails", null);
+GatewayAuthState = __decorate([
+    State({
+        name: 'auth',
+        defaults: AUTH_STATE_DEFAULTS,
+    })
+], GatewayAuthState);
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayAuthState, decorators: [{
+            type: Injectable
+        }], propDecorators: { login: [], verifyMfa: [], resendMfa: [], loadSsoProviders: [], startSso: [], exchangeSsoCode: [], loginSuccess: [], loginFailure: [], logout: [], updateUserData: [], updateTokens: [], clearError: [], clearPendingMfa: [] } });
+
+class GatewayAuthFacade {
+    store = inject(Store);
+    user = select(GatewayAuthState.user);
+    loading = select(GatewayAuthState.loading);
+    mfaResendLoading = select(GatewayAuthState.mfaResendLoading);
+    ssoLoading = select(GatewayAuthState.ssoLoading);
+    ssoCallbackLoading = select(GatewayAuthState.ssoCallbackLoading);
+    error = select(GatewayAuthState.error);
+    token = select(GatewayAuthState.token);
+    refreshToken = select(GatewayAuthState.refreshToken);
+    accessTokenExpiresAt = select(GatewayAuthState.accessTokenExpiresAt);
+    refreshTokenExpiresAt = select(GatewayAuthState.refreshTokenExpiresAt);
+    twoFactorRequired = select(GatewayAuthState.twoFactorRequired);
+    pendingMfa = select(GatewayAuthState.pendingMfa);
+    ssoProviders = select(GatewayAuthState.ssoProviders);
+    isAdmin = select(GatewayAuthState.isAdmin);
+    userDetails = select(GatewayAuthState.userDetails);
+    hasError = computed(() => this.error() !== null, ...(ngDevMode ? [{ debugName: "hasError" }] : /* istanbul ignore next */ []));
+    isReady = computed(() => !this.loading() && this.error() === null, ...(ngDevMode ? [{ debugName: "isReady" }] : /* istanbul ignore next */ []));
+    userDisplayName = computed(() => this.user()?.user?.displayName || '', ...(ngDevMode ? [{ debugName: "userDisplayName" }] : /* istanbul ignore next */ []));
+    userEmail = computed(() => this.user()?.user?.email || '', ...(ngDevMode ? [{ debugName: "userEmail" }] : /* istanbul ignore next */ []));
+    hasUser = computed(() => this.user() !== null, ...(ngDevMode ? [{ debugName: "hasUser" }] : /* istanbul ignore next */ []));
+    hasPendingMfa = computed(() => this.pendingMfa() !== null, ...(ngDevMode ? [{ debugName: "hasPendingMfa" }] : /* istanbul ignore next */ []));
+    isAuthenticated = computed(() => {
+        const token = this.token();
+        const accessExpiresAt = this.accessTokenExpiresAt();
+        if (token && !isExpired(accessExpiresAt)) {
+            return true;
+        }
+        const refreshToken = this.refreshToken();
+        const refreshExpiresAt = this.refreshTokenExpiresAt();
+        return !!refreshToken && !isExpired(refreshExpiresAt);
+    }, ...(ngDevMode ? [{ debugName: "isAuthenticated" }] : /* istanbul ignore next */ []));
+    login(loginRequest) {
+        this.store.dispatch(new Login(loginRequest));
+    }
+    verifyMfa(code) {
+        this.store.dispatch(new VerifyMfa(code));
+    }
+    resendMfa() {
+        this.store.dispatch(new ResendMfa());
+    }
+    loadSsoProviders() {
+        this.store.dispatch(new LoadSsoProviders());
+    }
+    startSso(provider) {
+        this.store.dispatch(new StartSso(provider));
+    }
+    exchangeSsoCode(code, state) {
+        this.store.dispatch(new ExchangeSsoCode(code, state));
+    }
+    logout(remote = false) {
+        this.store.dispatch(new Logout(remote));
+    }
+    updateUserData(user) {
+        this.store.dispatch(new UpdateUserData(user));
+    }
+    updateTokens(tokens) {
+        this.store.dispatch(new UpdateTokens(tokens));
+    }
+    clearError() {
+        this.store.dispatch(new ClearError());
+    }
+    clearPendingMfa() {
+        this.store.dispatch(new ClearPendingMfa());
+    }
+    hasRole(role) {
+        const userRoles = this.user()?.user?.roles;
+        return Array.isArray(userRoles) ? userRoles.includes(role) : false;
+    }
+    hasGroup(group) {
+        const userGroups = this.user()?.user?.groups;
+        return Array.isArray(userGroups) ? userGroups.includes(group) : false;
+    }
+    isTokenExpired() {
+        const accessExpiresAt = this.accessTokenExpiresAt();
+        return accessExpiresAt ? isExpired(accessExpiresAt) : false;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayAuthFacade, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayAuthFacade, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayAuthFacade, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
+        }] });
+
+const GATEWAY_AUTH_RETRY_CONTEXT = new HttpContextToken(() => false);
+const GATEWAY_AUTH_ENDPOINT_PATHS = new Set([
+    GATEWAY_AUTH_ENDPOINTS.login,
+    GATEWAY_AUTH_ENDPOINTS.refresh,
+    GATEWAY_AUTH_ENDPOINTS.logout,
+]);
+const GATEWAY_AUTH_ENDPOINT_PREFIXES = ['auth/2fa/', 'auth/sso/'];
+const isAbsoluteUrl = (url) => /^https?:\/\//i.test(url);
+const isAssetRequest = (url) => url.startsWith('/assets') || url.startsWith('assets');
+const normalizeBase = (baseUrl) => baseUrl?.replace(/\/+$/, '') ?? '';
+const buildAbsoluteUrl = (baseUrl, url) => {
+    if (isAbsoluteUrl(url) || !baseUrl) {
+        return url;
+    }
+    return `${normalizeBase(baseUrl)}/${url.replace(/^\/+/, '')}`;
+};
+const normalizePath = (path) => {
+    const trimmed = path.replace(/^\/+/, '');
+    const withoutQuery = trimmed.split('?')[0] || '';
+    return withoutQuery.startsWith('api/') ? withoutQuery.slice(4) : withoutQuery;
+};
+function resolveGatewayAuthPath(url, gatewayApiBaseUrl) {
+    if (isAbsoluteUrl(url)) {
+        try {
+            return normalizePath(new URL(url).pathname);
+        }
+        catch {
+            return normalizePath(url);
+        }
+    }
+    if (gatewayApiBaseUrl && url.startsWith(gatewayApiBaseUrl)) {
+        return normalizePath(url.slice(gatewayApiBaseUrl.length));
+    }
+    return normalizePath(url);
+}
+function isGatewayAuthRequestUrl(url, gatewayApiBaseUrl) {
+    const path = resolveGatewayAuthPath(url, gatewayApiBaseUrl).toLowerCase();
+    return (GATEWAY_AUTH_ENDPOINT_PATHS.has(path) ||
+        GATEWAY_AUTH_ENDPOINT_PREFIXES.some((prefix) => path.startsWith(prefix)));
+}
+let inflightRefresh$ = null;
+const refreshTokens$ = (http, gatewayApiBaseUrl, refreshToken, auth, deviceToken) => {
+    if (!inflightRefresh$) {
+        const url = buildGatewayUrl(gatewayApiBaseUrl, GATEWAY_AUTH_ENDPOINTS.refresh);
+        inflightRefresh$ = http
+            .post(url, {
+            refreshToken,
+            deviceToken,
+        })
+            .pipe(map((response) => response.data), map((tokens) => {
+            if (!tokens?.accessToken || !tokens.refreshToken) {
+                throw new Error('Invalid refresh response');
+            }
+            return tokens;
+        }), tap$1((tokens) => auth.updateTokens(tokens)), shareReplay({ bufferSize: 1, refCount: true }), finalize(() => {
+            inflightRefresh$ = null;
+        }));
+    }
+    return inflightRefresh$;
+};
+const prepareRequest = (req, token, markRetried, baseUrl) => {
+    let modifiedReq = req;
+    if (token) {
+        modifiedReq = modifiedReq.clone({
+            setHeaders: {
+                Authorization: `Bearer ${token}`,
+            },
+        });
+    }
+    if (!isAbsoluteUrl(modifiedReq.url) && !isAssetRequest(modifiedReq.url)) {
+        modifiedReq = modifiedReq.clone({
+            url: buildAbsoluteUrl(baseUrl, modifiedReq.url),
+        });
+    }
+    if (markRetried) {
+        modifiedReq = modifiedReq.clone({
+            context: modifiedReq.context.set(GATEWAY_AUTH_RETRY_CONTEXT, true),
+        });
+    }
+    return modifiedReq;
+};
+const gatewayAuthInterceptor = (req, next) => {
+    if (isAssetRequest(req.url)) {
+        return next(req);
+    }
+    const auth = inject(GatewayAuthFacade);
+    const options = inject(GATEWAY_AUTH_OPTIONS);
+    const http = new HttpClient(inject(HttpBackend));
+    const gatewayApiBaseUrl = options.getGatewayApiBaseUrl();
+    const appApiBaseUrl = options.getApplicationApiBaseUrl?.();
+    const useGatewayBaseUrl = options.shouldUseGatewayApiBaseUrl?.(req) ?? false;
+    const baseUrl = useGatewayBaseUrl ? gatewayApiBaseUrl : appApiBaseUrl;
+    const deviceToken = options.deviceToken ?? 'web-app';
+    const accessToken = auth.token();
+    const refreshToken = auth.refreshToken();
+    const accessTokenExpiresAt = auth.accessTokenExpiresAt();
+    const refreshTokenExpiresAt = auth.refreshTokenExpiresAt();
+    const accessTokenValid = !!accessToken && !isExpired(accessTokenExpiresAt);
+    const canRefresh = !!refreshToken && !isExpired(refreshTokenExpiresAt);
+    const alreadyRetried = req.context.get(GATEWAY_AUTH_RETRY_CONTEXT);
+    const isAuthRequest = isGatewayAuthRequestUrl(req.url, gatewayApiBaseUrl);
+    const tokenToAttach = !isAuthRequest && accessTokenValid ? accessToken : null;
+    if (!isAuthRequest && !accessTokenValid && canRefresh) {
+        return refreshTokens$(http, gatewayApiBaseUrl, refreshToken, auth, deviceToken).pipe(switchMap((tokens) => next(prepareRequest(req, tokens.accessToken, true, baseUrl))), catchError$1((error) => {
+            auth.logout();
+            return throwError(() => error);
+        }));
+    }
+    return next(prepareRequest(req, tokenToAttach, false, baseUrl)).pipe(catchError$1((error) => {
+        if (error?.status === 401 && !isAuthRequest && !alreadyRetried) {
+            const latestRefreshToken = auth.refreshToken();
+            const latestRefreshTokenExpiresAt = auth.refreshTokenExpiresAt();
+            const canRefreshNow = !!latestRefreshToken && !isExpired(latestRefreshTokenExpiresAt);
+            if (canRefreshNow) {
+                return refreshTokens$(http, gatewayApiBaseUrl, latestRefreshToken, auth, deviceToken).pipe(switchMap((tokens) => next(prepareRequest(req, tokens.accessToken, true, baseUrl))), catchError$1((refreshError) => {
+                    auth.logout();
+                    return throwError(() => refreshError);
+                }));
+            }
+        }
+        if (error?.status === 401 && !isAuthRequest) {
+            auth.logout();
+        }
+        return throwError(() => error);
+    }));
+};
+
+class GatewayMfa {
+    auth = inject(GatewayAuthFacade);
+    fb = inject(FormBuilder);
+    router = inject(Router);
+    options = inject(GATEWAY_AUTH_OPTIONS);
+    pendingMfa = this.auth.pendingMfa;
+    loading = this.auth.loading;
+    resendLoading = this.auth.mfaResendLoading;
+    error = this.auth.error;
+    deliveryChannel = computed(() => this.pendingMfa()?.deliveryChannel || 'your configured channel', ...(ngDevMode ? [{ debugName: "deliveryChannel" }] : /* istanbul ignore next */ []));
+    expiresAt = computed(() => this.pendingMfa()?.expiresAtUtc ?? null, ...(ngDevMode ? [{ debugName: "expiresAt" }] : /* istanbul ignore next */ []));
+    form = this.fb.group({
+        code: ['', [Validators.required, Validators.pattern(/^[0-9]{4,8}$/)]],
+    });
+    ngOnInit() {
+        if (!this.pendingMfa()) {
+            this.router.navigate([this.options.loginRoute ?? '/auth/login'], {
+                replaceUrl: true,
+            });
+        }
+    }
+    verify() {
+        if (this.form.invalid) {
+            this.form.markAllAsTouched();
+            return;
+        }
+        const code = this.form.controls.code.value ?? '';
+        this.form.reset();
+        this.auth.verifyMfa(code);
+    }
+    resend() {
+        this.form.reset();
+        this.auth.resendMfa();
+    }
+    backToLogin() {
+        this.auth.clearPendingMfa();
+        this.router.navigate([this.options.loginRoute ?? '/auth/login'], {
+            replaceUrl: true,
+        });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayMfa, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.8", type: GatewayMfa, isStandalone: true, selector: "mt-gateway-mfa", ngImport: i0, template: "<div\n  class=\"min-h-screen w-screen flex items-center justify-center p-6 bg-surface-50\"\n>\n  <div\n    class=\"w-full max-w-md rounded-xl bg-white p-8 shadow-sm border border-surface-200\"\n  >\n    <div class=\"flex justify-center mb-6\">\n      <div\n        class=\"h-12 w-12 rounded-full bg-primary/10 flex items-center justify-center\"\n      >\n        <mt-icon\n          icon=\"security.lock-01\"\n          class=\"text-primary text-2xl\"\n        ></mt-icon>\n      </div>\n    </div>\n\n    <div class=\"text-center space-y-2 mb-6\">\n      <h1 class=\"text-2xl font-semibold text-surface-950\">Verification code</h1>\n      <p class=\"text-sm text-surface-600\">\n        Enter the code sent through {{ deliveryChannel() }}.\n      </p>\n      @if (expiresAt(); as expiry) {\n        <p class=\"text-xs text-surface-500\">\n          Expires at {{ expiry | date: \"shortTime\" }}\n        </p>\n      }\n    </div>\n\n    <form [formGroup]=\"form\" (ngSubmit)=\"verify()\" class=\"space-y-4\">\n      <mt-text-field\n        label=\"Code\"\n        formControlName=\"code\"\n        [pInputs]=\"{ inputMode: 'numeric', autocomplete: 'one-time-code' }\"\n      />\n\n      @if (error(); as errorMessage) {\n        <p class=\"text-sm text-red-500 text-center\">{{ errorMessage }}</p>\n      }\n\n      <mt-button\n        label=\"Verify\"\n        type=\"submit\"\n        severity=\"primary\"\n        size=\"large\"\n        fluid\n        [loading]=\"loading()\"\n        [disabled]=\"form.invalid || loading()\"\n      />\n    </form>\n\n    <div class=\"flex items-center justify-between gap-3 pt-5\">\n      <mt-button\n        label=\"Back\"\n        type=\"button\"\n        text\n        [disabled]=\"loading()\"\n        (onClick)=\"backToLogin()\"\n      />\n      <mt-button\n        label=\"Resend code\"\n        type=\"button\"\n        variant=\"outlined\"\n        [loading]=\"resendLoading()\"\n        [disabled]=\"loading() || resendLoading()\"\n        (onClick)=\"resend()\"\n      />\n    </div>\n  </div>\n</div>\n", styles: [":host{display:block}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "ngmodule", type: ReactiveFormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.FormGroupDirective, selector: "[formGroup]", inputs: ["formGroup"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: i1.FormControlName, selector: "[formControlName]", inputs: ["formControlName", "disabled", "ngModel"], outputs: ["ngModelChange"] }, { kind: "component", type: Button, selector: "mt-button", inputs: ["icon", "label", "tooltip", "class", "type", "styleClass", "severity", "badge", "variant", "badgeSeverity", "size", "iconPos", "autofocus", "fluid", "raised", "rounded", "text", "plain", "outlined", "link", "disabled", "loading", "pInputs"], outputs: ["onClick", "onFocus", "onBlur"] }, { kind: "component", type: TextField, selector: "mt-text-field", inputs: ["field", "hint", "label", "placeholder", "class", "type", "readonly", "pInputs", "required", "icon", "iconPosition"] }, { kind: "component", type: Icon, selector: "mt-icon", inputs: ["icon"] }, { kind: "pipe", type: i2.DatePipe, name: "date" }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewayMfa, decorators: [{
+            type: Component,
+            args: [{ selector: 'mt-gateway-mfa', imports: [CommonModule, ReactiveFormsModule, Button, TextField, Icon], changeDetection: ChangeDetectionStrategy.OnPush, template: "<div\n  class=\"min-h-screen w-screen flex items-center justify-center p-6 bg-surface-50\"\n>\n  <div\n    class=\"w-full max-w-md rounded-xl bg-white p-8 shadow-sm border border-surface-200\"\n  >\n    <div class=\"flex justify-center mb-6\">\n      <div\n        class=\"h-12 w-12 rounded-full bg-primary/10 flex items-center justify-center\"\n      >\n        <mt-icon\n          icon=\"security.lock-01\"\n          class=\"text-primary text-2xl\"\n        ></mt-icon>\n      </div>\n    </div>\n\n    <div class=\"text-center space-y-2 mb-6\">\n      <h1 class=\"text-2xl font-semibold text-surface-950\">Verification code</h1>\n      <p class=\"text-sm text-surface-600\">\n        Enter the code sent through {{ deliveryChannel() }}.\n      </p>\n      @if (expiresAt(); as expiry) {\n        <p class=\"text-xs text-surface-500\">\n          Expires at {{ expiry | date: \"shortTime\" }}\n        </p>\n      }\n    </div>\n\n    <form [formGroup]=\"form\" (ngSubmit)=\"verify()\" class=\"space-y-4\">\n      <mt-text-field\n        label=\"Code\"\n        formControlName=\"code\"\n        [pInputs]=\"{ inputMode: 'numeric', autocomplete: 'one-time-code' }\"\n      />\n\n      @if (error(); as errorMessage) {\n        <p class=\"text-sm text-red-500 text-center\">{{ errorMessage }}</p>\n      }\n\n      <mt-button\n        label=\"Verify\"\n        type=\"submit\"\n        severity=\"primary\"\n        size=\"large\"\n        fluid\n        [loading]=\"loading()\"\n        [disabled]=\"form.invalid || loading()\"\n      />\n    </form>\n\n    <div class=\"flex items-center justify-between gap-3 pt-5\">\n      <mt-button\n        label=\"Back\"\n        type=\"button\"\n        text\n        [disabled]=\"loading()\"\n        (onClick)=\"backToLogin()\"\n      />\n      <mt-button\n        label=\"Resend code\"\n        type=\"button\"\n        variant=\"outlined\"\n        [loading]=\"resendLoading()\"\n        [disabled]=\"loading() || resendLoading()\"\n        (onClick)=\"resend()\"\n      />\n    </div>\n  </div>\n</div>\n", styles: [":host{display:block}\n"] }]
+        }] });
+
+class GatewaySsoCallback {
+    route = inject(ActivatedRoute);
+    router = inject(Router);
+    auth = inject(GatewayAuthFacade);
+    options = inject(GATEWAY_AUTH_OPTIONS);
+    ssoSession = new GatewaySsoSession();
+    loading = this.auth.ssoCallbackLoading;
+    exchangeError = this.auth.error;
+    callbackError = signal(null, ...(ngDevMode ? [{ debugName: "callbackError" }] : /* istanbul ignore next */ []));
+    ngOnInit() {
+        const params = this.route.snapshot.queryParamMap;
+        const error = params.get('error');
+        const errorCode = params.get('errorCode');
+        const code = params.get('code');
+        const state = params.get('state');
+        this.ssoSession.clearCallbackQuery(this.options.ssoCallbackPath ?? '/auth/sso/callback');
+        if (!this.ssoSession.consumeExpectedState(state)) {
+            this.callbackError.set(this.safeSsoMessage('invalid_state'));
+            return;
+        }
+        if (error) {
+            this.callbackError.set(this.safeSsoMessage(errorCode ?? 'sso_failed'));
+            return;
+        }
+        if (!code || !state) {
+            this.callbackError.set(this.safeSsoMessage('invalid_state'));
+            return;
+        }
+        this.auth.exchangeSsoCode(code, state);
+    }
+    retry() {
+        this.router.navigate([this.options.loginRoute ?? '/auth/login'], {
+            replaceUrl: true,
+        });
+    }
+    safeSsoMessage(errorCode) {
+        const messages = {
+            invalid_state: 'The sign-in session expired. Please try again.',
+            sso_exchange_expired: 'The sign-in session expired. Please try again.',
+            sso_exchange_used: 'This sign-in session was already used. Please try again.',
+            sso_user_not_found: 'Your account is not configured for SSO.',
+            sso_provisioning_not_allowed: 'Your account is not configured for SSO.',
+        };
+        return messages[errorCode] ?? 'SSO sign-in failed. Please try again.';
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewaySsoCallback, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.8", type: GatewaySsoCallback, isStandalone: true, selector: "mt-gateway-sso-callback", ngImport: i0, template: "<div\n  class=\"min-h-screen w-screen flex items-center justify-center p-6 bg-surface-50\"\n>\n  <div\n    class=\"w-full max-w-md rounded-xl bg-white p-8 shadow-sm border border-surface-200 text-center\"\n  >\n    @if (callbackError() || exchangeError(); as errorMessage) {\n      <div class=\"space-y-5\">\n        <mt-icon\n          icon=\"alert.alert-circle\"\n          class=\"text-red-500 text-4xl\"\n        ></mt-icon>\n        <div class=\"space-y-2\">\n          <h1 class=\"text-xl font-semibold text-surface-950\">\n            SSO sign-in failed\n          </h1>\n          <p class=\"text-sm text-surface-600\">{{ errorMessage }}</p>\n        </div>\n        <mt-button\n          label=\"Back to sign in\"\n          severity=\"primary\"\n          (onClick)=\"retry()\"\n        ></mt-button>\n      </div>\n    } @else {\n      <div class=\"space-y-5\">\n        <mt-icon\n          icon=\"general.loading-02\"\n          class=\"text-primary text-4xl animate-spin animate-duration-2000\"\n        >\n        </mt-icon>\n        <div class=\"space-y-2\">\n          <h1 class=\"text-xl font-semibold text-surface-950\">\n            Completing sign-in\n          </h1>\n          <p class=\"text-sm text-surface-600\">\n            Please wait while we finish the secure sign-in.\n          </p>\n        </div>\n      </div>\n    }\n  </div>\n</div>\n", styles: [":host{display:block}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "component", type: Button, selector: "mt-button", inputs: ["icon", "label", "tooltip", "class", "type", "styleClass", "severity", "badge", "variant", "badgeSeverity", "size", "iconPos", "autofocus", "fluid", "raised", "rounded", "text", "plain", "outlined", "link", "disabled", "loading", "pInputs"], outputs: ["onClick", "onFocus", "onBlur"] }, { kind: "component", type: Icon, selector: "mt-icon", inputs: ["icon"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewaySsoCallback, decorators: [{
+            type: Component,
+            args: [{ selector: 'mt-gateway-sso-callback', imports: [CommonModule, Button, Icon], changeDetection: ChangeDetectionStrategy.OnPush, template: "<div\n  class=\"min-h-screen w-screen flex items-center justify-center p-6 bg-surface-50\"\n>\n  <div\n    class=\"w-full max-w-md rounded-xl bg-white p-8 shadow-sm border border-surface-200 text-center\"\n  >\n    @if (callbackError() || exchangeError(); as errorMessage) {\n      <div class=\"space-y-5\">\n        <mt-icon\n          icon=\"alert.alert-circle\"\n          class=\"text-red-500 text-4xl\"\n        ></mt-icon>\n        <div class=\"space-y-2\">\n          <h1 class=\"text-xl font-semibold text-surface-950\">\n            SSO sign-in failed\n          </h1>\n          <p class=\"text-sm text-surface-600\">{{ errorMessage }}</p>\n        </div>\n        <mt-button\n          label=\"Back to sign in\"\n          severity=\"primary\"\n          (onClick)=\"retry()\"\n        ></mt-button>\n      </div>\n    } @else {\n      <div class=\"space-y-5\">\n        <mt-icon\n          icon=\"general.loading-02\"\n          class=\"text-primary text-4xl animate-spin animate-duration-2000\"\n        >\n        </mt-icon>\n        <div class=\"space-y-2\">\n          <h1 class=\"text-xl font-semibold text-surface-950\">\n            Completing sign-in\n          </h1>\n          <p class=\"text-sm text-surface-600\">\n            Please wait while we finish the secure sign-in.\n          </p>\n        </div>\n      </div>\n    }\n  </div>\n</div>\n", styles: [":host{display:block}\n"] }]
+        }] });
+
+class GatewaySsoButtons {
+    authFacade = inject(GatewayAuthFacade);
+    dividerLabel = input('or', ...(ngDevMode ? [{ debugName: "dividerLabel" }] : /* istanbul ignore next */ []));
+    providers = this.authFacade.ssoProviders;
+    loading = this.authFacade.ssoLoading;
+    constructor() {
+        this.authFacade.loadSsoProviders();
+    }
+    startSso(provider) {
+        this.authFacade.startSso(provider);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewaySsoButtons, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.8", type: GatewaySsoButtons, isStandalone: true, selector: "mt-gateway-sso-buttons", inputs: { dividerLabel: { classPropertyName: "dividerLabel", publicName: "dividerLabel", isSignal: true, isRequired: false, transformFunction: null } }, ngImport: i0, template: "@if (providers().length > 0) {\n  <div class=\"gateway-sso-divider\">\n    <span></span>\n    <span>{{ dividerLabel() }}</span>\n    <span></span>\n  </div>\n\n  <div class=\"gateway-sso-list\">\n    @for (provider of providers(); track provider.key) {\n      <mt-button\n        [label]=\"provider.displayName\"\n        size=\"large\"\n        variant=\"outlined\"\n        fluid\n        type=\"button\"\n        [disabled]=\"loading()\"\n        (onClick)=\"startSso(provider)\"\n      />\n    }\n  </div>\n}\n", styles: [":host{display:block}.gateway-sso-divider{align-items:center;display:flex;gap:.75rem;padding-top:.5rem}.gateway-sso-divider span:first-child,.gateway-sso-divider span:last-child{background:#ffffff4d;flex:1;height:1px}.gateway-sso-divider span:nth-child(2){font-size:.75rem;letter-spacing:0;text-transform:uppercase}.gateway-sso-list{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}\n"], dependencies: [{ kind: "component", type: Button, selector: "mt-button", inputs: ["icon", "label", "tooltip", "class", "type", "styleClass", "severity", "badge", "variant", "badgeSeverity", "size", "iconPos", "autofocus", "fluid", "raised", "rounded", "text", "plain", "outlined", "link", "disabled", "loading", "pInputs"], outputs: ["onClick", "onFocus", "onBlur"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.8", ngImport: i0, type: GatewaySsoButtons, decorators: [{
+            type: Component,
+            args: [{ selector: 'mt-gateway-sso-buttons', imports: [Button], changeDetection: ChangeDetectionStrategy.OnPush, template: "@if (providers().length > 0) {\n  <div class=\"gateway-sso-divider\">\n    <span></span>\n    <span>{{ dividerLabel() }}</span>\n    <span></span>\n  </div>\n\n  <div class=\"gateway-sso-list\">\n    @for (provider of providers(); track provider.key) {\n      <mt-button\n        [label]=\"provider.displayName\"\n        size=\"large\"\n        variant=\"outlined\"\n        fluid\n        type=\"button\"\n        [disabled]=\"loading()\"\n        (onClick)=\"startSso(provider)\"\n      />\n    }\n  </div>\n}\n", styles: [":host{display:block}.gateway-sso-divider{align-items:center;display:flex;gap:.75rem;padding-top:.5rem}.gateway-sso-divider span:first-child,.gateway-sso-divider span:last-child{background:#ffffff4d;flex:1;height:1px}.gateway-sso-divider span:nth-child(2){font-size:.75rem;letter-spacing:0;text-transform:uppercase}.gateway-sso-list{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}\n"] }]
+        }], ctorParameters: () => [], propDecorators: { dividerLabel: [{ type: i0.Input, args: [{ isSignal: true, alias: "dividerLabel", required: false }] }] } });
+
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { GATEWAY_AUTH_DEVICE_TOKEN, GATEWAY_AUTH_ENDPOINTS, GatewaySsoSession, buildGatewayUrl, buildSsoStartUrl, createSecureClientState, getGatewayErrorMessage, hasGatewayTokens, isExpired, mapGatewayTokens, mapGatewayUser, normalizeGatewayBase, resolveApiDateValue };
+export { AUTH_STATE_DEFAULTS, ClearError, ClearPendingMfa, ExchangeSsoCode, GATEWAY_AUTH_DEVICE_TOKEN, GATEWAY_AUTH_ENDPOINTS, GATEWAY_AUTH_OPTIONS, GATEWAY_AUTH_RETRY_CONTEXT, GatewayAuthFacade, GatewayAuthState, GatewayMfa, GatewaySsoButtons, GatewaySsoCallback, GatewaySsoSession, LoadSsoProviders, Login, LoginFailure, LoginSuccess, Logout, ResendMfa, StartSso, UpdateTokens, UpdateUserData, VerifyMfa, buildGatewayUrl, buildSsoStartUrl, createSecureClientState, gatewayAuthInterceptor, getGatewayErrorMessage, hasGatewayTokens, isExpired, isGatewayAuthRequestUrl, mapGatewayTokens, mapGatewayUser, normalizeGatewayBase, resolveApiDateValue, resolveGatewayAuthPath, sanitizePersistedAuthState };
 //# sourceMappingURL=masterteam-gateway-auth.mjs.map