@medha-analytics/medhasso-auth 1.0.0 → 1.0.2

package/fesm2022/medha-analytics-medhasso-auth.mjs

@@ -1,9 +1,9 @@
 import * as i0 from '@angular/core';
 import { InjectionToken, Inject, Injectable, NgModule } from '@angular/core';
 import * as i1 from '@angular/common/http';
-import { HTTP_INTERCEPTORS } from '@angular/common/http';
+import { HttpClient, HTTP_INTERCEPTORS } from '@angular/common/http';
 import { BehaviorSubject, timer, throwError, of } from 'rxjs';
-import { tap, catchError, switchMap, map } from 'rxjs/operators';
+import { tap, catchError, finalize, shareReplay, map, switchMap } from 'rxjs/operators';
 import * as i2 from '@angular/router';
 
 const MEDHASSO_CONFIG = new InjectionToken('MEDHASSO_CONFIG');
@@ -27,14 +27,48 @@ class TokenManagementService {
     get autoRefresh() {
         return this.tokenConfig.autoRefresh !== false;
     }
-    constructor(config, http) {
+    constructor(config, http, httpBackend) {
         this.config = config;
         this.http = http;
+        this.refreshInProgress$ = null;
         this.tokenSubject = new BehaviorSubject(null);
         this.userSubject = new BehaviorSubject(null);
+        this.onVisibilityChange = () => {
+            if (document.visibilityState === 'visible') {
+                this.ensureValidToken().subscribe();
+            }
+        };
+        this.onWindowFocus = () => {
+            this.ensureValidToken().subscribe();
+        };
         this.token$ = this.tokenSubject.asObservable();
         this.user$ = this.userSubject.asObservable();
+        this.refreshHttp = new HttpClient(httpBackend);
         this.initializeFromStorage();
+        this.setupWakeDetection();
+    }
+    /**
+     * Re-validate the token whenever the tab regains focus/visibility.
+     * The refresh timer is a JS timer and does not fire while the OS/browser
+     * was suspended (e.g. laptop sleep overnight), so it can't be relied on
+     * alone to catch a token that went stale while the app was inactive.
+     */
+    setupWakeDetection() {
+        if (typeof document === 'undefined' || typeof window === 'undefined') {
+            return;
+        }
+        document.addEventListener('visibilitychange', this.onVisibilityChange);
+        window.addEventListener('focus', this.onWindowFocus);
+    }
+    /**
+     * Remove wake-detection listeners registered in setupWakeDetection().
+     */
+    teardownWakeDetection() {
+        if (typeof document === 'undefined' || typeof window === 'undefined') {
+            return;
+        }
+        document.removeEventListener('visibilitychange', this.onVisibilityChange);
+        window.removeEventListener('focus', this.onWindowFocus);
     }
     /**
      * Initialize token information from storage
@@ -50,6 +84,30 @@ class TokenManagementService {
             }
         }
     }
+    /**
+     * Re-sync in-memory token state from storage if it has drifted (e.g.
+     * something wrote tokens directly to storage without going through
+     * setTokens()). No-op when storage already matches memory.
+     */
+    syncFromStorage() {
+        const storedToken = this.getStoredToken();
+        const currentToken = this.getTokenInfo()?.token ?? null;
+        if (storedToken === currentToken) {
+            return;
+        }
+        if (!storedToken) {
+            this.tokenSubject.next(null);
+            this.userSubject.next(null);
+            this.clearTokenRefreshInterval();
+            return;
+        }
+        const tokenInfo = this.createTokenInfo(storedToken);
+        this.tokenSubject.next(tokenInfo);
+        this.userSubject.next(this.extractUserFromToken(storedToken));
+        if (this.autoRefresh && !tokenInfo.isExpired) {
+            this.setTokenRefreshInterval(tokenInfo);
+        }
+    }
     /**
      * Get stored token from configured storage
      */
@@ -83,19 +141,26 @@ class TokenManagementService {
         storage.removeItem(this.refreshTokenKey);
     }
     /**
-     * Create token info object from JWT token
+     * Create token info object from JWT token.
+     *
+     * `isExpired` and `needsRefresh` are getters, not snapshotted booleans:
+     * the TokenInfo object may outlive wall-clock events that change its
+     * expiry status (e.g. OS/browser suspended overnight, laptop sleep).
+     * A snapshotted boolean captured at creation time would then lie — the
+     * wake handler would call ensureValidToken(), see `isExpired: false`
+     * from the pre-sleep snapshot, and skip the refresh. Reading these as
+     * getters means every access reflects the current clock.
      */
     createTokenInfo(token) {
         const payload = this.decodeJwt(token);
         const expiresAt = payload.exp * 1000; // Convert to milliseconds
-        const now = Date.now();
         const refreshWindow = this.refreshBeforeExpiryMinutes * 60 * 1000;
         return {
             token,
             payload,
             expiresAt,
-            isExpired: now >= expiresAt,
-            needsRefresh: now >= (expiresAt - refreshWindow)
+            get isExpired() { return Date.now() >= expiresAt; },
+            get needsRefresh() { return Date.now() >= (expiresAt - refreshWindow); }
         };
     }
     /**
@@ -202,23 +267,81 @@ class TokenManagementService {
         }
     }
     /**
-     * Refresh the current token
+     * Refresh the current token.
+     * Concurrent callers (auto-refresh timer, wake detection, interceptor,
+     * route guard) share the same in-flight request instead of each firing
+     * their own POST to the refresh endpoint.
      */
     refreshToken() {
+        if (this.refreshInProgress$) {
+            return this.refreshInProgress$;
+        }
         const refreshToken = this.getStoredRefreshToken();
         if (!refreshToken) {
             return throwError(() => new Error('No refresh token available'));
         }
-        return this.http.post(`${this.config.refreshUrl}/api/refresh-token`, { refreshToken })
+        const request$ = this.refreshHttp.post(`${this.config.refreshUrl}/api/refresh-token`, { refreshToken })
             .pipe(tap((response) => {
             if (response.id_token) {
                 this.setTokens(response.id_token, response.refresh_token);
             }
         }), catchError(error => {
             console.error('Token refresh failed:', error);
-            this.logout();
+            // Only clear the session on a definitive auth failure from the refresh
+            // endpoint (dead/revoked/invalid refresh token). Transient failures —
+            // network blips, 5xx, timeouts — must NOT force a logout: the current
+            // id_token may still be valid for the rest of its lifetime, and the
+            // background-refresh path (ensureValidToken → needsRefresh) runs on
+            // every request within the 5-min window, so a single network hiccup
+            // would otherwise log the user out mid-session.
+            const status = error?.status;
+            if (status === 400 || status === 401) {
+                this.logout();
+            }
             return throwError(() => error);
-        }));
+        }), finalize(() => {
+            this.refreshInProgress$ = null;
+        }), shareReplay({ bufferSize: 1, refCount: false }));
+        this.refreshInProgress$ = request$;
+        return request$;
+    }
+    /**
+     * Ensure the current token is valid, refreshing it first if it is
+     * expired. Resolves `false` if there is no token at all, or the token
+     * is expired and refreshing it failed (in both cases the caller should
+     * redirect to SSO).
+     *
+     * A token that merely `needsRefresh` (inside the refresh window, but
+     * not yet expired) is still good enough to use: the refresh for it is
+     * kicked off in the background so the *current* request/route isn't
+     * blocked or logged out by a transient refresh failure (network blip,
+     * refresh endpoint hiccup) while the existing token would have worked
+     * fine. Only an actually-expired token blocks the caller.
+     *
+     * Re-syncs from storage first: the in-memory token snapshot is only
+     * updated via setTokens()/logout(), so if something wrote directly to
+     * storage (e.g. the SSO callback flow) without going through this
+     * service, the in-memory copy would otherwise be stale until the next
+     * full page load re-runs initializeFromStorage().
+     *
+     * Anonymous/bootstrap endpoints that must be reachable before any token
+     * exists (e.g. the SSO callback's own token-exchange request) should be
+     * added to `interceptorConfig.excludeUrls` so they bypass this check
+     * entirely, rather than relying on this method to let them through.
+     */
+    ensureValidToken() {
+        this.syncFromStorage();
+        const tokenInfo = this.getTokenInfo();
+        if (!tokenInfo) {
+            return of(false);
+        }
+        if (tokenInfo.isExpired) {
+            return this.refreshToken().pipe(map(() => true), catchError(() => of(false)));
+        }
+        if (tokenInfo.needsRefresh) {
+            this.refreshToken().subscribe({ error: () => { } });
+        }
+        return of(true);
     }
     /**
      * Logout user and clear all tokens
@@ -263,8 +386,9 @@ class TokenManagementService {
      */
     ngOnDestroy() {
         this.clearTokenRefreshInterval();
+        this.teardownWakeDetection();
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: TokenManagementService, deps: [{ token: MEDHASSO_CONFIG }, { token: i1.HttpClient }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: TokenManagementService, deps: [{ token: MEDHASSO_CONFIG }, { token: i1.HttpClient }, { token: i1.HttpBackend }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: TokenManagementService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: TokenManagementService, decorators: [{
@@ -275,7 +399,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImpo
         }], ctorParameters: () => [{ type: undefined, decorators: [{
                     type: Inject,
                     args: [MEDHASSO_CONFIG]
-                }] }, { type: i1.HttpClient }] });
+                }] }, { type: i1.HttpClient }, { type: i1.HttpBackend }] });
 
 class MedHassoAuthInterceptor {
     constructor(config, tokenService) {
@@ -295,18 +419,27 @@ class MedHassoAuthInterceptor {
         if (!this.shouldIncludeRequest(request)) {
             return next.handle(request);
         }
-        // Add authorization header
-        const modifiedRequest = this.addAuthorizationHeader(request);
-        return next.handle(modifiedRequest).pipe(catchError((error) => {
-            // Handle 401 Unauthorized errors
-            if (error.status === 401) {
-                return this.handle401Error(request, next);
+        // Proactively ensure the token is valid (refreshing first if it's
+        // expired or within the refresh window) before attaching the header.
+        // This avoids sending a guaranteed-401 request after the app has been
+        // idle/suspended long enough for the in-memory refresh timer to miss it.
+        return this.tokenService.ensureValidToken().pipe(switchMap(valid => {
+            if (!valid) {
+                this.redirectToSSO();
+                return throwError(() => new Error('Authentication required'));
             }
-            // Handle 403 Forbidden errors
-            if (error.status === 403) {
-                console.warn('MedHasso Auth: Access forbidden (403)', error);
-            }
-            return throwError(() => error);
+            const modifiedRequest = this.addAuthorizationHeader(request);
+            return next.handle(modifiedRequest).pipe(catchError((error) => {
+                // Handle 401 Unauthorized errors
+                if (error.status === 401) {
+                    return this.handle401Error(request, next);
+                }
+                // Handle 403 Forbidden errors
+                if (error.status === 403) {
+                    console.warn('MedHasso Auth: Access forbidden (403)', error);
+                }
+                return throwError(() => error);
+            }));
         }));
     }
     /**
@@ -355,25 +488,32 @@ class MedHassoAuthInterceptor {
         });
     }
     /**
-     * Handle 401 Unauthorized errors by attempting token refresh
+     * Handle 401 Unauthorized errors by attempting token refresh.
+     *
+     * Always tries the refresh path first, even when the in-memory token looks
+     * expired to our clock. The server already said "unauthorized" — whether our
+     * local isExpired check agrees doesn't change what we need to do next.
+     * Short-circuiting to SSO on `tokenInfo.isExpired` would bounce the user on
+     * mid-flight expirations and small client/server clock skews, cases where the
+     * refresh token is still perfectly valid and would have recovered. If the
+     * refresh really can't succeed (no refresh token in storage, dead refresh
+     * token → 400/401), refreshToken() throws and the catchError below redirects.
      */
     handle401Error(request, next) {
-        const tokenInfo = this.tokenService.getTokenInfo();
-        // If no token or token is expired, redirect to SSO
-        if (!tokenInfo || tokenInfo.isExpired) {
+        // catchError sits BEFORE switchMap on purpose: it must only catch failures
+        // from refreshToken(), not from the retried next.handle(retryRequest). If
+        // the refresh succeeds but the retry fails (403, 500, etc.), that error
+        // has nothing to do with authentication — redirecting to SSO would be
+        // wrong. Keep the SSO redirect scoped to the "refresh really can't help"
+        // case; let any retry error propagate normally to the component.
+        return this.tokenService.refreshToken().pipe(catchError((refreshError) => {
+            console.error('MedHasso Auth: Token refresh failed', refreshError);
             this.redirectToSSO();
-            return throwError(() => new Error('Authentication required'));
-        }
-        // If token exists but request failed, try to refresh
-        return this.tokenService.refreshToken().pipe(switchMap(() => {
+            return throwError(() => refreshError);
+        }), switchMap(() => {
             // Retry the original request with new token
             const retryRequest = this.addAuthorizationHeader(request);
             return next.handle(retryRequest);
-        }), catchError((refreshError) => {
-            // If refresh fails, redirect to SSO
-            console.error('MedHasso Auth: Token refresh failed', refreshError);
-            this.redirectToSSO();
-            return throwError(() => refreshError);
         }));
     }
     /**
@@ -672,16 +812,19 @@ class MedHassoAuthGuard {
         if (this.handleAuthCallback(route)) {
             return of(true);
         }
-        // Check if user is already authenticated
-        if (this.tokenService.isAuthenticated()) {
-            return this.refreshTokenIfNeeded().pipe(map(() => true), catchError(() => {
+        // Re-syncs from storage and refreshes a stale/expired token before
+        // deciding, so this guard shares the same de-duplicated refresh and
+        // storage-drift handling as the HTTP interceptor.
+        return this.tokenService.ensureValidToken().pipe(map(valid => {
+            if (!valid) {
                 this.tokenService.redirectToSSO();
-                return of(false);
-            }));
-        }
-        // Not authenticated, redirect to SSO
-        this.tokenService.redirectToSSO();
-        return of(false);
+                return false;
+            }
+            return true;
+        }), catchError(() => {
+            this.tokenService.redirectToSSO();
+            return of(false);
+        }));
     }
     /**
      * Handle authentication callback from MedHasso SSO
@@ -704,16 +847,6 @@ class MedHassoAuthGuard {
         }
         return false;
     }
-    /**
-     * Refresh token if needed
-     */
-    refreshTokenIfNeeded() {
-        const tokenInfo = this.tokenService.getTokenInfo();
-        if (tokenInfo?.needsRefresh) {
-            return this.tokenService.refreshToken();
-        }
-        return of(null);
-    }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthGuard, deps: [{ token: TokenManagementService }, { token: i2.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthGuard, providedIn: 'root' }); }
 }

package/fesm2022/medha-analytics-medhasso-auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"medha-analytics-medhasso-auth.mjs","sources":["../../../projects/medhasso-auth/src/lib/tokens/medhasso-config.token.ts","../../../projects/medhasso-auth/src/lib/services/token-management.service.ts","../../../projects/medhasso-auth/src/lib/interceptors/medhasso-auth.interceptor.ts","../../../projects/medhasso-auth/src/lib/services/medhasso-auth.service.ts","../../../projects/medhasso-auth/src/lib/medhasso-auth.module.ts","../../../projects/medhasso-auth/src/lib/guards/medhasso-auth.guard.ts","../../../projects/medhasso-auth/src/public-api.ts","../../../projects/medhasso-auth/src/medha-analytics-medhasso-auth.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\nimport { MedHassoConfig } from '../interfaces/medhasso-config.interface';\n\nexport const MEDHASSO_CONFIG = new InjectionToken<MedHassoConfig>('MEDHASSO_CONFIG');","import { Injectable, Inject } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { BehaviorSubject, Observable, throwError, timer } from 'rxjs';\nimport { catchError, tap } from 'rxjs/operators';\nimport { MedHassoConfig, TokenConfig, TokenInfo, MedHassoUser } from '../interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from '../tokens/medhasso-config.token';\n\n@Injectable({\n  providedIn: 'root'\n})\nexport class TokenManagementService {\n  private refreshTokenInterval: any;\n  private tokenSubject = new BehaviorSubject<TokenInfo | null>(null);\n  private userSubject = new BehaviorSubject<MedHassoUser | null>(null);\n\n  public token$ = this.tokenSubject.asObservable();\n  public user$ = this.userSubject.asObservable();\n\n  private get tokenConfig(): TokenConfig {\n    return this.config.tokenConfig || {};\n  }\n\n  private get storageType(): 'localStorage' | 'sessionStorage' {\n    return this.tokenConfig.storageType || 'localStorage';\n  }\n\n  private get idTokenKey(): string {\n    return this.tokenConfig.idTokenKey || 'idToken';\n  }\n\n  private get refreshTokenKey(): string {\n    return this.tokenConfig.refreshTokenKey || 'refreshToken';\n  }\n\n  private get refreshBeforeExpiryMinutes(): number {\n    return this.tokenConfig.refreshBeforeExpiryMinutes || 5;\n  }\n\n  private get autoRefresh(): boolean {\n    return this.tokenConfig.autoRefresh !== false;\n  }\n\n  constructor(\n    @Inject(MEDHASSO_CONFIG) private config: MedHassoConfig,\n    private http: HttpClient\n  ) {\n    this.initializeFromStorage();\n  }\n\n  /**\n   * Initialize token information from storage\n   */\n  private initializeFromStorage(): void {\n    const token = this.getStoredToken();\n    if (token) {\n      const tokenInfo = this.createTokenInfo(token);\n      this.tokenSubject.next(tokenInfo);\n      this.userSubject.next(this.extractUserFromToken(token));\n      \n      if (this.autoRefresh && !tokenInfo.isExpired) {\n        this.setTokenRefreshInterval(tokenInfo);\n      }\n    }\n  }\n\n  /**\n   * Get stored token from configured storage\n   */\n  private getStoredToken(): string | null {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    return storage.getItem(this.idTokenKey);\n  }\n\n  /**\n   * Get stored refresh token from configured storage\n   */\n  private getStoredRefreshToken(): string | null {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    return storage.getItem(this.refreshTokenKey);\n  }\n\n  /**\n   * Store tokens in configured storage\n   */\n  private storeTokens(idToken: string, refreshToken?: string): void {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    storage.setItem(this.idTokenKey, idToken);\n    if (refreshToken) {\n      storage.setItem(this.refreshTokenKey, refreshToken);\n    }\n  }\n\n  /**\n   * Clear stored tokens\n   */\n  private clearStoredTokens(): void {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    storage.removeItem(this.idTokenKey);\n    storage.removeItem(this.refreshTokenKey);\n  }\n\n  /**\n   * Create token info object from JWT token\n   */\n  private createTokenInfo(token: string): TokenInfo {\n    const payload = this.decodeJwt(token);\n    const expiresAt = payload.exp * 1000; // Convert to milliseconds\n    const now = Date.now();\n    const refreshWindow = this.refreshBeforeExpiryMinutes * 60 * 1000;\n\n    return {\n      token,\n      payload,\n      expiresAt,\n      isExpired: now >= expiresAt,\n      needsRefresh: now >= (expiresAt - refreshWindow)\n    };\n  }\n\n  /**\n   * Decode JWT token payload\n   */\n  private decodeJwt(token: string): any {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        throw new Error('Invalid JWT token format');\n      }\n      const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));\n      return payload;\n    } catch (error) {\n      console.error('Error decoding JWT token:', error);\n      throw new Error('Invalid JWT token');\n    }\n  }\n\n  /**\n   * Extract user information from JWT token\n   */\n  private extractUserFromToken(token: string): MedHassoUser {\n    const payload = this.decodeJwt(token);\n    return {\n      upn: payload.upn || payload.email,\n      name: payload.name,\n      roles: payload.roles || [],\n      ...payload\n    };\n  }\n\n  /**\n   * Set up automatic token refresh interval\n   */\n  private setTokenRefreshInterval(tokenInfo: TokenInfo): void {\n    this.clearTokenRefreshInterval();\n\n    if (!this.autoRefresh || tokenInfo.isExpired) {\n      return;\n    }\n\n    const remainingTime = tokenInfo.expiresAt - Date.now();\n    const refreshTime = remainingTime - (this.refreshBeforeExpiryMinutes * 60 * 1000);\n\n    if (refreshTime > 0) {\n      this.refreshTokenInterval = timer(refreshTime).subscribe(() => {\n        this.refreshToken().subscribe();\n      });\n    } else {\n      // Token needs immediate refresh\n      this.refreshToken().subscribe();\n    }\n  }\n\n  /**\n   * Clear token refresh interval\n   */\n  private clearTokenRefreshInterval(): void {\n    if (this.refreshTokenInterval) {\n      this.refreshTokenInterval.unsubscribe();\n      this.refreshTokenInterval = null;\n    }\n  }\n\n  /**\n   * Get current token information\n   */\n  getTokenInfo(): TokenInfo | null {\n    return this.tokenSubject.value;\n  }\n\n  /**\n   * Get current user information\n   */\n  getCurrentUser(): MedHassoUser | null {\n    return this.userSubject.value;\n  }\n\n  /**\n   * Check if user is authenticated\n   */\n  isAuthenticated(): boolean {\n    const tokenInfo = this.getTokenInfo();\n    return tokenInfo !== null && !tokenInfo.isExpired;\n  }\n\n  /**\n   * Check if user has specific role\n   */\n  hasRole(role: string): boolean {\n    const user = this.getCurrentUser();\n    return user?.roles?.includes(role) || false;\n  }\n\n  /**\n   * Check if user is admin\n   */\n  isAdmin(): boolean {\n    return this.hasRole('admin') || this.hasRole('administrator');\n  }\n\n  /**\n   * Set tokens (typically called after successful authentication)\n   */\n  setTokens(idToken: string, refreshToken?: string): void {\n    this.storeTokens(idToken, refreshToken);\n    const tokenInfo = this.createTokenInfo(idToken);\n    const user = this.extractUserFromToken(idToken);\n\n    this.tokenSubject.next(tokenInfo);\n    this.userSubject.next(user);\n\n    if (this.autoRefresh) {\n      this.setTokenRefreshInterval(tokenInfo);\n    }\n  }\n\n  /**\n   * Refresh the current token\n   */\n  refreshToken(): Observable<any> {\n    const refreshToken = this.getStoredRefreshToken();\n    \n    if (!refreshToken) {\n      return throwError(() => new Error('No refresh token available'));\n    }\n\n    return this.http.post(`${this.config.refreshUrl}/api/refresh-token`, { refreshToken })\n      .pipe(\n        tap((response: any) => {\n          if (response.id_token) {\n            this.setTokens(response.id_token, response.refresh_token);\n          }\n        }),\n        catchError(error => {\n          console.error('Token refresh failed:', error);\n          this.logout();\n          return throwError(() => error);\n        })\n      );\n  }\n\n  /**\n   * Logout user and clear all tokens\n   */\n  logout(): void {\n    this.clearTokenRefreshInterval();\n    this.clearStoredTokens();\n    this.tokenSubject.next(null);\n    this.userSubject.next(null);\n  }\n\n  /**\n   * Redirect to MedHasso SSO for authentication\n   */\n  redirectToSSO(returnUrl?: string): void {\n    const currentUrl = returnUrl || window.location.href;\n    const ssoUrl = `${this.config.ssoUrl}?url=${encodeURIComponent(currentUrl)}&applicationName=${encodeURIComponent(this.config.applicationName)}`;\n    window.location.href = ssoUrl;\n  }\n\n  /**\n   * Handle authentication callback (typically from SSO redirect)\n   */\n  handleAuthCallback(params: { idToken?: string; refreshToken?: string }): boolean {\n    if (params.idToken) {\n      this.setTokens(params.idToken, params.refreshToken);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Get authorization header value\n   */\n  getAuthorizationHeader(): string | null {\n    const tokenInfo = this.getTokenInfo();\n    if (tokenInfo && !tokenInfo.isExpired) {\n      const prefix = this.config.interceptorConfig?.authHeaderPrefix || 'Bearer';\n      return `${prefix} ${tokenInfo.token}`;\n    }\n    return null;\n  }\n\n  /**\n   * Cleanup on service destruction\n   */\n  ngOnDestroy(): void {\n    this.clearTokenRefreshInterval();\n  }\n}","import { Injectable, Inject } from '@angular/core';\nimport { HttpInterceptor, HttpRequest, HttpHandler, HttpEvent, HttpErrorResponse } from '@angular/common/http';\nimport { Observable, throwError } from 'rxjs';\nimport { catchError, switchMap } from 'rxjs/operators';\nimport { MedHassoConfig } from '../interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from '../tokens/medhasso-config.token';\nimport { TokenManagementService } from '../services/token-management.service';\n\n@Injectable()\nexport class MedHassoAuthInterceptor implements HttpInterceptor {\n\n  constructor(\n    @Inject(MEDHASSO_CONFIG) private config: MedHassoConfig,\n    private tokenService: TokenManagementService\n  ) {}\n\n  intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {\n    // Check if interceptor is enabled\n    if (this.config.interceptorConfig?.enabled === false) {\n      return next.handle(request);\n    }\n\n    // Check if request should be excluded\n    if (this.shouldExcludeRequest(request)) {\n      return next.handle(request);\n    }\n\n    // Check if request should be included (if includeUrls is specified)\n    if (!this.shouldIncludeRequest(request)) {\n      return next.handle(request);\n    }\n\n    // Add authorization header\n    const modifiedRequest = this.addAuthorizationHeader(request);\n\n    return next.handle(modifiedRequest).pipe(\n      catchError((error: HttpErrorResponse) => {\n        // Handle 401 Unauthorized errors\n        if (error.status === 401) {\n          return this.handle401Error(request, next);\n        }\n        \n        // Handle 403 Forbidden errors\n        if (error.status === 403) {\n          console.warn('MedHasso Auth: Access forbidden (403)', error);\n        }\n\n        return throwError(() => error);\n      })\n    );\n  }\n\n  /**\n   * Check if request URL should be excluded from authentication\n   */\n  private shouldExcludeRequest(request: HttpRequest<any>): boolean {\n    const excludeUrls = this.config.interceptorConfig?.excludeUrls || [];\n    return excludeUrls.some(url => this.matchesUrl(request.url, url));\n  }\n\n  /**\n   * Check if request URL should be included for authentication\n   * If includeUrls is not specified, all requests are included (unless excluded)\n   */\n  private shouldIncludeRequest(request: HttpRequest<any>): boolean {\n    const includeUrls = this.config.interceptorConfig?.includeUrls;\n    \n    // If no includeUrls specified, include all requests\n    if (!includeUrls || includeUrls.length === 0) {\n      return true;\n    }\n\n    // If includeUrls specified, only include matching requests\n    return includeUrls.some(url => this.matchesUrl(request.url, url));\n  }\n\n  /**\n   * Check if request URL matches the pattern\n   */\n  private matchesUrl(requestUrl: string, pattern: string): boolean {\n    // Support wildcards and exact matches\n    if (pattern.includes('*')) {\n      const regex = new RegExp(pattern.replace(/\\*/g, '.*'));\n      return regex.test(requestUrl);\n    }\n    \n    return requestUrl.includes(pattern);\n  }\n\n  /**\n   * Add authorization header to request\n   */\n  private addAuthorizationHeader(request: HttpRequest<any>): HttpRequest<any> {\n    const authHeader = this.tokenService.getAuthorizationHeader();\n    \n    if (!authHeader) {\n      return request;\n    }\n\n    return request.clone({\n      setHeaders: {\n        Authorization: authHeader\n      }\n    });\n  }\n\n  /**\n   * Handle 401 Unauthorized errors by attempting token refresh\n   */\n  private handle401Error(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {\n    const tokenInfo = this.tokenService.getTokenInfo();\n    \n    // If no token or token is expired, redirect to SSO\n    if (!tokenInfo || tokenInfo.isExpired) {\n      this.redirectToSSO();\n      return throwError(() => new Error('Authentication required'));\n    }\n\n    // If token exists but request failed, try to refresh\n    return this.tokenService.refreshToken().pipe(\n      switchMap(() => {\n        // Retry the original request with new token\n        const retryRequest = this.addAuthorizationHeader(request);\n        return next.handle(retryRequest);\n      }),\n      catchError((refreshError) => {\n        // If refresh fails, redirect to SSO\n        console.error('MedHasso Auth: Token refresh failed', refreshError);\n        this.redirectToSSO();\n        return throwError(() => refreshError);\n      })\n    );\n  }\n\n  /**\n   * Redirect to SSO for authentication\n   */\n  private redirectToSSO(): void {\n    // Add a small delay to prevent multiple redirects\n    setTimeout(() => {\n      this.tokenService.redirectToSSO();\n    }, 100);\n  }\n}","import { Injectable, Inject } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { Observable, of } from 'rxjs';\nimport { map, catchError } from 'rxjs/operators';\nimport { MedHassoConfig, MedHassoUser } from '../interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from '../tokens/medhasso-config.token';\nimport { TokenManagementService } from './token-management.service';\n\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoAuthService {\n\n  constructor(\n    @Inject(MEDHASSO_CONFIG) private config: MedHassoConfig,\n    private tokenService: TokenManagementService,\n    private http: HttpClient\n  ) {}\n\n  /**\n   * Get current authentication status\n   */\n  isAuthenticated(): boolean {\n    return this.tokenService.isAuthenticated();\n  }\n\n  /**\n   * Get current user information\n   */\n  getCurrentUser(): MedHassoUser | null {\n    return this.tokenService.getCurrentUser();\n  }\n\n  /**\n   * Get current user as observable\n   */\n  getCurrentUser$(): Observable<MedHassoUser | null> {\n    return this.tokenService.user$;\n  }\n\n  /**\n   * Check if user has specific role\n   */\n  hasRole(role: string): boolean {\n    return this.tokenService.hasRole(role);\n  }\n\n  /**\n   * Check if user has any of the specified roles\n   */\n  hasAnyRole(roles: string[]): boolean {\n    return roles.some(role => this.tokenService.hasRole(role));\n  }\n\n  /**\n   * Check if user has all of the specified roles\n   */\n  hasAllRoles(roles: string[]): boolean {\n    return roles.every(role => this.tokenService.hasRole(role));\n  }\n\n  /**\n   * Check if user is admin\n   */\n  isAdmin(): boolean {\n    return this.tokenService.isAdmin();\n  }\n\n  /**\n   * Login user (redirect to SSO)\n   */\n  login(returnUrl?: string): void {\n    this.tokenService.redirectToSSO(returnUrl);\n  }\n\n  /**\n   * Logout user\n   */\n  logout(): void {\n    this.tokenService.logout();\n  }\n\n  /**\n   * Refresh authentication token\n   */\n  refreshToken(): Observable<any> {\n    return this.tokenService.refreshToken();\n  }\n\n  /**\n   * Check access permissions for a simple key (if applicable)\n   */\n  checkAccess(simpleKey: string, backendUrl?: string): Observable<any> {\n    const url = backendUrl || this.getBackendUrl();\n    if (!url) {\n      return of(null);\n    }\n\n    return this.http.get(`${url}/auth/guard?simple_key=${simpleKey}`)\n      .pipe(\n        catchError(error => {\n          console.error('Access check failed:', error);\n          return of(null);\n        })\n      );\n  }\n\n  /**\n   * Check if user is admin via backend API (if applicable)\n   */\n  checkIsAdmin(backendUrl?: string): Observable<boolean> {\n    const user = this.getCurrentUser();\n    const url = backendUrl || this.getBackendUrl();\n    \n    if (!user?.upn || !url) {\n      return of(false);\n    }\n\n    return this.http.get(`${url}/isAdmin?email=${user.upn}`)\n      .pipe(\n        map((response: any) => !!response),\n        catchError(() => of(false))\n      );\n  }\n\n  /**\n   * Get backend URL from config (helper method)\n   */\n  private getBackendUrl(): string | null {\n    // This would need to be configured or passed in\n    // For now, return null as it's application-specific\n    return null;\n  }\n\n  /**\n   * Get token information\n   */\n  getTokenInfo() {\n    return this.tokenService.getTokenInfo();\n  }\n\n  /**\n   * Get token as observable\n   */\n  getToken$() {\n    return this.tokenService.token$;\n  }\n\n  /**\n   * Handle authentication callback\n   */\n  handleAuthCallback(params: { idToken?: string; refreshToken?: string }): boolean {\n    return this.tokenService.handleAuthCallback(params);\n  }\n\n  /**\n   * Get user email\n   */\n  getUserEmail(): string | null {\n    return this.getCurrentUser()?.upn || null;\n  }\n\n  /**\n   * Get user display name\n   */\n  getUserDisplayName(): string | null {\n    return this.getCurrentUser()?.name || null;\n  }\n\n  /**\n   * Get all user roles\n   */\n  getUserRoles(): string[] {\n    return this.getCurrentUser()?.roles || [];\n  }\n\n  /**\n   * Get authorization header value\n   */\n  getAuthorizationHeader(): string | null {\n    return this.tokenService.getAuthorizationHeader();\n  }\n}","import { NgModule, ModuleWithProviders, Provider } from '@angular/core';\nimport { HTTP_INTERCEPTORS } from '@angular/common/http';\nimport { MedHassoConfig } from './interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from './tokens/medhasso-config.token';\nimport { MedHassoAuthInterceptor } from './interceptors/medhasso-auth.interceptor';\nimport { TokenManagementService } from './services/token-management.service';\nimport { MedHassoAuthService } from './services/medhasso-auth.service';\n\n@NgModule({\n  declarations: [],\n  imports: [],\n  exports: []\n})\nexport class MedHassoAuthModule {\n  \n  /**\n   * Configure the MedHasso authentication module with required settings\n   */\n  static forRoot(config: MedHassoConfig): ModuleWithProviders<MedHassoAuthModule> {\n    return {\n      ngModule: MedHassoAuthModule,\n      providers: [\n        {\n          provide: MEDHASSO_CONFIG,\n          useValue: this.mergeWithDefaults(config)\n        },\n        TokenManagementService,\n        MedHassoAuthService,\n        {\n          provide: HTTP_INTERCEPTORS,\n          useClass: MedHassoAuthInterceptor,\n          multi: true\n        }\n      ]\n    };\n  }\n\n  /**\n   * Configure the MedHasso authentication module for feature modules\n   */\n  static forChild(): ModuleWithProviders<MedHassoAuthModule> {\n    return {\n      ngModule: MedHassoAuthModule,\n      providers: []\n    };\n  }\n\n  /**\n   * Provide MedHasso authentication with standalone components\n   */\n  static forStandalone(config: MedHassoConfig): Provider[] {\n    return [\n      {\n        provide: MEDHASSO_CONFIG,\n        useValue: this.mergeWithDefaults(config)\n      },\n      TokenManagementService,\n      MedHassoAuthService,\n      {\n        provide: HTTP_INTERCEPTORS,\n        useClass: MedHassoAuthInterceptor,\n        multi: true\n      }\n    ];\n  }\n\n  /**\n   * Merge user configuration with sensible defaults\n   */\n  private static mergeWithDefaults(config: MedHassoConfig): MedHassoConfig {\n    const defaultConfig: Partial<MedHassoConfig> = {\n      tokenConfig: {\n        storageType: 'localStorage',\n        idTokenKey: 'idToken',\n        refreshTokenKey: 'refreshToken',\n        refreshBeforeExpiryMinutes: 5,\n        autoRefresh: true,\n        ...config.tokenConfig\n      },\n      interceptorConfig: {\n        enabled: true,\n        authHeaderPrefix: 'Bearer',\n        excludeUrls: [],\n        includeUrls: [],\n        ...config.interceptorConfig\n      },\n      securityConfig: {\n        httpsOnly: true,\n        secureCookies: true,\n        additionalCspSources: [],\n        ...config.securityConfig\n      }\n    };\n\n    return {\n      ...config,\n      ...defaultConfig,\n      tokenConfig: {\n        ...defaultConfig.tokenConfig,\n        ...config.tokenConfig\n      },\n      interceptorConfig: {\n        ...defaultConfig.interceptorConfig,\n        ...config.interceptorConfig\n      },\n      securityConfig: {\n        ...defaultConfig.securityConfig,\n        ...config.securityConfig\n      }\n    };\n  }\n}","import { Injectable } from '@angular/core';\nimport { ActivatedRouteSnapshot, CanActivate, CanActivateChild, Router, UrlTree } from '@angular/router';\nimport { Observable, of } from 'rxjs';\nimport { map, catchError } from 'rxjs/operators';\nimport { TokenManagementService } from '../services/token-management.service';\n\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoAuthGuard implements CanActivate, CanActivateChild {\n\n  constructor(\n    private tokenService: TokenManagementService,\n    private router: Router\n  ) {}\n\n  canActivate(route: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkAuthentication(route);\n  }\n\n  canActivateChild(childRoute: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkAuthentication(childRoute);\n  }\n\n  private checkAuthentication(route: ActivatedRouteSnapshot): Observable<boolean | UrlTree> {\n    // Check for authentication callback parameters\n    if (this.handleAuthCallback(route)) {\n      return of(true);\n    }\n\n    // Check if user is already authenticated\n    if (this.tokenService.isAuthenticated()) {\n      return this.refreshTokenIfNeeded().pipe(\n        map(() => true),\n        catchError(() => {\n          this.tokenService.redirectToSSO();\n          return of(false);\n        })\n      );\n    }\n\n    // Not authenticated, redirect to SSO\n    this.tokenService.redirectToSSO();\n    return of(false);\n  }\n\n  /**\n   * Handle authentication callback from MedHasso SSO\n   */\n  private handleAuthCallback(route: ActivatedRouteSnapshot): boolean {\n    const queryParams = route.queryParams;\n    \n    // Check for AIRO redirect flow\n    if (queryParams['redirectapp'] === 'airo' && queryParams['idToken']) {\n      return this.tokenService.handleAuthCallback({\n        idToken: queryParams['idToken'],\n        refreshToken: queryParams['refreshToken']\n      });\n    }\n\n    // Check for standard authentication callback\n    if (queryParams['idToken'] || queryParams['token']) {\n      return this.tokenService.handleAuthCallback({\n        idToken: queryParams['idToken'] || queryParams['token'],\n        refreshToken: queryParams['refreshToken']\n      });\n    }\n\n    return false;\n  }\n\n  /**\n   * Refresh token if needed\n   */\n  private refreshTokenIfNeeded(): Observable<any> {\n    const tokenInfo = this.tokenService.getTokenInfo();\n    \n    if (tokenInfo?.needsRefresh) {\n      return this.tokenService.refreshToken();\n    }\n\n    return of(null);\n  }\n}\n\n/**\n * Role-based authentication guard\n */\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoRoleGuard implements CanActivate, CanActivateChild {\n\n  constructor(\n    private tokenService: TokenManagementService,\n    private router: Router\n  ) {}\n\n  canActivate(route: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkRole(route);\n  }\n\n  canActivateChild(childRoute: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkRole(childRoute);\n  }\n\n  private checkRole(route: ActivatedRouteSnapshot): boolean | UrlTree {\n    const requiredRoles = route.data['roles'] as string[];\n    const requiredRole = route.data['role'] as string;\n\n    if (!this.tokenService.isAuthenticated()) {\n      this.tokenService.redirectToSSO();\n      return false;\n    }\n\n    // Check multiple roles (OR condition)\n    if (requiredRoles && requiredRoles.length > 0) {\n      const hasAnyRole = requiredRoles.some(role => this.tokenService.hasRole(role));\n      if (!hasAnyRole) {\n        return this.router.createUrlTree(['/unauthorized']);\n      }\n    }\n\n    // Check single role\n    if (requiredRole && !this.tokenService.hasRole(requiredRole)) {\n      return this.router.createUrlTree(['/unauthorized']);\n    }\n\n    return true;\n  }\n}\n\n/**\n * Admin-only authentication guard\n */\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoAdminGuard implements CanActivate, CanActivateChild {\n\n  constructor(\n    private tokenService: TokenManagementService,\n    private router: Router\n  ) {}\n\n  canActivate(): boolean | UrlTree {\n    return this.checkAdmin();\n  }\n\n  canActivateChild(): boolean | UrlTree {\n    return this.checkAdmin();\n  }\n\n  private checkAdmin(): boolean | UrlTree {\n    if (!this.tokenService.isAuthenticated()) {\n      this.tokenService.redirectToSSO();\n      return false;\n    }\n\n    if (!this.tokenService.isAdmin()) {\n      return this.router.createUrlTree(['/unauthorized']);\n    }\n\n    return true;\n  }\n}","/*\n * Public API Surface of medhasso-auth\n */\n\n// Module\nexport * from './lib/medhasso-auth.module';\n\n// Services\nexport * from './lib/services/token-management.service';\nexport * from './lib/services/medhasso-auth.service';\n\n// Guards\nexport * from './lib/guards/medhasso-auth.guard';\n\n// Interceptors\nexport * from './lib/interceptors/medhasso-auth.interceptor';\n\n// Interfaces\nexport * from './lib/interfaces/medhasso-config.interface';\n\n// Tokens\nexport * from './lib/tokens/medhasso-config.token';","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":["i1.TokenManagementService","i2"],"mappings":";;;;;;;;MAGa,eAAe,GAAG,IAAI,cAAc,CAAiB,iBAAiB;;MCOtE,sBAAsB,CAAA;AAQjC,IAAA,IAAY,WAAW,GAAA;AACrB,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE;;AAGtC,IAAA,IAAY,WAAW,GAAA;AACrB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,IAAI,cAAc;;AAGvD,IAAA,IAAY,UAAU,GAAA;AACpB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,SAAS;;AAGjD,IAAA,IAAY,eAAe,GAAA;AACzB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,IAAI,cAAc;;AAG3D,IAAA,IAAY,0BAA0B,GAAA;AACpC,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,0BAA0B,IAAI,CAAC;;AAGzD,IAAA,IAAY,WAAW,GAAA;AACrB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,KAAK,KAAK;;IAG/C,WACmC,CAAA,MAAsB,EAC/C,IAAgB,EAAA;QADS,IAAM,CAAA,MAAA,GAAN,MAAM;QAC/B,IAAI,CAAA,IAAA,GAAJ,IAAI;AAhCN,QAAA,IAAA,CAAA,YAAY,GAAG,IAAI,eAAe,CAAmB,IAAI,CAAC;AAC1D,QAAA,IAAA,CAAA,WAAW,GAAG,IAAI,eAAe,CAAsB,IAAI,CAAC;AAE7D,QAAA,IAAA,CAAA,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;AACzC,QAAA,IAAA,CAAA,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE;QA8B5C,IAAI,CAAC,qBAAqB,EAAE;;AAG9B;;AAEG;IACK,qBAAqB,GAAA;AAC3B,QAAA,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE;QACnC,IAAI,KAAK,EAAE;YACT,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,YAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;AACjC,YAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAEvD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;AAC5C,gBAAA,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;;;;AAK7C;;AAEG;IACK,cAAc,GAAA;AACpB,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;QACnF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;;AAGzC;;AAEG;IACK,qBAAqB,GAAA;AAC3B,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;QACnF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;;AAG9C;;AAEG;IACK,WAAW,CAAC,OAAe,EAAE,YAAqB,EAAA;AACxD,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;QACnF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;QACzC,IAAI,YAAY,EAAE;YAChB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;;;AAIvD;;AAEG;IACK,iBAAiB,GAAA;AACvB,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;AACnF,QAAA,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,QAAA,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC;;AAG1C;;AAEG;AACK,IAAA,eAAe,CAAC,KAAa,EAAA;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;AACrC,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACtB,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,GAAG,EAAE,GAAG,IAAI;QAEjE,OAAO;YACL,KAAK;YACL,OAAO;YACP,SAAS;YACT,SAAS,EAAE,GAAG,IAAI,SAAS;AAC3B,YAAA,YAAY,EAAE,GAAG,KAAK,SAAS,GAAG,aAAa;SAChD;;AAGH;;AAEG;AACK,IAAA,SAAS,CAAC,KAAa,EAAA;AAC7B,QAAA,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9B,YAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,gBAAA,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC;;AAE7C,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAChF,YAAA,OAAO,OAAO;;QACd,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC;AACjD,YAAA,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;;;AAIxC;;AAEG;AACK,IAAA,oBAAoB,CAAC,KAAa,EAAA;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACrC,OAAO;AACL,YAAA,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;AAClB,YAAA,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;AAC1B,YAAA,GAAG;SACJ;;AAGH;;AAEG;AACK,IAAA,uBAAuB,CAAC,SAAoB,EAAA;QAClD,IAAI,CAAC,yBAAyB,EAAE;QAEhC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,SAAS,EAAE;YAC5C;;QAGF,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;AACtD,QAAA,MAAM,WAAW,GAAG,aAAa,IAAI,IAAI,CAAC,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjF,QAAA,IAAI,WAAW,GAAG,CAAC,EAAE;YACnB,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,MAAK;AAC5D,gBAAA,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE;AACjC,aAAC,CAAC;;aACG;;AAEL,YAAA,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE;;;AAInC;;AAEG;IACK,yBAAyB,GAAA;AAC/B,QAAA,IAAI,IAAI,CAAC,oBAAoB,EAAE;AAC7B,YAAA,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE;AACvC,YAAA,IAAI,CAAC,oBAAoB,GAAG,IAAI;;;AAIpC;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK;;AAGhC;;AAEG;IACH,cAAc,GAAA;AACZ,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK;;AAG/B;;AAEG;IACH,eAAe,GAAA;AACb,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE;QACrC,OAAO,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS;;AAGnD;;AAEG;AACH,IAAA,OAAO,CAAC,IAAY,EAAA;AAClB,QAAA,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE;QAClC,OAAO,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK;;AAG7C;;AAEG;IACH,OAAO,GAAA;AACL,QAAA,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;;AAG/D;;AAEG;IACH,SAAS,CAAC,OAAe,EAAE,YAAqB,EAAA;AAC9C,QAAA,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;AAE/C,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;AACjC,QAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;AAE3B,QAAA,IAAI,IAAI,CAAC,WAAW,EAAE;AACpB,YAAA,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;;;AAI3C;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,EAAE;QAEjD,IAAI,CAAC,YAAY,EAAE;YACjB,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;;AAGlE,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAG,EAAA,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA,kBAAA,CAAoB,EAAE,EAAE,YAAY,EAAE;AAClF,aAAA,IAAI,CACH,GAAG,CAAC,CAAC,QAAa,KAAI;AACpB,YAAA,IAAI,QAAQ,CAAC,QAAQ,EAAE;gBACrB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC;;AAE7D,SAAC,CAAC,EACF,UAAU,CAAC,KAAK,IAAG;AACjB,YAAA,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC;YAC7C,IAAI,CAAC,MAAM,EAAE;AACb,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;SAC/B,CAAC,CACH;;AAGL;;AAEG;IACH,MAAM,GAAA;QACJ,IAAI,CAAC,yBAAyB,EAAE;QAChC,IAAI,CAAC,iBAAiB,EAAE;AACxB,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;AAC5B,QAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;;AAG7B;;AAEG;AACH,IAAA,aAAa,CAAC,SAAkB,EAAA;QAC9B,MAAM,UAAU,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;QACpD,MAAM,MAAM,GAAG,CAAG,EAAA,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA,KAAA,EAAQ,kBAAkB,CAAC,UAAU,CAAC,CAAA,iBAAA,EAAoB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA,CAAE;AAC/I,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM;;AAG/B;;AAEG;AACH,IAAA,kBAAkB,CAAC,MAAmD,EAAA;AACpE,QAAA,IAAI,MAAM,CAAC,OAAO,EAAE;YAClB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACnD,YAAA,OAAO,IAAI;;AAEb,QAAA,OAAO,KAAK;;AAGd;;AAEG;IACH,sBAAsB,GAAA;AACpB,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE;AACrC,QAAA,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,IAAI,QAAQ;AAC1E,YAAA,OAAO,GAAG,MAAM,CAAA,CAAA,EAAI,SAAS,CAAC,KAAK,EAAE;;AAEvC,QAAA,OAAO,IAAI;;AAGb;;AAEG;IACH,WAAW,GAAA;QACT,IAAI,CAAC,yBAAyB,EAAE;;AAxSvB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,sBAAsB,kBAiCvB,eAAe,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,UAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAjCd,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,sBAAsB,cAFrB,MAAM,EAAA,CAAA,CAAA;;4FAEP,sBAAsB,EAAA,UAAA,EAAA,CAAA;kBAHlC,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;0BAkCI,MAAM;2BAAC,eAAe;;;MClCd,uBAAuB,CAAA;IAElC,WACmC,CAAA,MAAsB,EAC/C,YAAoC,EAAA;QADX,IAAM,CAAA,MAAA,GAAN,MAAM;QAC/B,IAAY,CAAA,YAAA,GAAZ,YAAY;;IAGtB,SAAS,CAAC,OAAyB,EAAE,IAAiB,EAAA;;QAEpD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,KAAK,KAAK,EAAE;AACpD,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;;;AAI7B,QAAA,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE;AACtC,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;;;QAI7B,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE;AACvC,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;;;QAI7B,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;AAE5D,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CACtC,UAAU,CAAC,CAAC,KAAwB,KAAI;;AAEtC,YAAA,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE;gBACxB,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;;;AAI3C,YAAA,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE;AACxB,gBAAA,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,KAAK,CAAC;;AAG9D,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;SAC/B,CAAC,CACH;;AAGH;;AAEG;AACK,IAAA,oBAAoB,CAAC,OAAyB,EAAA;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,IAAI,EAAE;AACpE,QAAA,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;AAGnE;;;AAGG;AACK,IAAA,oBAAoB,CAAC,OAAyB,EAAA;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW;;QAG9D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AAC5C,YAAA,OAAO,IAAI;;;AAIb,QAAA,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;AAGnE;;AAEG;IACK,UAAU,CAAC,UAAkB,EAAE,OAAe,EAAA;;AAEpD,QAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AACzB,YAAA,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtD,YAAA,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;;AAG/B,QAAA,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;;AAGrC;;AAEG;AACK,IAAA,sBAAsB,CAAC,OAAyB,EAAA;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE;QAE7D,IAAI,CAAC,UAAU,EAAE;AACf,YAAA,OAAO,OAAO;;QAGhB,OAAO,OAAO,CAAC,KAAK,CAAC;AACnB,YAAA,UAAU,EAAE;AACV,gBAAA,aAAa,EAAE;AAChB;AACF,SAAA,CAAC;;AAGJ;;AAEG;IACK,cAAc,CAAC,OAAyB,EAAE,IAAiB,EAAA;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;;AAGlD,QAAA,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE;YACrC,IAAI,CAAC,aAAa,EAAE;YACpB,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;;;AAI/D,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,CAC1C,SAAS,CAAC,MAAK;;YAEb,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;AACzD,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;AAClC,SAAC,CAAC,EACF,UAAU,CAAC,CAAC,YAAY,KAAI;;AAE1B,YAAA,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,YAAY,CAAC;YAClE,IAAI,CAAC,aAAa,EAAE;AACpB,YAAA,OAAO,UAAU,CAAC,MAAM,YAAY,CAAC;SACtC,CAAC,CACH;;AAGH;;AAEG;IACK,aAAa,GAAA;;QAEnB,UAAU,CAAC,MAAK;AACd,YAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;SAClC,EAAE,GAAG,CAAC;;AApIE,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,kBAGxB,eAAe,EAAA,EAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;mHAHd,uBAAuB,EAAA,CAAA,CAAA;;4FAAvB,uBAAuB,EAAA,UAAA,EAAA,CAAA;kBADnC;;0BAII,MAAM;2BAAC,eAAe;;;MCDd,mBAAmB,CAAA;AAE9B,IAAA,WAAA,CACmC,MAAsB,EAC/C,YAAoC,EACpC,IAAgB,EAAA;QAFS,IAAM,CAAA,MAAA,GAAN,MAAM;QAC/B,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAI,CAAA,IAAA,GAAJ,IAAI;;AAGd;;AAEG;IACH,eAAe,GAAA;AACb,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE;;AAG5C;;AAEG;IACH,cAAc,GAAA;AACZ,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE;;AAG3C;;AAEG;IACH,eAAe,GAAA;AACb,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK;;AAGhC;;AAEG;AACH,IAAA,OAAO,CAAC,IAAY,EAAA;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;;AAGxC;;AAEG;AACH,IAAA,UAAU,CAAC,KAAe,EAAA;AACxB,QAAA,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;;AAG5D;;AAEG;AACH,IAAA,WAAW,CAAC,KAAe,EAAA;AACzB,QAAA,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;;AAG7D;;AAEG;IACH,OAAO,GAAA;AACL,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;;AAGpC;;AAEG;AACH,IAAA,KAAK,CAAC,SAAkB,EAAA;AACtB,QAAA,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC;;AAG5C;;AAEG;IACH,MAAM,GAAA;AACJ,QAAA,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;;AAG5B;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;;AAGzC;;AAEG;IACH,WAAW,CAAC,SAAiB,EAAE,UAAmB,EAAA;QAChD,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE;QAC9C,IAAI,CAAC,GAAG,EAAE;AACR,YAAA,OAAO,EAAE,CAAC,IAAI,CAAC;;QAGjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA,EAAG,GAAG,CAAA,uBAAA,EAA0B,SAAS,CAAA,CAAE;AAC7D,aAAA,IAAI,CACH,UAAU,CAAC,KAAK,IAAG;AACjB,YAAA,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC;AAC5C,YAAA,OAAO,EAAE,CAAC,IAAI,CAAC;SAChB,CAAC,CACH;;AAGL;;AAEG;AACH,IAAA,YAAY,CAAC,UAAmB,EAAA;AAC9B,QAAA,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE;QAClC,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE;QAE9C,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;AACtB,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;;AAGlB,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAG,EAAA,GAAG,CAAkB,eAAA,EAAA,IAAI,CAAC,GAAG,EAAE;aACpD,IAAI,CACH,GAAG,CAAC,CAAC,QAAa,KAAK,CAAC,CAAC,QAAQ,CAAC,EAClC,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAC5B;;AAGL;;AAEG;IACK,aAAa,GAAA;;;AAGnB,QAAA,OAAO,IAAI;;AAGb;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;;AAGzC;;AAEG;IACH,SAAS,GAAA;AACP,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM;;AAGjC;;AAEG;AACH,IAAA,kBAAkB,CAAC,MAAmD,EAAA;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CAAC;;AAGrD;;AAEG;IACH,YAAY,GAAA;QACV,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,IAAI;;AAG3C;;AAEG;IACH,kBAAkB,GAAA;QAChB,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI,IAAI;;AAG5C;;AAEG;IACH,YAAY,GAAA;QACV,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,IAAI,EAAE;;AAG3C;;AAEG;IACH,sBAAsB,GAAA;AACpB,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE;;AAzKxC,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,mBAAmB,kBAGpB,eAAe,EAAA,EAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAAC,EAAA,CAAA,UAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAHd,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,mBAAmB,cAFlB,MAAM,EAAA,CAAA,CAAA;;4FAEP,mBAAmB,EAAA,UAAA,EAAA,CAAA;kBAH/B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;0BAII,MAAM;2BAAC,eAAe;;;MCDd,kBAAkB,CAAA;AAE7B;;AAEG;IACH,OAAO,OAAO,CAAC,MAAsB,EAAA;QACnC,OAAO;AACL,YAAA,QAAQ,EAAE,kBAAkB;AAC5B,YAAA,SAAS,EAAE;AACT,gBAAA;AACE,oBAAA,OAAO,EAAE,eAAe;AACxB,oBAAA,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM;AACxC,iBAAA;gBACD,sBAAsB;gBACtB,mBAAmB;AACnB,gBAAA;AACE,oBAAA,OAAO,EAAE,iBAAiB;AAC1B,oBAAA,QAAQ,EAAE,uBAAuB;AACjC,oBAAA,KAAK,EAAE;AACR;AACF;SACF;;AAGH;;AAEG;AACH,IAAA,OAAO,QAAQ,GAAA;QACb,OAAO;AACL,YAAA,QAAQ,EAAE,kBAAkB;AAC5B,YAAA,SAAS,EAAE;SACZ;;AAGH;;AAEG;IACH,OAAO,aAAa,CAAC,MAAsB,EAAA;QACzC,OAAO;AACL,YAAA;AACE,gBAAA,OAAO,EAAE,eAAe;AACxB,gBAAA,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM;AACxC,aAAA;YACD,sBAAsB;YACtB,mBAAmB;AACnB,YAAA;AACE,gBAAA,OAAO,EAAE,iBAAiB;AAC1B,gBAAA,QAAQ,EAAE,uBAAuB;AACjC,gBAAA,KAAK,EAAE;AACR;SACF;;AAGH;;AAEG;IACK,OAAO,iBAAiB,CAAC,MAAsB,EAAA;AACrD,QAAA,MAAM,aAAa,GAA4B;AAC7C,YAAA,WAAW,EAAE;AACX,gBAAA,WAAW,EAAE,cAAc;AAC3B,gBAAA,UAAU,EAAE,SAAS;AACrB,gBAAA,eAAe,EAAE,cAAc;AAC/B,gBAAA,0BAA0B,EAAE,CAAC;AAC7B,gBAAA,WAAW,EAAE,IAAI;gBACjB,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,iBAAiB,EAAE;AACjB,gBAAA,OAAO,EAAE,IAAI;AACb,gBAAA,gBAAgB,EAAE,QAAQ;AAC1B,gBAAA,WAAW,EAAE,EAAE;AACf,gBAAA,WAAW,EAAE,EAAE;gBACf,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,cAAc,EAAE;AACd,gBAAA,SAAS,EAAE,IAAI;AACf,gBAAA,aAAa,EAAE,IAAI;AACnB,gBAAA,oBAAoB,EAAE,EAAE;gBACxB,GAAG,MAAM,CAAC;AACX;SACF;QAED,OAAO;AACL,YAAA,GAAG,MAAM;AACT,YAAA,GAAG,aAAa;AAChB,YAAA,WAAW,EAAE;gBACX,GAAG,aAAa,CAAC,WAAW;gBAC5B,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,iBAAiB,EAAE;gBACjB,GAAG,aAAa,CAAC,iBAAiB;gBAClC,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,cAAc,EAAE;gBACd,GAAG,aAAa,CAAC,cAAc;gBAC/B,GAAG,MAAM,CAAC;AACX;SACF;;+GAhGQ,kBAAkB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,QAAA,EAAA,CAAA,CAAA;gHAAlB,kBAAkB,EAAA,CAAA,CAAA;gHAAlB,kBAAkB,EAAA,CAAA,CAAA;;4FAAlB,kBAAkB,EAAA,UAAA,EAAA,CAAA;kBAL9B,QAAQ;AAAC,YAAA,IAAA,EAAA,CAAA;AACR,oBAAA,YAAY,EAAE,EAAE;AAChB,oBAAA,OAAO,EAAE,EAAE;AACX,oBAAA,OAAO,EAAE;AACV,iBAAA;;;MCHY,iBAAiB,CAAA;IAE5B,WACU,CAAA,YAAoC,EACpC,MAAc,EAAA;QADd,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAM,CAAA,MAAA,GAAN,MAAM;;AAGhB,IAAA,WAAW,CAAC,KAA6B,EAAA;AACvC,QAAA,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;;AAGxC,IAAA,gBAAgB,CAAC,UAAkC,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC;;AAGrC,IAAA,mBAAmB,CAAC,KAA6B,EAAA;;AAEvD,QAAA,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE;AAClC,YAAA,OAAO,EAAE,CAAC,IAAI,CAAC;;;AAIjB,QAAA,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE;AACvC,YAAA,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC,IAAI,CACrC,GAAG,CAAC,MAAM,IAAI,CAAC,EACf,UAAU,CAAC,MAAK;AACd,gBAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,gBAAA,OAAO,EAAE,CAAC,KAAK,CAAC;aACjB,CAAC,CACH;;;AAIH,QAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,QAAA,OAAO,EAAE,CAAC,KAAK,CAAC;;AAGlB;;AAEG;AACK,IAAA,kBAAkB,CAAC,KAA6B,EAAA;AACtD,QAAA,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;;AAGrC,QAAA,IAAI,WAAW,CAAC,aAAa,CAAC,KAAK,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE;AACnE,YAAA,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC;AAC1C,gBAAA,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC;AAC/B,gBAAA,YAAY,EAAE,WAAW,CAAC,cAAc;AACzC,aAAA,CAAC;;;QAIJ,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE;AAClD,YAAA,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC;gBAC1C,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC;AACvD,gBAAA,YAAY,EAAE,WAAW,CAAC,cAAc;AACzC,aAAA,CAAC;;AAGJ,QAAA,OAAO,KAAK;;AAGd;;AAEG;IACK,oBAAoB,GAAA;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;AAElD,QAAA,IAAI,SAAS,EAAE,YAAY,EAAE;AAC3B,YAAA,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;;AAGzC,QAAA,OAAO,EAAE,CAAC,IAAI,CAAC;;+GAxEN,iBAAiB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAD,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,MAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAjB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,iBAAiB,cAFhB,MAAM,EAAA,CAAA,CAAA;;4FAEP,iBAAiB,EAAA,UAAA,EAAA,CAAA;kBAH7B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;AA6ED;;AAEG;MAIU,iBAAiB,CAAA;IAE5B,WACU,CAAA,YAAoC,EACpC,MAAc,EAAA;QADd,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAM,CAAA,MAAA,GAAN,MAAM;;AAGhB,IAAA,WAAW,CAAC,KAA6B,EAAA;AACvC,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;AAG9B,IAAA,gBAAgB,CAAC,UAAkC,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;AAG3B,IAAA,SAAS,CAAC,KAA6B,EAAA;QAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAa;QACrD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAW;QAEjD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE;AACxC,YAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,YAAA,OAAO,KAAK;;;QAId,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7C,YAAA,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9E,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC;;;;AAKvD,QAAA,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;YAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC;;AAGrD,QAAA,OAAO,IAAI;;+GArCF,iBAAiB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,MAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAjB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,iBAAiB,cAFhB,MAAM,EAAA,CAAA,CAAA;;4FAEP,iBAAiB,EAAA,UAAA,EAAA,CAAA;kBAH7B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;AA0CD;;AAEG;MAIU,kBAAkB,CAAA;IAE7B,WACU,CAAA,YAAoC,EACpC,MAAc,EAAA;QADd,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAM,CAAA,MAAA,GAAN,MAAM;;IAGhB,WAAW,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,UAAU,EAAE;;IAG1B,gBAAgB,GAAA;AACd,QAAA,OAAO,IAAI,CAAC,UAAU,EAAE;;IAGlB,UAAU,GAAA;QAChB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE;AACxC,YAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,YAAA,OAAO,KAAK;;QAGd,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC;;AAGrD,QAAA,OAAO,IAAI;;+GAzBF,kBAAkB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,MAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAlB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,kBAAkB,cAFjB,MAAM,EAAA,CAAA,CAAA;;4FAEP,kBAAkB,EAAA,UAAA,EAAA,CAAA;kBAH9B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;;ACzID;;AAEG;AAEH;;ACJA;;AAEG;;;;"}
+{"version":3,"file":"medha-analytics-medhasso-auth.mjs","sources":["../../../projects/medhasso-auth/src/lib/tokens/medhasso-config.token.ts","../../../projects/medhasso-auth/src/lib/services/token-management.service.ts","../../../projects/medhasso-auth/src/lib/interceptors/medhasso-auth.interceptor.ts","../../../projects/medhasso-auth/src/lib/services/medhasso-auth.service.ts","../../../projects/medhasso-auth/src/lib/medhasso-auth.module.ts","../../../projects/medhasso-auth/src/lib/guards/medhasso-auth.guard.ts","../../../projects/medhasso-auth/src/public-api.ts","../../../projects/medhasso-auth/src/medha-analytics-medhasso-auth.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\nimport { MedHassoConfig } from '../interfaces/medhasso-config.interface';\n\nexport const MEDHASSO_CONFIG = new InjectionToken<MedHassoConfig>('MEDHASSO_CONFIG');","import { Injectable, Inject } from '@angular/core';\nimport { HttpBackend, HttpClient } from '@angular/common/http';\nimport { BehaviorSubject, Observable, of, throwError, timer } from 'rxjs';\nimport { catchError, finalize, map, shareReplay, tap } from 'rxjs/operators';\nimport { MedHassoConfig, TokenConfig, TokenInfo, MedHassoUser } from '../interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from '../tokens/medhasso-config.token';\n\n@Injectable({\n  providedIn: 'root'\n})\nexport class TokenManagementService {\n  private refreshTokenInterval: any;\n  private refreshInProgress$: Observable<any> | null = null;\n  private tokenSubject = new BehaviorSubject<TokenInfo | null>(null);\n  private userSubject = new BehaviorSubject<MedHassoUser | null>(null);\n  /**\n   * Dedicated HttpClient wired directly to HttpBackend so the refresh POST\n   * bypasses the HTTP_INTERCEPTORS chain. Routing refresh through the normal\n   * http (which runs MedHassoAuthInterceptor) causes self-interception:\n   * interceptor → ensureValidToken → refreshToken → returns the in-flight\n   * refreshInProgress$ which is itself → deadlock, with finalize never firing\n   * so refreshInProgress$ stays pinned and every subsequent request hangs too.\n   */\n  private readonly refreshHttp: HttpClient;\n  private readonly onVisibilityChange = () => {\n    if (document.visibilityState === 'visible') {\n      this.ensureValidToken().subscribe();\n    }\n  };\n  private readonly onWindowFocus = () => {\n    this.ensureValidToken().subscribe();\n  };\n\n  public token$ = this.tokenSubject.asObservable();\n  public user$ = this.userSubject.asObservable();\n\n  private get tokenConfig(): TokenConfig {\n    return this.config.tokenConfig || {};\n  }\n\n  private get storageType(): 'localStorage' | 'sessionStorage' {\n    return this.tokenConfig.storageType || 'localStorage';\n  }\n\n  private get idTokenKey(): string {\n    return this.tokenConfig.idTokenKey || 'idToken';\n  }\n\n  private get refreshTokenKey(): string {\n    return this.tokenConfig.refreshTokenKey || 'refreshToken';\n  }\n\n  private get refreshBeforeExpiryMinutes(): number {\n    return this.tokenConfig.refreshBeforeExpiryMinutes || 5;\n  }\n\n  private get autoRefresh(): boolean {\n    return this.tokenConfig.autoRefresh !== false;\n  }\n\n  constructor(\n    @Inject(MEDHASSO_CONFIG) private config: MedHassoConfig,\n    private http: HttpClient,\n    httpBackend: HttpBackend\n  ) {\n    this.refreshHttp = new HttpClient(httpBackend);\n    this.initializeFromStorage();\n    this.setupWakeDetection();\n  }\n\n  /**\n   * Re-validate the token whenever the tab regains focus/visibility.\n   * The refresh timer is a JS timer and does not fire while the OS/browser\n   * was suspended (e.g. laptop sleep overnight), so it can't be relied on\n   * alone to catch a token that went stale while the app was inactive.\n   */\n  private setupWakeDetection(): void {\n    if (typeof document === 'undefined' || typeof window === 'undefined') {\n      return;\n    }\n\n    document.addEventListener('visibilitychange', this.onVisibilityChange);\n    window.addEventListener('focus', this.onWindowFocus);\n  }\n\n  /**\n   * Remove wake-detection listeners registered in setupWakeDetection().\n   */\n  private teardownWakeDetection(): void {\n    if (typeof document === 'undefined' || typeof window === 'undefined') {\n      return;\n    }\n\n    document.removeEventListener('visibilitychange', this.onVisibilityChange);\n    window.removeEventListener('focus', this.onWindowFocus);\n  }\n\n  /**\n   * Initialize token information from storage\n   */\n  private initializeFromStorage(): void {\n    const token = this.getStoredToken();\n    if (token) {\n      const tokenInfo = this.createTokenInfo(token);\n      this.tokenSubject.next(tokenInfo);\n      this.userSubject.next(this.extractUserFromToken(token));\n      \n      if (this.autoRefresh && !tokenInfo.isExpired) {\n        this.setTokenRefreshInterval(tokenInfo);\n      }\n    }\n  }\n\n  /**\n   * Re-sync in-memory token state from storage if it has drifted (e.g.\n   * something wrote tokens directly to storage without going through\n   * setTokens()). No-op when storage already matches memory.\n   */\n  private syncFromStorage(): void {\n    const storedToken = this.getStoredToken();\n    const currentToken = this.getTokenInfo()?.token ?? null;\n\n    if (storedToken === currentToken) {\n      return;\n    }\n\n    if (!storedToken) {\n      this.tokenSubject.next(null);\n      this.userSubject.next(null);\n      this.clearTokenRefreshInterval();\n      return;\n    }\n\n    const tokenInfo = this.createTokenInfo(storedToken);\n    this.tokenSubject.next(tokenInfo);\n    this.userSubject.next(this.extractUserFromToken(storedToken));\n\n    if (this.autoRefresh && !tokenInfo.isExpired) {\n      this.setTokenRefreshInterval(tokenInfo);\n    }\n  }\n\n  /**\n   * Get stored token from configured storage\n   */\n  private getStoredToken(): string | null {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    return storage.getItem(this.idTokenKey);\n  }\n\n  /**\n   * Get stored refresh token from configured storage\n   */\n  private getStoredRefreshToken(): string | null {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    return storage.getItem(this.refreshTokenKey);\n  }\n\n  /**\n   * Store tokens in configured storage\n   */\n  private storeTokens(idToken: string, refreshToken?: string): void {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    storage.setItem(this.idTokenKey, idToken);\n    if (refreshToken) {\n      storage.setItem(this.refreshTokenKey, refreshToken);\n    }\n  }\n\n  /**\n   * Clear stored tokens\n   */\n  private clearStoredTokens(): void {\n    const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;\n    storage.removeItem(this.idTokenKey);\n    storage.removeItem(this.refreshTokenKey);\n  }\n\n  /**\n   * Create token info object from JWT token.\n   *\n   * `isExpired` and `needsRefresh` are getters, not snapshotted booleans:\n   * the TokenInfo object may outlive wall-clock events that change its\n   * expiry status (e.g. OS/browser suspended overnight, laptop sleep).\n   * A snapshotted boolean captured at creation time would then lie — the\n   * wake handler would call ensureValidToken(), see `isExpired: false`\n   * from the pre-sleep snapshot, and skip the refresh. Reading these as\n   * getters means every access reflects the current clock.\n   */\n  private createTokenInfo(token: string): TokenInfo {\n    const payload = this.decodeJwt(token);\n    const expiresAt = payload.exp * 1000; // Convert to milliseconds\n    const refreshWindow = this.refreshBeforeExpiryMinutes * 60 * 1000;\n\n    return {\n      token,\n      payload,\n      expiresAt,\n      get isExpired() { return Date.now() >= expiresAt; },\n      get needsRefresh() { return Date.now() >= (expiresAt - refreshWindow); }\n    };\n  }\n\n  /**\n   * Decode JWT token payload\n   */\n  private decodeJwt(token: string): any {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        throw new Error('Invalid JWT token format');\n      }\n      const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));\n      return payload;\n    } catch (error) {\n      console.error('Error decoding JWT token:', error);\n      throw new Error('Invalid JWT token');\n    }\n  }\n\n  /**\n   * Extract user information from JWT token\n   */\n  private extractUserFromToken(token: string): MedHassoUser {\n    const payload = this.decodeJwt(token);\n    return {\n      upn: payload.upn || payload.email,\n      name: payload.name,\n      roles: payload.roles || [],\n      ...payload\n    };\n  }\n\n  /**\n   * Set up automatic token refresh interval\n   */\n  private setTokenRefreshInterval(tokenInfo: TokenInfo): void {\n    this.clearTokenRefreshInterval();\n\n    if (!this.autoRefresh || tokenInfo.isExpired) {\n      return;\n    }\n\n    const remainingTime = tokenInfo.expiresAt - Date.now();\n    const refreshTime = remainingTime - (this.refreshBeforeExpiryMinutes * 60 * 1000);\n\n    if (refreshTime > 0) {\n      this.refreshTokenInterval = timer(refreshTime).subscribe(() => {\n        this.refreshToken().subscribe();\n      });\n    } else {\n      // Token needs immediate refresh\n      this.refreshToken().subscribe();\n    }\n  }\n\n  /**\n   * Clear token refresh interval\n   */\n  private clearTokenRefreshInterval(): void {\n    if (this.refreshTokenInterval) {\n      this.refreshTokenInterval.unsubscribe();\n      this.refreshTokenInterval = null;\n    }\n  }\n\n  /**\n   * Get current token information\n   */\n  getTokenInfo(): TokenInfo | null {\n    return this.tokenSubject.value;\n  }\n\n  /**\n   * Get current user information\n   */\n  getCurrentUser(): MedHassoUser | null {\n    return this.userSubject.value;\n  }\n\n  /**\n   * Check if user is authenticated\n   */\n  isAuthenticated(): boolean {\n    const tokenInfo = this.getTokenInfo();\n    return tokenInfo !== null && !tokenInfo.isExpired;\n  }\n\n  /**\n   * Check if user has specific role\n   */\n  hasRole(role: string): boolean {\n    const user = this.getCurrentUser();\n    return user?.roles?.includes(role) || false;\n  }\n\n  /**\n   * Check if user is admin\n   */\n  isAdmin(): boolean {\n    return this.hasRole('admin') || this.hasRole('administrator');\n  }\n\n  /**\n   * Set tokens (typically called after successful authentication)\n   */\n  setTokens(idToken: string, refreshToken?: string): void {\n    this.storeTokens(idToken, refreshToken);\n    const tokenInfo = this.createTokenInfo(idToken);\n    const user = this.extractUserFromToken(idToken);\n\n    this.tokenSubject.next(tokenInfo);\n    this.userSubject.next(user);\n\n    if (this.autoRefresh) {\n      this.setTokenRefreshInterval(tokenInfo);\n    }\n  }\n\n  /**\n   * Refresh the current token.\n   * Concurrent callers (auto-refresh timer, wake detection, interceptor,\n   * route guard) share the same in-flight request instead of each firing\n   * their own POST to the refresh endpoint.\n   */\n  refreshToken(): Observable<any> {\n    if (this.refreshInProgress$) {\n      return this.refreshInProgress$;\n    }\n\n    const refreshToken = this.getStoredRefreshToken();\n\n    if (!refreshToken) {\n      return throwError(() => new Error('No refresh token available'));\n    }\n\n    const request$ = this.refreshHttp.post(`${this.config.refreshUrl}/api/refresh-token`, { refreshToken })\n      .pipe(\n        tap((response: any) => {\n          if (response.id_token) {\n            this.setTokens(response.id_token, response.refresh_token);\n          }\n        }),\n        catchError(error => {\n          console.error('Token refresh failed:', error);\n          // Only clear the session on a definitive auth failure from the refresh\n          // endpoint (dead/revoked/invalid refresh token). Transient failures —\n          // network blips, 5xx, timeouts — must NOT force a logout: the current\n          // id_token may still be valid for the rest of its lifetime, and the\n          // background-refresh path (ensureValidToken → needsRefresh) runs on\n          // every request within the 5-min window, so a single network hiccup\n          // would otherwise log the user out mid-session.\n          const status = error?.status;\n          if (status === 400 || status === 401) {\n            this.logout();\n          }\n          return throwError(() => error);\n        }),\n        finalize(() => {\n          this.refreshInProgress$ = null;\n        }),\n        shareReplay({ bufferSize: 1, refCount: false })\n      );\n\n    this.refreshInProgress$ = request$;\n    return request$;\n  }\n\n  /**\n   * Ensure the current token is valid, refreshing it first if it is\n   * expired. Resolves `false` if there is no token at all, or the token\n   * is expired and refreshing it failed (in both cases the caller should\n   * redirect to SSO).\n   *\n   * A token that merely `needsRefresh` (inside the refresh window, but\n   * not yet expired) is still good enough to use: the refresh for it is\n   * kicked off in the background so the *current* request/route isn't\n   * blocked or logged out by a transient refresh failure (network blip,\n   * refresh endpoint hiccup) while the existing token would have worked\n   * fine. Only an actually-expired token blocks the caller.\n   *\n   * Re-syncs from storage first: the in-memory token snapshot is only\n   * updated via setTokens()/logout(), so if something wrote directly to\n   * storage (e.g. the SSO callback flow) without going through this\n   * service, the in-memory copy would otherwise be stale until the next\n   * full page load re-runs initializeFromStorage().\n   *\n   * Anonymous/bootstrap endpoints that must be reachable before any token\n   * exists (e.g. the SSO callback's own token-exchange request) should be\n   * added to `interceptorConfig.excludeUrls` so they bypass this check\n   * entirely, rather than relying on this method to let them through.\n   */\n  ensureValidToken(): Observable<boolean> {\n    this.syncFromStorage();\n    const tokenInfo = this.getTokenInfo();\n\n    if (!tokenInfo) {\n      return of(false);\n    }\n\n    if (tokenInfo.isExpired) {\n      return this.refreshToken().pipe(\n        map(() => true),\n        catchError(() => of(false))\n      );\n    }\n\n    if (tokenInfo.needsRefresh) {\n      this.refreshToken().subscribe({ error: () => {} });\n    }\n\n    return of(true);\n  }\n\n  /**\n   * Logout user and clear all tokens\n   */\n  logout(): void {\n    this.clearTokenRefreshInterval();\n    this.clearStoredTokens();\n    this.tokenSubject.next(null);\n    this.userSubject.next(null);\n  }\n\n  /**\n   * Redirect to MedHasso SSO for authentication\n   */\n  redirectToSSO(returnUrl?: string): void {\n    const currentUrl = returnUrl || window.location.href;\n    const ssoUrl = `${this.config.ssoUrl}?url=${encodeURIComponent(currentUrl)}&applicationName=${encodeURIComponent(this.config.applicationName)}`;\n    window.location.href = ssoUrl;\n  }\n\n  /**\n   * Handle authentication callback (typically from SSO redirect)\n   */\n  handleAuthCallback(params: { idToken?: string; refreshToken?: string }): boolean {\n    if (params.idToken) {\n      this.setTokens(params.idToken, params.refreshToken);\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Get authorization header value\n   */\n  getAuthorizationHeader(): string | null {\n    const tokenInfo = this.getTokenInfo();\n    if (tokenInfo && !tokenInfo.isExpired) {\n      const prefix = this.config.interceptorConfig?.authHeaderPrefix || 'Bearer';\n      return `${prefix} ${tokenInfo.token}`;\n    }\n    return null;\n  }\n\n  /**\n   * Cleanup on service destruction\n   */\n  ngOnDestroy(): void {\n    this.clearTokenRefreshInterval();\n    this.teardownWakeDetection();\n  }\n}\n","import { Injectable, Inject } from '@angular/core';\nimport { HttpInterceptor, HttpRequest, HttpHandler, HttpEvent, HttpErrorResponse } from '@angular/common/http';\nimport { Observable, throwError } from 'rxjs';\nimport { catchError, switchMap } from 'rxjs/operators';\nimport { MedHassoConfig } from '../interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from '../tokens/medhasso-config.token';\nimport { TokenManagementService } from '../services/token-management.service';\n\n@Injectable()\nexport class MedHassoAuthInterceptor implements HttpInterceptor {\n\n  constructor(\n    @Inject(MEDHASSO_CONFIG) private config: MedHassoConfig,\n    private tokenService: TokenManagementService\n  ) {}\n\n  intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {\n    // Check if interceptor is enabled\n    if (this.config.interceptorConfig?.enabled === false) {\n      return next.handle(request);\n    }\n\n    // Check if request should be excluded\n    if (this.shouldExcludeRequest(request)) {\n      return next.handle(request);\n    }\n\n    // Check if request should be included (if includeUrls is specified)\n    if (!this.shouldIncludeRequest(request)) {\n      return next.handle(request);\n    }\n\n    // Proactively ensure the token is valid (refreshing first if it's\n    // expired or within the refresh window) before attaching the header.\n    // This avoids sending a guaranteed-401 request after the app has been\n    // idle/suspended long enough for the in-memory refresh timer to miss it.\n    return this.tokenService.ensureValidToken().pipe(\n      switchMap(valid => {\n        if (!valid) {\n          this.redirectToSSO();\n          return throwError(() => new Error('Authentication required'));\n        }\n\n        const modifiedRequest = this.addAuthorizationHeader(request);\n\n        return next.handle(modifiedRequest).pipe(\n          catchError((error: HttpErrorResponse) => {\n            // Handle 401 Unauthorized errors\n            if (error.status === 401) {\n              return this.handle401Error(request, next);\n            }\n\n            // Handle 403 Forbidden errors\n            if (error.status === 403) {\n              console.warn('MedHasso Auth: Access forbidden (403)', error);\n            }\n\n            return throwError(() => error);\n          })\n        );\n      })\n    );\n  }\n\n  /**\n   * Check if request URL should be excluded from authentication\n   */\n  private shouldExcludeRequest(request: HttpRequest<any>): boolean {\n    const excludeUrls = this.config.interceptorConfig?.excludeUrls || [];\n    return excludeUrls.some(url => this.matchesUrl(request.url, url));\n  }\n\n  /**\n   * Check if request URL should be included for authentication\n   * If includeUrls is not specified, all requests are included (unless excluded)\n   */\n  private shouldIncludeRequest(request: HttpRequest<any>): boolean {\n    const includeUrls = this.config.interceptorConfig?.includeUrls;\n    \n    // If no includeUrls specified, include all requests\n    if (!includeUrls || includeUrls.length === 0) {\n      return true;\n    }\n\n    // If includeUrls specified, only include matching requests\n    return includeUrls.some(url => this.matchesUrl(request.url, url));\n  }\n\n  /**\n   * Check if request URL matches the pattern\n   */\n  private matchesUrl(requestUrl: string, pattern: string): boolean {\n    // Support wildcards and exact matches\n    if (pattern.includes('*')) {\n      const regex = new RegExp(pattern.replace(/\\*/g, '.*'));\n      return regex.test(requestUrl);\n    }\n    \n    return requestUrl.includes(pattern);\n  }\n\n  /**\n   * Add authorization header to request\n   */\n  private addAuthorizationHeader(request: HttpRequest<any>): HttpRequest<any> {\n    const authHeader = this.tokenService.getAuthorizationHeader();\n    \n    if (!authHeader) {\n      return request;\n    }\n\n    return request.clone({\n      setHeaders: {\n        Authorization: authHeader\n      }\n    });\n  }\n\n  /**\n   * Handle 401 Unauthorized errors by attempting token refresh.\n   *\n   * Always tries the refresh path first, even when the in-memory token looks\n   * expired to our clock. The server already said \"unauthorized\" — whether our\n   * local isExpired check agrees doesn't change what we need to do next.\n   * Short-circuiting to SSO on `tokenInfo.isExpired` would bounce the user on\n   * mid-flight expirations and small client/server clock skews, cases where the\n   * refresh token is still perfectly valid and would have recovered. If the\n   * refresh really can't succeed (no refresh token in storage, dead refresh\n   * token → 400/401), refreshToken() throws and the catchError below redirects.\n   */\n  private handle401Error(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {\n    // catchError sits BEFORE switchMap on purpose: it must only catch failures\n    // from refreshToken(), not from the retried next.handle(retryRequest). If\n    // the refresh succeeds but the retry fails (403, 500, etc.), that error\n    // has nothing to do with authentication — redirecting to SSO would be\n    // wrong. Keep the SSO redirect scoped to the \"refresh really can't help\"\n    // case; let any retry error propagate normally to the component.\n    return this.tokenService.refreshToken().pipe(\n      catchError((refreshError) => {\n        console.error('MedHasso Auth: Token refresh failed', refreshError);\n        this.redirectToSSO();\n        return throwError(() => refreshError);\n      }),\n      switchMap(() => {\n        // Retry the original request with new token\n        const retryRequest = this.addAuthorizationHeader(request);\n        return next.handle(retryRequest);\n      })\n    );\n  }\n\n  /**\n   * Redirect to SSO for authentication\n   */\n  private redirectToSSO(): void {\n    // Add a small delay to prevent multiple redirects\n    setTimeout(() => {\n      this.tokenService.redirectToSSO();\n    }, 100);\n  }\n}","import { Injectable, Inject } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { Observable, of } from 'rxjs';\nimport { map, catchError } from 'rxjs/operators';\nimport { MedHassoConfig, MedHassoUser } from '../interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from '../tokens/medhasso-config.token';\nimport { TokenManagementService } from './token-management.service';\n\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoAuthService {\n\n  constructor(\n    @Inject(MEDHASSO_CONFIG) private config: MedHassoConfig,\n    private tokenService: TokenManagementService,\n    private http: HttpClient\n  ) {}\n\n  /**\n   * Get current authentication status\n   */\n  isAuthenticated(): boolean {\n    return this.tokenService.isAuthenticated();\n  }\n\n  /**\n   * Get current user information\n   */\n  getCurrentUser(): MedHassoUser | null {\n    return this.tokenService.getCurrentUser();\n  }\n\n  /**\n   * Get current user as observable\n   */\n  getCurrentUser$(): Observable<MedHassoUser | null> {\n    return this.tokenService.user$;\n  }\n\n  /**\n   * Check if user has specific role\n   */\n  hasRole(role: string): boolean {\n    return this.tokenService.hasRole(role);\n  }\n\n  /**\n   * Check if user has any of the specified roles\n   */\n  hasAnyRole(roles: string[]): boolean {\n    return roles.some(role => this.tokenService.hasRole(role));\n  }\n\n  /**\n   * Check if user has all of the specified roles\n   */\n  hasAllRoles(roles: string[]): boolean {\n    return roles.every(role => this.tokenService.hasRole(role));\n  }\n\n  /**\n   * Check if user is admin\n   */\n  isAdmin(): boolean {\n    return this.tokenService.isAdmin();\n  }\n\n  /**\n   * Login user (redirect to SSO)\n   */\n  login(returnUrl?: string): void {\n    this.tokenService.redirectToSSO(returnUrl);\n  }\n\n  /**\n   * Logout user\n   */\n  logout(): void {\n    this.tokenService.logout();\n  }\n\n  /**\n   * Refresh authentication token\n   */\n  refreshToken(): Observable<any> {\n    return this.tokenService.refreshToken();\n  }\n\n  /**\n   * Check access permissions for a simple key (if applicable)\n   */\n  checkAccess(simpleKey: string, backendUrl?: string): Observable<any> {\n    const url = backendUrl || this.getBackendUrl();\n    if (!url) {\n      return of(null);\n    }\n\n    return this.http.get(`${url}/auth/guard?simple_key=${simpleKey}`)\n      .pipe(\n        catchError(error => {\n          console.error('Access check failed:', error);\n          return of(null);\n        })\n      );\n  }\n\n  /**\n   * Check if user is admin via backend API (if applicable)\n   */\n  checkIsAdmin(backendUrl?: string): Observable<boolean> {\n    const user = this.getCurrentUser();\n    const url = backendUrl || this.getBackendUrl();\n    \n    if (!user?.upn || !url) {\n      return of(false);\n    }\n\n    return this.http.get(`${url}/isAdmin?email=${user.upn}`)\n      .pipe(\n        map((response: any) => !!response),\n        catchError(() => of(false))\n      );\n  }\n\n  /**\n   * Get backend URL from config (helper method)\n   */\n  private getBackendUrl(): string | null {\n    // This would need to be configured or passed in\n    // For now, return null as it's application-specific\n    return null;\n  }\n\n  /**\n   * Get token information\n   */\n  getTokenInfo() {\n    return this.tokenService.getTokenInfo();\n  }\n\n  /**\n   * Get token as observable\n   */\n  getToken$() {\n    return this.tokenService.token$;\n  }\n\n  /**\n   * Handle authentication callback\n   */\n  handleAuthCallback(params: { idToken?: string; refreshToken?: string }): boolean {\n    return this.tokenService.handleAuthCallback(params);\n  }\n\n  /**\n   * Get user email\n   */\n  getUserEmail(): string | null {\n    return this.getCurrentUser()?.upn || null;\n  }\n\n  /**\n   * Get user display name\n   */\n  getUserDisplayName(): string | null {\n    return this.getCurrentUser()?.name || null;\n  }\n\n  /**\n   * Get all user roles\n   */\n  getUserRoles(): string[] {\n    return this.getCurrentUser()?.roles || [];\n  }\n\n  /**\n   * Get authorization header value\n   */\n  getAuthorizationHeader(): string | null {\n    return this.tokenService.getAuthorizationHeader();\n  }\n}","import { NgModule, ModuleWithProviders, Provider } from '@angular/core';\nimport { HTTP_INTERCEPTORS } from '@angular/common/http';\nimport { MedHassoConfig } from './interfaces/medhasso-config.interface';\nimport { MEDHASSO_CONFIG } from './tokens/medhasso-config.token';\nimport { MedHassoAuthInterceptor } from './interceptors/medhasso-auth.interceptor';\nimport { TokenManagementService } from './services/token-management.service';\nimport { MedHassoAuthService } from './services/medhasso-auth.service';\n\n@NgModule({\n  declarations: [],\n  imports: [],\n  exports: []\n})\nexport class MedHassoAuthModule {\n  \n  /**\n   * Configure the MedHasso authentication module with required settings\n   */\n  static forRoot(config: MedHassoConfig): ModuleWithProviders<MedHassoAuthModule> {\n    return {\n      ngModule: MedHassoAuthModule,\n      providers: [\n        {\n          provide: MEDHASSO_CONFIG,\n          useValue: this.mergeWithDefaults(config)\n        },\n        TokenManagementService,\n        MedHassoAuthService,\n        {\n          provide: HTTP_INTERCEPTORS,\n          useClass: MedHassoAuthInterceptor,\n          multi: true\n        }\n      ]\n    };\n  }\n\n  /**\n   * Configure the MedHasso authentication module for feature modules\n   */\n  static forChild(): ModuleWithProviders<MedHassoAuthModule> {\n    return {\n      ngModule: MedHassoAuthModule,\n      providers: []\n    };\n  }\n\n  /**\n   * Provide MedHasso authentication with standalone components\n   */\n  static forStandalone(config: MedHassoConfig): Provider[] {\n    return [\n      {\n        provide: MEDHASSO_CONFIG,\n        useValue: this.mergeWithDefaults(config)\n      },\n      TokenManagementService,\n      MedHassoAuthService,\n      {\n        provide: HTTP_INTERCEPTORS,\n        useClass: MedHassoAuthInterceptor,\n        multi: true\n      }\n    ];\n  }\n\n  /**\n   * Merge user configuration with sensible defaults\n   */\n  private static mergeWithDefaults(config: MedHassoConfig): MedHassoConfig {\n    const defaultConfig: Partial<MedHassoConfig> = {\n      tokenConfig: {\n        storageType: 'localStorage',\n        idTokenKey: 'idToken',\n        refreshTokenKey: 'refreshToken',\n        refreshBeforeExpiryMinutes: 5,\n        autoRefresh: true,\n        ...config.tokenConfig\n      },\n      interceptorConfig: {\n        enabled: true,\n        authHeaderPrefix: 'Bearer',\n        excludeUrls: [],\n        includeUrls: [],\n        ...config.interceptorConfig\n      },\n      securityConfig: {\n        httpsOnly: true,\n        secureCookies: true,\n        additionalCspSources: [],\n        ...config.securityConfig\n      }\n    };\n\n    return {\n      ...config,\n      ...defaultConfig,\n      tokenConfig: {\n        ...defaultConfig.tokenConfig,\n        ...config.tokenConfig\n      },\n      interceptorConfig: {\n        ...defaultConfig.interceptorConfig,\n        ...config.interceptorConfig\n      },\n      securityConfig: {\n        ...defaultConfig.securityConfig,\n        ...config.securityConfig\n      }\n    };\n  }\n}","import { Injectable } from '@angular/core';\nimport { ActivatedRouteSnapshot, CanActivate, CanActivateChild, Router, UrlTree } from '@angular/router';\nimport { Observable, of } from 'rxjs';\nimport { map, catchError } from 'rxjs/operators';\nimport { TokenManagementService } from '../services/token-management.service';\n\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoAuthGuard implements CanActivate, CanActivateChild {\n\n  constructor(\n    private tokenService: TokenManagementService,\n    private router: Router\n  ) {}\n\n  canActivate(route: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkAuthentication(route);\n  }\n\n  canActivateChild(childRoute: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkAuthentication(childRoute);\n  }\n\n  private checkAuthentication(route: ActivatedRouteSnapshot): Observable<boolean | UrlTree> {\n    // Check for authentication callback parameters\n    if (this.handleAuthCallback(route)) {\n      return of(true);\n    }\n\n    // Re-syncs from storage and refreshes a stale/expired token before\n    // deciding, so this guard shares the same de-duplicated refresh and\n    // storage-drift handling as the HTTP interceptor.\n    return this.tokenService.ensureValidToken().pipe(\n      map(valid => {\n        if (!valid) {\n          this.tokenService.redirectToSSO();\n          return false;\n        }\n        return true;\n      }),\n      catchError(() => {\n        this.tokenService.redirectToSSO();\n        return of(false);\n      })\n    );\n  }\n\n  /**\n   * Handle authentication callback from MedHasso SSO\n   */\n  private handleAuthCallback(route: ActivatedRouteSnapshot): boolean {\n    const queryParams = route.queryParams;\n    \n    // Check for AIRO redirect flow\n    if (queryParams['redirectapp'] === 'airo' && queryParams['idToken']) {\n      return this.tokenService.handleAuthCallback({\n        idToken: queryParams['idToken'],\n        refreshToken: queryParams['refreshToken']\n      });\n    }\n\n    // Check for standard authentication callback\n    if (queryParams['idToken'] || queryParams['token']) {\n      return this.tokenService.handleAuthCallback({\n        idToken: queryParams['idToken'] || queryParams['token'],\n        refreshToken: queryParams['refreshToken']\n      });\n    }\n\n    return false;\n  }\n}\n\n/**\n * Role-based authentication guard\n */\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoRoleGuard implements CanActivate, CanActivateChild {\n\n  constructor(\n    private tokenService: TokenManagementService,\n    private router: Router\n  ) {}\n\n  canActivate(route: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkRole(route);\n  }\n\n  canActivateChild(childRoute: ActivatedRouteSnapshot): Observable<boolean | UrlTree> | Promise<boolean | UrlTree> | boolean | UrlTree {\n    return this.checkRole(childRoute);\n  }\n\n  private checkRole(route: ActivatedRouteSnapshot): boolean | UrlTree {\n    const requiredRoles = route.data['roles'] as string[];\n    const requiredRole = route.data['role'] as string;\n\n    if (!this.tokenService.isAuthenticated()) {\n      this.tokenService.redirectToSSO();\n      return false;\n    }\n\n    // Check multiple roles (OR condition)\n    if (requiredRoles && requiredRoles.length > 0) {\n      const hasAnyRole = requiredRoles.some(role => this.tokenService.hasRole(role));\n      if (!hasAnyRole) {\n        return this.router.createUrlTree(['/unauthorized']);\n      }\n    }\n\n    // Check single role\n    if (requiredRole && !this.tokenService.hasRole(requiredRole)) {\n      return this.router.createUrlTree(['/unauthorized']);\n    }\n\n    return true;\n  }\n}\n\n/**\n * Admin-only authentication guard\n */\n@Injectable({\n  providedIn: 'root'\n})\nexport class MedHassoAdminGuard implements CanActivate, CanActivateChild {\n\n  constructor(\n    private tokenService: TokenManagementService,\n    private router: Router\n  ) {}\n\n  canActivate(): boolean | UrlTree {\n    return this.checkAdmin();\n  }\n\n  canActivateChild(): boolean | UrlTree {\n    return this.checkAdmin();\n  }\n\n  private checkAdmin(): boolean | UrlTree {\n    if (!this.tokenService.isAuthenticated()) {\n      this.tokenService.redirectToSSO();\n      return false;\n    }\n\n    if (!this.tokenService.isAdmin()) {\n      return this.router.createUrlTree(['/unauthorized']);\n    }\n\n    return true;\n  }\n}","/*\n * Public API Surface of medhasso-auth\n */\n\n// Module\nexport * from './lib/medhasso-auth.module';\n\n// Services\nexport * from './lib/services/token-management.service';\nexport * from './lib/services/medhasso-auth.service';\n\n// Guards\nexport * from './lib/guards/medhasso-auth.guard';\n\n// Interceptors\nexport * from './lib/interceptors/medhasso-auth.interceptor';\n\n// Interfaces\nexport * from './lib/interfaces/medhasso-config.interface';\n\n// Tokens\nexport * from './lib/tokens/medhasso-config.token';","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":["i1.TokenManagementService","i2"],"mappings":";;;;;;;;MAGa,eAAe,GAAG,IAAI,cAAc,CAAiB,iBAAiB;;MCOtE,sBAAsB,CAAA;AA0BjC,IAAA,IAAY,WAAW,GAAA;AACrB,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE;;AAGtC,IAAA,IAAY,WAAW,GAAA;AACrB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,IAAI,cAAc;;AAGvD,IAAA,IAAY,UAAU,GAAA;AACpB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,SAAS;;AAGjD,IAAA,IAAY,eAAe,GAAA;AACzB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,IAAI,cAAc;;AAG3D,IAAA,IAAY,0BAA0B,GAAA;AACpC,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,0BAA0B,IAAI,CAAC;;AAGzD,IAAA,IAAY,WAAW,GAAA;AACrB,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,KAAK,KAAK;;AAG/C,IAAA,WAAA,CACmC,MAAsB,EAC/C,IAAgB,EACxB,WAAwB,EAAA;QAFS,IAAM,CAAA,MAAA,GAAN,MAAM;QAC/B,IAAI,CAAA,IAAA,GAAJ,IAAI;QAlDN,IAAkB,CAAA,kBAAA,GAA2B,IAAI;AACjD,QAAA,IAAA,CAAA,YAAY,GAAG,IAAI,eAAe,CAAmB,IAAI,CAAC;AAC1D,QAAA,IAAA,CAAA,WAAW,GAAG,IAAI,eAAe,CAAsB,IAAI,CAAC;QAUnD,IAAkB,CAAA,kBAAA,GAAG,MAAK;AACzC,YAAA,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE;AAC1C,gBAAA,IAAI,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE;;AAEvC,SAAC;QACgB,IAAa,CAAA,aAAA,GAAG,MAAK;AACpC,YAAA,IAAI,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE;AACrC,SAAC;AAEM,QAAA,IAAA,CAAA,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;AACzC,QAAA,IAAA,CAAA,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE;QA+B5C,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,qBAAqB,EAAE;QAC5B,IAAI,CAAC,kBAAkB,EAAE;;AAG3B;;;;;AAKG;IACK,kBAAkB,GAAA;QACxB,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;YACpE;;QAGF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC;QACtE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;;AAGtD;;AAEG;IACK,qBAAqB,GAAA;QAC3B,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;YACpE;;QAGF,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC;QACzE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;;AAGzD;;AAEG;IACK,qBAAqB,GAAA;AAC3B,QAAA,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE;QACnC,IAAI,KAAK,EAAE;YACT,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7C,YAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;AACjC,YAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAEvD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;AAC5C,gBAAA,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;;;;AAK7C;;;;AAIG;IACK,eAAe,GAAA;AACrB,QAAA,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,IAAI,IAAI;AAEvD,QAAA,IAAI,WAAW,KAAK,YAAY,EAAE;YAChC;;QAGF,IAAI,CAAC,WAAW,EAAE;AAChB,YAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;AAC5B,YAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,IAAI,CAAC,yBAAyB,EAAE;YAChC;;QAGF,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;AACnD,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;AACjC,QAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;AAC5C,YAAA,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;;;AAI3C;;AAEG;IACK,cAAc,GAAA;AACpB,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;QACnF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;;AAGzC;;AAEG;IACK,qBAAqB,GAAA;AAC3B,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;QACnF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;;AAG9C;;AAEG;IACK,WAAW,CAAC,OAAe,EAAE,YAAqB,EAAA;AACxD,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;QACnF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;QACzC,IAAI,YAAY,EAAE;YAChB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;;;AAIvD;;AAEG;IACK,iBAAiB,GAAA;AACvB,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,cAAc,GAAG,YAAY,GAAG,cAAc;AACnF,QAAA,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,QAAA,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC;;AAG1C;;;;;;;;;;AAUG;AACK,IAAA,eAAe,CAAC,KAAa,EAAA;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;QACrC,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,GAAG,EAAE,GAAG,IAAI;QAEjE,OAAO;YACL,KAAK;YACL,OAAO;YACP,SAAS;YACT,IAAI,SAAS,GAAK,EAAA,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE;AACnD,YAAA,IAAI,YAAY,GAAA,EAAK,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,SAAS,GAAG,aAAa,CAAC,CAAC;SACvE;;AAGH;;AAEG;AACK,IAAA,SAAS,CAAC,KAAa,EAAA;AAC7B,QAAA,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9B,YAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,gBAAA,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC;;AAE7C,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAChF,YAAA,OAAO,OAAO;;QACd,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC;AACjD,YAAA,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;;;AAIxC;;AAEG;AACK,IAAA,oBAAoB,CAAC,KAAa,EAAA;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACrC,OAAO;AACL,YAAA,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;AAClB,YAAA,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;AAC1B,YAAA,GAAG;SACJ;;AAGH;;AAEG;AACK,IAAA,uBAAuB,CAAC,SAAoB,EAAA;QAClD,IAAI,CAAC,yBAAyB,EAAE;QAEhC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,SAAS,EAAE;YAC5C;;QAGF,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;AACtD,QAAA,MAAM,WAAW,GAAG,aAAa,IAAI,IAAI,CAAC,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjF,QAAA,IAAI,WAAW,GAAG,CAAC,EAAE;YACnB,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,MAAK;AAC5D,gBAAA,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE;AACjC,aAAC,CAAC;;aACG;;AAEL,YAAA,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE;;;AAInC;;AAEG;IACK,yBAAyB,GAAA;AAC/B,QAAA,IAAI,IAAI,CAAC,oBAAoB,EAAE;AAC7B,YAAA,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE;AACvC,YAAA,IAAI,CAAC,oBAAoB,GAAG,IAAI;;;AAIpC;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK;;AAGhC;;AAEG;IACH,cAAc,GAAA;AACZ,QAAA,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK;;AAG/B;;AAEG;IACH,eAAe,GAAA;AACb,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE;QACrC,OAAO,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS;;AAGnD;;AAEG;AACH,IAAA,OAAO,CAAC,IAAY,EAAA;AAClB,QAAA,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE;QAClC,OAAO,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK;;AAG7C;;AAEG;IACH,OAAO,GAAA;AACL,QAAA,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;;AAG/D;;AAEG;IACH,SAAS,CAAC,OAAe,EAAE,YAAqB,EAAA;AAC9C,QAAA,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;AAE/C,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;AACjC,QAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;AAE3B,QAAA,IAAI,IAAI,CAAC,WAAW,EAAE;AACpB,YAAA,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;;;AAI3C;;;;;AAKG;IACH,YAAY,GAAA;AACV,QAAA,IAAI,IAAI,CAAC,kBAAkB,EAAE;YAC3B,OAAO,IAAI,CAAC,kBAAkB;;AAGhC,QAAA,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,EAAE;QAEjD,IAAI,CAAC,YAAY,EAAE;YACjB,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;;AAGlE,QAAA,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA,kBAAA,CAAoB,EAAE,EAAE,YAAY,EAAE;AACnG,aAAA,IAAI,CACH,GAAG,CAAC,CAAC,QAAa,KAAI;AACpB,YAAA,IAAI,QAAQ,CAAC,QAAQ,EAAE;gBACrB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC;;AAE7D,SAAC,CAAC,EACF,UAAU,CAAC,KAAK,IAAG;AACjB,YAAA,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC;;;;;;;;AAQ7C,YAAA,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM;YAC5B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE;gBACpC,IAAI,CAAC,MAAM,EAAE;;AAEf,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;AAChC,SAAC,CAAC,EACF,QAAQ,CAAC,MAAK;AACZ,YAAA,IAAI,CAAC,kBAAkB,GAAG,IAAI;AAChC,SAAC,CAAC,EACF,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAChD;AAEH,QAAA,IAAI,CAAC,kBAAkB,GAAG,QAAQ;AAClC,QAAA,OAAO,QAAQ;;AAGjB;;;;;;;;;;;;;;;;;;;;;;;AAuBG;IACH,gBAAgB,GAAA;QACd,IAAI,CAAC,eAAe,EAAE;AACtB,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE;QAErC,IAAI,CAAC,SAAS,EAAE;AACd,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;;AAGlB,QAAA,IAAI,SAAS,CAAC,SAAS,EAAE;YACvB,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAC7B,GAAG,CAAC,MAAM,IAAI,CAAC,EACf,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAC5B;;AAGH,QAAA,IAAI,SAAS,CAAC,YAAY,EAAE;AAC1B,YAAA,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAK,GAAG,EAAE,CAAC;;AAGpD,QAAA,OAAO,EAAE,CAAC,IAAI,CAAC;;AAGjB;;AAEG;IACH,MAAM,GAAA;QACJ,IAAI,CAAC,yBAAyB,EAAE;QAChC,IAAI,CAAC,iBAAiB,EAAE;AACxB,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;AAC5B,QAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;;AAG7B;;AAEG;AACH,IAAA,aAAa,CAAC,SAAkB,EAAA;QAC9B,MAAM,UAAU,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;QACpD,MAAM,MAAM,GAAG,CAAG,EAAA,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA,KAAA,EAAQ,kBAAkB,CAAC,UAAU,CAAC,CAAA,iBAAA,EAAoB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA,CAAE;AAC/I,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM;;AAG/B;;AAEG;AACH,IAAA,kBAAkB,CAAC,MAAmD,EAAA;AACpE,QAAA,IAAI,MAAM,CAAC,OAAO,EAAE;YAClB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACnD,YAAA,OAAO,IAAI;;AAEb,QAAA,OAAO,KAAK;;AAGd;;AAEG;IACH,sBAAsB,GAAA;AACpB,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE;AACrC,QAAA,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,IAAI,QAAQ;AAC1E,YAAA,OAAO,GAAG,MAAM,CAAA,CAAA,EAAI,SAAS,CAAC,KAAK,EAAE;;AAEvC,QAAA,OAAO,IAAI;;AAGb;;AAEG;IACH,WAAW,GAAA;QACT,IAAI,CAAC,yBAAyB,EAAE;QAChC,IAAI,CAAC,qBAAqB,EAAE;;AAncnB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,sBAAsB,kBAmDvB,eAAe,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,UAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,WAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAnDd,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,sBAAsB,cAFrB,MAAM,EAAA,CAAA,CAAA;;4FAEP,sBAAsB,EAAA,UAAA,EAAA,CAAA;kBAHlC,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;0BAoDI,MAAM;2BAAC,eAAe;;;MCpDd,uBAAuB,CAAA;IAElC,WACmC,CAAA,MAAsB,EAC/C,YAAoC,EAAA;QADX,IAAM,CAAA,MAAA,GAAN,MAAM;QAC/B,IAAY,CAAA,YAAA,GAAZ,YAAY;;IAGtB,SAAS,CAAC,OAAyB,EAAE,IAAiB,EAAA;;QAEpD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,KAAK,KAAK,EAAE;AACpD,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;;;AAI7B,QAAA,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE;AACtC,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;;;QAI7B,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE;AACvC,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;;;;;;AAO7B,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAC9C,SAAS,CAAC,KAAK,IAAG;YAChB,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,CAAC,aAAa,EAAE;gBACpB,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;;YAG/D,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;AAE5D,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CACtC,UAAU,CAAC,CAAC,KAAwB,KAAI;;AAEtC,gBAAA,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE;oBACxB,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;;;AAI3C,gBAAA,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE;AACxB,oBAAA,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,KAAK,CAAC;;AAG9D,gBAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;aAC/B,CAAC,CACH;SACF,CAAC,CACH;;AAGH;;AAEG;AACK,IAAA,oBAAoB,CAAC,OAAyB,EAAA;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,IAAI,EAAE;AACpE,QAAA,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;AAGnE;;;AAGG;AACK,IAAA,oBAAoB,CAAC,OAAyB,EAAA;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW;;QAG9D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AAC5C,YAAA,OAAO,IAAI;;;AAIb,QAAA,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;AAGnE;;AAEG;IACK,UAAU,CAAC,UAAkB,EAAE,OAAe,EAAA;;AAEpD,QAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AACzB,YAAA,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtD,YAAA,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;;AAG/B,QAAA,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;;AAGrC;;AAEG;AACK,IAAA,sBAAsB,CAAC,OAAyB,EAAA;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE;QAE7D,IAAI,CAAC,UAAU,EAAE;AACf,YAAA,OAAO,OAAO;;QAGhB,OAAO,OAAO,CAAC,KAAK,CAAC;AACnB,YAAA,UAAU,EAAE;AACV,gBAAA,aAAa,EAAE;AAChB;AACF,SAAA,CAAC;;AAGJ;;;;;;;;;;;AAWG;IACK,cAAc,CAAC,OAAyB,EAAE,IAAiB,EAAA;;;;;;;AAOjE,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,CAC1C,UAAU,CAAC,CAAC,YAAY,KAAI;AAC1B,YAAA,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,YAAY,CAAC;YAClE,IAAI,CAAC,aAAa,EAAE;AACpB,YAAA,OAAO,UAAU,CAAC,MAAM,YAAY,CAAC;AACvC,SAAC,CAAC,EACF,SAAS,CAAC,MAAK;;YAEb,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;AACzD,YAAA,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACjC,CAAC,CACH;;AAGH;;AAEG;IACK,aAAa,GAAA;;QAEnB,UAAU,CAAC,MAAK;AACd,YAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;SAClC,EAAE,GAAG,CAAC;;AArJE,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,kBAGxB,eAAe,EAAA,EAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;mHAHd,uBAAuB,EAAA,CAAA,CAAA;;4FAAvB,uBAAuB,EAAA,UAAA,EAAA,CAAA;kBADnC;;0BAII,MAAM;2BAAC,eAAe;;;MCDd,mBAAmB,CAAA;AAE9B,IAAA,WAAA,CACmC,MAAsB,EAC/C,YAAoC,EACpC,IAAgB,EAAA;QAFS,IAAM,CAAA,MAAA,GAAN,MAAM;QAC/B,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAI,CAAA,IAAA,GAAJ,IAAI;;AAGd;;AAEG;IACH,eAAe,GAAA;AACb,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE;;AAG5C;;AAEG;IACH,cAAc,GAAA;AACZ,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE;;AAG3C;;AAEG;IACH,eAAe,GAAA;AACb,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK;;AAGhC;;AAEG;AACH,IAAA,OAAO,CAAC,IAAY,EAAA;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;;AAGxC;;AAEG;AACH,IAAA,UAAU,CAAC,KAAe,EAAA;AACxB,QAAA,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;;AAG5D;;AAEG;AACH,IAAA,WAAW,CAAC,KAAe,EAAA;AACzB,QAAA,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;;AAG7D;;AAEG;IACH,OAAO,GAAA;AACL,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;;AAGpC;;AAEG;AACH,IAAA,KAAK,CAAC,SAAkB,EAAA;AACtB,QAAA,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC;;AAG5C;;AAEG;IACH,MAAM,GAAA;AACJ,QAAA,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;;AAG5B;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;;AAGzC;;AAEG;IACH,WAAW,CAAC,SAAiB,EAAE,UAAmB,EAAA;QAChD,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE;QAC9C,IAAI,CAAC,GAAG,EAAE;AACR,YAAA,OAAO,EAAE,CAAC,IAAI,CAAC;;QAGjB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA,EAAG,GAAG,CAAA,uBAAA,EAA0B,SAAS,CAAA,CAAE;AAC7D,aAAA,IAAI,CACH,UAAU,CAAC,KAAK,IAAG;AACjB,YAAA,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC;AAC5C,YAAA,OAAO,EAAE,CAAC,IAAI,CAAC;SAChB,CAAC,CACH;;AAGL;;AAEG;AACH,IAAA,YAAY,CAAC,UAAmB,EAAA;AAC9B,QAAA,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE;QAClC,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE;QAE9C,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;AACtB,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;;AAGlB,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAG,EAAA,GAAG,CAAkB,eAAA,EAAA,IAAI,CAAC,GAAG,EAAE;aACpD,IAAI,CACH,GAAG,CAAC,CAAC,QAAa,KAAK,CAAC,CAAC,QAAQ,CAAC,EAClC,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAC5B;;AAGL;;AAEG;IACK,aAAa,GAAA;;;AAGnB,QAAA,OAAO,IAAI;;AAGb;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE;;AAGzC;;AAEG;IACH,SAAS,GAAA;AACP,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM;;AAGjC;;AAEG;AACH,IAAA,kBAAkB,CAAC,MAAmD,EAAA;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CAAC;;AAGrD;;AAEG;IACH,YAAY,GAAA;QACV,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,IAAI;;AAG3C;;AAEG;IACH,kBAAkB,GAAA;QAChB,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI,IAAI;;AAG5C;;AAEG;IACH,YAAY,GAAA;QACV,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,IAAI,EAAE;;AAG3C;;AAEG;IACH,sBAAsB,GAAA;AACpB,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE;;AAzKxC,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,mBAAmB,kBAGpB,eAAe,EAAA,EAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAAC,EAAA,CAAA,UAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAHd,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,mBAAmB,cAFlB,MAAM,EAAA,CAAA,CAAA;;4FAEP,mBAAmB,EAAA,UAAA,EAAA,CAAA;kBAH/B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;0BAII,MAAM;2BAAC,eAAe;;;MCDd,kBAAkB,CAAA;AAE7B;;AAEG;IACH,OAAO,OAAO,CAAC,MAAsB,EAAA;QACnC,OAAO;AACL,YAAA,QAAQ,EAAE,kBAAkB;AAC5B,YAAA,SAAS,EAAE;AACT,gBAAA;AACE,oBAAA,OAAO,EAAE,eAAe;AACxB,oBAAA,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM;AACxC,iBAAA;gBACD,sBAAsB;gBACtB,mBAAmB;AACnB,gBAAA;AACE,oBAAA,OAAO,EAAE,iBAAiB;AAC1B,oBAAA,QAAQ,EAAE,uBAAuB;AACjC,oBAAA,KAAK,EAAE;AACR;AACF;SACF;;AAGH;;AAEG;AACH,IAAA,OAAO,QAAQ,GAAA;QACb,OAAO;AACL,YAAA,QAAQ,EAAE,kBAAkB;AAC5B,YAAA,SAAS,EAAE;SACZ;;AAGH;;AAEG;IACH,OAAO,aAAa,CAAC,MAAsB,EAAA;QACzC,OAAO;AACL,YAAA;AACE,gBAAA,OAAO,EAAE,eAAe;AACxB,gBAAA,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM;AACxC,aAAA;YACD,sBAAsB;YACtB,mBAAmB;AACnB,YAAA;AACE,gBAAA,OAAO,EAAE,iBAAiB;AAC1B,gBAAA,QAAQ,EAAE,uBAAuB;AACjC,gBAAA,KAAK,EAAE;AACR;SACF;;AAGH;;AAEG;IACK,OAAO,iBAAiB,CAAC,MAAsB,EAAA;AACrD,QAAA,MAAM,aAAa,GAA4B;AAC7C,YAAA,WAAW,EAAE;AACX,gBAAA,WAAW,EAAE,cAAc;AAC3B,gBAAA,UAAU,EAAE,SAAS;AACrB,gBAAA,eAAe,EAAE,cAAc;AAC/B,gBAAA,0BAA0B,EAAE,CAAC;AAC7B,gBAAA,WAAW,EAAE,IAAI;gBACjB,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,iBAAiB,EAAE;AACjB,gBAAA,OAAO,EAAE,IAAI;AACb,gBAAA,gBAAgB,EAAE,QAAQ;AAC1B,gBAAA,WAAW,EAAE,EAAE;AACf,gBAAA,WAAW,EAAE,EAAE;gBACf,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,cAAc,EAAE;AACd,gBAAA,SAAS,EAAE,IAAI;AACf,gBAAA,aAAa,EAAE,IAAI;AACnB,gBAAA,oBAAoB,EAAE,EAAE;gBACxB,GAAG,MAAM,CAAC;AACX;SACF;QAED,OAAO;AACL,YAAA,GAAG,MAAM;AACT,YAAA,GAAG,aAAa;AAChB,YAAA,WAAW,EAAE;gBACX,GAAG,aAAa,CAAC,WAAW;gBAC5B,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,iBAAiB,EAAE;gBACjB,GAAG,aAAa,CAAC,iBAAiB;gBAClC,GAAG,MAAM,CAAC;AACX,aAAA;AACD,YAAA,cAAc,EAAE;gBACd,GAAG,aAAa,CAAC,cAAc;gBAC/B,GAAG,MAAM,CAAC;AACX;SACF;;+GAhGQ,kBAAkB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,QAAA,EAAA,CAAA,CAAA;gHAAlB,kBAAkB,EAAA,CAAA,CAAA;gHAAlB,kBAAkB,EAAA,CAAA,CAAA;;4FAAlB,kBAAkB,EAAA,UAAA,EAAA,CAAA;kBAL9B,QAAQ;AAAC,YAAA,IAAA,EAAA,CAAA;AACR,oBAAA,YAAY,EAAE,EAAE;AAChB,oBAAA,OAAO,EAAE,EAAE;AACX,oBAAA,OAAO,EAAE;AACV,iBAAA;;;MCHY,iBAAiB,CAAA;IAE5B,WACU,CAAA,YAAoC,EACpC,MAAc,EAAA;QADd,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAM,CAAA,MAAA,GAAN,MAAM;;AAGhB,IAAA,WAAW,CAAC,KAA6B,EAAA;AACvC,QAAA,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;;AAGxC,IAAA,gBAAgB,CAAC,UAAkC,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC;;AAGrC,IAAA,mBAAmB,CAAC,KAA6B,EAAA;;AAEvD,QAAA,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE;AAClC,YAAA,OAAO,EAAE,CAAC,IAAI,CAAC;;;;;AAMjB,QAAA,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAC9C,GAAG,CAAC,KAAK,IAAG;YACV,IAAI,CAAC,KAAK,EAAE;AACV,gBAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,gBAAA,OAAO,KAAK;;AAEd,YAAA,OAAO,IAAI;AACb,SAAC,CAAC,EACF,UAAU,CAAC,MAAK;AACd,YAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,YAAA,OAAO,EAAE,CAAC,KAAK,CAAC;SACjB,CAAC,CACH;;AAGH;;AAEG;AACK,IAAA,kBAAkB,CAAC,KAA6B,EAAA;AACtD,QAAA,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;;AAGrC,QAAA,IAAI,WAAW,CAAC,aAAa,CAAC,KAAK,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE;AACnE,YAAA,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC;AAC1C,gBAAA,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC;AAC/B,gBAAA,YAAY,EAAE,WAAW,CAAC,cAAc;AACzC,aAAA,CAAC;;;QAIJ,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE;AAClD,YAAA,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC;gBAC1C,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC;AACvD,gBAAA,YAAY,EAAE,WAAW,CAAC,cAAc;AACzC,aAAA,CAAC;;AAGJ,QAAA,OAAO,KAAK;;+GA7DH,iBAAiB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAD,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,MAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAjB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,iBAAiB,cAFhB,MAAM,EAAA,CAAA,CAAA;;4FAEP,iBAAiB,EAAA,UAAA,EAAA,CAAA;kBAH7B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;AAkED;;AAEG;MAIU,iBAAiB,CAAA;IAE5B,WACU,CAAA,YAAoC,EACpC,MAAc,EAAA;QADd,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAM,CAAA,MAAA,GAAN,MAAM;;AAGhB,IAAA,WAAW,CAAC,KAA6B,EAAA;AACvC,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;AAG9B,IAAA,gBAAgB,CAAC,UAAkC,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;AAG3B,IAAA,SAAS,CAAC,KAA6B,EAAA;QAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAa;QACrD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAW;QAEjD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE;AACxC,YAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,YAAA,OAAO,KAAK;;;QAId,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7C,YAAA,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9E,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC;;;;AAKvD,QAAA,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;YAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC;;AAGrD,QAAA,OAAO,IAAI;;+GArCF,iBAAiB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,MAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAjB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,iBAAiB,cAFhB,MAAM,EAAA,CAAA,CAAA;;4FAEP,iBAAiB,EAAA,UAAA,EAAA,CAAA;kBAH7B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;AA0CD;;AAEG;MAIU,kBAAkB,CAAA;IAE7B,WACU,CAAA,YAAoC,EACpC,MAAc,EAAA;QADd,IAAY,CAAA,YAAA,GAAZ,YAAY;QACZ,IAAM,CAAA,MAAA,GAAN,MAAM;;IAGhB,WAAW,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,UAAU,EAAE;;IAG1B,gBAAgB,GAAA;AACd,QAAA,OAAO,IAAI,CAAC,UAAU,EAAE;;IAGlB,UAAU,GAAA;QAChB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE;AACxC,YAAA,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE;AACjC,YAAA,OAAO,KAAK;;QAGd,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC;;AAGrD,QAAA,OAAO,IAAI;;+GAzBF,kBAAkB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAA,sBAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,MAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAlB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,kBAAkB,cAFjB,MAAM,EAAA,CAAA,CAAA;;4FAEP,kBAAkB,EAAA,UAAA,EAAA,CAAA;kBAH9B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE;AACb,iBAAA;;;AC9HD;;AAEG;AAEH;;ACJA;;AAEG;;;;"}

package/lib/guards/medhasso-auth.guard.d.ts

@@ -13,10 +13,6 @@ export declare class MedHassoAuthGuard implements CanActivate, CanActivateChild
      * Handle authentication callback from MedHasso SSO
      */
     private handleAuthCallback;
-    /**
-     * Refresh token if needed
-     */
-    private refreshTokenIfNeeded;
     static ɵfac: i0.ɵɵFactoryDeclaration<MedHassoAuthGuard, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<MedHassoAuthGuard>;
 }

package/lib/interceptors/medhasso-auth.interceptor.d.ts

@@ -26,7 +26,16 @@ export declare class MedHassoAuthInterceptor implements HttpInterceptor {
      */
     private addAuthorizationHeader;
     /**
-     * Handle 401 Unauthorized errors by attempting token refresh
+     * Handle 401 Unauthorized errors by attempting token refresh.
+     *
+     * Always tries the refresh path first, even when the in-memory token looks
+     * expired to our clock. The server already said "unauthorized" — whether our
+     * local isExpired check agrees doesn't change what we need to do next.
+     * Short-circuiting to SSO on `tokenInfo.isExpired` would bounce the user on
+     * mid-flight expirations and small client/server clock skews, cases where the
+     * refresh token is still perfectly valid and would have recovered. If the
+     * refresh really can't succeed (no refresh token in storage, dead refresh
+     * token → 400/401), refreshToken() throws and the catchError below redirects.
      */
     private handle401Error;
     /**

package/lib/interfaces/medhasso-config.interface.d.ts

@@ -110,11 +110,17 @@ export interface TokenInfo {
      */
     expiresAt: number;
     /**
-     * Whether token is expired
+     * Whether token is expired. Backed by a dynamic getter: every read
+     * re-evaluates against the current clock, so the value stays accurate even
+     * after a long idle/suspend when nothing has written to storage. Spreading
+     * (`{...tokenInfo}`) or `JSON.stringify`-ing a TokenInfo captures a boolean
+     * snapshot and loses this behavior — pass the object itself around, don't
+     * clone it.
      */
-    isExpired: boolean;
+    readonly isExpired: boolean;
     /**
-     * Whether token will expire soon (within refresh window)
+     * Whether token will expire soon (within refresh window). Dynamic getter —
+     * same spread/JSON caveat as `isExpired`.
      */
-    needsRefresh: boolean;
+    readonly needsRefresh: boolean;
 }

package/lib/services/token-management.service.d.ts

@@ -1,4 +1,4 @@
-import { HttpClient } from '@angular/common/http';
+import { HttpBackend, HttpClient } from '@angular/common/http';
 import { Observable } from 'rxjs';
 import { MedHassoConfig, TokenInfo, MedHassoUser } from '../interfaces/medhasso-config.interface';
 import * as i0 from "@angular/core";
@@ -6,8 +6,20 @@ export declare class TokenManagementService {
     private config;
     private http;
     private refreshTokenInterval;
+    private refreshInProgress$;
     private tokenSubject;
     private userSubject;
+    /**
+     * Dedicated HttpClient wired directly to HttpBackend so the refresh POST
+     * bypasses the HTTP_INTERCEPTORS chain. Routing refresh through the normal
+     * http (which runs MedHassoAuthInterceptor) causes self-interception:
+     * interceptor → ensureValidToken → refreshToken → returns the in-flight
+     * refreshInProgress$ which is itself → deadlock, with finalize never firing
+     * so refreshInProgress$ stays pinned and every subsequent request hangs too.
+     */
+    private readonly refreshHttp;
+    private readonly onVisibilityChange;
+    private readonly onWindowFocus;
     token$: Observable<TokenInfo | null>;
     user$: Observable<MedHassoUser | null>;
     private get tokenConfig();
@@ -16,11 +28,28 @@ export declare class TokenManagementService {
     private get refreshTokenKey();
     private get refreshBeforeExpiryMinutes();
     private get autoRefresh();
-    constructor(config: MedHassoConfig, http: HttpClient);
+    constructor(config: MedHassoConfig, http: HttpClient, httpBackend: HttpBackend);
+    /**
+     * Re-validate the token whenever the tab regains focus/visibility.
+     * The refresh timer is a JS timer and does not fire while the OS/browser
+     * was suspended (e.g. laptop sleep overnight), so it can't be relied on
+     * alone to catch a token that went stale while the app was inactive.
+     */
+    private setupWakeDetection;
+    /**
+     * Remove wake-detection listeners registered in setupWakeDetection().
+     */
+    private teardownWakeDetection;
     /**
      * Initialize token information from storage
      */
     private initializeFromStorage;
+    /**
+     * Re-sync in-memory token state from storage if it has drifted (e.g.
+     * something wrote tokens directly to storage without going through
+     * setTokens()). No-op when storage already matches memory.
+     */
+    private syncFromStorage;
     /**
      * Get stored token from configured storage
      */
@@ -38,7 +67,15 @@ export declare class TokenManagementService {
      */
     private clearStoredTokens;
     /**
-     * Create token info object from JWT token
+     * Create token info object from JWT token.
+     *
+     * `isExpired` and `needsRefresh` are getters, not snapshotted booleans:
+     * the TokenInfo object may outlive wall-clock events that change its
+     * expiry status (e.g. OS/browser suspended overnight, laptop sleep).
+     * A snapshotted boolean captured at creation time would then lie — the
+     * wake handler would call ensureValidToken(), see `isExpired: false`
+     * from the pre-sleep snapshot, and skip the refresh. Reading these as
+     * getters means every access reflects the current clock.
      */
     private createTokenInfo;
     /**
@@ -82,9 +119,37 @@ export declare class TokenManagementService {
      */
     setTokens(idToken: string, refreshToken?: string): void;
     /**
-     * Refresh the current token
+     * Refresh the current token.
+     * Concurrent callers (auto-refresh timer, wake detection, interceptor,
+     * route guard) share the same in-flight request instead of each firing
+     * their own POST to the refresh endpoint.
      */
     refreshToken(): Observable<any>;
+    /**
+     * Ensure the current token is valid, refreshing it first if it is
+     * expired. Resolves `false` if there is no token at all, or the token
+     * is expired and refreshing it failed (in both cases the caller should
+     * redirect to SSO).
+     *
+     * A token that merely `needsRefresh` (inside the refresh window, but
+     * not yet expired) is still good enough to use: the refresh for it is
+     * kicked off in the background so the *current* request/route isn't
+     * blocked or logged out by a transient refresh failure (network blip,
+     * refresh endpoint hiccup) while the existing token would have worked
+     * fine. Only an actually-expired token blocks the caller.
+     *
+     * Re-syncs from storage first: the in-memory token snapshot is only
+     * updated via setTokens()/logout(), so if something wrote directly to
+     * storage (e.g. the SSO callback flow) without going through this
+     * service, the in-memory copy would otherwise be stale until the next
+     * full page load re-runs initializeFromStorage().
+     *
+     * Anonymous/bootstrap endpoints that must be reachable before any token
+     * exists (e.g. the SSO callback's own token-exchange request) should be
+     * added to `interceptorConfig.excludeUrls` so they bypass this check
+     * entirely, rather than relying on this method to let them through.
+     */
+    ensureValidToken(): Observable<boolean>;
     /**
      * Logout user and clear all tokens
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@medha-analytics/medhasso-auth",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Angular authentication library for MedHasso SSO integration",
   "keywords": [
     "angular",