@medha-analytics/medhasso-auth 1.0.0

package/fesm2022/medha-analytics-medhasso-auth.mjs

@@ -0,0 +1,813 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, Inject, Injectable, NgModule } from '@angular/core';
+import * as i1 from '@angular/common/http';
+import { HTTP_INTERCEPTORS } from '@angular/common/http';
+import { BehaviorSubject, timer, throwError, of } from 'rxjs';
+import { tap, catchError, switchMap, map } from 'rxjs/operators';
+import * as i2 from '@angular/router';
+
+const MEDHASSO_CONFIG = new InjectionToken('MEDHASSO_CONFIG');
+
+class TokenManagementService {
+    get tokenConfig() {
+        return this.config.tokenConfig || {};
+    }
+    get storageType() {
+        return this.tokenConfig.storageType || 'localStorage';
+    }
+    get idTokenKey() {
+        return this.tokenConfig.idTokenKey || 'idToken';
+    }
+    get refreshTokenKey() {
+        return this.tokenConfig.refreshTokenKey || 'refreshToken';
+    }
+    get refreshBeforeExpiryMinutes() {
+        return this.tokenConfig.refreshBeforeExpiryMinutes || 5;
+    }
+    get autoRefresh() {
+        return this.tokenConfig.autoRefresh !== false;
+    }
+    constructor(config, http) {
+        this.config = config;
+        this.http = http;
+        this.tokenSubject = new BehaviorSubject(null);
+        this.userSubject = new BehaviorSubject(null);
+        this.token$ = this.tokenSubject.asObservable();
+        this.user$ = this.userSubject.asObservable();
+        this.initializeFromStorage();
+    }
+    /**
+     * Initialize token information from storage
+     */
+    initializeFromStorage() {
+        const token = this.getStoredToken();
+        if (token) {
+            const tokenInfo = this.createTokenInfo(token);
+            this.tokenSubject.next(tokenInfo);
+            this.userSubject.next(this.extractUserFromToken(token));
+            if (this.autoRefresh && !tokenInfo.isExpired) {
+                this.setTokenRefreshInterval(tokenInfo);
+            }
+        }
+    }
+    /**
+     * Get stored token from configured storage
+     */
+    getStoredToken() {
+        const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;
+        return storage.getItem(this.idTokenKey);
+    }
+    /**
+     * Get stored refresh token from configured storage
+     */
+    getStoredRefreshToken() {
+        const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;
+        return storage.getItem(this.refreshTokenKey);
+    }
+    /**
+     * Store tokens in configured storage
+     */
+    storeTokens(idToken, refreshToken) {
+        const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;
+        storage.setItem(this.idTokenKey, idToken);
+        if (refreshToken) {
+            storage.setItem(this.refreshTokenKey, refreshToken);
+        }
+    }
+    /**
+     * Clear stored tokens
+     */
+    clearStoredTokens() {
+        const storage = this.storageType === 'localStorage' ? localStorage : sessionStorage;
+        storage.removeItem(this.idTokenKey);
+        storage.removeItem(this.refreshTokenKey);
+    }
+    /**
+     * Create token info object from JWT token
+     */
+    createTokenInfo(token) {
+        const payload = this.decodeJwt(token);
+        const expiresAt = payload.exp * 1000; // Convert to milliseconds
+        const now = Date.now();
+        const refreshWindow = this.refreshBeforeExpiryMinutes * 60 * 1000;
+        return {
+            token,
+            payload,
+            expiresAt,
+            isExpired: now >= expiresAt,
+            needsRefresh: now >= (expiresAt - refreshWindow)
+        };
+    }
+    /**
+     * Decode JWT token payload
+     */
+    decodeJwt(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3) {
+                throw new Error('Invalid JWT token format');
+            }
+            const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+            return payload;
+        }
+        catch (error) {
+            console.error('Error decoding JWT token:', error);
+            throw new Error('Invalid JWT token');
+        }
+    }
+    /**
+     * Extract user information from JWT token
+     */
+    extractUserFromToken(token) {
+        const payload = this.decodeJwt(token);
+        return {
+            upn: payload.upn || payload.email,
+            name: payload.name,
+            roles: payload.roles || [],
+            ...payload
+        };
+    }
+    /**
+     * Set up automatic token refresh interval
+     */
+    setTokenRefreshInterval(tokenInfo) {
+        this.clearTokenRefreshInterval();
+        if (!this.autoRefresh || tokenInfo.isExpired) {
+            return;
+        }
+        const remainingTime = tokenInfo.expiresAt - Date.now();
+        const refreshTime = remainingTime - (this.refreshBeforeExpiryMinutes * 60 * 1000);
+        if (refreshTime > 0) {
+            this.refreshTokenInterval = timer(refreshTime).subscribe(() => {
+                this.refreshToken().subscribe();
+            });
+        }
+        else {
+            // Token needs immediate refresh
+            this.refreshToken().subscribe();
+        }
+    }
+    /**
+     * Clear token refresh interval
+     */
+    clearTokenRefreshInterval() {
+        if (this.refreshTokenInterval) {
+            this.refreshTokenInterval.unsubscribe();
+            this.refreshTokenInterval = null;
+        }
+    }
+    /**
+     * Get current token information
+     */
+    getTokenInfo() {
+        return this.tokenSubject.value;
+    }
+    /**
+     * Get current user information
+     */
+    getCurrentUser() {
+        return this.userSubject.value;
+    }
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated() {
+        const tokenInfo = this.getTokenInfo();
+        return tokenInfo !== null && !tokenInfo.isExpired;
+    }
+    /**
+     * Check if user has specific role
+     */
+    hasRole(role) {
+        const user = this.getCurrentUser();
+        return user?.roles?.includes(role) || false;
+    }
+    /**
+     * Check if user is admin
+     */
+    isAdmin() {
+        return this.hasRole('admin') || this.hasRole('administrator');
+    }
+    /**
+     * Set tokens (typically called after successful authentication)
+     */
+    setTokens(idToken, refreshToken) {
+        this.storeTokens(idToken, refreshToken);
+        const tokenInfo = this.createTokenInfo(idToken);
+        const user = this.extractUserFromToken(idToken);
+        this.tokenSubject.next(tokenInfo);
+        this.userSubject.next(user);
+        if (this.autoRefresh) {
+            this.setTokenRefreshInterval(tokenInfo);
+        }
+    }
+    /**
+     * Refresh the current token
+     */
+    refreshToken() {
+        const refreshToken = this.getStoredRefreshToken();
+        if (!refreshToken) {
+            return throwError(() => new Error('No refresh token available'));
+        }
+        return this.http.post(`${this.config.refreshUrl}/api/refresh-token`, { refreshToken })
+            .pipe(tap((response) => {
+            if (response.id_token) {
+                this.setTokens(response.id_token, response.refresh_token);
+            }
+        }), catchError(error => {
+            console.error('Token refresh failed:', error);
+            this.logout();
+            return throwError(() => error);
+        }));
+    }
+    /**
+     * Logout user and clear all tokens
+     */
+    logout() {
+        this.clearTokenRefreshInterval();
+        this.clearStoredTokens();
+        this.tokenSubject.next(null);
+        this.userSubject.next(null);
+    }
+    /**
+     * Redirect to MedHasso SSO for authentication
+     */
+    redirectToSSO(returnUrl) {
+        const currentUrl = returnUrl || window.location.href;
+        const ssoUrl = `${this.config.ssoUrl}?url=${encodeURIComponent(currentUrl)}&applicationName=${encodeURIComponent(this.config.applicationName)}`;
+        window.location.href = ssoUrl;
+    }
+    /**
+     * Handle authentication callback (typically from SSO redirect)
+     */
+    handleAuthCallback(params) {
+        if (params.idToken) {
+            this.setTokens(params.idToken, params.refreshToken);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Get authorization header value
+     */
+    getAuthorizationHeader() {
+        const tokenInfo = this.getTokenInfo();
+        if (tokenInfo && !tokenInfo.isExpired) {
+            const prefix = this.config.interceptorConfig?.authHeaderPrefix || 'Bearer';
+            return `${prefix} ${tokenInfo.token}`;
+        }
+        return null;
+    }
+    /**
+     * Cleanup on service destruction
+     */
+    ngOnDestroy() {
+        this.clearTokenRefreshInterval();
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: TokenManagementService, deps: [{ token: MEDHASSO_CONFIG }, { token: i1.HttpClient }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: TokenManagementService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: TokenManagementService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: undefined, decorators: [{
+                    type: Inject,
+                    args: [MEDHASSO_CONFIG]
+                }] }, { type: i1.HttpClient }] });
+
+class MedHassoAuthInterceptor {
+    constructor(config, tokenService) {
+        this.config = config;
+        this.tokenService = tokenService;
+    }
+    intercept(request, next) {
+        // Check if interceptor is enabled
+        if (this.config.interceptorConfig?.enabled === false) {
+            return next.handle(request);
+        }
+        // Check if request should be excluded
+        if (this.shouldExcludeRequest(request)) {
+            return next.handle(request);
+        }
+        // Check if request should be included (if includeUrls is specified)
+        if (!this.shouldIncludeRequest(request)) {
+            return next.handle(request);
+        }
+        // Add authorization header
+        const modifiedRequest = this.addAuthorizationHeader(request);
+        return next.handle(modifiedRequest).pipe(catchError((error) => {
+            // Handle 401 Unauthorized errors
+            if (error.status === 401) {
+                return this.handle401Error(request, next);
+            }
+            // Handle 403 Forbidden errors
+            if (error.status === 403) {
+                console.warn('MedHasso Auth: Access forbidden (403)', error);
+            }
+            return throwError(() => error);
+        }));
+    }
+    /**
+     * Check if request URL should be excluded from authentication
+     */
+    shouldExcludeRequest(request) {
+        const excludeUrls = this.config.interceptorConfig?.excludeUrls || [];
+        return excludeUrls.some(url => this.matchesUrl(request.url, url));
+    }
+    /**
+     * Check if request URL should be included for authentication
+     * If includeUrls is not specified, all requests are included (unless excluded)
+     */
+    shouldIncludeRequest(request) {
+        const includeUrls = this.config.interceptorConfig?.includeUrls;
+        // If no includeUrls specified, include all requests
+        if (!includeUrls || includeUrls.length === 0) {
+            return true;
+        }
+        // If includeUrls specified, only include matching requests
+        return includeUrls.some(url => this.matchesUrl(request.url, url));
+    }
+    /**
+     * Check if request URL matches the pattern
+     */
+    matchesUrl(requestUrl, pattern) {
+        // Support wildcards and exact matches
+        if (pattern.includes('*')) {
+            const regex = new RegExp(pattern.replace(/\*/g, '.*'));
+            return regex.test(requestUrl);
+        }
+        return requestUrl.includes(pattern);
+    }
+    /**
+     * Add authorization header to request
+     */
+    addAuthorizationHeader(request) {
+        const authHeader = this.tokenService.getAuthorizationHeader();
+        if (!authHeader) {
+            return request;
+        }
+        return request.clone({
+            setHeaders: {
+                Authorization: authHeader
+            }
+        });
+    }
+    /**
+     * Handle 401 Unauthorized errors by attempting token refresh
+     */
+    handle401Error(request, next) {
+        const tokenInfo = this.tokenService.getTokenInfo();
+        // If no token or token is expired, redirect to SSO
+        if (!tokenInfo || tokenInfo.isExpired) {
+            this.redirectToSSO();
+            return throwError(() => new Error('Authentication required'));
+        }
+        // If token exists but request failed, try to refresh
+        return this.tokenService.refreshToken().pipe(switchMap(() => {
+            // Retry the original request with new token
+            const retryRequest = this.addAuthorizationHeader(request);
+            return next.handle(retryRequest);
+        }), catchError((refreshError) => {
+            // If refresh fails, redirect to SSO
+            console.error('MedHasso Auth: Token refresh failed', refreshError);
+            this.redirectToSSO();
+            return throwError(() => refreshError);
+        }));
+    }
+    /**
+     * Redirect to SSO for authentication
+     */
+    redirectToSSO() {
+        // Add a small delay to prevent multiple redirects
+        setTimeout(() => {
+            this.tokenService.redirectToSSO();
+        }, 100);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthInterceptor, deps: [{ token: MEDHASSO_CONFIG }, { token: TokenManagementService }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthInterceptor }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthInterceptor, decorators: [{
+            type: Injectable
+        }], ctorParameters: () => [{ type: undefined, decorators: [{
+                    type: Inject,
+                    args: [MEDHASSO_CONFIG]
+                }] }, { type: TokenManagementService }] });
+
+class MedHassoAuthService {
+    constructor(config, tokenService, http) {
+        this.config = config;
+        this.tokenService = tokenService;
+        this.http = http;
+    }
+    /**
+     * Get current authentication status
+     */
+    isAuthenticated() {
+        return this.tokenService.isAuthenticated();
+    }
+    /**
+     * Get current user information
+     */
+    getCurrentUser() {
+        return this.tokenService.getCurrentUser();
+    }
+    /**
+     * Get current user as observable
+     */
+    getCurrentUser$() {
+        return this.tokenService.user$;
+    }
+    /**
+     * Check if user has specific role
+     */
+    hasRole(role) {
+        return this.tokenService.hasRole(role);
+    }
+    /**
+     * Check if user has any of the specified roles
+     */
+    hasAnyRole(roles) {
+        return roles.some(role => this.tokenService.hasRole(role));
+    }
+    /**
+     * Check if user has all of the specified roles
+     */
+    hasAllRoles(roles) {
+        return roles.every(role => this.tokenService.hasRole(role));
+    }
+    /**
+     * Check if user is admin
+     */
+    isAdmin() {
+        return this.tokenService.isAdmin();
+    }
+    /**
+     * Login user (redirect to SSO)
+     */
+    login(returnUrl) {
+        this.tokenService.redirectToSSO(returnUrl);
+    }
+    /**
+     * Logout user
+     */
+    logout() {
+        this.tokenService.logout();
+    }
+    /**
+     * Refresh authentication token
+     */
+    refreshToken() {
+        return this.tokenService.refreshToken();
+    }
+    /**
+     * Check access permissions for a simple key (if applicable)
+     */
+    checkAccess(simpleKey, backendUrl) {
+        const url = backendUrl || this.getBackendUrl();
+        if (!url) {
+            return of(null);
+        }
+        return this.http.get(`${url}/auth/guard?simple_key=${simpleKey}`)
+            .pipe(catchError(error => {
+            console.error('Access check failed:', error);
+            return of(null);
+        }));
+    }
+    /**
+     * Check if user is admin via backend API (if applicable)
+     */
+    checkIsAdmin(backendUrl) {
+        const user = this.getCurrentUser();
+        const url = backendUrl || this.getBackendUrl();
+        if (!user?.upn || !url) {
+            return of(false);
+        }
+        return this.http.get(`${url}/isAdmin?email=${user.upn}`)
+            .pipe(map((response) => !!response), catchError(() => of(false)));
+    }
+    /**
+     * Get backend URL from config (helper method)
+     */
+    getBackendUrl() {
+        // This would need to be configured or passed in
+        // For now, return null as it's application-specific
+        return null;
+    }
+    /**
+     * Get token information
+     */
+    getTokenInfo() {
+        return this.tokenService.getTokenInfo();
+    }
+    /**
+     * Get token as observable
+     */
+    getToken$() {
+        return this.tokenService.token$;
+    }
+    /**
+     * Handle authentication callback
+     */
+    handleAuthCallback(params) {
+        return this.tokenService.handleAuthCallback(params);
+    }
+    /**
+     * Get user email
+     */
+    getUserEmail() {
+        return this.getCurrentUser()?.upn || null;
+    }
+    /**
+     * Get user display name
+     */
+    getUserDisplayName() {
+        return this.getCurrentUser()?.name || null;
+    }
+    /**
+     * Get all user roles
+     */
+    getUserRoles() {
+        return this.getCurrentUser()?.roles || [];
+    }
+    /**
+     * Get authorization header value
+     */
+    getAuthorizationHeader() {
+        return this.tokenService.getAuthorizationHeader();
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthService, deps: [{ token: MEDHASSO_CONFIG }, { token: TokenManagementService }, { token: i1.HttpClient }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: undefined, decorators: [{
+                    type: Inject,
+                    args: [MEDHASSO_CONFIG]
+                }] }, { type: TokenManagementService }, { type: i1.HttpClient }] });
+
+class MedHassoAuthModule {
+    /**
+     * Configure the MedHasso authentication module with required settings
+     */
+    static forRoot(config) {
+        return {
+            ngModule: MedHassoAuthModule,
+            providers: [
+                {
+                    provide: MEDHASSO_CONFIG,
+                    useValue: this.mergeWithDefaults(config)
+                },
+                TokenManagementService,
+                MedHassoAuthService,
+                {
+                    provide: HTTP_INTERCEPTORS,
+                    useClass: MedHassoAuthInterceptor,
+                    multi: true
+                }
+            ]
+        };
+    }
+    /**
+     * Configure the MedHasso authentication module for feature modules
+     */
+    static forChild() {
+        return {
+            ngModule: MedHassoAuthModule,
+            providers: []
+        };
+    }
+    /**
+     * Provide MedHasso authentication with standalone components
+     */
+    static forStandalone(config) {
+        return [
+            {
+                provide: MEDHASSO_CONFIG,
+                useValue: this.mergeWithDefaults(config)
+            },
+            TokenManagementService,
+            MedHassoAuthService,
+            {
+                provide: HTTP_INTERCEPTORS,
+                useClass: MedHassoAuthInterceptor,
+                multi: true
+            }
+        ];
+    }
+    /**
+     * Merge user configuration with sensible defaults
+     */
+    static mergeWithDefaults(config) {
+        const defaultConfig = {
+            tokenConfig: {
+                storageType: 'localStorage',
+                idTokenKey: 'idToken',
+                refreshTokenKey: 'refreshToken',
+                refreshBeforeExpiryMinutes: 5,
+                autoRefresh: true,
+                ...config.tokenConfig
+            },
+            interceptorConfig: {
+                enabled: true,
+                authHeaderPrefix: 'Bearer',
+                excludeUrls: [],
+                includeUrls: [],
+                ...config.interceptorConfig
+            },
+            securityConfig: {
+                httpsOnly: true,
+                secureCookies: true,
+                additionalCspSources: [],
+                ...config.securityConfig
+            }
+        };
+        return {
+            ...config,
+            ...defaultConfig,
+            tokenConfig: {
+                ...defaultConfig.tokenConfig,
+                ...config.tokenConfig
+            },
+            interceptorConfig: {
+                ...defaultConfig.interceptorConfig,
+                ...config.interceptorConfig
+            },
+            securityConfig: {
+                ...defaultConfig.securityConfig,
+                ...config.securityConfig
+            }
+        };
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule }); }
+    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthModule }); }
+    static { this.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthModule }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthModule, decorators: [{
+            type: NgModule,
+            args: [{
+                    declarations: [],
+                    imports: [],
+                    exports: []
+                }]
+        }] });
+
+class MedHassoAuthGuard {
+    constructor(tokenService, router) {
+        this.tokenService = tokenService;
+        this.router = router;
+    }
+    canActivate(route) {
+        return this.checkAuthentication(route);
+    }
+    canActivateChild(childRoute) {
+        return this.checkAuthentication(childRoute);
+    }
+    checkAuthentication(route) {
+        // Check for authentication callback parameters
+        if (this.handleAuthCallback(route)) {
+            return of(true);
+        }
+        // Check if user is already authenticated
+        if (this.tokenService.isAuthenticated()) {
+            return this.refreshTokenIfNeeded().pipe(map(() => true), catchError(() => {
+                this.tokenService.redirectToSSO();
+                return of(false);
+            }));
+        }
+        // Not authenticated, redirect to SSO
+        this.tokenService.redirectToSSO();
+        return of(false);
+    }
+    /**
+     * Handle authentication callback from MedHasso SSO
+     */
+    handleAuthCallback(route) {
+        const queryParams = route.queryParams;
+        // Check for AIRO redirect flow
+        if (queryParams['redirectapp'] === 'airo' && queryParams['idToken']) {
+            return this.tokenService.handleAuthCallback({
+                idToken: queryParams['idToken'],
+                refreshToken: queryParams['refreshToken']
+            });
+        }
+        // Check for standard authentication callback
+        if (queryParams['idToken'] || queryParams['token']) {
+            return this.tokenService.handleAuthCallback({
+                idToken: queryParams['idToken'] || queryParams['token'],
+                refreshToken: queryParams['refreshToken']
+            });
+        }
+        return false;
+    }
+    /**
+     * Refresh token if needed
+     */
+    refreshTokenIfNeeded() {
+        const tokenInfo = this.tokenService.getTokenInfo();
+        if (tokenInfo?.needsRefresh) {
+            return this.tokenService.refreshToken();
+        }
+        return of(null);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthGuard, deps: [{ token: TokenManagementService }, { token: i2.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthGuard, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAuthGuard, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: TokenManagementService }, { type: i2.Router }] });
+/**
+ * Role-based authentication guard
+ */
+class MedHassoRoleGuard {
+    constructor(tokenService, router) {
+        this.tokenService = tokenService;
+        this.router = router;
+    }
+    canActivate(route) {
+        return this.checkRole(route);
+    }
+    canActivateChild(childRoute) {
+        return this.checkRole(childRoute);
+    }
+    checkRole(route) {
+        const requiredRoles = route.data['roles'];
+        const requiredRole = route.data['role'];
+        if (!this.tokenService.isAuthenticated()) {
+            this.tokenService.redirectToSSO();
+            return false;
+        }
+        // Check multiple roles (OR condition)
+        if (requiredRoles && requiredRoles.length > 0) {
+            const hasAnyRole = requiredRoles.some(role => this.tokenService.hasRole(role));
+            if (!hasAnyRole) {
+                return this.router.createUrlTree(['/unauthorized']);
+            }
+        }
+        // Check single role
+        if (requiredRole && !this.tokenService.hasRole(requiredRole)) {
+            return this.router.createUrlTree(['/unauthorized']);
+        }
+        return true;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoRoleGuard, deps: [{ token: TokenManagementService }, { token: i2.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoRoleGuard, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoRoleGuard, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: TokenManagementService }, { type: i2.Router }] });
+/**
+ * Admin-only authentication guard
+ */
+class MedHassoAdminGuard {
+    constructor(tokenService, router) {
+        this.tokenService = tokenService;
+        this.router = router;
+    }
+    canActivate() {
+        return this.checkAdmin();
+    }
+    canActivateChild() {
+        return this.checkAdmin();
+    }
+    checkAdmin() {
+        if (!this.tokenService.isAuthenticated()) {
+            this.tokenService.redirectToSSO();
+            return false;
+        }
+        if (!this.tokenService.isAdmin()) {
+            return this.router.createUrlTree(['/unauthorized']);
+        }
+        return true;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAdminGuard, deps: [{ token: TokenManagementService }, { token: i2.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAdminGuard, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.14", ngImport: i0, type: MedHassoAdminGuard, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: TokenManagementService }, { type: i2.Router }] });
+
+/*
+ * Public API Surface of medhasso-auth
+ */
+// Module
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { MEDHASSO_CONFIG, MedHassoAdminGuard, MedHassoAuthGuard, MedHassoAuthInterceptor, MedHassoAuthModule, MedHassoAuthService, MedHassoRoleGuard, TokenManagementService };
+//# sourceMappingURL=medha-analytics-medhasso-auth.mjs.map