@memberjunction/ng-auth-services 2.129.0 → 2.130.1

package/dist/lib/IAuthProvider.d.ts

@@ -1,55 +1,217 @@
 import { Observable } from 'rxjs';
 import { AuthProviderConfig } from '@memberjunction/core';
+import { StandardUserInfo, StandardAuthToken, StandardAuthError } from './auth-types';
 export interface AngularAuthProviderConfig extends AuthProviderConfig {
 }
 /**
- * Interface for Angular authentication providers
- * Mirrors the backend IAuthProvider pattern for consistency
+ * Interface for Angular authentication providers - v3.0.0
+ *
+ * This interface defines the contract that all auth providers must implement.
+ * It ensures consistent behavior across different OAuth providers while hiding
+ * provider-specific implementation details.
+ *
+ * ## Breaking Changes from v2.x:
+ * - Removed: getUserProfile() - Use getUserInfo() instead
+ * - Removed: getUser() - Use getUserInfo() instead
+ * - Removed: getUserClaims() - Use getTokenInfo() instead
+ * - Removed: getToken() - Use getIdToken() instead
+ * - Removed: refresh() - Use refreshToken() instead
+ * - Removed: checkExpiredTokenError() - Use classifyError() instead
+ *
+ * @version 3.0.0
  */
 export interface IAngularAuthProvider {
     /**
      * Provider type identifier (e.g., 'msal', 'auth0', 'okta')
      */
-    type: string;
+    readonly type: string;
     /**
      * Initialize the authentication provider
+     *
+     * This should handle callback processing, session restoration, etc.
+     * Called automatically during app startup.
      */
     initialize(): Promise<void>;
     /**
-     * Login the user
+     * Initiate login flow
+     *
+     * @param options Optional provider-specific login options
+     * @returns Observable for backward compatibility, can also return Promise
+     *
+     * @example
+     * ```typescript
+     * await this.authBase.login({ appState: { target: '/dashboard' } });
+     * ```
      */
-    login(options?: any): Observable<void> | Promise<void>;
+    login(options?: Record<string, unknown>): Observable<void> | Promise<void>;
     /**
-     * Logout the user
+     * Log out the current user
+     *
+     * Clears local session and redirects to provider's logout endpoint.
+     *
+     * @example
+     * ```typescript
+     * await this.authBase.logout();
+     * ```
      */
     logout(): Promise<void>;
     /**
-     * Check if user is authenticated
+     * Handle OAuth callback after redirect
+     *
+     * This is called automatically by the redirect component.
+     * Application code typically doesn't need to call this directly.
      */
-    isAuthenticated(): Observable<boolean>;
+    handleCallback(): Promise<void>;
     /**
-     * Get the current access token
+     * Observable stream of authentication state
+     *
+     * Emits true when user is authenticated, false otherwise.
+     * Subscribe to this for reactive UI updates.
+     *
+     * @example
+     * ```typescript
+     * this.authBase.isAuthenticated().subscribe(isAuth => {
+     *   this.showLoginButton = !isAuth;
+     * });
+     * ```
      */
-    getToken(): Promise<string | null>;
+    isAuthenticated(): Observable<boolean>;
     /**
-     * Get user profile information
+     * Observable stream of user profile information
+     *
+     * Emits StandardUserInfo when authenticated, null otherwise.
+     * This replaces the old getUserProfile() which returned 'any'.
+     *
+     * @example
+     * ```typescript
+     * this.authBase.getUserInfo().subscribe(user => {
+     *   if (user) {
+     *     console.log(`Welcome ${user.name}!`);
+     *   }
+     * });
+     * ```
      */
-    getUserProfile(): Observable<any>;
+    getUserInfo(): Observable<StandardUserInfo | null>;
     /**
-     * Get user email
+     * Observable stream of user's email address
+     *
+     * Emits email string when authenticated, empty string otherwise.
+     *
+     * @example
+     * ```typescript
+     * this.userEmail$ = this.authBase.getUserEmail();
+     * ```
      */
     getUserEmail(): Observable<string>;
     /**
-     * Handle callback after redirect
+     * Get the current ID token as a string
+     *
+     * This is the primary method applications should use to get the token
+     * for backend API calls. It abstracts away provider-specific token storage
+     * (Auth0's __raw vs MSAL's idToken).
+     *
+     * @returns Promise resolving to the ID token string, or null if not authenticated
+     *
+     * @example
+     * ```typescript
+     * const token = await this.authBase.getIdToken();
+     * if (token) {
+     *   // Use token for GraphQL or REST API calls
+     *   setupGraphQLClient(token, apiUrl);
+     * }
+     * ```
      */
-    handleCallback(): Promise<void>;
+    getIdToken(): Promise<string | null>;
+    /**
+     * Get complete token information
+     *
+     * Returns a standardized token object with ID token, access token, and expiration.
+     * Use this when you need more than just the token string.
+     *
+     * @returns Promise resolving to StandardAuthToken or null if not authenticated
+     *
+     * @example
+     * ```typescript
+     * const tokenInfo = await this.authBase.getTokenInfo();
+     * if (tokenInfo) {
+     *   console.log(`Token expires at: ${new Date(tokenInfo.expiresAt)}`);
+     * }
+     * ```
+     */
+    getTokenInfo(): Promise<StandardAuthToken | null>;
+    /**
+     * Refresh the current authentication token
+     *
+     * Attempts to obtain a fresh authentication token using the provider's
+     * refresh mechanism. If silent refresh fails due to session expiry, the
+     * provider will handle re-authentication automatically (which may involve
+     * redirecting to the auth provider's login page).
+     *
+     * Returns a fresh token on success, or throws on complete failure.
+     *
+     * IMPORTANT: If the provider requires interactive re-authentication (redirect
+     * or popup), this method may never return. The app will reload after
+     * authentication completes and re-initialize with a fresh token.
+     *
+     * @returns Promise resolving to StandardAuthToken or throws on failure
+     *
+     * @example
+     * ```typescript
+     * const token = await this.authBase.refreshToken();
+     * return token.idToken; // Always succeeds or throws
+     * ```
+     */
+    refreshToken(): Promise<StandardAuthToken>;
+    /**
+     * Classify an error into a standard error type
+     *
+     * This method converts provider-specific errors into semantic error types
+     * that application code can handle consistently. Eliminates the need for
+     * consumers to check provider-specific error names like 'BrowserAuthError'.
+     *
+     * @param error The error to classify (can be any type)
+     * @returns StandardAuthError with categorized error type
+     *
+     * @example
+     * ```typescript
+     * try {
+     *   await this.authBase.login();
+     * } catch (err) {
+     *   const authError = this.authBase.classifyError(err);
+     *
+     *   switch (authError.type) {
+     *     case AuthErrorType.TOKEN_EXPIRED:
+     *       // Show "session expired" message
+     *       break;
+     *     case AuthErrorType.USER_CANCELLED:
+     *       // User cancelled - don't show error
+     *       break;
+     *     default:
+     *       // Show generic error
+     *       alert(authError.userMessage);
+     *   }
+     * }
+     * ```
+     */
+    classifyError(error: unknown): StandardAuthError;
     /**
-     * Get provider-specific configuration requirements
+     * Get list of required configuration fields for this provider
+     *
+     * @returns Array of required config field names
+     *
+     * @example
+     * ```typescript
+     * // Auth0 requires: ['clientId', 'domain']
+     * // MSAL requires: ['clientId', 'tenantId']
+     * ```
      */
     getRequiredConfig(): string[];
     /**
      * Validate provider configuration
+     *
+     * @param config Configuration object to validate
+     * @returns True if configuration is valid
      */
-    validateConfig(config: any): boolean;
+    validateConfig(config: Record<string, unknown>): boolean;
 }
 //# sourceMappingURL=IAuthProvider.d.ts.map

package/dist/lib/IAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IAuthProvider.d.ts","sourceRoot":"","sources":["../../src/lib/IAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;CAEpE;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB;;OAEG;IACH,eAAe,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAEvC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEnC;;OAEG;IACH,cAAc,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAElC;;OAEG;IACH,YAAY,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnC;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhC;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE,CAAC;IAE9B;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC;CACtC"}
+{"version":3,"file":"IAuthProvider.d.ts","sourceRoot":"","sources":["../../src/lib/IAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAElB,MAAM,cAAc,CAAC;AAGtB,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;CAEpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E;;;;;;;;;OASG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB;;;;;OAKG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAMhC;;;;;;;;;;;;OAYG;IACH,eAAe,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAEvC;;;;;;;;;;;;;;OAcG;IACH,WAAW,IAAI,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,YAAY,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAMnC;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAErC;;;;;;;;;;;;;;;OAeG;IACH,YAAY,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAElD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,YAAY,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAM3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAMjD;;;;;;;;;;OAUG;IACH,iBAAiB,IAAI,MAAM,EAAE,CAAC;IAE9B;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;CAC1D"}

package/dist/lib/auth-types.d.ts

@@ -0,0 +1,351 @@
+/**
+ * Standardized authentication types for v3.0.0
+ *
+ * These types ensure consistent interfaces across all auth providers,
+ * eliminating leaky abstractions where consumers needed to know about
+ * provider-specific token storage (__raw vs idToken) or claim structures.
+ *
+ * @module @memberjunction/ng-auth-services
+ * @version 3.0.0
+ */
+/**
+ * Standardized user information returned by all auth providers
+ *
+ * Maps provider-specific claims to a consistent structure.
+ * Each provider implements extractUserInfoInternal() to convert their
+ * claim format to this standard structure.
+ *
+ * @example
+ * ```typescript
+ * const userInfo = await firstValueFrom(this.authBase.getUserInfo());
+ * console.log(`Welcome ${userInfo.name}!`);
+ * console.log(`Email: ${userInfo.email}`);
+ * ```
+ */
+export interface StandardUserInfo {
+    /**
+     * Unique user identifier from the auth provider
+     * (e.g., Auth0: user.sub, MSAL: account.localAccountId)
+     */
+    id: string;
+    /**
+     * User's email address
+     */
+    email: string;
+    /**
+     * User's full display name
+     */
+    name: string;
+    /**
+     * User's given name / first name
+     */
+    givenName?: string;
+    /**
+     * User's family name / last name
+     */
+    familyName?: string;
+    /**
+     * Preferred username or handle
+     * Often the same as email for most providers
+     */
+    preferredUsername?: string;
+    /**
+     * URL to user's profile picture (if available)
+     */
+    pictureUrl?: string;
+    /**
+     * User's locale/language preference
+     * (e.g., "en-US", "fr-FR")
+     */
+    locale?: string;
+    /**
+     * Email verification status
+     * True if the auth provider has verified the user's email
+     */
+    emailVerified?: boolean;
+}
+/**
+ * Standardized token information returned by all auth providers
+ *
+ * Provides access to tokens without exposing provider-specific claim structures.
+ * Each provider implements extractTokenInfoInternal() to extract tokens from
+ * their specific storage format.
+ *
+ * @example
+ * ```typescript
+ * const tokenInfo = await this.authBase.getTokenInfo();
+ * console.log(`Token expires at: ${new Date(tokenInfo.expiresAt)}`);
+ * ```
+ */
+export interface StandardAuthToken {
+    /**
+     * The ID token as a JWT string
+     *
+     * This is what should be sent to the backend GraphQL API in the
+     * Authorization header as "Bearer {idToken}"
+     */
+    idToken: string;
+    /**
+     * Access token for calling APIs (if different from ID token)
+     *
+     * Some providers (like Auth0) use the same token for both authentication
+     * and API access. Others (like MSAL) provide separate tokens.
+     */
+    accessToken?: string;
+    /**
+     * Token expiration timestamp (milliseconds since epoch)
+     *
+     * Use this to determine if the token needs to be refreshed.
+     *
+     * @example
+     * ```typescript
+     * const isExpired = Date.now() >= tokenInfo.expiresAt;
+     * if (isExpired) {
+     *   await this.authBase.refreshToken();
+     * }
+     * ```
+     */
+    expiresAt: number;
+    /**
+     * OAuth scopes granted with this token
+     *
+     * @example ["openid", "profile", "email", "User.Read"]
+     */
+    scopes?: string[];
+}
+/**
+ * Standardized authentication error types
+ *
+ * Abstracts provider-specific error names (like "BrowserAuthError",
+ * "InteractionRequiredAuthError") into semantic categories that
+ * application code can handle consistently.
+ *
+ * This eliminates the need for consumers to check provider-specific
+ * error properties like `err.name === 'BrowserAuthError'`.
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   await this.authBase.login();
+ * } catch (err) {
+ *   const authError = this.authBase.classifyError(err);
+ *
+ *   switch (authError.type) {
+ *     case AuthErrorType.TOKEN_EXPIRED:
+ *       this.showMessage('Session expired. Please log in again.');
+ *       break;
+ *     case AuthErrorType.USER_CANCELLED:
+ *       // User cancelled - don't show error
+ *       break;
+ *     default:
+ *       this.showError(authError.userMessage);
+ *   }
+ * }
+ * ```
+ */
+export declare enum AuthErrorType {
+    /**
+     * Token has expired - user needs to refresh or re-authenticate
+     *
+     * Mapped from:
+     * - Auth0: "jwt expired", "token expired"
+     * - MSAL: InteractionRequiredAuthError (when token expired)
+     * - Okta: "token_expired"
+     */
+    TOKEN_EXPIRED = "TOKEN_EXPIRED",
+    /**
+     * No active user session found - user needs to log in
+     *
+     * Mapped from:
+     * - Auth0: "login_required", "no active session"
+     * - MSAL: BrowserAuthError (no accounts)
+     * - Okta: "login_required"
+     */
+    NO_ACTIVE_SESSION = "NO_ACTIVE_SESSION",
+    /**
+     * User interaction required (e.g., consent, MFA)
+     *
+     * Mapped from:
+     * - Auth0: "consent_required", "interaction_required"
+     * - MSAL: InteractionRequiredAuthError
+     * - Okta: "consent_required"
+     */
+    INTERACTION_REQUIRED = "INTERACTION_REQUIRED",
+    /**
+     * User cancelled the authentication flow
+     *
+     * Typically doesn't require showing an error message to the user,
+     * as the cancellation was intentional.
+     */
+    USER_CANCELLED = "USER_CANCELLED",
+    /**
+     * Network error communicating with auth provider
+     *
+     * Could be DNS failure, timeout, or other connectivity issues.
+     */
+    NETWORK_ERROR = "NETWORK_ERROR",
+    /**
+     * Invalid configuration or setup error
+     *
+     * Usually indicates a problem with the auth provider configuration
+     * (wrong client ID, invalid redirect URI, etc.)
+     */
+    CONFIGURATION_ERROR = "CONFIGURATION_ERROR",
+    /**
+     * Generic/unknown error
+     *
+     * Used when the error doesn't fit into any other category.
+     * The error message and originalError should provide more details.
+     */
+    UNKNOWN_ERROR = "UNKNOWN_ERROR"
+}
+/**
+ * Standardized auth error with categorization
+ *
+ * Provides both machine-readable error types and human-readable messages.
+ * Each provider implements classifyErrorInternal() to map their specific
+ * errors to this standard format.
+ *
+ * @example
+ * ```typescript
+ * const authError = this.authBase.classifyError(err);
+ *
+ * // Log for debugging
+ * console.error(`Auth error (${authError.type}):`, authError.message);
+ *
+ * // Show to user
+ * this.showErrorMessage(authError.userMessage || authError.message);
+ *
+ * // Access original error for detailed debugging
+ * if (environment.debug) {
+ *   console.error('Original error:', authError.originalError);
+ * }
+ * ```
+ */
+export interface StandardAuthError {
+    /**
+     * Semantic error type for programmatic handling
+     *
+     * Use this in switch statements or if conditions to handle
+     * different error scenarios appropriately.
+     */
+    type: AuthErrorType;
+    /**
+     * Technical error message
+     *
+     * Suitable for logging and debugging. May contain technical details
+     * not appropriate for end users.
+     */
+    message: string;
+    /**
+     * Original error from the provider (for debugging)
+     *
+     * Preserved for detailed error analysis and debugging.
+     * Can be any type (Error, object, string, etc.)
+     */
+    originalError?: unknown;
+    /**
+     * User-friendly error message
+     *
+     * A message suitable for displaying to end users.
+     * Explains the error in plain language and may suggest next steps.
+     *
+     * @example "Your session has expired. Please log in again."
+     */
+    userMessage?: string;
+}
+/**
+ * Token refresh result
+ *
+ * Returned by refreshToken() to indicate success or failure.
+ * Consumers should check the success property before accessing the token.
+ *
+ * @example
+ * ```typescript
+ * const result = await this.authBase.refreshToken();
+ *
+ * if (result.success && result.token) {
+ *   // Use the refreshed token
+ *   const newIdToken = result.token.idToken;
+ *   await this.updateGraphQLClient(newIdToken);
+ * } else {
+ *   // Handle refresh failure
+ *   console.error('Token refresh failed:', result.error?.message);
+ *
+ *   if (result.error?.type === AuthErrorType.TOKEN_EXPIRED) {
+ *     // Token is expired and can't be refreshed - need re-login
+ *     await this.authBase.login();
+ *   }
+ * }
+ * ```
+ */
+export interface TokenRefreshResult {
+    /**
+     * Whether the refresh was successful
+     *
+     * If true, the token property will contain the new token.
+     * If false, the error property will explain why.
+     */
+    success: boolean;
+    /**
+     * New token if refresh succeeded
+     *
+     * Only present when success is true.
+     */
+    token?: StandardAuthToken;
+    /**
+     * Error if refresh failed
+     *
+     * Only present when success is false.
+     * Contains details about why the refresh failed.
+     */
+    error?: StandardAuthError;
+}
+/**
+ * Authentication state snapshot
+ *
+ * Represents the current authentication state of the application.
+ * This is useful for components that need to react to auth state changes.
+ *
+ * @example
+ * ```typescript
+ * // Subscribe to complete auth state
+ * this.authState$ = this.authBase.getAuthState();
+ *
+ * this.authState$.subscribe(state => {
+ *   if (state.isLoading) {
+ *     this.showLoadingSpinner();
+ *   } else if (state.isAuthenticated && state.user) {
+ *     this.showWelcomeMessage(state.user.name);
+ *   } else if (state.error) {
+ *     this.showError(state.error.userMessage);
+ *   }
+ * });
+ * ```
+ */
+export interface AuthState {
+    /**
+     * Whether user is currently authenticated
+     */
+    isAuthenticated: boolean;
+    /**
+     * Current user info (if authenticated)
+     *
+     * Undefined if not authenticated or still loading.
+     */
+    user?: StandardUserInfo;
+    /**
+     * Whether auth state is still being determined
+     *
+     * True during initial authentication check or token refresh.
+     * Useful for showing loading spinners.
+     */
+    isLoading: boolean;
+    /**
+     * Current error (if any)
+     *
+     * Present if there was an error during authentication or token refresh.
+     */
+    error?: StandardAuthError;
+}
+//# sourceMappingURL=auth-types.d.ts.map

package/dist/lib/auth-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-types.d.ts","sourceRoot":"","sources":["../../src/lib/auth-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,aAAa;IACvB;;;;;;;OAOG;IACH,aAAa,kBAAkB;IAE/B;;;;;;;OAOG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;;;OAOG;IACH,oBAAoB,yBAAyB;IAE7C;;;;;OAKG;IACH,cAAc,mBAAmB;IAEjC;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAE3C;;;;;OAKG;IACH,aAAa,kBAAkB;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,EAAE,aAAa,CAAC;IAEpB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAE1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B"}

package/dist/lib/auth-types.js

@@ -0,0 +1,98 @@
+/**
+ * Standardized authentication types for v3.0.0
+ *
+ * These types ensure consistent interfaces across all auth providers,
+ * eliminating leaky abstractions where consumers needed to know about
+ * provider-specific token storage (__raw vs idToken) or claim structures.
+ *
+ * @module @memberjunction/ng-auth-services
+ * @version 3.0.0
+ */
+/**
+ * Standardized authentication error types
+ *
+ * Abstracts provider-specific error names (like "BrowserAuthError",
+ * "InteractionRequiredAuthError") into semantic categories that
+ * application code can handle consistently.
+ *
+ * This eliminates the need for consumers to check provider-specific
+ * error properties like `err.name === 'BrowserAuthError'`.
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   await this.authBase.login();
+ * } catch (err) {
+ *   const authError = this.authBase.classifyError(err);
+ *
+ *   switch (authError.type) {
+ *     case AuthErrorType.TOKEN_EXPIRED:
+ *       this.showMessage('Session expired. Please log in again.');
+ *       break;
+ *     case AuthErrorType.USER_CANCELLED:
+ *       // User cancelled - don't show error
+ *       break;
+ *     default:
+ *       this.showError(authError.userMessage);
+ *   }
+ * }
+ * ```
+ */
+export var AuthErrorType;
+(function (AuthErrorType) {
+    /**
+     * Token has expired - user needs to refresh or re-authenticate
+     *
+     * Mapped from:
+     * - Auth0: "jwt expired", "token expired"
+     * - MSAL: InteractionRequiredAuthError (when token expired)
+     * - Okta: "token_expired"
+     */
+    AuthErrorType["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
+    /**
+     * No active user session found - user needs to log in
+     *
+     * Mapped from:
+     * - Auth0: "login_required", "no active session"
+     * - MSAL: BrowserAuthError (no accounts)
+     * - Okta: "login_required"
+     */
+    AuthErrorType["NO_ACTIVE_SESSION"] = "NO_ACTIVE_SESSION";
+    /**
+     * User interaction required (e.g., consent, MFA)
+     *
+     * Mapped from:
+     * - Auth0: "consent_required", "interaction_required"
+     * - MSAL: InteractionRequiredAuthError
+     * - Okta: "consent_required"
+     */
+    AuthErrorType["INTERACTION_REQUIRED"] = "INTERACTION_REQUIRED";
+    /**
+     * User cancelled the authentication flow
+     *
+     * Typically doesn't require showing an error message to the user,
+     * as the cancellation was intentional.
+     */
+    AuthErrorType["USER_CANCELLED"] = "USER_CANCELLED";
+    /**
+     * Network error communicating with auth provider
+     *
+     * Could be DNS failure, timeout, or other connectivity issues.
+     */
+    AuthErrorType["NETWORK_ERROR"] = "NETWORK_ERROR";
+    /**
+     * Invalid configuration or setup error
+     *
+     * Usually indicates a problem with the auth provider configuration
+     * (wrong client ID, invalid redirect URI, etc.)
+     */
+    AuthErrorType["CONFIGURATION_ERROR"] = "CONFIGURATION_ERROR";
+    /**
+     * Generic/unknown error
+     *
+     * Used when the error doesn't fit into any other category.
+     * The error message and originalError should provide more details.
+     */
+    AuthErrorType["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
+})(AuthErrorType || (AuthErrorType = {}));
+//# sourceMappingURL=auth-types.js.map

package/dist/lib/auth-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-types.js","sourceRoot":"","sources":["../../src/lib/auth-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAwHH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAN,IAAY,aA6DX;AA7DD,WAAY,aAAa;IACvB;;;;;;;OAOG;IACH,gDAA+B,CAAA;IAE/B;;;;;;;OAOG;IACH,wDAAuC,CAAA;IAEvC;;;;;;;OAOG;IACH,8DAA6C,CAAA;IAE7C;;;;;OAKG;IACH,kDAAiC,CAAA;IAEjC;;;;OAIG;IACH,gDAA+B,CAAA;IAE/B;;;;;OAKG;IACH,4DAA2C,CAAA;IAE3C;;;;;OAKG;IACH,gDAA+B,CAAA;AACjC,CAAC,EA7DW,aAAa,KAAb,aAAa,QA6DxB"}