@memberjunction/ng-auth-services 5.13.0 → 5.15.0

package/dist/lib/providers/mjexplorer-auth0-provider.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mjexplorer-auth0-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-auth0-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAiB,SAAS,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1J,OAAO,EAAkB,cAAc,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,UAAU;;IA+C1B;IA9CnB,MAAM,CAAU,aAAa,GAAG,OAAO,CAAC;IAC/B,IAAI,GAAG,iBAAe,CAAC,aAAa,CAAC;IACtC,YAAY,GAAG,KAAK,CAAC;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE;QACvE,gDAAgD;QAChD,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAElF,OAAO;YACL,WAAW;YACX,SAAS;YACT;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,QAAQ,EAAE;oBACR,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC;oBACnC,QAAQ,EAAE,WAAW,CAAC,gBAAgB,CAAC;oBACvC,mBAAmB,EAAE;wBACnB,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;wBACpC,KAAK,EAAE,qCAAqC;wBAC5C,yEAAyE;wBACzE,iEAAiE;qBAClE;oBACD,aAAa,EAAE,cAAc;oBAC7B,mFAAmF;oBACnF,gBAAgB,EAAE,IAAI;oBACtB,kDAAkD;oBAClD,wBAAwB,EAAE,IAAI;oBAC9B,4EAA4E;oBAC5E,8EAA8E;oBAC9E,0EAA0E;oBAC1E,6DAA6D;oBAC7D,oBAAoB,EAAE,kBAAkB;iBACzC;aACF;YACD;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,kBAAkB,CAAC,YAAY;gBAC3C,IAAI,EAAE,CAAC,gBAAgB,CAAC;aACzB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,YAAmB,IAAiB;QAClC,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,iBAAe,CAAC,aAAa;YACnC,IAAI,EAAE,iBAAe,CAAC,aAAa;SACpC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;IAMpC,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,mEAAmE;QACnE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAC3B,IAAI,CAAC,CAAC,CAAC,CACR,CAAC,CAAC;QAEH,mCAAmC;QACnC,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEzE,6DAA6D;QAC7D,wEAAwE;QACxE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,kEAAkE;QAClE,iDAAiD;IACnD,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,kDAAkD;YAClD,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B;gBACzE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YAEtD,yCAAyC;YACzC,qFAAqF;YACrF,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC;gBACpD,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC,CAAC;YAEJ,0DAA0D;YAC1D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAEvD,oDAAoD;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,0DAA0D;wBACnE,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE;gBAC9C,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aACnD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAEtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAW,IAAI,EAAE,CAAC;QAEtD,0CAA0C;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,iCAAiC;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,kBAAkB,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,2DAA2D;aACzE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,IAAU;QACvC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,iBAAiB,EAAE,IAAI,CAAC,QAAQ;YAChC,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,iDAAiD;QACjD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;yGA7WU,eAAe;gEAAf,eAAe,WAAf,eAAe,mBAHd,MAAM;;AAGP,eAAe;IAD3B,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC;GACtB,eAAe,CA8W3B;;iFA9WY,eAAe;cAJ3B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { AuthService, IdToken, User, AuthGuard, AuthConfigService, Auth0ClientService, Auth0ClientFactory, AuthClientConfig } from '@auth0/auth0-angular';\nimport { Observable, of, firstValueFrom } from 'rxjs';\nimport { take, filter } from 'rxjs/operators';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n  StandardUserInfo,\n  StandardAuthToken,\n  StandardAuthError,\n  AuthErrorType,\n  TokenRefreshResult\n} from '../auth-types';\n/**\n * Auth0 authentication provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide Auth0-specific details.\n * The key abstraction is that Auth0 stores the JWT in `idTokenClaims.__raw`,\n * but consumers never need to know this detail.\n */\n@Injectable({\n  providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'auth0')\nexport class MJAuth0Provider extends MJAuthBase {\n  static readonly PROVIDER_TYPE = 'auth0';\n  readonly type = MJAuth0Provider.PROVIDER_TYPE;\n  private _initialized = false;\n\n  /**\n   * Factory function to provide Angular dependencies required by Auth0\n   * Stored as a static property for the factory to access without instantiation\n   */\n  static angularProviderFactory = (environment: Record<string, unknown>) => {\n    // Check if we're on the MCP OAuth callback path\n    const isMCPOAuthCallback = window.location.pathname.startsWith('/oauth/callback');\n\n    return [\n      AuthService,\n      AuthGuard,\n      {\n        provide: AuthConfigService,\n        useValue: {\n          domain: environment['AUTH0_DOMAIN'],\n          clientId: environment['AUTH0_CLIENTID'],\n          authorizationParams: {\n            redirect_uri: window.location.origin,\n            scope: 'openid profile email offline_access',\n            // No audience parameter - uses ID tokens (matches pre-refactor behavior)\n            // ID tokens have aud=clientId by default and contain user claims\n          },\n          cacheLocation: 'localstorage',\n          // Enable refresh tokens so we can refresh without relying on Auth0 session cookies\n          useRefreshTokens: true,\n          // Use rotating refresh tokens for better security\n          useRefreshTokensFallback: true,\n          // CRITICAL: Skip Auth0's redirect callback handling for MCP OAuth callbacks\n          // The /oauth/callback path is used by MCP OAuth, not Auth0. If we don't skip,\n          // Auth0 will consume the code parameter and redirect to /, preventing the\n          // OAuthCallbackComponent from processing the MCP OAuth flow.\n          skipRedirectCallback: isMCPOAuthCallback,\n        },\n      },\n      {\n        provide: Auth0ClientService,\n        useFactory: Auth0ClientFactory.createClient,\n        deps: [AuthClientConfig],\n      }\n    ];\n  };\n\n  constructor(public auth: AuthService) {\n    const config: AngularAuthProviderConfig = {\n      name: MJAuth0Provider.PROVIDER_TYPE,\n      type: MJAuth0Provider.PROVIDER_TYPE\n    };\n    super(config);\n  }\n\n  // ============================================================================\n  // LIFECYCLE METHODS\n  // ============================================================================\n\n  async initialize(): Promise<void> {\n    if (this._initialized) {\n      return;\n    }\n\n    // CRITICAL: Wait for Auth0 SDK to process any redirect callback\n    // The SDK handles this internally and updates isLoading$ when done\n    await firstValueFrom(this.auth.isLoading$.pipe(\n      filter(loading => !loading),\n      take(1)\n    ));\n\n    // Get current authentication state\n    const isAuthenticated = await firstValueFrom(this.auth.isAuthenticated$);\n\n    // CRITICAL: Get current user BEFORE setting up subscriptions\n    // This ensures userInfo$ has a value before app.component.ts subscribes\n    if (isAuthenticated) {\n      const user = await firstValueFrom(this.auth.user$);\n      if (user) {\n        const userInfo = this.mapAuth0UserToStandard(user);\n        this.updateUserInfo(userInfo);\n      }\n    }\n\n    // Subscribe to authentication state and user info for future changes\n    this.auth.isAuthenticated$.subscribe((loggedIn) => {\n      this.updateAuthState(loggedIn);\n    });\n\n    this.auth.user$.subscribe((user) => {\n      if (user) {\n        const userInfo = this.mapAuth0UserToStandard(user);\n        this.updateUserInfo(userInfo);\n      } else {\n        this.updateUserInfo(null);\n      }\n    });\n\n    this._initialized = true;\n  }\n\n  protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n    await this.ensureInitialized();\n    this.auth.loginWithRedirect(options);\n  }\n\n  async logout(): Promise<void> {\n    this.auth.logout({ logoutParams: { returnTo: document.location.origin } });\n  }\n\n  async handleCallback(): Promise<void> {\n    // Auth0 Angular SDK handles callbacks internally via interceptors\n    // This method exists for interface compatibility\n  }\n\n  // ============================================================================\n  // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n  // ============================================================================\n\n  /**\n   * Extract ID token from Auth0's storage\n   *\n   * Auth0 stores the JWT string in idTokenClaims.__raw\n   * This is the key abstraction - consumers never need to know about __raw!\n   */\n  protected async extractIdTokenInternal(): Promise<string | null> {\n    try {\n      const claims = await firstValueFrom(this.auth.idTokenClaims$);\n      // Auth0-specific detail: JWT is in __raw property\n      return claims?.__raw || null;\n    } catch (error) {\n      console.error('[Auth0] Error extracting ID token:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract complete token info from Auth0\n   *\n   * Maps Auth0's token structure to StandardAuthToken\n   */\n  protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n    try {\n      const claims = await firstValueFrom(this.auth.idTokenClaims$);\n      if (!claims) {\n        return null;\n      }\n\n      const idToken = claims.__raw;\n      if (!idToken) {\n        return null;\n      }\n\n      return {\n        idToken,\n        expiresAt: claims.exp ? claims.exp * 1000 : 0, // Convert to milliseconds\n        scopes: claims.scope ? claims.scope.split(' ') : undefined\n      };\n    } catch (error) {\n      console.error('[Auth0] Error extracting token info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract user info from Auth0 claims\n   *\n   * Maps Auth0's user object structure to StandardUserInfo\n   */\n  protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n    try {\n      const user = await firstValueFrom(this.auth.user$);\n      if (!user) {\n        return null;\n      }\n\n      return this.mapAuth0UserToStandard(user);\n    } catch (error) {\n      console.error('[Auth0] Error extracting user info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Refresh token using Auth0's silent authentication\n   *\n   * Uses cacheMode: 'off' to bypass cache and force token refresh\n   * With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n   */\n  protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n    try {\n      console.log('[Auth0] Attempting to refresh token...');\n\n      // Force token refresh by bypassing cache\n      // With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n      await firstValueFrom(this.auth.getAccessTokenSilently({\n        cacheMode: 'off'\n      }));\n\n      // Small delay to ensure Auth0 SDK has updated observables\n      await new Promise(resolve => setTimeout(resolve, 100));\n\n      // Extract fresh token info from updated observables\n      const token = await this.extractTokenInfoInternal();\n\n      if (!token) {\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'Token refresh succeeded but could not extract token info',\n            userMessage: 'Session refresh failed. Please log in again.'\n          }\n        };\n      }\n\n      console.log('[Auth0] Token refresh successful', {\n        expiresAt: new Date(token.expiresAt).toISOString()\n      });\n\n      return {\n        success: true,\n        token\n      };\n    } catch (error) {\n      console.error('[Auth0] Token refresh failed:', error);\n\n      return {\n        success: false,\n        error: this.classifyErrorInternal(error)\n      };\n    }\n  }\n\n  /**\n   * Classify Auth0-specific errors into semantic types\n   *\n   * Maps Auth0 error patterns to AuthErrorType enum\n   */\n  protected classifyErrorInternal(error: unknown): StandardAuthError {\n    const errorObj = error as Record<string, unknown>;\n    const message = errorObj?.['message'] as string || 'Unknown error';\n    const errorType = errorObj?.['error'] as string || '';\n\n    // Check for specific Auth0 error patterns\n    if (message.includes('jwt expired') || message.includes('token expired')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (errorType === 'login_required' || message.includes('login_required')) {\n      return {\n        type: AuthErrorType.NO_ACTIVE_SESSION,\n        message,\n        originalError: error,\n        userMessage: 'You need to log in to continue.'\n      };\n    }\n\n    if (errorType === 'consent_required' || message.includes('consent_required')) {\n      return {\n        type: AuthErrorType.INTERACTION_REQUIRED,\n        message,\n        originalError: error,\n        userMessage: 'Additional permissions are required. Please log in again.'\n      };\n    }\n\n    if (message.includes('user closed') || message.includes('cancelled')) {\n      return {\n        type: AuthErrorType.USER_CANCELLED,\n        message,\n        originalError: error,\n        userMessage: 'Login was cancelled.'\n      };\n    }\n\n    if (message.includes('network') || message.includes('fetch')) {\n      return {\n        type: AuthErrorType.NETWORK_ERROR,\n        message,\n        originalError: error,\n        userMessage: 'Network error. Please check your connection and try again.'\n      };\n    }\n\n    // Default to unknown error\n    return {\n      type: AuthErrorType.UNKNOWN_ERROR,\n      message,\n      originalError: error,\n      userMessage: 'An unexpected error occurred. Please try again.'\n    };\n  }\n\n  // ============================================================================\n  // HELPER METHODS\n  // ============================================================================\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this._initialized) {\n      await this.initialize();\n    }\n  }\n\n  /**\n   * Map Auth0 User object to StandardUserInfo\n   */\n  private mapAuth0UserToStandard(user: User): StandardUserInfo {\n    return {\n      id: user.sub || '',\n      email: user.email || '',\n      name: user.name || '',\n      givenName: user.given_name,\n      familyName: user.family_name,\n      preferredUsername: user.nickname,\n      pictureUrl: user.picture,\n      locale: user.locale,\n      emailVerified: user.email_verified\n    };\n  }\n\n  /**\n   * Get profile picture URL from Auth0\n   *\n   * Auth0 includes the picture URL directly in user claims.\n   * No additional API call needed.\n   */\n  protected async getProfilePictureUrlInternal(): Promise<string | null> {\n    try {\n      const user = await firstValueFrom(this.auth.user$);\n      return user?.picture || null;\n    } catch (error) {\n      console.error('[Auth0] Error getting profile picture:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Handle session expiry - no-op for Auth0\n   *\n   * Auth0 uses refresh tokens (offline_access scope), so it doesn't need\n   * interactive re-authentication when tokens expire. If refresh fails,\n   * the base class will throw an error and the user must log out/in manually.\n   */\n  protected async handleSessionExpiryInternal(): Promise<void> {\n    // No-op - Auth0 doesn't need interactive re-auth\n    return;\n  }\n\n  // ============================================================================\n  // CONFIGURATION\n  // ============================================================================\n\n  override getRequiredConfig(): string[] {\n    return ['clientId', 'domain'];\n  }\n\n  override validateConfig(_config: Record<string, unknown>): boolean {\n    // Auth0 configuration is handled by Angular module providers\n    return true;\n  }\n}\n"]}
+{"version":3,"file":"mjexplorer-auth0-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-auth0-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAiB,SAAS,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1J,OAAO,EAAkB,cAAc,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,UAAU;;IA+C1B;IA9CnB,MAAM,CAAU,aAAa,GAAG,OAAO,CAAC;IAC/B,IAAI,GAAG,iBAAe,CAAC,aAAa,CAAC;IACtC,YAAY,GAAG,KAAK,CAAC;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE;QACvE,gDAAgD;QAChD,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAElF,OAAO;YACL,WAAW;YACX,SAAS;YACT;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,QAAQ,EAAE;oBACR,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC;oBACnC,QAAQ,EAAE,WAAW,CAAC,gBAAgB,CAAC;oBACvC,mBAAmB,EAAE;wBACnB,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;wBACpC,KAAK,EAAE,qCAAqC;wBAC5C,yEAAyE;wBACzE,iEAAiE;qBAClE;oBACD,aAAa,EAAE,cAAc;oBAC7B,mFAAmF;oBACnF,gBAAgB,EAAE,IAAI;oBACtB,kDAAkD;oBAClD,wBAAwB,EAAE,IAAI;oBAC9B,4EAA4E;oBAC5E,8EAA8E;oBAC9E,0EAA0E;oBAC1E,6DAA6D;oBAC7D,oBAAoB,EAAE,kBAAkB;iBACzC;aACF;YACD;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,kBAAkB,CAAC,YAAY;gBAC3C,IAAI,EAAE,CAAC,gBAAgB,CAAC;aACzB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,YAAmB,IAAiB;QAClC,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,iBAAe,CAAC,aAAa;YACnC,IAAI,EAAE,iBAAe,CAAC,aAAa;SACpC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;IAMpC,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,mEAAmE;QACnE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAC3B,IAAI,CAAC,CAAC,CAAC,CACR,CAAC,CAAC;QAEH,mCAAmC;QACnC,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEzE,6DAA6D;QAC7D,wEAAwE;QACxE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,mFAAmF;QACnF,IAAI,CAAC;YACH,MAAM,cAAc,CAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAC3E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,kEAAkE;QAClE,iDAAiD;IACnD,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,kDAAkD;YAClD,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B;gBACzE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YAEtD,yCAAyC;YACzC,qFAAqF;YACrF,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC;gBACpD,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC,CAAC;YAEJ,0DAA0D;YAC1D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAEvD,oDAAoD;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,0DAA0D;wBACnE,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE;gBAC9C,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aACnD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAEtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAW,IAAI,EAAE,CAAC;QAEtD,0CAA0C;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,iCAAiC;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,kBAAkB,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,2DAA2D;aACzE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,IAAU;QACvC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,iBAAiB,EAAE,IAAI,CAAC,QAAQ;YAChC,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,iDAAiD;QACjD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;yGApXU,eAAe;gEAAf,eAAe,WAAf,eAAe,mBAHd,MAAM;;AAGP,eAAe;IAD3B,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC;GACtB,eAAe,CAqX3B;;iFArXY,eAAe;cAJ3B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { AuthService, IdToken, User, AuthGuard, AuthConfigService, Auth0ClientService, Auth0ClientFactory, AuthClientConfig } from '@auth0/auth0-angular';\nimport { Observable, of, firstValueFrom } from 'rxjs';\nimport { take, filter } from 'rxjs/operators';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n  StandardUserInfo,\n  StandardAuthToken,\n  StandardAuthError,\n  AuthErrorType,\n  TokenRefreshResult\n} from '../auth-types';\n/**\n * Auth0 authentication provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide Auth0-specific details.\n * The key abstraction is that Auth0 stores the JWT in `idTokenClaims.__raw`,\n * but consumers never need to know this detail.\n */\n@Injectable({\n  providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'auth0')\nexport class MJAuth0Provider extends MJAuthBase {\n  static readonly PROVIDER_TYPE = 'auth0';\n  readonly type = MJAuth0Provider.PROVIDER_TYPE;\n  private _initialized = false;\n\n  /**\n   * Factory function to provide Angular dependencies required by Auth0\n   * Stored as a static property for the factory to access without instantiation\n   */\n  static angularProviderFactory = (environment: Record<string, unknown>) => {\n    // Check if we're on the MCP OAuth callback path\n    const isMCPOAuthCallback = window.location.pathname.startsWith('/oauth/callback');\n\n    return [\n      AuthService,\n      AuthGuard,\n      {\n        provide: AuthConfigService,\n        useValue: {\n          domain: environment['AUTH0_DOMAIN'],\n          clientId: environment['AUTH0_CLIENTID'],\n          authorizationParams: {\n            redirect_uri: window.location.origin,\n            scope: 'openid profile email offline_access',\n            // No audience parameter - uses ID tokens (matches pre-refactor behavior)\n            // ID tokens have aud=clientId by default and contain user claims\n          },\n          cacheLocation: 'localstorage',\n          // Enable refresh tokens so we can refresh without relying on Auth0 session cookies\n          useRefreshTokens: true,\n          // Use rotating refresh tokens for better security\n          useRefreshTokensFallback: true,\n          // CRITICAL: Skip Auth0's redirect callback handling for MCP OAuth callbacks\n          // The /oauth/callback path is used by MCP OAuth, not Auth0. If we don't skip,\n          // Auth0 will consume the code parameter and redirect to /, preventing the\n          // OAuthCallbackComponent from processing the MCP OAuth flow.\n          skipRedirectCallback: isMCPOAuthCallback,\n        },\n      },\n      {\n        provide: Auth0ClientService,\n        useFactory: Auth0ClientFactory.createClient,\n        deps: [AuthClientConfig],\n      }\n    ];\n  };\n\n  constructor(public auth: AuthService) {\n    const config: AngularAuthProviderConfig = {\n      name: MJAuth0Provider.PROVIDER_TYPE,\n      type: MJAuth0Provider.PROVIDER_TYPE\n    };\n    super(config);\n  }\n\n  // ============================================================================\n  // LIFECYCLE METHODS\n  // ============================================================================\n\n  async initialize(): Promise<void> {\n    if (this._initialized) {\n      return;\n    }\n\n    // CRITICAL: Wait for Auth0 SDK to process any redirect callback\n    // The SDK handles this internally and updates isLoading$ when done\n    await firstValueFrom(this.auth.isLoading$.pipe(\n      filter(loading => !loading),\n      take(1)\n    ));\n\n    // Get current authentication state\n    const isAuthenticated = await firstValueFrom(this.auth.isAuthenticated$);\n\n    // CRITICAL: Get current user BEFORE setting up subscriptions\n    // This ensures userInfo$ has a value before app.component.ts subscribes\n    if (isAuthenticated) {\n      const user = await firstValueFrom(this.auth.user$);\n      if (user) {\n        const userInfo = this.mapAuth0UserToStandard(user);\n        this.updateUserInfo(userInfo);\n      }\n    }\n\n    // Subscribe to authentication state and user info for future changes\n    this.auth.isAuthenticated$.subscribe((loggedIn) => {\n      this.updateAuthState(loggedIn);\n    });\n\n    this.auth.user$.subscribe((user) => {\n      if (user) {\n        const userInfo = this.mapAuth0UserToStandard(user);\n        this.updateUserInfo(userInfo);\n      } else {\n        this.updateUserInfo(null);\n      }\n    });\n\n    this._initialized = true;\n  }\n\n  protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n    await this.ensureInitialized();\n    this.auth.loginWithRedirect(options);\n  }\n\n  protected async logoutInternal(): Promise<void> {\n    // Subscribe to the Observable so Auth0 Angular SDK v2's authState.refresh() fires.\n    try {\n      await firstValueFrom(\n        this.auth.logout({ logoutParams: { returnTo: document.location.origin } })\n      );\n    } catch {\n      // Expected when Auth0 redirects the browser before the Observable completes.\n    }\n  }\n\n  async handleCallback(): Promise<void> {\n    // Auth0 Angular SDK handles callbacks internally via interceptors\n    // This method exists for interface compatibility\n  }\n\n  // ============================================================================\n  // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n  // ============================================================================\n\n  /**\n   * Extract ID token from Auth0's storage\n   *\n   * Auth0 stores the JWT string in idTokenClaims.__raw\n   * This is the key abstraction - consumers never need to know about __raw!\n   */\n  protected async extractIdTokenInternal(): Promise<string | null> {\n    try {\n      const claims = await firstValueFrom(this.auth.idTokenClaims$);\n      // Auth0-specific detail: JWT is in __raw property\n      return claims?.__raw || null;\n    } catch (error) {\n      console.error('[Auth0] Error extracting ID token:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract complete token info from Auth0\n   *\n   * Maps Auth0's token structure to StandardAuthToken\n   */\n  protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n    try {\n      const claims = await firstValueFrom(this.auth.idTokenClaims$);\n      if (!claims) {\n        return null;\n      }\n\n      const idToken = claims.__raw;\n      if (!idToken) {\n        return null;\n      }\n\n      return {\n        idToken,\n        expiresAt: claims.exp ? claims.exp * 1000 : 0, // Convert to milliseconds\n        scopes: claims.scope ? claims.scope.split(' ') : undefined\n      };\n    } catch (error) {\n      console.error('[Auth0] Error extracting token info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract user info from Auth0 claims\n   *\n   * Maps Auth0's user object structure to StandardUserInfo\n   */\n  protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n    try {\n      const user = await firstValueFrom(this.auth.user$);\n      if (!user) {\n        return null;\n      }\n\n      return this.mapAuth0UserToStandard(user);\n    } catch (error) {\n      console.error('[Auth0] Error extracting user info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Refresh token using Auth0's silent authentication\n   *\n   * Uses cacheMode: 'off' to bypass cache and force token refresh\n   * With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n   */\n  protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n    try {\n      console.log('[Auth0] Attempting to refresh token...');\n\n      // Force token refresh by bypassing cache\n      // With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n      await firstValueFrom(this.auth.getAccessTokenSilently({\n        cacheMode: 'off'\n      }));\n\n      // Small delay to ensure Auth0 SDK has updated observables\n      await new Promise(resolve => setTimeout(resolve, 100));\n\n      // Extract fresh token info from updated observables\n      const token = await this.extractTokenInfoInternal();\n\n      if (!token) {\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'Token refresh succeeded but could not extract token info',\n            userMessage: 'Session refresh failed. Please log in again.'\n          }\n        };\n      }\n\n      console.log('[Auth0] Token refresh successful', {\n        expiresAt: new Date(token.expiresAt).toISOString()\n      });\n\n      return {\n        success: true,\n        token\n      };\n    } catch (error) {\n      console.error('[Auth0] Token refresh failed:', error);\n\n      return {\n        success: false,\n        error: this.classifyErrorInternal(error)\n      };\n    }\n  }\n\n  /**\n   * Classify Auth0-specific errors into semantic types\n   *\n   * Maps Auth0 error patterns to AuthErrorType enum\n   */\n  protected classifyErrorInternal(error: unknown): StandardAuthError {\n    const errorObj = error as Record<string, unknown>;\n    const message = errorObj?.['message'] as string || 'Unknown error';\n    const errorType = errorObj?.['error'] as string || '';\n\n    // Check for specific Auth0 error patterns\n    if (message.includes('jwt expired') || message.includes('token expired')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (errorType === 'login_required' || message.includes('login_required')) {\n      return {\n        type: AuthErrorType.NO_ACTIVE_SESSION,\n        message,\n        originalError: error,\n        userMessage: 'You need to log in to continue.'\n      };\n    }\n\n    if (errorType === 'consent_required' || message.includes('consent_required')) {\n      return {\n        type: AuthErrorType.INTERACTION_REQUIRED,\n        message,\n        originalError: error,\n        userMessage: 'Additional permissions are required. Please log in again.'\n      };\n    }\n\n    if (message.includes('user closed') || message.includes('cancelled')) {\n      return {\n        type: AuthErrorType.USER_CANCELLED,\n        message,\n        originalError: error,\n        userMessage: 'Login was cancelled.'\n      };\n    }\n\n    if (message.includes('network') || message.includes('fetch')) {\n      return {\n        type: AuthErrorType.NETWORK_ERROR,\n        message,\n        originalError: error,\n        userMessage: 'Network error. Please check your connection and try again.'\n      };\n    }\n\n    // Default to unknown error\n    return {\n      type: AuthErrorType.UNKNOWN_ERROR,\n      message,\n      originalError: error,\n      userMessage: 'An unexpected error occurred. Please try again.'\n    };\n  }\n\n  // ============================================================================\n  // HELPER METHODS\n  // ============================================================================\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this._initialized) {\n      await this.initialize();\n    }\n  }\n\n  /**\n   * Map Auth0 User object to StandardUserInfo\n   */\n  private mapAuth0UserToStandard(user: User): StandardUserInfo {\n    return {\n      id: user.sub || '',\n      email: user.email || '',\n      name: user.name || '',\n      givenName: user.given_name,\n      familyName: user.family_name,\n      preferredUsername: user.nickname,\n      pictureUrl: user.picture,\n      locale: user.locale,\n      emailVerified: user.email_verified\n    };\n  }\n\n  /**\n   * Get profile picture URL from Auth0\n   *\n   * Auth0 includes the picture URL directly in user claims.\n   * No additional API call needed.\n   */\n  protected async getProfilePictureUrlInternal(): Promise<string | null> {\n    try {\n      const user = await firstValueFrom(this.auth.user$);\n      return user?.picture || null;\n    } catch (error) {\n      console.error('[Auth0] Error getting profile picture:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Handle session expiry - no-op for Auth0\n   *\n   * Auth0 uses refresh tokens (offline_access scope), so it doesn't need\n   * interactive re-authentication when tokens expire. If refresh fails,\n   * the base class will throw an error and the user must log out/in manually.\n   */\n  protected async handleSessionExpiryInternal(): Promise<void> {\n    // No-op - Auth0 doesn't need interactive re-auth\n    return;\n  }\n\n  // ============================================================================\n  // CONFIGURATION\n  // ============================================================================\n\n  override getRequiredConfig(): string[] {\n    return ['clientId', 'domain'];\n  }\n\n  override validateConfig(_config: Record<string, unknown>): boolean {\n    // Auth0 configuration is handled by Angular module providers\n    return true;\n  }\n}\n"]}

package/dist/lib/providers/mjexplorer-msal-provider.service.d.ts

@@ -47,7 +47,7 @@ export declare class MJMSALProvider extends MJAuthBase implements OnDestroy {
     initialize(): Promise<void>;
     private _performInitialization;
     protected loginInternal(options?: Record<string, unknown>): Promise<void>;
-    logout(): Promise<void>;
+    protected logoutInternal(): Promise<void>;
     handleCallback(): Promise<void>;
     /**
      * Extract ID token from MSAL's storage
@@ -73,8 +73,14 @@ export declare class MJMSALProvider extends MJAuthBase implements OnDestroy {
      *
      * MSAL 5.x Best Practices:
      * - Pass account parameter for reliable silent acquisition
-     * - Use CacheLookupPolicy.Default for efficient cache → refresh token → iframe chain
+     * - Use forceRefresh: true to bypass cache and get fresh tokens from Azure AD
      * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)
+     *
+     * IMPORTANT: This method is called when the server has already rejected the current
+     * token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a
+     * cached ID token that is still expired (e.g. when the access token has a longer
+     * lifetime than the ID token). forceRefresh: true ensures a network round-trip to
+     * Azure AD so both the access token and ID token are genuinely refreshed.
      */
     protected refreshTokenInternal(): Promise<TokenRefreshResult>;
     /**

package/dist/lib/providers/mjexplorer-msal-provider.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mjexplorer-msal-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,SAAS,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAA6D,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAuF,uBAAuB,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAGtL,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAW,YAAW,SAAS;IA+C9C,IAAI,EAAE,WAAW;IAAE,OAAO,CAAC,oBAAoB;IA9ClE,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAE7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,YAAY,CAA8B;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;SAiCnE;gBAEiB,IAAI,EAAE,WAAW,EAAU,oBAAoB,EAAE,oBAAoB;IAYlF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YASnB,sBAAsB;cAkEpB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBzE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAOvB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAUrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkDhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA4C7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAgB3E;;;;;;;OAOG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAsFnE;;;;;OAKG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;YAiHpD,iBAAiB;IAQ/B;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAepB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqCtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IASlE,WAAW,IAAI,IAAI;yCAnoBR,cAAc;6CAAd,cAAc;CAyoB1B"}
+{"version":3,"file":"mjexplorer-msal-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,SAAS,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAA6D,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAuF,uBAAuB,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAGtL,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAW,YAAW,SAAS;IA+C9C,IAAI,EAAE,WAAW;IAAE,OAAO,CAAC,oBAAoB;IA9ClE,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAE7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,YAAY,CAA8B;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;SAiCnE;gBAEiB,IAAI,EAAE,WAAW,EAAU,oBAAoB,EAAE,oBAAoB;IAYlF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YASnB,sBAAsB;cAkEpB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAqB/D,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAOzC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAUrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkDhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA4C7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAgB3E;;;;;;;;;;;;;OAaG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwGnE;;;;;OAKG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;YAiHpD,iBAAiB;IAQ/B;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAepB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqCtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IASlE,WAAW,IAAI,IAAI;yCA3pBR,cAAc;6CAAd,cAAc;CAiqB1B"}

package/dist/lib/providers/mjexplorer-msal-provider.service.js

@@ -160,7 +160,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
             });
         });
     }
-    async logout() {
+    async logoutInternal() {
         await this.ensureInitialized();
         this.auth.logoutRedirect().subscribe(() => {
             // Logout will trigger a redirect
@@ -293,8 +293,14 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
      *
      * MSAL 5.x Best Practices:
      * - Pass account parameter for reliable silent acquisition
-     * - Use CacheLookupPolicy.Default for efficient cache → refresh token → iframe chain
+     * - Use forceRefresh: true to bypass cache and get fresh tokens from Azure AD
      * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)
+     *
+     * IMPORTANT: This method is called when the server has already rejected the current
+     * token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a
+     * cached ID token that is still expired (e.g. when the access token has a longer
+     * lifetime than the ID token). forceRefresh: true ensures a network round-trip to
+     * Azure AD so both the access token and ID token are genuinely refreshed.
      */
     async refreshTokenInternal() {
         try {
@@ -311,11 +317,14 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
                 };
             }
             // MSAL 5.x: Pass account for reliable silent acquisition
-            // Use Default policy for efficient cache → refresh token → iframe chain
+            // Use forceRefresh to bypass cache and ensure a network round-trip.
+            // This is critical because this method is called after the server rejected
+            // the current token — returning a cached (potentially stale) ID token would
+            // cause the retry to fail with the same JWT_EXPIRED error.
             const response = await this.auth.instance.acquireTokenSilent({
                 scopes: ['User.Read', 'email', 'profile'],
                 account: account,
-                cacheLookupPolicy: CacheLookupPolicy.Default
+                forceRefresh: true
             });
             if (!response.idToken) {
                 return {
@@ -327,6 +336,20 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
                     }
                 };
             }
+            // Safety net: verify the refreshed token is actually valid.
+            // This should always pass after a forced refresh, but guards against
+            // edge cases like severe clock skew between client and Azure AD.
+            if (!this.isTokenValid(response.idToken)) {
+                console.warn('[MSAL] Forced refresh returned an expired ID token — requesting interaction');
+                return {
+                    success: false,
+                    error: {
+                        type: AuthErrorType.INTERACTION_REQUIRED,
+                        message: 'Token refresh returned an expired ID token',
+                        userMessage: 'Your session has expired. Redirecting to login...'
+                    }
+                };
+            }
             const token = {
                 idToken: response.idToken,
                 accessToken: response.accessToken,

package/dist/lib/providers/mjexplorer-msal-provider.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mjexplorer-msal-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAc,OAAO,EAAc,MAAM,EAA6B,SAAS,EAAQ,MAAM,MAAM,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtL,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IA+CzB;IAA2B;IA9C9C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IAE5B,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACnC,yBAAyB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACzE,YAAY,GAAyB,IAAI,CAAC;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI,uBAAuB,CAAC;gBACpC,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAW;oBAC5C,SAAS,EAAE,WAAW,CAAC,kBAAkB,CAAW;oBACpD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;iBACpC;gBACD,KAAK,EAAE;oBACL,aAAa,EAAE,cAAc;iBAC9B;aACF,CAAC;SACH;QACD;YACE,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,WAAW,EAAE;oBACX,MAAM,EAAE,CAAC,WAAW,CAAC;iBACtB;aACF;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;aACxF;SACF;QACD,WAAW;QACX,SAAS;QACT,oBAAoB;KACrB,CAAC;IAEF,YAAmB,IAAiB,EAAU,oBAA0C;QACtF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;QAAU,yBAAoB,GAApB,oBAAoB,CAAsB;IAMxF,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAElD,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACjD,mCAAmC;YACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAE3B,gCAAgC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAE3B,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,oBAAoB,CAAC,WAAW;aAClC,IAAI,CACH,MAAM,CAAC,CAAC,MAAyB,EAAE,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI,CAAC,EACxE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAC7B;aACA,SAAS,CAAC,GAAG,EAAE;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAEnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,GAAG,EAAE;oBACT,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,iCAAiC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6CAA6C;YAC7C,wDAAwD;YACxD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,4EAA4E;gBAC5E,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACzB,CAAC;gBAED,wDAAwD;gBACxD,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;wBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;wBACzC,OAAO,EAAE,OAAO;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;gBAClC,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,YAAY,CAAC,CAAC;oBAC5F,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,mDAAmD;YACnD,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,oDAAoD;gBACpD,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,CAAC,EAAE,6BAA6B;oBAC3C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,yBAAyB;wBAClC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,yDAAyD;YACzD,wEAAwE;YACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,OAAO;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,kDAAkD;wBAC3D,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAsB;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAErD,4DAA4D;YAC5D,kFAAkF;YAClF,2DAA2D;YAC3D,gDAAgD;YAChD,iDAAiD;YACjD,mEAAmE;YACnE,MAAM,SAAS,GAAI,KAAiC,EAAE,SAA+B,CAAC;YACtF,MAAM,wBAAwB,GAAG;gBAC/B,wBAAwB;gBACxB,WAAW;gBACX,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;gBAClB,wBAAwB,CAAE,kDAAkD;aAC7E,CAAC;YAEF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBACxG,uFAAuF;gBACvF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,uDAAuD,SAAS,IAAI,SAAS,GAAG;wBACzF,WAAW,EAAE,mDAAmD;wBAChE,aAAa,EAAE,KAAK;qBACrB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAE1D,sCAAsC;QACtC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,wBAAwB,EAAE,CAAC;gBAC3C,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,8CAA8C;YAC9C,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,cAAc;oBAClC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,sBAAsB;iBACpC,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,MAAM,wBAAwB,GAAG;gBAC/B,WAAW;gBACX,wBAAwB;gBACxB,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;aACnB,CAAC;YACF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4CAA4C;aAC1D,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,KAAa,EAAE,gBAAwB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC;YAC/D,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAoB;QACnD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa;YACnD,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,YAAY,CAAW;YAC1D,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,aAAa,CAAW;YAC5D,iBAAiB,EAAE,OAAO,CAAC,QAAQ;YACnC,aAAa,EAAE,IAAI,CAAC,yCAAyC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uCAAuC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;gBACpF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,WAAW,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAEhF,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,SAAS,CAAC;YACX,KAAK,EAAE,CAAC,aAAa,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,gFAAgF;QAChF,OAAO,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAE/E,WAAW;QACT,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;wGAxoBU,cAAc;gEAAd,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAyoB1B;;iFAzoBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable, OnDestroy } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { BehaviorSubject, Observable, Subject, catchError, filter, from, map, of, throwError, takeUntil, take } from 'rxjs';\nimport { MsalBroadcastService, MsalService, MSAL_INSTANCE, MSAL_GUARD_CONFIG, MSAL_INTERCEPTOR_CONFIG, MsalGuard } from '@azure/msal-angular';\nimport { AccountInfo, AuthenticationResult } from '@azure/msal-common';\nimport { CacheLookupPolicy, ClientAuthError, InteractionRequiredAuthError, InteractionStatus, PublicClientApplication, InteractionType, BrowserAuthError } from '@azure/msal-browser';\nimport { LogError } from '@memberjunction/core';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n  StandardUserInfo,\n  StandardAuthToken,\n  StandardAuthError,\n  AuthErrorType,\n  TokenRefreshResult\n} from '../auth-types';\n/**\n * MSAL (Microsoft Authentication Library) provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide MSAL-specific details.\n * The key abstraction is that MSAL stores the JWT in AuthenticationResult.idToken,\n * but consumers never need to know this detail.\n */\n@Injectable({\n  providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'msal')\nexport class MJMSALProvider extends MJAuthBase implements OnDestroy {\n  static readonly PROVIDER_TYPE = 'msal';\n  readonly type = MJMSALProvider.PROVIDER_TYPE;\n\n  private readonly _destroying$ = new Subject<void>();\n  private readonly _initializationCompleted$ = new BehaviorSubject<boolean>(false);\n  private _initPromise: Promise<void> | null = null;\n\n  /**\n   * Factory function to provide Angular dependencies required by MSAL\n   * Stored as a static property for the factory to access without instantiation\n   */\n  static angularProviderFactory = (environment: Record<string, unknown>) => [\n    {\n      provide: MSAL_INSTANCE,\n      useValue: new PublicClientApplication({\n        auth: {\n          clientId: environment['CLIENT_ID'] as string,\n          authority: environment['CLIENT_AUTHORITY'] as string,\n          redirectUri: window.location.origin,\n        },\n        cache: {\n          cacheLocation: 'localStorage',\n        },\n      }),\n    },\n    {\n      provide: MSAL_GUARD_CONFIG,\n      useValue: {\n        interactionType: InteractionType.Redirect,\n        authRequest: {\n          scopes: ['User.Read'],\n        },\n      },\n    },\n    {\n      provide: MSAL_INTERCEPTOR_CONFIG,\n      useValue: {\n        interactionType: InteractionType.Redirect,\n        protectedResourceMap: new Map([['https://graph.microsoft.com/v1.0/me', ['user.read']]]),\n      },\n    },\n    MsalService,\n    MsalGuard,\n    MsalBroadcastService\n  ];\n\n  constructor(public auth: MsalService, private msalBroadcastService: MsalBroadcastService) {\n    const config: AngularAuthProviderConfig = {\n      name: MJMSALProvider.PROVIDER_TYPE,\n      type: MJMSALProvider.PROVIDER_TYPE\n    };\n    super(config);\n  }\n\n  // ============================================================================\n  // LIFECYCLE METHODS\n  // ============================================================================\n\n  async initialize(): Promise<void> {\n    if (this._initPromise) {\n      return this._initPromise;\n    }\n\n    this._initPromise = this._performInitialization();\n    return this._initPromise;\n  }\n\n  private async _performInitialization(): Promise<void> {\n    console.debug('[MSAL] Starting initialization...');\n    await this.auth.instance.initialize();\n    console.debug('[MSAL] MSAL instance initialized');\n\n    // Handle redirect immediately after initialization\n    const redirectResponse = await this.auth.instance.handleRedirectPromise();\n    console.debug('[MSAL] Redirect response:', redirectResponse ? 'Found' : 'None');\n\n    if (redirectResponse && redirectResponse.account) {\n      // User just logged in via redirect\n      console.debug('[MSAL] Processing redirect login');\n      this.auth.instance.setActiveAccount(redirectResponse.account);\n      this.updateAuthState(true);\n\n      // Update user info from account\n      const userInfo = this.mapMSALAccountToStandard(redirectResponse.account);\n      this.updateUserInfo(userInfo);\n\n      this._initializationCompleted$.next(true);\n      console.debug('[MSAL] Initialization completed (redirect login)');\n    } else {\n      // Set active account if we have one from cache\n      const accounts = this.auth.instance.getAllAccounts();\n      console.debug('[MSAL] Cached accounts found:', accounts.length);\n\n      if (accounts.length > 0) {\n        console.debug('[MSAL] Restoring session from cached account:', accounts[0].username);\n        this.auth.instance.setActiveAccount(accounts[0]);\n        this.updateAuthState(true);\n\n        // Update user info from cached account\n        const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n        this.updateUserInfo(userInfo);\n\n        this._initializationCompleted$.next(true);\n        console.debug('[MSAL] Initialization completed (cached session restored)');\n      } else {\n        console.debug('[MSAL] No cached accounts, user needs to log in');\n      }\n    }\n\n    // Subscribe to broadcast service for ongoing auth state changes\n    this.msalBroadcastService.inProgress$\n      .pipe(\n        filter((status: InteractionStatus) => status === InteractionStatus.None),\n        takeUntil(this._destroying$)\n      )\n      .subscribe(() => {\n        const accounts = this.auth.instance.getAllAccounts();\n        const isAuth = accounts.length > 0;\n\n        this.updateAuthState(isAuth);\n\n        if (isAuth) {\n          this.auth.instance.setActiveAccount(accounts[0]);\n          const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n          this.updateUserInfo(userInfo);\n        } else {\n          this.updateUserInfo(null);\n        }\n\n        this._initializationCompleted$.next(true);\n      });\n  }\n\n  protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n    await this.ensureInitialized();\n\n    const silentRequest = {\n      scopes: ['User.Read', 'email', 'profile'],\n      ...options\n    };\n\n    return new Promise((resolve, reject) => {\n      this.auth.loginRedirect(silentRequest).subscribe({\n        next: () => {\n          resolve();\n        },\n        error: (error) => {\n          LogError(error);\n          reject(error);\n        }\n      });\n    });\n  }\n\n  async logout(): Promise<void> {\n    await this.ensureInitialized();\n    this.auth.logoutRedirect().subscribe(() => {\n      // Logout will trigger a redirect\n    });\n  }\n\n  async handleCallback(): Promise<void> {\n    // MSAL Angular handles callbacks internally through its broadcast service\n    // The handleRedirectPromise is called in initialize()\n    await this.ensureInitialized();\n  }\n\n  // ============================================================================\n  // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n  // ============================================================================\n\n  /**\n   * Extract ID token from MSAL's storage\n   *\n   * MSAL stores the JWT in AuthenticationResult.idToken\n   * This is the key abstraction - consumers never need to know about MSAL's structure!\n   */\n  protected async extractIdTokenInternal(): Promise<string | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      // First try to get cached token from account\n      // This avoids unnecessary iframe calls that can timeout\n      if (account.idToken) {\n        // Check if token is expired or about to expire (within 5-minute buffer)\n        // This prevents the race condition where proactive refresh hasn't completed\n        // but the cached token is already expired\n        if (this.isTokenValid(account.idToken, 300)) {\n          return account.idToken;\n        }\n\n        // Token expired or near-expiry — force a silent refresh\n        console.debug('[MSAL] Cached token expired or near-expiry, forcing silent refresh');\n        try {\n          const response = await this.auth.instance.acquireTokenSilent({\n            scopes: ['User.Read', 'email', 'profile'],\n            account: account,\n            forceRefresh: true\n          });\n          return response.idToken || null;\n        } catch (refreshError) {\n          console.warn('[MSAL] Silent refresh failed, returning expired cached token:', refreshError);\n          // Fall through to existing cache-only acquisition below\n        }\n      }\n\n      // If not in account, try silent token acquisition from cache only\n      // Use CacheLookupPolicy.AccessToken to avoid iframe calls\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read', 'email', 'profile'],\n        account: account,\n        cacheLookupPolicy: CacheLookupPolicy.AccessToken\n      });\n\n      // MSAL-specific detail: JWT is in idToken property\n      return response.idToken || null;\n    } catch (error) {\n      console.error('[MSAL] Error extracting ID token:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract complete token info from MSAL\n   *\n   * Maps MSAL's AuthenticationResult to StandardAuthToken\n   */\n  protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      // Use cache-only lookup to avoid iframe timeouts during normal token extraction\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read', 'email', 'profile'],\n        account: account,\n        cacheLookupPolicy: CacheLookupPolicy.AccessToken\n      });\n\n      if (!response.idToken) {\n        return null;\n      }\n\n      return {\n        idToken: response.idToken,\n        accessToken: response.accessToken,\n        expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n        scopes: response.scopes\n      };\n    } catch (error) {\n      // If acquireTokenSilent fails (e.g., iframe timeout), try to use cached account data\n      console.error('[MSAL] Error extracting token info:', error);\n\n      const account = this.auth.instance.getActiveAccount();\n      if (account?.idToken) {\n        // Return basic token info from account if available\n        return {\n          idToken: account.idToken,\n          expiresAt: 0, // Unknown from account alone\n          scopes: []\n        };\n      }\n\n      return null;\n    }\n  }\n\n  /**\n   * Extract user info from MSAL account\n   *\n   * Maps MSAL's AccountInfo structure to StandardUserInfo\n   */\n  protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      return this.mapMSALAccountToStandard(account);\n    } catch (error) {\n      console.error('[MSAL] Error extracting user info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Refresh token using MSAL's silent token acquisition\n   *\n   * MSAL 5.x Best Practices:\n   * - Pass account parameter for reliable silent acquisition\n   * - Use CacheLookupPolicy.Default for efficient cache → refresh token → iframe chain\n   * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)\n   */\n  protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'No active account found',\n            userMessage: 'You need to log in to continue.'\n          }\n        };\n      }\n\n      // MSAL 5.x: Pass account for reliable silent acquisition\n      // Use Default policy for efficient cache → refresh token → iframe chain\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read', 'email', 'profile'],\n        account: account,\n        cacheLookupPolicy: CacheLookupPolicy.Default\n      });\n\n      if (!response.idToken) {\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'Token refresh succeeded but no ID token returned',\n            userMessage: 'Session refresh failed. Please log in again.'\n          }\n        };\n      }\n\n      const token: StandardAuthToken = {\n        idToken: response.idToken,\n        accessToken: response.accessToken,\n        expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n        scopes: response.scopes\n      };\n\n      return {\n        success: true,\n        token\n      };\n    } catch (error) {\n      console.error('[MSAL] Token refresh failed:', error);\n\n      // Handle MSAL 5.x error codes that require user interaction\n      // - timed_out: MSAL 5.x iframe timeout (replaces monitor_window_timeout from 3.x)\n      // - monitor_window_timeout: Legacy MSAL 3.x iframe timeout\n      // - no_tokens_found: No cached tokens available\n      // - no_account_error: Account not found in cache\n      // - InteractionRequiredAuthError: Server requires user interaction\n      const errorCode = (error as Record<string, unknown>)?.errorCode as string | undefined;\n      const interactionRequiredCodes = [\n        'monitor_window_timeout',\n        'timed_out',\n        'no_tokens_found',\n        'no_account_error',\n        'login_required',\n        'consent_required',\n        'token_refresh_required'  // ClientAuthError when cached token needs refresh\n      ];\n\n      if (interactionRequiredCodes.includes(errorCode || '') || error instanceof InteractionRequiredAuthError) {\n        // Return INTERACTION_REQUIRED error - base class will call handleSessionExpiryInternal\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.INTERACTION_REQUIRED,\n            message: `Silent token refresh failed - interaction required (${errorCode || 'unknown'})`,\n            userMessage: 'Your session has expired. Redirecting to login...',\n            originalError: error\n          }\n        };\n      }\n\n      return {\n        success: false,\n        error: this.classifyErrorInternal(error)\n      };\n    }\n  }\n\n  /**\n   * Classify MSAL-specific errors into semantic types\n   *\n   * Maps MSAL error classes to AuthErrorType enum.\n   * Updated for MSAL 5.x error codes.\n   */\n  protected classifyErrorInternal(error: unknown): StandardAuthError {\n    const errorObj = error as Record<string, unknown>;\n    const message = errorObj?.['message'] as string || 'Unknown error';\n    const errorCode = errorObj?.['errorCode'] as string || '';\n\n    // Check for specific MSAL error types\n    if (error instanceof InteractionRequiredAuthError) {\n      return {\n        type: AuthErrorType.INTERACTION_REQUIRED,\n        message,\n        originalError: error,\n        userMessage: 'Additional authentication is required. Please log in again.'\n      };\n    }\n\n    // ClientAuthError — covers codes like token_refresh_required that are not\n    // surfaced through BrowserAuthError or InteractionRequiredAuthError.\n    if (error instanceof ClientAuthError) {\n      if (errorCode === 'token_refresh_required') {\n        return {\n          type: AuthErrorType.INTERACTION_REQUIRED,\n          message,\n          originalError: error,\n          userMessage: 'Your session has expired. Please log in again.'\n        };\n      }\n\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (error instanceof BrowserAuthError) {\n      // Check specific error codes - MSAL 5.x codes\n      if (errorCode === 'user_cancelled' || message.includes('user cancelled')) {\n        return {\n          type: AuthErrorType.USER_CANCELLED,\n          message,\n          originalError: error,\n          userMessage: 'Login was cancelled.'\n        };\n      }\n\n      // MSAL 5.x timeout and session errors that require interaction\n      const interactionRequiredCodes = [\n        'timed_out',\n        'monitor_window_timeout',\n        'no_tokens_found',\n        'no_account_error',\n        'login_required',\n        'consent_required'\n      ];\n      if (interactionRequiredCodes.includes(errorCode)) {\n        return {\n          type: AuthErrorType.INTERACTION_REQUIRED,\n          message,\n          originalError: error,\n          userMessage: 'Your session has expired. Please log in again.'\n        };\n      }\n\n      return {\n        type: AuthErrorType.NO_ACTIVE_SESSION,\n        message,\n        originalError: error,\n        userMessage: 'Authentication error. Please log in again.'\n      };\n    }\n\n    // Check message patterns\n    if (message.includes('token') && message.includes('expired')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (message.includes('network') || message.includes('fetch')) {\n      return {\n        type: AuthErrorType.NETWORK_ERROR,\n        message,\n        originalError: error,\n        userMessage: 'Network error. Please check your connection and try again.'\n      };\n    }\n\n    if (message.includes('you need to be authorized')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    // Default to unknown error\n    return {\n      type: AuthErrorType.UNKNOWN_ERROR,\n      message,\n      originalError: error,\n      userMessage: 'An unexpected error occurred. Please try again.'\n    };\n  }\n\n  // ============================================================================\n  // HELPER METHODS\n  // ============================================================================\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this._initPromise) {\n      await this.initialize();\n    } else if (!this._initializationCompleted$.value) {\n      await this._initPromise;\n    }\n  }\n\n  /**\n   * Check if a JWT token is still valid with an optional buffer period.\n   * Decodes the payload to read the `exp` claim without cryptographic verification\n   * (expiry is a timing check, not an authenticity check).\n   *\n   * @param token - The JWT string to check\n   * @param bufferSeconds - Number of seconds before actual expiry to consider the token invalid (default: 0)\n   * @returns true if the token's exp claim is beyond (now + buffer), false otherwise\n   */\n  private isTokenValid(token: string, bufferSeconds: number = 0): boolean {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        return false;\n      }\n      const payload = JSON.parse(atob(parts[1])) as { exp?: number };\n      const expiresAtMs = (payload.exp ?? 0) * 1000;\n      return expiresAtMs > Date.now() + (bufferSeconds * 1000);\n    } catch {\n      // If we can't decode the token, treat it as invalid\n      return false;\n    }\n  }\n\n  /**\n   * Map MSAL AccountInfo to StandardUserInfo\n   */\n  private mapMSALAccountToStandard(account: AccountInfo): StandardUserInfo {\n    return {\n      id: account.localAccountId || account.homeAccountId,\n      email: account.username || '',\n      name: account.name || account.username || '',\n      givenName: account.idTokenClaims?.['given_name'] as string,\n      familyName: account.idTokenClaims?.['family_name'] as string,\n      preferredUsername: account.username,\n      emailVerified: true // MSAL doesn't provide this, assume true\n    };\n  }\n\n  /**\n   * Get profile picture URL from Microsoft Graph API\n   *\n   * MSAL requires fetching the photo from Microsoft Graph.\n   * This is the key advantage of encapsulation - consumers don't need\n   * to know about Graph API, they just call getProfilePictureUrl()!\n   */\n  protected async getProfilePictureUrlInternal(): Promise<string | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      // Get access token for Microsoft Graph\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read'],\n        account: account,\n        forceRefresh: false\n      });\n\n      if (!response.accessToken) {\n        return null;\n      }\n\n      // Fetch photo from Microsoft Graph\n      const graphResponse = await fetch('https://graph.microsoft.com/v1.0/me/photo/$value', {\n        headers: { 'Authorization': `Bearer ${response.accessToken}` }\n      });\n\n      if (graphResponse.ok) {\n        const blob = await graphResponse.blob();\n        return URL.createObjectURL(blob);\n      }\n\n      return null;\n    } catch (error) {\n      console.error('[MSAL] Error getting profile picture:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Handle session expiry by redirecting to Microsoft login\n   *\n   * This method is called by the base class when silent token refresh fails\n   * with INTERACTION_REQUIRED error. It redirects to Microsoft login and never returns.\n   * After authentication, the app will reload and re-initialize with a fresh token.\n   */\n  protected async handleSessionExpiryInternal(): Promise<void> {\n    console.debug('[MSAL] Redirecting to Microsoft login for re-authentication...');\n\n    // Initiate redirect authentication - page will navigate away\n    this.auth.loginRedirect({\n      scopes: ['User.Read', 'email', 'profile'],\n      prompt: 'select_account'\n    }).subscribe({\n      error: (redirectError) => {\n        console.error('[MSAL] Redirect initiation failed:', redirectError);\n      }\n    });\n\n    // Return a promise that never resolves - page will navigate before this matters\n    return new Promise<void>(() => {});\n  }\n\n  // ============================================================================\n  // CONFIGURATION\n  // ============================================================================\n\n  override getRequiredConfig(): string[] {\n    return ['clientId', 'tenantId'];\n  }\n\n  override validateConfig(_config: Record<string, unknown>): boolean {\n    // MSAL configuration is handled by Angular module providers\n    return true;\n  }\n\n  // ============================================================================\n  // CLEANUP\n  // ============================================================================\n\n  ngOnDestroy(): void {\n    this._destroying$.next();\n    this._destroying$.complete();\n    this._initPromise = null;\n    this._initializationCompleted$.complete();\n  }\n}"]}
+{"version":3,"file":"mjexplorer-msal-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAc,OAAO,EAAc,MAAM,EAA6B,SAAS,EAAQ,MAAM,MAAM,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtL,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IA+CzB;IAA2B;IA9C9C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IAE5B,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACnC,yBAAyB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACzE,YAAY,GAAyB,IAAI,CAAC;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI,uBAAuB,CAAC;gBACpC,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAW;oBAC5C,SAAS,EAAE,WAAW,CAAC,kBAAkB,CAAW;oBACpD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;iBACpC;gBACD,KAAK,EAAE;oBACL,aAAa,EAAE,cAAc;iBAC9B;aACF,CAAC;SACH;QACD;YACE,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,WAAW,EAAE;oBACX,MAAM,EAAE,CAAC,WAAW,CAAC;iBACtB;aACF;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;aACxF;SACF;QACD,WAAW;QACX,SAAS;QACT,oBAAoB;KACrB,CAAC;IAEF,YAAmB,IAAiB,EAAU,oBAA0C;QACtF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;QAAU,yBAAoB,GAApB,oBAAoB,CAAsB;IAMxF,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAElD,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACjD,mCAAmC;YACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAE3B,gCAAgC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAE3B,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,oBAAoB,CAAC,WAAW;aAClC,IAAI,CACH,MAAM,CAAC,CAAC,MAAyB,EAAE,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI,CAAC,EACxE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAC7B;aACA,SAAS,CAAC,GAAG,EAAE;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAEnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,GAAG,EAAE;oBACT,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,iCAAiC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6CAA6C;YAC7C,wDAAwD;YACxD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,4EAA4E;gBAC5E,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACzB,CAAC;gBAED,wDAAwD;gBACxD,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;wBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;wBACzC,OAAO,EAAE,OAAO;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;gBAClC,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,YAAY,CAAC,CAAC;oBAC5F,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,mDAAmD;YACnD,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,oDAAoD;gBACpD,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,CAAC,EAAE,6BAA6B;oBAC3C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,yBAAyB;wBAClC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,yDAAyD;YACzD,oEAAoE;YACpE,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,kDAAkD;wBAC3D,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;gBAC5F,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,4CAA4C;wBACrD,WAAW,EAAE,mDAAmD;qBACjE;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAsB;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAErD,4DAA4D;YAC5D,kFAAkF;YAClF,2DAA2D;YAC3D,gDAAgD;YAChD,iDAAiD;YACjD,mEAAmE;YACnE,MAAM,SAAS,GAAI,KAAiC,EAAE,SAA+B,CAAC;YACtF,MAAM,wBAAwB,GAAG;gBAC/B,wBAAwB;gBACxB,WAAW;gBACX,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;gBAClB,wBAAwB,CAAE,kDAAkD;aAC7E,CAAC;YAEF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBACxG,uFAAuF;gBACvF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,uDAAuD,SAAS,IAAI,SAAS,GAAG;wBACzF,WAAW,EAAE,mDAAmD;wBAChE,aAAa,EAAE,KAAK;qBACrB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAE1D,sCAAsC;QACtC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,wBAAwB,EAAE,CAAC;gBAC3C,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,8CAA8C;YAC9C,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,cAAc;oBAClC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,sBAAsB;iBACpC,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,MAAM,wBAAwB,GAAG;gBAC/B,WAAW;gBACX,wBAAwB;gBACxB,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;aACnB,CAAC;YACF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4CAA4C;aAC1D,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,KAAa,EAAE,gBAAwB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC;YAC/D,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAoB;QACnD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa;YACnD,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,YAAY,CAAW;YAC1D,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,aAAa,CAAW;YAC5D,iBAAiB,EAAE,OAAO,CAAC,QAAQ;YACnC,aAAa,EAAE,IAAI,CAAC,yCAAyC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uCAAuC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;gBACpF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,WAAW,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAEhF,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,SAAS,CAAC;YACX,KAAK,EAAE,CAAC,aAAa,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,gFAAgF;QAChF,OAAO,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAE/E,WAAW;QACT,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;wGAhqBU,cAAc;gEAAd,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAiqB1B;;iFAjqBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable, OnDestroy } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { BehaviorSubject, Observable, Subject, catchError, filter, from, map, of, throwError, takeUntil, take } from 'rxjs';\nimport { MsalBroadcastService, MsalService, MSAL_INSTANCE, MSAL_GUARD_CONFIG, MSAL_INTERCEPTOR_CONFIG, MsalGuard } from '@azure/msal-angular';\nimport { AccountInfo, AuthenticationResult } from '@azure/msal-common';\nimport { CacheLookupPolicy, ClientAuthError, InteractionRequiredAuthError, InteractionStatus, PublicClientApplication, InteractionType, BrowserAuthError } from '@azure/msal-browser';\nimport { LogError } from '@memberjunction/core';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n  StandardUserInfo,\n  StandardAuthToken,\n  StandardAuthError,\n  AuthErrorType,\n  TokenRefreshResult\n} from '../auth-types';\n/**\n * MSAL (Microsoft Authentication Library) provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide MSAL-specific details.\n * The key abstraction is that MSAL stores the JWT in AuthenticationResult.idToken,\n * but consumers never need to know this detail.\n */\n@Injectable({\n  providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'msal')\nexport class MJMSALProvider extends MJAuthBase implements OnDestroy {\n  static readonly PROVIDER_TYPE = 'msal';\n  readonly type = MJMSALProvider.PROVIDER_TYPE;\n\n  private readonly _destroying$ = new Subject<void>();\n  private readonly _initializationCompleted$ = new BehaviorSubject<boolean>(false);\n  private _initPromise: Promise<void> | null = null;\n\n  /**\n   * Factory function to provide Angular dependencies required by MSAL\n   * Stored as a static property for the factory to access without instantiation\n   */\n  static angularProviderFactory = (environment: Record<string, unknown>) => [\n    {\n      provide: MSAL_INSTANCE,\n      useValue: new PublicClientApplication({\n        auth: {\n          clientId: environment['CLIENT_ID'] as string,\n          authority: environment['CLIENT_AUTHORITY'] as string,\n          redirectUri: window.location.origin,\n        },\n        cache: {\n          cacheLocation: 'localStorage',\n        },\n      }),\n    },\n    {\n      provide: MSAL_GUARD_CONFIG,\n      useValue: {\n        interactionType: InteractionType.Redirect,\n        authRequest: {\n          scopes: ['User.Read'],\n        },\n      },\n    },\n    {\n      provide: MSAL_INTERCEPTOR_CONFIG,\n      useValue: {\n        interactionType: InteractionType.Redirect,\n        protectedResourceMap: new Map([['https://graph.microsoft.com/v1.0/me', ['user.read']]]),\n      },\n    },\n    MsalService,\n    MsalGuard,\n    MsalBroadcastService\n  ];\n\n  constructor(public auth: MsalService, private msalBroadcastService: MsalBroadcastService) {\n    const config: AngularAuthProviderConfig = {\n      name: MJMSALProvider.PROVIDER_TYPE,\n      type: MJMSALProvider.PROVIDER_TYPE\n    };\n    super(config);\n  }\n\n  // ============================================================================\n  // LIFECYCLE METHODS\n  // ============================================================================\n\n  async initialize(): Promise<void> {\n    if (this._initPromise) {\n      return this._initPromise;\n    }\n\n    this._initPromise = this._performInitialization();\n    return this._initPromise;\n  }\n\n  private async _performInitialization(): Promise<void> {\n    console.debug('[MSAL] Starting initialization...');\n    await this.auth.instance.initialize();\n    console.debug('[MSAL] MSAL instance initialized');\n\n    // Handle redirect immediately after initialization\n    const redirectResponse = await this.auth.instance.handleRedirectPromise();\n    console.debug('[MSAL] Redirect response:', redirectResponse ? 'Found' : 'None');\n\n    if (redirectResponse && redirectResponse.account) {\n      // User just logged in via redirect\n      console.debug('[MSAL] Processing redirect login');\n      this.auth.instance.setActiveAccount(redirectResponse.account);\n      this.updateAuthState(true);\n\n      // Update user info from account\n      const userInfo = this.mapMSALAccountToStandard(redirectResponse.account);\n      this.updateUserInfo(userInfo);\n\n      this._initializationCompleted$.next(true);\n      console.debug('[MSAL] Initialization completed (redirect login)');\n    } else {\n      // Set active account if we have one from cache\n      const accounts = this.auth.instance.getAllAccounts();\n      console.debug('[MSAL] Cached accounts found:', accounts.length);\n\n      if (accounts.length > 0) {\n        console.debug('[MSAL] Restoring session from cached account:', accounts[0].username);\n        this.auth.instance.setActiveAccount(accounts[0]);\n        this.updateAuthState(true);\n\n        // Update user info from cached account\n        const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n        this.updateUserInfo(userInfo);\n\n        this._initializationCompleted$.next(true);\n        console.debug('[MSAL] Initialization completed (cached session restored)');\n      } else {\n        console.debug('[MSAL] No cached accounts, user needs to log in');\n      }\n    }\n\n    // Subscribe to broadcast service for ongoing auth state changes\n    this.msalBroadcastService.inProgress$\n      .pipe(\n        filter((status: InteractionStatus) => status === InteractionStatus.None),\n        takeUntil(this._destroying$)\n      )\n      .subscribe(() => {\n        const accounts = this.auth.instance.getAllAccounts();\n        const isAuth = accounts.length > 0;\n\n        this.updateAuthState(isAuth);\n\n        if (isAuth) {\n          this.auth.instance.setActiveAccount(accounts[0]);\n          const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n          this.updateUserInfo(userInfo);\n        } else {\n          this.updateUserInfo(null);\n        }\n\n        this._initializationCompleted$.next(true);\n      });\n  }\n\n  protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n    await this.ensureInitialized();\n\n    const silentRequest = {\n      scopes: ['User.Read', 'email', 'profile'],\n      ...options\n    };\n\n    return new Promise((resolve, reject) => {\n      this.auth.loginRedirect(silentRequest).subscribe({\n        next: () => {\n          resolve();\n        },\n        error: (error) => {\n          LogError(error);\n          reject(error);\n        }\n      });\n    });\n  }\n\n  protected async logoutInternal(): Promise<void> {\n    await this.ensureInitialized();\n    this.auth.logoutRedirect().subscribe(() => {\n      // Logout will trigger a redirect\n    });\n  }\n\n  async handleCallback(): Promise<void> {\n    // MSAL Angular handles callbacks internally through its broadcast service\n    // The handleRedirectPromise is called in initialize()\n    await this.ensureInitialized();\n  }\n\n  // ============================================================================\n  // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n  // ============================================================================\n\n  /**\n   * Extract ID token from MSAL's storage\n   *\n   * MSAL stores the JWT in AuthenticationResult.idToken\n   * This is the key abstraction - consumers never need to know about MSAL's structure!\n   */\n  protected async extractIdTokenInternal(): Promise<string | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      // First try to get cached token from account\n      // This avoids unnecessary iframe calls that can timeout\n      if (account.idToken) {\n        // Check if token is expired or about to expire (within 5-minute buffer)\n        // This prevents the race condition where proactive refresh hasn't completed\n        // but the cached token is already expired\n        if (this.isTokenValid(account.idToken, 300)) {\n          return account.idToken;\n        }\n\n        // Token expired or near-expiry — force a silent refresh\n        console.debug('[MSAL] Cached token expired or near-expiry, forcing silent refresh');\n        try {\n          const response = await this.auth.instance.acquireTokenSilent({\n            scopes: ['User.Read', 'email', 'profile'],\n            account: account,\n            forceRefresh: true\n          });\n          return response.idToken || null;\n        } catch (refreshError) {\n          console.warn('[MSAL] Silent refresh failed, returning expired cached token:', refreshError);\n          // Fall through to existing cache-only acquisition below\n        }\n      }\n\n      // If not in account, try silent token acquisition from cache only\n      // Use CacheLookupPolicy.AccessToken to avoid iframe calls\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read', 'email', 'profile'],\n        account: account,\n        cacheLookupPolicy: CacheLookupPolicy.AccessToken\n      });\n\n      // MSAL-specific detail: JWT is in idToken property\n      return response.idToken || null;\n    } catch (error) {\n      console.error('[MSAL] Error extracting ID token:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract complete token info from MSAL\n   *\n   * Maps MSAL's AuthenticationResult to StandardAuthToken\n   */\n  protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      // Use cache-only lookup to avoid iframe timeouts during normal token extraction\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read', 'email', 'profile'],\n        account: account,\n        cacheLookupPolicy: CacheLookupPolicy.AccessToken\n      });\n\n      if (!response.idToken) {\n        return null;\n      }\n\n      return {\n        idToken: response.idToken,\n        accessToken: response.accessToken,\n        expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n        scopes: response.scopes\n      };\n    } catch (error) {\n      // If acquireTokenSilent fails (e.g., iframe timeout), try to use cached account data\n      console.error('[MSAL] Error extracting token info:', error);\n\n      const account = this.auth.instance.getActiveAccount();\n      if (account?.idToken) {\n        // Return basic token info from account if available\n        return {\n          idToken: account.idToken,\n          expiresAt: 0, // Unknown from account alone\n          scopes: []\n        };\n      }\n\n      return null;\n    }\n  }\n\n  /**\n   * Extract user info from MSAL account\n   *\n   * Maps MSAL's AccountInfo structure to StandardUserInfo\n   */\n  protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      return this.mapMSALAccountToStandard(account);\n    } catch (error) {\n      console.error('[MSAL] Error extracting user info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Refresh token using MSAL's silent token acquisition\n   *\n   * MSAL 5.x Best Practices:\n   * - Pass account parameter for reliable silent acquisition\n   * - Use forceRefresh: true to bypass cache and get fresh tokens from Azure AD\n   * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)\n   *\n   * IMPORTANT: This method is called when the server has already rejected the current\n   * token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a\n   * cached ID token that is still expired (e.g. when the access token has a longer\n   * lifetime than the ID token). forceRefresh: true ensures a network round-trip to\n   * Azure AD so both the access token and ID token are genuinely refreshed.\n   */\n  protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'No active account found',\n            userMessage: 'You need to log in to continue.'\n          }\n        };\n      }\n\n      // MSAL 5.x: Pass account for reliable silent acquisition\n      // Use forceRefresh to bypass cache and ensure a network round-trip.\n      // This is critical because this method is called after the server rejected\n      // the current token — returning a cached (potentially stale) ID token would\n      // cause the retry to fail with the same JWT_EXPIRED error.\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read', 'email', 'profile'],\n        account: account,\n        forceRefresh: true\n      });\n\n      if (!response.idToken) {\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'Token refresh succeeded but no ID token returned',\n            userMessage: 'Session refresh failed. Please log in again.'\n          }\n        };\n      }\n\n      // Safety net: verify the refreshed token is actually valid.\n      // This should always pass after a forced refresh, but guards against\n      // edge cases like severe clock skew between client and Azure AD.\n      if (!this.isTokenValid(response.idToken)) {\n        console.warn('[MSAL] Forced refresh returned an expired ID token — requesting interaction');\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.INTERACTION_REQUIRED,\n            message: 'Token refresh returned an expired ID token',\n            userMessage: 'Your session has expired. Redirecting to login...'\n          }\n        };\n      }\n\n      const token: StandardAuthToken = {\n        idToken: response.idToken,\n        accessToken: response.accessToken,\n        expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n        scopes: response.scopes\n      };\n\n      return {\n        success: true,\n        token\n      };\n    } catch (error) {\n      console.error('[MSAL] Token refresh failed:', error);\n\n      // Handle MSAL 5.x error codes that require user interaction\n      // - timed_out: MSAL 5.x iframe timeout (replaces monitor_window_timeout from 3.x)\n      // - monitor_window_timeout: Legacy MSAL 3.x iframe timeout\n      // - no_tokens_found: No cached tokens available\n      // - no_account_error: Account not found in cache\n      // - InteractionRequiredAuthError: Server requires user interaction\n      const errorCode = (error as Record<string, unknown>)?.errorCode as string | undefined;\n      const interactionRequiredCodes = [\n        'monitor_window_timeout',\n        'timed_out',\n        'no_tokens_found',\n        'no_account_error',\n        'login_required',\n        'consent_required',\n        'token_refresh_required'  // ClientAuthError when cached token needs refresh\n      ];\n\n      if (interactionRequiredCodes.includes(errorCode || '') || error instanceof InteractionRequiredAuthError) {\n        // Return INTERACTION_REQUIRED error - base class will call handleSessionExpiryInternal\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.INTERACTION_REQUIRED,\n            message: `Silent token refresh failed - interaction required (${errorCode || 'unknown'})`,\n            userMessage: 'Your session has expired. Redirecting to login...',\n            originalError: error\n          }\n        };\n      }\n\n      return {\n        success: false,\n        error: this.classifyErrorInternal(error)\n      };\n    }\n  }\n\n  /**\n   * Classify MSAL-specific errors into semantic types\n   *\n   * Maps MSAL error classes to AuthErrorType enum.\n   * Updated for MSAL 5.x error codes.\n   */\n  protected classifyErrorInternal(error: unknown): StandardAuthError {\n    const errorObj = error as Record<string, unknown>;\n    const message = errorObj?.['message'] as string || 'Unknown error';\n    const errorCode = errorObj?.['errorCode'] as string || '';\n\n    // Check for specific MSAL error types\n    if (error instanceof InteractionRequiredAuthError) {\n      return {\n        type: AuthErrorType.INTERACTION_REQUIRED,\n        message,\n        originalError: error,\n        userMessage: 'Additional authentication is required. Please log in again.'\n      };\n    }\n\n    // ClientAuthError — covers codes like token_refresh_required that are not\n    // surfaced through BrowserAuthError or InteractionRequiredAuthError.\n    if (error instanceof ClientAuthError) {\n      if (errorCode === 'token_refresh_required') {\n        return {\n          type: AuthErrorType.INTERACTION_REQUIRED,\n          message,\n          originalError: error,\n          userMessage: 'Your session has expired. Please log in again.'\n        };\n      }\n\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (error instanceof BrowserAuthError) {\n      // Check specific error codes - MSAL 5.x codes\n      if (errorCode === 'user_cancelled' || message.includes('user cancelled')) {\n        return {\n          type: AuthErrorType.USER_CANCELLED,\n          message,\n          originalError: error,\n          userMessage: 'Login was cancelled.'\n        };\n      }\n\n      // MSAL 5.x timeout and session errors that require interaction\n      const interactionRequiredCodes = [\n        'timed_out',\n        'monitor_window_timeout',\n        'no_tokens_found',\n        'no_account_error',\n        'login_required',\n        'consent_required'\n      ];\n      if (interactionRequiredCodes.includes(errorCode)) {\n        return {\n          type: AuthErrorType.INTERACTION_REQUIRED,\n          message,\n          originalError: error,\n          userMessage: 'Your session has expired. Please log in again.'\n        };\n      }\n\n      return {\n        type: AuthErrorType.NO_ACTIVE_SESSION,\n        message,\n        originalError: error,\n        userMessage: 'Authentication error. Please log in again.'\n      };\n    }\n\n    // Check message patterns\n    if (message.includes('token') && message.includes('expired')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (message.includes('network') || message.includes('fetch')) {\n      return {\n        type: AuthErrorType.NETWORK_ERROR,\n        message,\n        originalError: error,\n        userMessage: 'Network error. Please check your connection and try again.'\n      };\n    }\n\n    if (message.includes('you need to be authorized')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    // Default to unknown error\n    return {\n      type: AuthErrorType.UNKNOWN_ERROR,\n      message,\n      originalError: error,\n      userMessage: 'An unexpected error occurred. Please try again.'\n    };\n  }\n\n  // ============================================================================\n  // HELPER METHODS\n  // ============================================================================\n\n  private async ensureInitialized(): Promise<void> {\n    if (!this._initPromise) {\n      await this.initialize();\n    } else if (!this._initializationCompleted$.value) {\n      await this._initPromise;\n    }\n  }\n\n  /**\n   * Check if a JWT token is still valid with an optional buffer period.\n   * Decodes the payload to read the `exp` claim without cryptographic verification\n   * (expiry is a timing check, not an authenticity check).\n   *\n   * @param token - The JWT string to check\n   * @param bufferSeconds - Number of seconds before actual expiry to consider the token invalid (default: 0)\n   * @returns true if the token's exp claim is beyond (now + buffer), false otherwise\n   */\n  private isTokenValid(token: string, bufferSeconds: number = 0): boolean {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) {\n        return false;\n      }\n      const payload = JSON.parse(atob(parts[1])) as { exp?: number };\n      const expiresAtMs = (payload.exp ?? 0) * 1000;\n      return expiresAtMs > Date.now() + (bufferSeconds * 1000);\n    } catch {\n      // If we can't decode the token, treat it as invalid\n      return false;\n    }\n  }\n\n  /**\n   * Map MSAL AccountInfo to StandardUserInfo\n   */\n  private mapMSALAccountToStandard(account: AccountInfo): StandardUserInfo {\n    return {\n      id: account.localAccountId || account.homeAccountId,\n      email: account.username || '',\n      name: account.name || account.username || '',\n      givenName: account.idTokenClaims?.['given_name'] as string,\n      familyName: account.idTokenClaims?.['family_name'] as string,\n      preferredUsername: account.username,\n      emailVerified: true // MSAL doesn't provide this, assume true\n    };\n  }\n\n  /**\n   * Get profile picture URL from Microsoft Graph API\n   *\n   * MSAL requires fetching the photo from Microsoft Graph.\n   * This is the key advantage of encapsulation - consumers don't need\n   * to know about Graph API, they just call getProfilePictureUrl()!\n   */\n  protected async getProfilePictureUrlInternal(): Promise<string | null> {\n    try {\n      await this.ensureInitialized();\n\n      const account = this.auth.instance.getActiveAccount();\n      if (!account) {\n        return null;\n      }\n\n      // Get access token for Microsoft Graph\n      const response = await this.auth.instance.acquireTokenSilent({\n        scopes: ['User.Read'],\n        account: account,\n        forceRefresh: false\n      });\n\n      if (!response.accessToken) {\n        return null;\n      }\n\n      // Fetch photo from Microsoft Graph\n      const graphResponse = await fetch('https://graph.microsoft.com/v1.0/me/photo/$value', {\n        headers: { 'Authorization': `Bearer ${response.accessToken}` }\n      });\n\n      if (graphResponse.ok) {\n        const blob = await graphResponse.blob();\n        return URL.createObjectURL(blob);\n      }\n\n      return null;\n    } catch (error) {\n      console.error('[MSAL] Error getting profile picture:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Handle session expiry by redirecting to Microsoft login\n   *\n   * This method is called by the base class when silent token refresh fails\n   * with INTERACTION_REQUIRED error. It redirects to Microsoft login and never returns.\n   * After authentication, the app will reload and re-initialize with a fresh token.\n   */\n  protected async handleSessionExpiryInternal(): Promise<void> {\n    console.debug('[MSAL] Redirecting to Microsoft login for re-authentication...');\n\n    // Initiate redirect authentication - page will navigate away\n    this.auth.loginRedirect({\n      scopes: ['User.Read', 'email', 'profile'],\n      prompt: 'select_account'\n    }).subscribe({\n      error: (redirectError) => {\n        console.error('[MSAL] Redirect initiation failed:', redirectError);\n      }\n    });\n\n    // Return a promise that never resolves - page will navigate before this matters\n    return new Promise<void>(() => {});\n  }\n\n  // ============================================================================\n  // CONFIGURATION\n  // ============================================================================\n\n  override getRequiredConfig(): string[] {\n    return ['clientId', 'tenantId'];\n  }\n\n  override validateConfig(_config: Record<string, unknown>): boolean {\n    // MSAL configuration is handled by Angular module providers\n    return true;\n  }\n\n  // ============================================================================\n  // CLEANUP\n  // ============================================================================\n\n  ngOnDestroy(): void {\n    this._destroying$.next();\n    this._destroying$.complete();\n    this._initPromise = null;\n    this._initializationCompleted$.complete();\n  }\n}"]}

package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts

@@ -34,7 +34,7 @@ export declare class MJOktaProvider extends MJAuthBase {
     });
     initialize(): Promise<void>;
     protected loginInternal(options?: Record<string, unknown>): Promise<void>;
-    logout(): Promise<void>;
+    protected logoutInternal(): Promise<void>;
     handleCallback(): Promise<void>;
     /**
      * Extract ID token from Okta's storage

package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mjexplorer-okta-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAiB,EAAE,eAAe,EAAwB,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAU;IAuBV,OAAO,CAAC,UAAU;IAtBpD,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;QAWnE;gBAEwC,UAAU,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyCrF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4DjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBvB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAqB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;OAIG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwFnE;;;;;;;;;OASG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;IA8FlE;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;yCApgBtD,cAAc;6CAAd,cAAc;CAugB1B"}
+{"version":3,"file":"mjexplorer-okta-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAiB,EAAE,eAAe,EAAwB,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAU;IAuBV,OAAO,CAAC,UAAU;IAtBpD,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;QAWnE;gBAEwC,UAAU,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyCrF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4DjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAoB/D,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBzC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAqB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;OAIG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwFnE;;;;;;;;;OASG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;IA8FlE;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;yCApgBtD,cAAc;6CAAd,cAAc;CAugB1B"}

package/dist/lib/providers/mjexplorer-okta-provider.service.js

@@ -150,7 +150,7 @@ let MJOktaProvider = class MJOktaProvider extends MJAuthBase {
             throw error;
         }
     }
-    async logout() {
+    async logoutInternal() {
         try {
             // Clear the local authentication state immediately
             this.updateAuthState(false);

package/dist/lib/providers/mjexplorer-okta-provider.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mjexplorer-okta-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,QAAmD,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IAuBF;IAtB1C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IACrC,QAAQ,CAAW;IACnB,YAAY,GAAG,KAAK,CAAC;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,YAAY;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,WAAW,CAAC,eAAe,CAAC;gBACtC,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC;gBAClC,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,IAAI,WAAW,WAAW,CAAC,aAAa,CAAC,iBAAiB;gBAC5F,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACvE,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;aACrE;SACF;KACF,CAAC;IAEF,YAA0C,UAAiD;QACzF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QAL0B,eAAU,GAAV,UAAU,CAAuC;QAOzF,oCAAoC;QACpC,MAAM,cAAc,GAAoB;YACtC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW;YAChF,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChE,IAAI,EAAE,IAAI,EAAE,wBAAwB;YACpC,GAAG,IAAI,CAAC,UAAU;YAClB,kFAAkF;YAClF,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;SACrH,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE7C,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,SAAkB,EAAE,EAAE;YAC9D,MAAM,KAAK,GAAG,SAA6D,CAAC;YAC5E,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC;YAErD,6DAA6D;YAC7D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,YAAY,EAAE,CAAC;YACjB,mEAAmE;YACnE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,6FAA6F;QAC7F,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAErC,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBAEtE,IAAI,SAAS,EAAE,eAAe,EAAE,CAAC;oBAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBAE3B,2BAA2B;oBAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;oBAC3E,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;wBACtD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,CAAC,2DAA2D;QACrE,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;YAE9D,IAAI,eAAe,EAAE,CAAC;gBACpB,6CAA6C;gBAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;gBAE3E,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;oBACrB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBAE3B,qCAAqC;oBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;oBACtD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,IAAI,CAAC;YACH,wCAAwC;YACxC,6FAA6F;YAC7F,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,uBAAuB;YACvB,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACrC,WAAW,EAAG,OAAO,EAAE,CAAC,WAAW,CAAY,IAAI,GAAG;gBACtD,GAAG,OAAO;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,mDAAmD;YACnD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAE1B,sCAAsC;YACtC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAEzC,gCAAgC;YAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC1B,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAC7C,yBAAyB,EAAE,IAAI;aAChC,CAAC,CAAC;YAEH,qFAAqF;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,yDAAyD;YACzD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,6FAA6F;YAC7F,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAErC,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBACtE,IAAI,SAAS,EAAE,eAAe,EAAE,CAAC;oBAC/B,gDAAgD;oBAChD,UAAU,CAAC,GAAG,EAAE;wBACd,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAChD,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,mDAAmD;YACnD,OAAO,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAgB,CAAC;YAEvF,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,WAAW,EAAE,WAAW;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B;gBACvF,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YAErD,+DAA+D;YAC/D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAEzB,qCAAqC;YACrC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;YAE9D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,2BAA2B;wBACpC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,wBAAwB;YACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAgB,CAAC;YAEvF,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,gCAAgC;wBACzC,WAAW,EAAE,yCAAyC;qBACvD;iBACF,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAE9D,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC1B,2BAA2B;gBAC3B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAEpD,0CAA0C;gBAC1C,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAEvD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAE1B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAkB,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE;oBAC7C,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK;iBAC9F,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAsB;oBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,EAAE;oBACjC,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,WAAW;oBACnD,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjE,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,KAAK;iBACN,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;oBACrC,OAAO,EAAE,kDAAkD;oBAC3D,WAAW,EAAE,8CAA8C;iBAC5D;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAE1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAC1D,6EAA6E;QAC7E,MAAM,UAAU,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAW,IAAI,EAAE,CAAC;QAEvD,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,SAAS,KAAK,eAAe,IAAI,UAAU,KAAK,eAAe;YAC/D,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,SAAS,KAAK,eAAe,IAAI,UAAU,KAAK,eAAe;YAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sCAAsC;aACpD,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,SAAS,KAAK,gBAAgB,IAAI,UAAU,KAAK,gBAAgB;YACjE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,iCAAiC;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzE,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,SAAS,KAAK,gBAAgB,IAAI,SAAS,KAAK,uBAAuB;YACvE,UAAU,KAAK,uBAAuB;YACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5E,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/G,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChG,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAE/E;;OAEG;IACK,sBAAsB,CAAC,OAAgB;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;YACpB,KAAK,EAAE,MAAM,CAAC,KAAe,IAAI,EAAE;YACnC,IAAI,EAAE,MAAM,CAAC,IAAc,IAAI,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,UAAoB;YACtC,UAAU,EAAE,MAAM,CAAC,WAAqB;YACxC,iBAAiB,EAAE,MAAM,CAAC,kBAA4B;YACtD,aAAa,EAAE,MAAM,CAAC,cAAyB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,OAAiB,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,8CAA8C;YAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAQ,IAAI,EAAE,OAAkB,IAAI,IAAI,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,gDAAgD;QAChD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEQ,cAAc,CAAC,MAA+B;QACrD,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;wGAtgBU,cAAc,cAuBL,YAAY;gEAvBrB,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAugB1B;;iFAvgBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB;;sBAyBc,MAAM;uBAAC,YAAY","sourcesContent":["import { Injectable, Inject } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { Observable, BehaviorSubject, from } from 'rxjs';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport OktaAuth, { OktaAuthOptions, IDToken, AccessToken } from '@okta/okta-auth-js';\nimport {\n  StandardUserInfo,\n  StandardAuthToken,\n  StandardAuthError,\n  AuthErrorType,\n  TokenRefreshResult\n} from '../auth-types';\n/**\n * Okta authentication provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide Okta-specific details.\n * The key abstraction is that Okta stores the JWT in IDToken.idToken,\n * but consumers never need to know this detail.\n */\n@Injectable({\n  providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'okta')\nexport class MJOktaProvider extends MJAuthBase {\n  static readonly PROVIDER_TYPE = 'okta';\n  readonly type = MJOktaProvider.PROVIDER_TYPE;\n  private oktaAuth: OktaAuth;\n  private isRefreshing = false;\n\n  /**\n   * Factory function to provide Angular dependencies required by Okta\n   * Stored as a static property for the factory to access without instantiation\n   */\n  static angularProviderFactory = (environment: Record<string, unknown>) => [\n    {\n      provide: 'oktaConfig',\n      useValue: {\n        clientId: environment['OKTA_CLIENTID'],\n        domain: environment['OKTA_DOMAIN'],\n        issuer: environment['OKTA_ISSUER'] || `https://${environment['OKTA_DOMAIN']}/oauth2/default`,\n        redirectUri: environment['OKTA_REDIRECT_URI'] || window.location.origin,\n        scopes: environment['OKTA_SCOPES'] || ['openid', 'profile', 'email']\n      }\n    }\n  ];\n\n  constructor(@Inject('oktaConfig') private oktaConfig: OktaAuthOptions & { domain?: string }) {\n    const config: AngularAuthProviderConfig = {\n      name: MJOktaProvider.PROVIDER_TYPE,\n      type: MJOktaProvider.PROVIDER_TYPE\n    };\n    super(config);\n\n    // Build configuration with defaults\n    const oktaAuthConfig: OktaAuthOptions = {\n      clientId: this.oktaConfig.clientId,\n      redirectUri: this.oktaConfig.redirectUri || window.location.origin + '/callback',\n      scopes: this.oktaConfig.scopes || ['openid', 'profile', 'email'],\n      pkce: true, // Use PKCE for security\n      ...this.oktaConfig,\n      // Set issuer after spread to ensure it's not overwritten if not present in config\n      issuer: this.oktaConfig.issuer || (this.oktaConfig.domain ? `https://${this.oktaConfig.domain}/oauth2/default` : '')\n    };\n\n    this.oktaAuth = new OktaAuth(oktaAuthConfig);\n\n    // Listen for token events\n    this.oktaAuth.authStateManager.subscribe((authState: unknown) => {\n      const state = authState as { isAuthenticated?: boolean; idToken?: IDToken };\n      this.updateAuthState(state.isAuthenticated || false);\n\n      // Don't update user info if we're in the middle of a refresh\n      if (!this.isRefreshing) {\n        if (state.isAuthenticated && state.idToken) {\n          const userInfo = this.mapOktaTokenToStandard(state.idToken);\n          this.updateUserInfo(userInfo);\n        } else {\n          this.updateUserInfo(null);\n        }\n      }\n    });\n  }\n\n  // ============================================================================\n  // LIFECYCLE METHODS\n  // ============================================================================\n\n  async initialize(): Promise<void> {\n    // Check URL for logout indicator\n    const urlParams = new URLSearchParams(window.location.search);\n    const isPostLogout = urlParams.has('logout');\n\n    if (isPostLogout) {\n      // We're returning from a logout, clear the URL and stay logged out\n      window.history.replaceState({}, document.title, window.location.pathname);\n      return;\n    }\n\n    // Check if we're returning from a login redirect\n    // Note: handleRedirect() is the modern v7.x replacement for deprecated handleLoginRedirect()\n    if (this.oktaAuth.isLoginRedirect()) {\n      try {\n        await this.oktaAuth.handleRedirect();\n\n        // After handling redirect, check if we're authenticated\n        const authState = await this.oktaAuth.authStateManager.getAuthState();\n\n        if (authState?.isAuthenticated) {\n          this.updateAuthState(true);\n\n          // Get and update user info\n          const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n          if (idToken) {\n            const userInfo = this.mapOktaTokenToStandard(idToken);\n            this.updateUserInfo(userInfo);\n          }\n        }\n      } catch (error) {\n        console.error('[Okta] Initialization redirect handling error:', error);\n      }\n      return; // Don't check for existing session after handling redirect\n    }\n\n    // Only check for existing session if not a redirect\n    try {\n      const isAuthenticated = await this.oktaAuth.isAuthenticated();\n\n      if (isAuthenticated) {\n        // Double-check we actually have valid tokens\n        const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n\n        if (idToken?.idToken) {\n          this.updateAuthState(true);\n\n          // Update user info from cached token\n          const userInfo = this.mapOktaTokenToStandard(idToken);\n          this.updateUserInfo(userInfo);\n        } else {\n          // No valid tokens, stay logged out\n          this.updateAuthState(false);\n        }\n      }\n    } catch (error) {\n      console.warn('[Okta] Error checking authentication status:', error);\n    }\n  }\n\n  protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n    try {\n      // Check if we're in a redirect callback\n      // Note: handleRedirect() is the modern v7.x replacement for deprecated handleLoginRedirect()\n      if (this.oktaAuth.isLoginRedirect()) {\n        await this.oktaAuth.handleRedirect();\n        return;\n      }\n\n      // Start the login flow\n      await this.oktaAuth.signInWithRedirect({\n        originalUri: (options?.['targetUrl'] as string) || '/',\n        ...options\n      });\n    } catch (error) {\n      console.error('[Okta] Login error:', error);\n      throw error;\n    }\n  }\n\n  async logout(): Promise<void> {\n    try {\n      // Clear the local authentication state immediately\n      this.updateAuthState(false);\n      this.updateUserInfo(null);\n\n      // Clear all tokens from local storage\n      await this.oktaAuth.tokenManager.clear();\n\n      // Sign out from Okta completely\n      await this.oktaAuth.signOut({\n        postLogoutRedirectUri: window.location.origin,\n        clearTokensBeforeRedirect: true\n      });\n\n      // Note: The signOut call will redirect the browser, so code after this won't execute\n    } catch (error) {\n      console.error('[Okta] Logout error:', error);\n      // If logout fails, at least clear local state and reload\n      window.location.href = window.location.origin;\n    }\n  }\n\n  async handleCallback(): Promise<void> {\n    try {\n      // Note: handleRedirect() is the modern v7.x replacement for deprecated handleLoginRedirect()\n      if (this.oktaAuth.isLoginRedirect()) {\n        await this.oktaAuth.handleRedirect();\n\n        // After handling redirect, check if we're authenticated\n        const authState = await this.oktaAuth.authStateManager.getAuthState();\n        if (authState?.isAuthenticated) {\n          // Do a controlled reload after successful login\n          setTimeout(() => {\n            window.location.href = window.location.origin;\n          }, 100);\n        }\n      }\n    } catch (error) {\n      console.error('[Okta] Callback handling error:', error);\n      throw error;\n    }\n  }\n\n  // ============================================================================\n  // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n  // ============================================================================\n\n  /**\n   * Extract ID token from Okta's storage\n   *\n   * Okta stores the JWT in IDToken.idToken\n   * This is the key abstraction - consumers never need to know about Okta's structure!\n   */\n  protected async extractIdTokenInternal(): Promise<string | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      // Okta-specific detail: JWT is in idToken property\n      return idToken?.idToken || null;\n    } catch (error) {\n      console.error('[Okta] Error extracting ID token:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract complete token info from Okta\n   *\n   * Maps Okta's token structure to StandardAuthToken\n   */\n  protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      const accessToken = await this.oktaAuth.tokenManager.get('accessToken') as AccessToken;\n\n      if (!idToken?.idToken) {\n        return null;\n      }\n\n      return {\n        idToken: idToken.idToken,\n        accessToken: accessToken?.accessToken,\n        expiresAt: idToken.expiresAt ? idToken.expiresAt * 1000 : 0, // Convert to milliseconds\n        scopes: idToken.scopes\n      };\n    } catch (error) {\n      console.error('[Okta] Error extracting token info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract user info from Okta claims\n   *\n   * Maps Okta's IDToken structure to StandardUserInfo\n   */\n  protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      if (!idToken) {\n        return null;\n      }\n\n      return this.mapOktaTokenToStandard(idToken);\n    } catch (error) {\n      console.error('[Okta] Error extracting user info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Refresh token using Okta's token renewal\n   *\n   * Uses renewTokens() to get new tokens silently\n   */\n  protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n    try {\n      console.log('[Okta] Attempting to refresh token...');\n\n      // Set flag to prevent authStateManager from triggering updates\n      this.isRefreshing = true;\n\n      // First check if we're authenticated\n      const isAuthenticated = await this.oktaAuth.isAuthenticated();\n\n      if (!isAuthenticated) {\n        this.isRefreshing = false;\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'User is not authenticated',\n            userMessage: 'You need to log in to continue.'\n          }\n        };\n      }\n\n      // Check if tokens exist\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      const accessToken = await this.oktaAuth.tokenManager.get('accessToken') as AccessToken;\n\n      if (!idToken || !accessToken) {\n        this.isRefreshing = false;\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'No tokens available to refresh',\n            userMessage: 'Session not found. Please log in again.'\n          }\n        };\n      }\n\n      // Attempt to renew tokens\n      const renewedTokens = await this.oktaAuth.token.renewTokens();\n\n      if (renewedTokens.idToken) {\n        // Store the renewed tokens\n        this.oktaAuth.tokenManager.setTokens(renewedTokens);\n\n        // Wait a moment before resetting the flag\n        await new Promise(resolve => setTimeout(resolve, 100));\n\n        this.isRefreshing = false;\n\n        const newIdToken = renewedTokens.idToken as IDToken;\n        console.log('[Okta] Token refresh successful', {\n          expiresAt: newIdToken.expiresAt ? new Date(newIdToken.expiresAt * 1000).toISOString() : 'N/A'\n        });\n\n        const token: StandardAuthToken = {\n          idToken: newIdToken.idToken || '',\n          accessToken: renewedTokens.accessToken?.accessToken,\n          expiresAt: newIdToken.expiresAt ? newIdToken.expiresAt * 1000 : 0,\n          scopes: newIdToken.scopes\n        };\n\n        return {\n          success: true,\n          token\n        };\n      }\n\n      this.isRefreshing = false;\n      return {\n        success: false,\n        error: {\n          type: AuthErrorType.NO_ACTIVE_SESSION,\n          message: 'Token renewal succeeded but no ID token returned',\n          userMessage: 'Session refresh failed. Please log in again.'\n        }\n      };\n    } catch (error) {\n      console.error('[Okta] Token refresh failed:', error);\n      this.isRefreshing = false;\n\n      return {\n        success: false,\n        error: this.classifyErrorInternal(error)\n      };\n    }\n  }\n\n  /**\n   * Classify Okta-specific errors into semantic types\n   *\n   * Maps Okta error patterns to AuthErrorType enum.\n   * Updated for okta-auth-js v7.x error codes.\n   *\n   * Error sources:\n   * - errorCode: From Okta SDK errors (AuthSdkError, AuthApiError)\n   * - error: From OAuth /token endpoint responses (invalid_grant, access_denied, etc.)\n   */\n  protected classifyErrorInternal(error: unknown): StandardAuthError {\n    const errorObj = error as Record<string, unknown>;\n    const message = errorObj?.['message'] as string || 'Unknown error';\n    const errorCode = errorObj?.['errorCode'] as string || '';\n    // OAuth errors from /token endpoint use 'error' field instead of 'errorCode'\n    const oauthError = errorObj?.['error'] as string || '';\n\n    // Handle invalid_grant - refresh token is invalid or expired\n    // This is a common error when refresh tokens expire or are revoked\n    if (errorCode === 'invalid_grant' || oauthError === 'invalid_grant' ||\n        message.includes('refresh token is invalid or expired')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    // Handle access_denied - user or server denied the request\n    if (errorCode === 'access_denied' || oauthError === 'access_denied' ||\n        message.includes('access_denied')) {\n      return {\n        type: AuthErrorType.USER_CANCELLED,\n        message,\n        originalError: error,\n        userMessage: 'Access was denied. Please try again.'\n      };\n    }\n\n    // Check for specific Okta error patterns\n    if (errorCode === 'login_required' || oauthError === 'login_required' ||\n        message.includes('login_required')) {\n      return {\n        type: AuthErrorType.NO_ACTIVE_SESSION,\n        message,\n        originalError: error,\n        userMessage: 'You need to log in to continue.'\n      };\n    }\n\n    if (message.includes('not to prompt') || message.includes('consent_required') ||\n        oauthError === 'consent_required') {\n      return {\n        type: AuthErrorType.INTERACTION_REQUIRED,\n        message,\n        originalError: error,\n        userMessage: 'Additional authentication is required. Please log in again.'\n      };\n    }\n\n    // Handle both user_cancelled (SDK) and user_canceled_request (OAuth redirect)\n    if (errorCode === 'user_cancelled' || errorCode === 'user_canceled_request' ||\n        oauthError === 'user_canceled_request' ||\n        message.includes('user cancelled') || message.includes('user canceled')) {\n      return {\n        type: AuthErrorType.USER_CANCELLED,\n        message,\n        originalError: error,\n        userMessage: 'Login was cancelled.'\n      };\n    }\n\n    if (message.includes('token expired') || message.includes('invalid_token') || message.includes('unauthorized')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (message.includes('network') || message.includes('fetch') || message.includes('Load failed')) {\n      return {\n        type: AuthErrorType.NETWORK_ERROR,\n        message,\n        originalError: error,\n        userMessage: 'Network error. Please check your connection and try again.'\n      };\n    }\n\n    // Default to unknown error\n    return {\n      type: AuthErrorType.UNKNOWN_ERROR,\n      message,\n      originalError: error,\n      userMessage: 'An unexpected error occurred. Please try again.'\n    };\n  }\n\n  // ============================================================================\n  // HELPER METHODS\n  // ============================================================================\n\n  /**\n   * Map Okta IDToken to StandardUserInfo\n   */\n  private mapOktaTokenToStandard(idToken: IDToken): StandardUserInfo {\n    const claims = idToken.claims;\n\n    return {\n      id: claims.sub || '',\n      email: claims.email as string || '',\n      name: claims.name as string || '',\n      givenName: claims.given_name as string,\n      familyName: claims.family_name as string,\n      preferredUsername: claims.preferred_username as string,\n      emailVerified: claims.email_verified as boolean\n    };\n  }\n\n  /**\n   * Get profile picture URL from Okta\n   *\n   * Okta may include picture URL in user claims, similar to Auth0.\n   * If available, we can also fetch from Okta's /userinfo endpoint.\n   */\n  protected async getProfilePictureUrlInternal(): Promise<string | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      if (!idToken) {\n        return null;\n      }\n\n      // Check if picture is in claims\n      const pictureUrl = idToken.claims.picture as string;\n      if (pictureUrl) {\n        return pictureUrl;\n      }\n\n      // Alternatively, fetch from userinfo endpoint\n      const user = await this.oktaAuth.getUser();\n      return (user?.picture as string) || null;\n    } catch (error) {\n      console.error('[Okta] Error getting profile picture:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Handle session expiry - no-op for Okta\n   *\n   * Okta uses refresh tokens, so it doesn't need interactive re-authentication\n   * when tokens expire. If refresh fails, the base class will throw an error\n   * and the user must log out/in manually.\n   */\n  protected async handleSessionExpiryInternal(): Promise<void> {\n    // No-op - Okta doesn't need interactive re-auth\n    return;\n  }\n\n  // ============================================================================\n  // CONFIGURATION\n  // ============================================================================\n\n  override getRequiredConfig(): string[] {\n    return ['clientId', 'domain'];\n  }\n\n  override validateConfig(config: Record<string, unknown>): boolean {\n    return !!(config['clientId'] && (config['domain'] || config['issuer']));\n  }\n}\n"]}
+{"version":3,"file":"mjexplorer-okta-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,QAAmD,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IAuBF;IAtB1C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IACrC,QAAQ,CAAW;IACnB,YAAY,GAAG,KAAK,CAAC;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,YAAY;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,WAAW,CAAC,eAAe,CAAC;gBACtC,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC;gBAClC,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,IAAI,WAAW,WAAW,CAAC,aAAa,CAAC,iBAAiB;gBAC5F,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACvE,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;aACrE;SACF;KACF,CAAC;IAEF,YAA0C,UAAiD;QACzF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QAL0B,eAAU,GAAV,UAAU,CAAuC;QAOzF,oCAAoC;QACpC,MAAM,cAAc,GAAoB;YACtC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW;YAChF,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChE,IAAI,EAAE,IAAI,EAAE,wBAAwB;YACpC,GAAG,IAAI,CAAC,UAAU;YAClB,kFAAkF;YAClF,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;SACrH,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE7C,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,SAAkB,EAAE,EAAE;YAC9D,MAAM,KAAK,GAAG,SAA6D,CAAC;YAC5E,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC;YAErD,6DAA6D;YAC7D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,YAAY,EAAE,CAAC;YACjB,mEAAmE;YACnE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,6FAA6F;QAC7F,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAErC,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBAEtE,IAAI,SAAS,EAAE,eAAe,EAAE,CAAC;oBAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBAE3B,2BAA2B;oBAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;oBAC3E,IAAI,OAAO,EAAE,CAAC;wBACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;wBACtD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,CAAC,2DAA2D;QACrE,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;YAE9D,IAAI,eAAe,EAAE,CAAC;gBACpB,6CAA6C;gBAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;gBAE3E,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;oBACrB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBAE3B,qCAAqC;oBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;oBACtD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,IAAI,CAAC;YACH,wCAAwC;YACxC,6FAA6F;YAC7F,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,uBAAuB;YACvB,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACrC,WAAW,EAAG,OAAO,EAAE,CAAC,WAAW,CAAY,IAAI,GAAG;gBACtD,GAAG,OAAO;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,IAAI,CAAC;YACH,mDAAmD;YACnD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAE1B,sCAAsC;YACtC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAEzC,gCAAgC;YAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC1B,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAC7C,yBAAyB,EAAE,IAAI;aAChC,CAAC,CAAC;YAEH,qFAAqF;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,yDAAyD;YACzD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,6FAA6F;YAC7F,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAErC,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBACtE,IAAI,SAAS,EAAE,eAAe,EAAE,CAAC;oBAC/B,gDAAgD;oBAChD,UAAU,CAAC,GAAG,EAAE;wBACd,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAChD,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,mDAAmD;YACnD,OAAO,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAgB,CAAC;YAEvF,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,WAAW,EAAE,WAAW;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B;gBACvF,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YAErD,+DAA+D;YAC/D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAEzB,qCAAqC;YACrC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;YAE9D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,2BAA2B;wBACpC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,wBAAwB;YACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAgB,CAAC;YAEvF,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,gCAAgC;wBACzC,WAAW,EAAE,yCAAyC;qBACvD;iBACF,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAE9D,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC1B,2BAA2B;gBAC3B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAEpD,0CAA0C;gBAC1C,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAEvD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAE1B,MAAM,UAAU,GAAG,aAAa,CAAC,OAAkB,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE;oBAC7C,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK;iBAC9F,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAsB;oBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,EAAE;oBACjC,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,WAAW;oBACnD,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjE,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,KAAK;iBACN,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;oBACrC,OAAO,EAAE,kDAAkD;oBAC3D,WAAW,EAAE,8CAA8C;iBAC5D;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAE1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAC1D,6EAA6E;QAC7E,MAAM,UAAU,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAW,IAAI,EAAE,CAAC;QAEvD,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,SAAS,KAAK,eAAe,IAAI,UAAU,KAAK,eAAe;YAC/D,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,SAAS,KAAK,eAAe,IAAI,UAAU,KAAK,eAAe;YAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sCAAsC;aACpD,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,SAAS,KAAK,gBAAgB,IAAI,UAAU,KAAK,gBAAgB;YACjE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,iCAAiC;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzE,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,SAAS,KAAK,gBAAgB,IAAI,SAAS,KAAK,uBAAuB;YACvE,UAAU,KAAK,uBAAuB;YACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5E,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/G,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChG,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAE/E;;OAEG;IACK,sBAAsB,CAAC,OAAgB;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;YACpB,KAAK,EAAE,MAAM,CAAC,KAAe,IAAI,EAAE;YACnC,IAAI,EAAE,MAAM,CAAC,IAAc,IAAI,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,UAAoB;YACtC,UAAU,EAAE,MAAM,CAAC,WAAqB;YACxC,iBAAiB,EAAE,MAAM,CAAC,kBAA4B;YACtD,aAAa,EAAE,MAAM,CAAC,cAAyB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAY,CAAC;YAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,OAAiB,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,8CAA8C;YAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAQ,IAAI,EAAE,OAAkB,IAAI,IAAI,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,gDAAgD;QAChD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEQ,cAAc,CAAC,MAA+B;QACrD,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;wGAtgBU,cAAc,cAuBL,YAAY;gEAvBrB,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAugB1B;;iFAvgBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB;;sBAyBc,MAAM;uBAAC,YAAY","sourcesContent":["import { Injectable, Inject } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { Observable, BehaviorSubject, from } from 'rxjs';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport OktaAuth, { OktaAuthOptions, IDToken, AccessToken } from '@okta/okta-auth-js';\nimport {\n  StandardUserInfo,\n  StandardAuthToken,\n  StandardAuthError,\n  AuthErrorType,\n  TokenRefreshResult\n} from '../auth-types';\n/**\n * Okta authentication provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide Okta-specific details.\n * The key abstraction is that Okta stores the JWT in IDToken.idToken,\n * but consumers never need to know this detail.\n */\n@Injectable({\n  providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'okta')\nexport class MJOktaProvider extends MJAuthBase {\n  static readonly PROVIDER_TYPE = 'okta';\n  readonly type = MJOktaProvider.PROVIDER_TYPE;\n  private oktaAuth: OktaAuth;\n  private isRefreshing = false;\n\n  /**\n   * Factory function to provide Angular dependencies required by Okta\n   * Stored as a static property for the factory to access without instantiation\n   */\n  static angularProviderFactory = (environment: Record<string, unknown>) => [\n    {\n      provide: 'oktaConfig',\n      useValue: {\n        clientId: environment['OKTA_CLIENTID'],\n        domain: environment['OKTA_DOMAIN'],\n        issuer: environment['OKTA_ISSUER'] || `https://${environment['OKTA_DOMAIN']}/oauth2/default`,\n        redirectUri: environment['OKTA_REDIRECT_URI'] || window.location.origin,\n        scopes: environment['OKTA_SCOPES'] || ['openid', 'profile', 'email']\n      }\n    }\n  ];\n\n  constructor(@Inject('oktaConfig') private oktaConfig: OktaAuthOptions & { domain?: string }) {\n    const config: AngularAuthProviderConfig = {\n      name: MJOktaProvider.PROVIDER_TYPE,\n      type: MJOktaProvider.PROVIDER_TYPE\n    };\n    super(config);\n\n    // Build configuration with defaults\n    const oktaAuthConfig: OktaAuthOptions = {\n      clientId: this.oktaConfig.clientId,\n      redirectUri: this.oktaConfig.redirectUri || window.location.origin + '/callback',\n      scopes: this.oktaConfig.scopes || ['openid', 'profile', 'email'],\n      pkce: true, // Use PKCE for security\n      ...this.oktaConfig,\n      // Set issuer after spread to ensure it's not overwritten if not present in config\n      issuer: this.oktaConfig.issuer || (this.oktaConfig.domain ? `https://${this.oktaConfig.domain}/oauth2/default` : '')\n    };\n\n    this.oktaAuth = new OktaAuth(oktaAuthConfig);\n\n    // Listen for token events\n    this.oktaAuth.authStateManager.subscribe((authState: unknown) => {\n      const state = authState as { isAuthenticated?: boolean; idToken?: IDToken };\n      this.updateAuthState(state.isAuthenticated || false);\n\n      // Don't update user info if we're in the middle of a refresh\n      if (!this.isRefreshing) {\n        if (state.isAuthenticated && state.idToken) {\n          const userInfo = this.mapOktaTokenToStandard(state.idToken);\n          this.updateUserInfo(userInfo);\n        } else {\n          this.updateUserInfo(null);\n        }\n      }\n    });\n  }\n\n  // ============================================================================\n  // LIFECYCLE METHODS\n  // ============================================================================\n\n  async initialize(): Promise<void> {\n    // Check URL for logout indicator\n    const urlParams = new URLSearchParams(window.location.search);\n    const isPostLogout = urlParams.has('logout');\n\n    if (isPostLogout) {\n      // We're returning from a logout, clear the URL and stay logged out\n      window.history.replaceState({}, document.title, window.location.pathname);\n      return;\n    }\n\n    // Check if we're returning from a login redirect\n    // Note: handleRedirect() is the modern v7.x replacement for deprecated handleLoginRedirect()\n    if (this.oktaAuth.isLoginRedirect()) {\n      try {\n        await this.oktaAuth.handleRedirect();\n\n        // After handling redirect, check if we're authenticated\n        const authState = await this.oktaAuth.authStateManager.getAuthState();\n\n        if (authState?.isAuthenticated) {\n          this.updateAuthState(true);\n\n          // Get and update user info\n          const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n          if (idToken) {\n            const userInfo = this.mapOktaTokenToStandard(idToken);\n            this.updateUserInfo(userInfo);\n          }\n        }\n      } catch (error) {\n        console.error('[Okta] Initialization redirect handling error:', error);\n      }\n      return; // Don't check for existing session after handling redirect\n    }\n\n    // Only check for existing session if not a redirect\n    try {\n      const isAuthenticated = await this.oktaAuth.isAuthenticated();\n\n      if (isAuthenticated) {\n        // Double-check we actually have valid tokens\n        const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n\n        if (idToken?.idToken) {\n          this.updateAuthState(true);\n\n          // Update user info from cached token\n          const userInfo = this.mapOktaTokenToStandard(idToken);\n          this.updateUserInfo(userInfo);\n        } else {\n          // No valid tokens, stay logged out\n          this.updateAuthState(false);\n        }\n      }\n    } catch (error) {\n      console.warn('[Okta] Error checking authentication status:', error);\n    }\n  }\n\n  protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n    try {\n      // Check if we're in a redirect callback\n      // Note: handleRedirect() is the modern v7.x replacement for deprecated handleLoginRedirect()\n      if (this.oktaAuth.isLoginRedirect()) {\n        await this.oktaAuth.handleRedirect();\n        return;\n      }\n\n      // Start the login flow\n      await this.oktaAuth.signInWithRedirect({\n        originalUri: (options?.['targetUrl'] as string) || '/',\n        ...options\n      });\n    } catch (error) {\n      console.error('[Okta] Login error:', error);\n      throw error;\n    }\n  }\n\n  protected async logoutInternal(): Promise<void> {\n    try {\n      // Clear the local authentication state immediately\n      this.updateAuthState(false);\n      this.updateUserInfo(null);\n\n      // Clear all tokens from local storage\n      await this.oktaAuth.tokenManager.clear();\n\n      // Sign out from Okta completely\n      await this.oktaAuth.signOut({\n        postLogoutRedirectUri: window.location.origin,\n        clearTokensBeforeRedirect: true\n      });\n\n      // Note: The signOut call will redirect the browser, so code after this won't execute\n    } catch (error) {\n      console.error('[Okta] Logout error:', error);\n      // If logout fails, at least clear local state and reload\n      window.location.href = window.location.origin;\n    }\n  }\n\n  async handleCallback(): Promise<void> {\n    try {\n      // Note: handleRedirect() is the modern v7.x replacement for deprecated handleLoginRedirect()\n      if (this.oktaAuth.isLoginRedirect()) {\n        await this.oktaAuth.handleRedirect();\n\n        // After handling redirect, check if we're authenticated\n        const authState = await this.oktaAuth.authStateManager.getAuthState();\n        if (authState?.isAuthenticated) {\n          // Do a controlled reload after successful login\n          setTimeout(() => {\n            window.location.href = window.location.origin;\n          }, 100);\n        }\n      }\n    } catch (error) {\n      console.error('[Okta] Callback handling error:', error);\n      throw error;\n    }\n  }\n\n  // ============================================================================\n  // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n  // ============================================================================\n\n  /**\n   * Extract ID token from Okta's storage\n   *\n   * Okta stores the JWT in IDToken.idToken\n   * This is the key abstraction - consumers never need to know about Okta's structure!\n   */\n  protected async extractIdTokenInternal(): Promise<string | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      // Okta-specific detail: JWT is in idToken property\n      return idToken?.idToken || null;\n    } catch (error) {\n      console.error('[Okta] Error extracting ID token:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract complete token info from Okta\n   *\n   * Maps Okta's token structure to StandardAuthToken\n   */\n  protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      const accessToken = await this.oktaAuth.tokenManager.get('accessToken') as AccessToken;\n\n      if (!idToken?.idToken) {\n        return null;\n      }\n\n      return {\n        idToken: idToken.idToken,\n        accessToken: accessToken?.accessToken,\n        expiresAt: idToken.expiresAt ? idToken.expiresAt * 1000 : 0, // Convert to milliseconds\n        scopes: idToken.scopes\n      };\n    } catch (error) {\n      console.error('[Okta] Error extracting token info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Extract user info from Okta claims\n   *\n   * Maps Okta's IDToken structure to StandardUserInfo\n   */\n  protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      if (!idToken) {\n        return null;\n      }\n\n      return this.mapOktaTokenToStandard(idToken);\n    } catch (error) {\n      console.error('[Okta] Error extracting user info:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Refresh token using Okta's token renewal\n   *\n   * Uses renewTokens() to get new tokens silently\n   */\n  protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n    try {\n      console.log('[Okta] Attempting to refresh token...');\n\n      // Set flag to prevent authStateManager from triggering updates\n      this.isRefreshing = true;\n\n      // First check if we're authenticated\n      const isAuthenticated = await this.oktaAuth.isAuthenticated();\n\n      if (!isAuthenticated) {\n        this.isRefreshing = false;\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'User is not authenticated',\n            userMessage: 'You need to log in to continue.'\n          }\n        };\n      }\n\n      // Check if tokens exist\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      const accessToken = await this.oktaAuth.tokenManager.get('accessToken') as AccessToken;\n\n      if (!idToken || !accessToken) {\n        this.isRefreshing = false;\n        return {\n          success: false,\n          error: {\n            type: AuthErrorType.NO_ACTIVE_SESSION,\n            message: 'No tokens available to refresh',\n            userMessage: 'Session not found. Please log in again.'\n          }\n        };\n      }\n\n      // Attempt to renew tokens\n      const renewedTokens = await this.oktaAuth.token.renewTokens();\n\n      if (renewedTokens.idToken) {\n        // Store the renewed tokens\n        this.oktaAuth.tokenManager.setTokens(renewedTokens);\n\n        // Wait a moment before resetting the flag\n        await new Promise(resolve => setTimeout(resolve, 100));\n\n        this.isRefreshing = false;\n\n        const newIdToken = renewedTokens.idToken as IDToken;\n        console.log('[Okta] Token refresh successful', {\n          expiresAt: newIdToken.expiresAt ? new Date(newIdToken.expiresAt * 1000).toISOString() : 'N/A'\n        });\n\n        const token: StandardAuthToken = {\n          idToken: newIdToken.idToken || '',\n          accessToken: renewedTokens.accessToken?.accessToken,\n          expiresAt: newIdToken.expiresAt ? newIdToken.expiresAt * 1000 : 0,\n          scopes: newIdToken.scopes\n        };\n\n        return {\n          success: true,\n          token\n        };\n      }\n\n      this.isRefreshing = false;\n      return {\n        success: false,\n        error: {\n          type: AuthErrorType.NO_ACTIVE_SESSION,\n          message: 'Token renewal succeeded but no ID token returned',\n          userMessage: 'Session refresh failed. Please log in again.'\n        }\n      };\n    } catch (error) {\n      console.error('[Okta] Token refresh failed:', error);\n      this.isRefreshing = false;\n\n      return {\n        success: false,\n        error: this.classifyErrorInternal(error)\n      };\n    }\n  }\n\n  /**\n   * Classify Okta-specific errors into semantic types\n   *\n   * Maps Okta error patterns to AuthErrorType enum.\n   * Updated for okta-auth-js v7.x error codes.\n   *\n   * Error sources:\n   * - errorCode: From Okta SDK errors (AuthSdkError, AuthApiError)\n   * - error: From OAuth /token endpoint responses (invalid_grant, access_denied, etc.)\n   */\n  protected classifyErrorInternal(error: unknown): StandardAuthError {\n    const errorObj = error as Record<string, unknown>;\n    const message = errorObj?.['message'] as string || 'Unknown error';\n    const errorCode = errorObj?.['errorCode'] as string || '';\n    // OAuth errors from /token endpoint use 'error' field instead of 'errorCode'\n    const oauthError = errorObj?.['error'] as string || '';\n\n    // Handle invalid_grant - refresh token is invalid or expired\n    // This is a common error when refresh tokens expire or are revoked\n    if (errorCode === 'invalid_grant' || oauthError === 'invalid_grant' ||\n        message.includes('refresh token is invalid or expired')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    // Handle access_denied - user or server denied the request\n    if (errorCode === 'access_denied' || oauthError === 'access_denied' ||\n        message.includes('access_denied')) {\n      return {\n        type: AuthErrorType.USER_CANCELLED,\n        message,\n        originalError: error,\n        userMessage: 'Access was denied. Please try again.'\n      };\n    }\n\n    // Check for specific Okta error patterns\n    if (errorCode === 'login_required' || oauthError === 'login_required' ||\n        message.includes('login_required')) {\n      return {\n        type: AuthErrorType.NO_ACTIVE_SESSION,\n        message,\n        originalError: error,\n        userMessage: 'You need to log in to continue.'\n      };\n    }\n\n    if (message.includes('not to prompt') || message.includes('consent_required') ||\n        oauthError === 'consent_required') {\n      return {\n        type: AuthErrorType.INTERACTION_REQUIRED,\n        message,\n        originalError: error,\n        userMessage: 'Additional authentication is required. Please log in again.'\n      };\n    }\n\n    // Handle both user_cancelled (SDK) and user_canceled_request (OAuth redirect)\n    if (errorCode === 'user_cancelled' || errorCode === 'user_canceled_request' ||\n        oauthError === 'user_canceled_request' ||\n        message.includes('user cancelled') || message.includes('user canceled')) {\n      return {\n        type: AuthErrorType.USER_CANCELLED,\n        message,\n        originalError: error,\n        userMessage: 'Login was cancelled.'\n      };\n    }\n\n    if (message.includes('token expired') || message.includes('invalid_token') || message.includes('unauthorized')) {\n      return {\n        type: AuthErrorType.TOKEN_EXPIRED,\n        message,\n        originalError: error,\n        userMessage: 'Your session has expired. Please log in again.'\n      };\n    }\n\n    if (message.includes('network') || message.includes('fetch') || message.includes('Load failed')) {\n      return {\n        type: AuthErrorType.NETWORK_ERROR,\n        message,\n        originalError: error,\n        userMessage: 'Network error. Please check your connection and try again.'\n      };\n    }\n\n    // Default to unknown error\n    return {\n      type: AuthErrorType.UNKNOWN_ERROR,\n      message,\n      originalError: error,\n      userMessage: 'An unexpected error occurred. Please try again.'\n    };\n  }\n\n  // ============================================================================\n  // HELPER METHODS\n  // ============================================================================\n\n  /**\n   * Map Okta IDToken to StandardUserInfo\n   */\n  private mapOktaTokenToStandard(idToken: IDToken): StandardUserInfo {\n    const claims = idToken.claims;\n\n    return {\n      id: claims.sub || '',\n      email: claims.email as string || '',\n      name: claims.name as string || '',\n      givenName: claims.given_name as string,\n      familyName: claims.family_name as string,\n      preferredUsername: claims.preferred_username as string,\n      emailVerified: claims.email_verified as boolean\n    };\n  }\n\n  /**\n   * Get profile picture URL from Okta\n   *\n   * Okta may include picture URL in user claims, similar to Auth0.\n   * If available, we can also fetch from Okta's /userinfo endpoint.\n   */\n  protected async getProfilePictureUrlInternal(): Promise<string | null> {\n    try {\n      const idToken = await this.oktaAuth.tokenManager.get('idToken') as IDToken;\n      if (!idToken) {\n        return null;\n      }\n\n      // Check if picture is in claims\n      const pictureUrl = idToken.claims.picture as string;\n      if (pictureUrl) {\n        return pictureUrl;\n      }\n\n      // Alternatively, fetch from userinfo endpoint\n      const user = await this.oktaAuth.getUser();\n      return (user?.picture as string) || null;\n    } catch (error) {\n      console.error('[Okta] Error getting profile picture:', error);\n      return null;\n    }\n  }\n\n  /**\n   * Handle session expiry - no-op for Okta\n   *\n   * Okta uses refresh tokens, so it doesn't need interactive re-authentication\n   * when tokens expire. If refresh fails, the base class will throw an error\n   * and the user must log out/in manually.\n   */\n  protected async handleSessionExpiryInternal(): Promise<void> {\n    // No-op - Okta doesn't need interactive re-auth\n    return;\n  }\n\n  // ============================================================================\n  // CONFIGURATION\n  // ============================================================================\n\n  override getRequiredConfig(): string[] {\n    return ['clientId', 'domain'];\n  }\n\n  override validateConfig(config: Record<string, unknown>): boolean {\n    return !!(config['clientId'] && (config['domain'] || config['issuer']));\n  }\n}\n"]}