npm - @memberjunction/ng-auth-services - Versions diffs - 5.14.0 → 5.16.0 - Mend

@memberjunction/ng-auth-services 5.14.0 → 5.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (27) hide show

package/dist/lib/mjexplorer-auth-base.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mjexplorer-auth-base.service.js","sourceRoot":"","sources":["../../src/lib/mjexplorer-auth-base.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAc,eAAe,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;;AASzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,OAAgB,UAAU;IACpB,MAAM,CAA4B;IAE5C,sDAAsD;IAC5C,gBAAgB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACvD,SAAS,GAAG,IAAI,eAAe,CAA0B,IAAI,CAAC,CAAC;IAC/D,UAAU,GAAG,IAAI,eAAe,CAAS,EAAE,CAAC,CAAC;IAE/C,YAAY,GAAkB,IAAI,CAAC;IACnC,cAAc,GAAkB,IAAI,CAAC;IAE7C;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAQD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/C,CAAC;IAyHD,+EAA+E;IAC/E,iEAAiE;IACjE,+EAA+E;IAE/E;;;;;;OAMG;IACH,KAAK,CAAC,OAAiC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,YAAY;QAChB,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEjD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,oCAAoC;YACpC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,yCAAyC;YAC3C,CAAC;YAED,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,gEAAgE;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QACrC,IAAI,SAAS,KAAK,eAAe,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;YAC1E,qEAAqE;YACrE,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAEzC,yDAAyD;YACzD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACtD,IAAI,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC7C,8BAA8B;gBAC9B,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBACtD,IAAI,QAAQ,EAAE,CAAC;wBACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;gBAED,OAAO,WAAW,CAAC,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,sBAAsB,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,KAAc;QAC1B,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,oBAAoB;QACxB,OAAO,IAAI,CAAC,4BAA4B,EAAE,CAAC;IAC7C,CAAC;IAED,+EAA+E;IAC/E,kDAAkD;IAClD,+EAA+E;IAE/E;;;;;OAKG;IACO,eAAe,CAAC,eAAwB;QAChD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACO,cAAc,CAAC,QAAiC;QACxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9B,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6BAA6B;IAC7B,+EAA+E;IAE/E;;;;;OAKG;IACH,iBAAiB;QACf,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAA+B;QAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAClC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CACpD,CAAC;IACJ,CAAC;;gEArYmB,UAAU,WAAV,UAAU;;iFAAV,UAAU;cAD/B,UAAU","sourcesContent":["import { Injectable } from '@angular/core';\nimport { Observable, BehaviorSubject, from } from 'rxjs';\nimport { IAngularAuthProvider, AngularAuthProviderConfig } from './IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n TokenRefreshResult\n} from './auth-types';\n\n/*\n Base class for Angular authentication providers - v3.0.0\n \n Provides common functionality and enforces the provider interface.\n * All concrete providers (MSAL, Auth0, Okta) should extend this class.\n \n ## Key Improvements in v3.0:\n * - Proper abstraction - no more leaky provider-specific logic\n * - Standardized types - no more `any` types\n * - Clean token access - no more `__raw \|\| idToken` patterns\n * - Semantic error handling - no more provider-specific error checks\n \n ## For Provider Implementers:\n * Extend this class and implement the abstract methods:\n * - `extractIdTokenInternal()` - Extract token from provider storage\n * - `extractTokenInfoInternal()` - Extract full token info\n * - `extractUserInfoInternal()` - Map claims to StandardUserInfo\n * - `refreshTokenInternal()` - Implement refresh mechanism\n * - `classifyErrorInternal()` - Map errors to AuthErrorType\n \n @version 3.0.0\n /\n@Injectable()\nexport abstract class MJAuthBase implements IAngularAuthProvider {\n protected config: AngularAuthProviderConfig;\n\n // State management with proper types (no more 'any'!)\n protected isAuthenticated$ = new BehaviorSubject<boolean>(false);\n protected userInfo$ = new BehaviorSubject<StandardUserInfo \| null>(null);\n protected userEmail$ = new BehaviorSubject<string>('');\n\n private _initialPath: string \| null = null;\n private _initialSearch: string \| null = null;\n\n /\n Contains the initial path from window.location.pathname before any work was done by auth services\n /\n get initialPath(): string \| null {\n return this._initialPath;\n }\n\n /\n Contains the initial search/query string from window.location.search before any work was done by auth services\n /\n get initialSearch(): string \| null {\n return this._initialSearch;\n }\n\n /\n Provider type identifier\n * Must be implemented by concrete providers\n /\n abstract readonly type: string;\n\n constructor(config: AngularAuthProviderConfig) {\n this.config = config;\n this._initialPath = window.location.pathname;\n this._initialSearch = window.location.search;\n }\n\n // ============================================================================\n // ABSTRACT METHODS (Must be implemented by concrete providers)\n // ============================================================================\n\n /\n Initialize the provider\n \n Subclasses should override to set up provider-specific initialization,\n * handle redirect callbacks, restore sessions, etc.\n /\n abstract initialize(): Promise<void>;\n\n /\n Internal login implementation\n \n Subclasses implement provider-specific login flow.\n * This is called by the public login() method.\n /\n protected abstract loginInternal(options?: Record<string, unknown>): Promise<void>;\n\n /\n Logout implementation\n \n Subclasses implement provider-specific logout flow.\n /\n abstract logout(): Promise<void>;\n\n /\n Handle OAuth callback\n \n Subclasses implement provider-specific callback handling.\n /\n abstract handleCallback(): Promise<void>;\n\n /\n Extract ID token from provider-specific storage\n \n This is where providers hide their implementation details.\n * - Auth0: Extracts from claims.__raw\n * - MSAL: Extracts from response.idToken\n * - Okta: Extracts from authState.idToken\n \n @returns Promise resolving to token string or null if not authenticated\n /\n protected abstract extractIdTokenInternal(): Promise<string \| null>;\n\n /\n Extract complete token info from provider-specific storage\n \n Maps provider-specific token structure to StandardAuthToken.\n \n @returns Promise resolving to StandardAuthToken or null if not authenticated\n /\n protected abstract extractTokenInfoInternal(): Promise<StandardAuthToken \| null>;\n\n /\n Extract user info from provider-specific claims\n \n Maps provider-specific claim structure to StandardUserInfo.\n * This is where providers translate their claims (sub, email, name, etc.)\n * into the standard structure.\n \n @returns Promise resolving to StandardUserInfo or null if not authenticated\n /\n protected abstract extractUserInfoInternal(): Promise<StandardUserInfo \| null>;\n\n /\n Refresh token using provider-specific mechanism\n \n Implements the provider's token refresh logic using whatever mechanism\n * is appropriate (silent refresh with refresh tokens, iframe-based token\n * acquisition, etc.).\n \n Should return success with token if refresh succeeds, or failure with\n * appropriate error type (TOKEN_EXPIRED, INTERACTION_REQUIRED, etc.) if\n * refresh fails.\n \n @returns Promise resolving to TokenRefreshResult indicating success/failure\n /\n protected abstract refreshTokenInternal(): Promise<TokenRefreshResult>;\n\n /\n Classify provider-specific error into standard error type\n \n Maps provider-specific errors to semantic AuthErrorType values.\n * Examines error objects, error codes, and messages to determine the\n * appropriate category (TOKEN_EXPIRED, INTERACTION_REQUIRED, NETWORK_ERROR, etc.).\n \n @param error The error to classify\n * @returns StandardAuthError with categorized type and user-friendly message\n /\n protected abstract classifyErrorInternal(error: unknown): StandardAuthError;\n\n /\n Get profile picture URL from auth provider\n \n Retrieves the user's profile picture using provider-specific mechanisms.\n * Some providers include the URL in user claims, others require API calls\n * to fetch the image.\n \n @returns Promise resolving to image URL or null if not available\n /\n protected abstract getProfilePictureUrlInternal(): Promise<string \| null>;\n\n /\n Handle session expiry when silent refresh fails\n \n Called internally when silent token refresh fails with TOKEN_EXPIRED or\n * INTERACTION_REQUIRED errors. Providers that support refresh tokens can\n * implement this as a no-op. Providers that require interactive re-authentication\n * should initiate the appropriate flow (redirect, popup, etc.).\n \n Note: If this method redirects the page, it may never return. The app will\n * reload after authentication completes and re-initialize with a fresh token.\n \n @returns Promise that resolves if re-auth completed, or never returns if redirected\n /\n protected abstract handleSessionExpiryInternal(): Promise<void>;\n\n // ============================================================================\n // PUBLIC API (Concrete implementations using abstract internals)\n // ============================================================================\n\n /\n Public login method with Observable wrapper for backward compatibility\n \n Consumers can use either:\n * - `await this.authBase.login()` (Promise)\n * - `this.authBase.login().subscribe()` (Observable)\n /\n login(options?: Record<string, unknown>): Observable<void> {\n return from(this.loginInternal(options));\n }\n\n /\n Check if user is authenticated (Observable stream)\n \n Returns a reactive stream that emits authentication state changes.\n * Consumers can subscribe to react to login/logout events.\n /\n isAuthenticated(): Observable<boolean> {\n return this.isAuthenticated$.asObservable();\n }\n\n /\n Get user info as Observable stream\n \n Returns standardized user info, hiding provider-specific claim structures.\n * No more need for consumers to merge claims or check provider-specific fields!\n /\n getUserInfo(): Observable<StandardUserInfo \| null> {\n return this.userInfo$.asObservable();\n }\n\n /\n Get user email as Observable stream\n /\n getUserEmail(): Observable<string> {\n return this.userEmail$.asObservable();\n }\n\n /\n Get ID token string (primary token method)\n \n This is the clean abstraction - no provider-specific logic needed!\n * Replaces the old pattern of: `claims?.__raw \|\| claims?.idToken`\n \n @example\n * ```typescript\n * const token = await this.authBase.getIdToken();\n * if (token) {\n * setupGraphQLClient(token, apiUrl);\n * }\n * ```\n /\n async getIdToken(): Promise<string \| null> {\n return this.extractIdTokenInternal();\n }\n\n /\n Get complete token information\n \n Returns full token details including expiration and scopes.\n * Use this when you need more than just the token string.\n /\n async getTokenInfo(): Promise<StandardAuthToken \| null> {\n return this.extractTokenInfoInternal();\n }\n\n /\n Refresh authentication token\n \n Attempts to obtain a fresh authentication token using the provider's\n * refresh mechanism. If silent refresh fails due to session expiry, the\n * provider will handle re-authentication automatically (which may involve\n * redirecting to the auth provider's login page).\n \n Returns StandardAuthToken on success, or throws on complete failure.\n \n IMPORTANT: If the provider requires interactive re-authentication (redirect\n * or popup), this method may never return. The app will reload after\n * authentication completes and re-initialize with a fresh token.\n \n @returns Promise resolving to StandardAuthToken or throws on failure\n \n @example\n * ```typescript\n * const token = await this.authBase.refreshToken();\n * return token.idToken; // Always succeeds or throws\n * ```\n /\n async refreshToken(): Promise<StandardAuthToken> {\n // Try silent refresh\n const result = await this.refreshTokenInternal();\n\n if (result.success && result.token) {\n // Update state if refresh succeeded\n try {\n const userInfo = await this.extractUserInfoInternal();\n if (userInfo) {\n this.updateUserInfo(userInfo);\n }\n } catch {\n // User info update failed, but token refresh succeeded\n // Don't fail the entire refresh for this\n }\n\n return result.token;\n }\n\n // Silent refresh failed - check if we can handle session expiry\n const errorType = result.error?.type;\n if (errorType === 'TOKEN_EXPIRED' \|\| errorType === 'INTERACTION_REQUIRED') {\n // Let provider handle session expiry (may redirect and never return)\n await this.handleSessionExpiryInternal();\n\n // If we reach here (didn't redirect), retry refresh once\n const retryResult = await this.refreshTokenInternal();\n if (retryResult.success && retryResult.token) {\n // Update state with new token\n try {\n const userInfo = await this.extractUserInfoInternal();\n if (userInfo) {\n this.updateUserInfo(userInfo);\n }\n } catch {\n // Ignore user info update errors\n }\n\n return retryResult.token;\n }\n }\n\n // Complete failure - throw error\n throw new Error(result.error?.userMessage \|\| 'Token refresh failed');\n }\n\n /\n Classify an error into standard error type\n \n Converts provider-specific errors into semantic categories.\n * Eliminates need for consumers to check error.name or error types.\n \n @example\n * ```typescript\n * const authError = this.authBase.classifyError(err);\n * if (authError.type === AuthErrorType.TOKEN_EXPIRED) {\n * this.showMessage(authError.userMessage);\n * }\n * ```\n /\n classifyError(error: unknown): StandardAuthError {\n return this.classifyErrorInternal(error);\n }\n\n /\n Get profile picture URL from auth provider\n \n Returns the user's profile picture URL if available from the auth provider.\n * This abstracts away provider-specific logic:\n * - Microsoft/MSAL: Fetches from Graph API\n * - Auth0/Okta: Returns from user claims\n \n @returns Promise resolving to image URL or null if not available\n \n @example\n * ```typescript\n * const pictureUrl = await this.authBase.getProfilePictureUrl();\n * if (pictureUrl) {\n * this.userAvatar = pictureUrl;\n * }\n * ```\n /\n async getProfilePictureUrl(): Promise<string \| null> {\n return this.getProfilePictureUrlInternal();\n }\n\n // ============================================================================\n // HELPER METHODS (For subclasses to update state)\n // ============================================================================\n\n /\n Update authentication state\n \n Subclasses should call this when authentication state changes\n * (after login, logout, session check, etc.)\n /\n protected updateAuthState(isAuthenticated: boolean): void {\n this.isAuthenticated$.next(isAuthenticated);\n }\n\n /\n Update user info\n \n Subclasses should call this when user info is retrieved or updated.\n * This automatically updates the email stream as well.\n /\n protected updateUserInfo(userInfo: StandardUserInfo \| null): void {\n this.userInfo$.next(userInfo);\n\n if (userInfo?.email) {\n this.userEmail$.next(userInfo.email);\n } else {\n this.userEmail$.next('');\n }\n }\n\n // ============================================================================\n // CONFIGURATION & VALIDATION\n // ============================================================================\n\n /\n Get required configuration fields\n \n Default implementation requires clientId.\n * Subclasses can override to add provider-specific requirements.\n /\n getRequiredConfig(): string[] {\n return ['clientId'];\n }\n\n /\n Validate provider configuration\n \n Checks that all required fields are present and non-empty.\n * Subclasses can override to add custom validation logic.\n */\n validateConfig(config: Record<string, unknown>): boolean {\n const requiredFields = this.getRequiredConfig();\n return requiredFields.every(field =>\n config[field] !== undefined && config[field] !== ''\n );\n }\n}\n"]}
1	+ {"version":3,"file":"mjexplorer-auth-base.service.js","sourceRoot":"","sources":["../../src/lib/mjexplorer-auth-base.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAc,eAAe,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;;AASzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,OAAgB,UAAU;IACpB,MAAM,CAA4B;IAE5C,sDAAsD;IAC5C,gBAAgB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACvD,SAAS,GAAG,IAAI,eAAe,CAA0B,IAAI,CAAC,CAAC;IAC/D,UAAU,GAAG,IAAI,eAAe,CAAS,EAAE,CAAC,CAAC;IAE/C,YAAY,GAAkB,IAAI,CAAC;IACnC,cAAc,GAAkB,IAAI,CAAC;IAE7C;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAQD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/C,CAAC;IA2HD,+EAA+E;IAC/E,iEAAiE;IACjE,+EAA+E;IAE/E;;;;;;OAMG;IACH,KAAK,CAAC,OAAiC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,IAAc,yBAAyB;QACrC,OAAO,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC;QACjD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAE1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YACpD,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAChC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,YAAY;QAChB,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEjD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,oCAAoC;YACpC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,yCAAyC;YAC3C,CAAC;YAED,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,gEAAgE;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QACrC,IAAI,SAAS,KAAK,eAAe,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;YAC1E,qEAAqE;YACrE,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAEzC,yDAAyD;YACzD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACtD,IAAI,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC7C,8BAA8B;gBAC9B,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBACtD,IAAI,QAAQ,EAAE,CAAC;wBACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;gBAED,OAAO,WAAW,CAAC,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,sBAAsB,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,KAAc;QAC1B,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,oBAAoB;QACxB,OAAO,IAAI,CAAC,4BAA4B,EAAE,CAAC;IAC7C,CAAC;IAED,+EAA+E;IAC/E,kDAAkD;IAClD,+EAA+E;IAE/E;;;;;OAKG;IACO,eAAe,CAAC,eAAwB;QAChD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACO,cAAc,CAAC,QAAiC;QACxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9B,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6BAA6B;IAC7B,+EAA+E;IAE/E;;;;;OAKG;IACH,iBAAiB;QACf,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAA+B;QAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAClC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CACpD,CAAC;IACJ,CAAC;;gEAxbmB,UAAU,WAAV,UAAU;;iFAAV,UAAU;cAD/B,UAAU","sourcesContent":["import { Injectable } from '@angular/core';\nimport { Observable, BehaviorSubject, from } from 'rxjs';\nimport { IAngularAuthProvider, AngularAuthProviderConfig } from './IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n TokenRefreshResult\n} from './auth-types';\n\n/*\n Base class for Angular authentication providers - v3.0.0\n \n Provides common functionality and enforces the provider interface.\n * All concrete providers (MSAL, Auth0, Okta) should extend this class.\n \n ## Key Improvements in v3.0:\n * - Proper abstraction - no more leaky provider-specific logic\n * - Standardized types - no more `any` types\n * - Clean token access - no more `__raw \|\| idToken` patterns\n * - Semantic error handling - no more provider-specific error checks\n \n ## For Provider Implementers:\n * Extend this class and implement the abstract methods:\n * - `extractIdTokenInternal()` - Extract token from provider storage\n * - `extractTokenInfoInternal()` - Extract full token info\n * - `extractUserInfoInternal()` - Map claims to StandardUserInfo\n * - `refreshTokenInternal()` - Implement refresh mechanism\n * - `classifyErrorInternal()` - Map errors to AuthErrorType\n \n @version 3.0.0\n /\n@Injectable()\nexport abstract class MJAuthBase implements IAngularAuthProvider {\n protected config: AngularAuthProviderConfig;\n\n // State management with proper types (no more 'any'!)\n protected isAuthenticated$ = new BehaviorSubject<boolean>(false);\n protected userInfo$ = new BehaviorSubject<StandardUserInfo \| null>(null);\n protected userEmail$ = new BehaviorSubject<string>('');\n\n private _initialPath: string \| null = null;\n private _initialSearch: string \| null = null;\n\n /\n Contains the initial path from window.location.pathname before any work was done by auth services\n /\n get initialPath(): string \| null {\n return this._initialPath;\n }\n\n /\n Contains the initial search/query string from window.location.search before any work was done by auth services\n /\n get initialSearch(): string \| null {\n return this._initialSearch;\n }\n\n /\n Provider type identifier\n * Must be implemented by concrete providers\n /\n abstract readonly type: string;\n\n constructor(config: AngularAuthProviderConfig) {\n this.config = config;\n this._initialPath = window.location.pathname;\n this._initialSearch = window.location.search;\n }\n\n // ============================================================================\n // ABSTRACT METHODS (Must be implemented by concrete providers)\n // ============================================================================\n\n /\n Initialize the provider\n \n Subclasses should override to set up provider-specific initialization,\n * handle redirect callbacks, restore sessions, etc.\n /\n abstract initialize(): Promise<void>;\n\n /\n Internal login implementation\n \n Subclasses implement provider-specific login flow.\n * This is called by the public login() method.\n /\n protected abstract loginInternal(options?: Record<string, unknown>): Promise<void>;\n\n /\n Provider-specific logout implementation\n \n Subclasses implement provider-specific logout flow (redirect, SDK logout, etc.).\n * The base class `logout()` calls `clearClientCaches()` before invoking this method,\n * so providers do NOT need to handle cache clearing themselves.\n /\n protected abstract logoutInternal(): Promise<void>;\n\n /\n Handle OAuth callback\n \n Subclasses implement provider-specific callback handling.\n /\n abstract handleCallback(): Promise<void>;\n\n /\n Extract ID token from provider-specific storage\n \n This is where providers hide their implementation details.\n * - Auth0: Extracts from claims.__raw\n * - MSAL: Extracts from response.idToken\n * - Okta: Extracts from authState.idToken\n \n @returns Promise resolving to token string or null if not authenticated\n /\n protected abstract extractIdTokenInternal(): Promise<string \| null>;\n\n /\n Extract complete token info from provider-specific storage\n \n Maps provider-specific token structure to StandardAuthToken.\n \n @returns Promise resolving to StandardAuthToken or null if not authenticated\n /\n protected abstract extractTokenInfoInternal(): Promise<StandardAuthToken \| null>;\n\n /\n Extract user info from provider-specific claims\n \n Maps provider-specific claim structure to StandardUserInfo.\n * This is where providers translate their claims (sub, email, name, etc.)\n * into the standard structure.\n \n @returns Promise resolving to StandardUserInfo or null if not authenticated\n /\n protected abstract extractUserInfoInternal(): Promise<StandardUserInfo \| null>;\n\n /\n Refresh token using provider-specific mechanism\n \n Implements the provider's token refresh logic using whatever mechanism\n * is appropriate (silent refresh with refresh tokens, iframe-based token\n * acquisition, etc.).\n \n Should return success with token if refresh succeeds, or failure with\n * appropriate error type (TOKEN_EXPIRED, INTERACTION_REQUIRED, etc.) if\n * refresh fails.\n \n @returns Promise resolving to TokenRefreshResult indicating success/failure\n /\n protected abstract refreshTokenInternal(): Promise<TokenRefreshResult>;\n\n /\n Classify provider-specific error into standard error type\n \n Maps provider-specific errors to semantic AuthErrorType values.\n * Examines error objects, error codes, and messages to determine the\n * appropriate category (TOKEN_EXPIRED, INTERACTION_REQUIRED, NETWORK_ERROR, etc.).\n \n @param error The error to classify\n * @returns StandardAuthError with categorized type and user-friendly message\n /\n protected abstract classifyErrorInternal(error: unknown): StandardAuthError;\n\n /\n Get profile picture URL from auth provider\n \n Retrieves the user's profile picture using provider-specific mechanisms.\n * Some providers include the URL in user claims, others require API calls\n * to fetch the image.\n \n @returns Promise resolving to image URL or null if not available\n /\n protected abstract getProfilePictureUrlInternal(): Promise<string \| null>;\n\n /\n Handle session expiry when silent refresh fails\n \n Called internally when silent token refresh fails with TOKEN_EXPIRED or\n * INTERACTION_REQUIRED errors. Providers that support refresh tokens can\n * implement this as a no-op. Providers that require interactive re-authentication\n * should initiate the appropriate flow (redirect, popup, etc.).\n \n Note: If this method redirects the page, it may never return. The app will\n * reload after authentication completes and re-initialize with a fresh token.\n \n @returns Promise that resolves if re-auth completed, or never returns if redirected\n /\n protected abstract handleSessionExpiryInternal(): Promise<void>;\n\n // ============================================================================\n // PUBLIC API (Concrete implementations using abstract internals)\n // ============================================================================\n\n /\n Public login method with Observable wrapper for backward compatibility\n \n Consumers can use either:\n * - `await this.authBase.login()` (Promise)\n * - `this.authBase.login().subscribe()` (Observable)\n /\n login(options?: Record<string, unknown>): Observable<void> {\n return from(this.loginInternal(options));\n }\n\n /\n Logout — clears all MJ client-side caches then delegates to the provider.\n \n Cache clearing happens universally regardless of auth provider so that a\n * subsequent login as a different user never sees the previous user's data.\n * Providers that need to clear additional caches should override\n * `logoutInternal()` and call `super.logoutInternal()` if applicable.\n /\n async logout(): Promise<void> {\n await this.clearClientCaches();\n await this.logoutInternal();\n }\n\n /\n localStorage keys that survive a logout (e.g. UI theme preference).\n \n Override this getter in a subclass to preserve additional keys specific\n * to your provider or application.\n /\n protected get preservedLocalStorageKeys(): Set<string> {\n return new Set(['mj-login-theme']);\n }\n\n /\n Clears MJ client-side caches before logout.\n \n Removes all localStorage entries except those returned by\n * `preservedLocalStorageKeys`, and deletes the `MJ_Metadata` IndexedDB\n * database so a subsequent user session starts with a clean slate.\n /\n protected async clearClientCaches(): Promise<void> {\n const preserved = this.preservedLocalStorageKeys;\n const keysToRemove: string[] = [];\n for (let i = 0; i < localStorage.length; i++) {\n const key = localStorage.key(i);\n if (key && !preserved.has(key)) {\n keysToRemove.push(key);\n }\n }\n keysToRemove.forEach(key => localStorage.removeItem(key));\n\n await new Promise<void>((resolve) => {\n const req = indexedDB.deleteDatabase('MJ_Metadata');\n req.onsuccess = () => resolve();\n req.onerror = () => resolve();\n req.onblocked = () => resolve();\n });\n }\n\n /\n Check if user is authenticated (Observable stream)\n \n Returns a reactive stream that emits authentication state changes.\n * Consumers can subscribe to react to login/logout events.\n /\n isAuthenticated(): Observable<boolean> {\n return this.isAuthenticated$.asObservable();\n }\n\n /\n Get user info as Observable stream\n \n Returns standardized user info, hiding provider-specific claim structures.\n * No more need for consumers to merge claims or check provider-specific fields!\n /\n getUserInfo(): Observable<StandardUserInfo \| null> {\n return this.userInfo$.asObservable();\n }\n\n /\n Get user email as Observable stream\n /\n getUserEmail(): Observable<string> {\n return this.userEmail$.asObservable();\n }\n\n /\n Get ID token string (primary token method)\n \n This is the clean abstraction - no provider-specific logic needed!\n * Replaces the old pattern of: `claims?.__raw \|\| claims?.idToken`\n \n @example\n * ```typescript\n * const token = await this.authBase.getIdToken();\n * if (token) {\n * setupGraphQLClient(token, apiUrl);\n * }\n * ```\n /\n async getIdToken(): Promise<string \| null> {\n return this.extractIdTokenInternal();\n }\n\n /\n Get complete token information\n \n Returns full token details including expiration and scopes.\n * Use this when you need more than just the token string.\n /\n async getTokenInfo(): Promise<StandardAuthToken \| null> {\n return this.extractTokenInfoInternal();\n }\n\n /\n Refresh authentication token\n \n Attempts to obtain a fresh authentication token using the provider's\n * refresh mechanism. If silent refresh fails due to session expiry, the\n * provider will handle re-authentication automatically (which may involve\n * redirecting to the auth provider's login page).\n \n Returns StandardAuthToken on success, or throws on complete failure.\n \n IMPORTANT: If the provider requires interactive re-authentication (redirect\n * or popup), this method may never return. The app will reload after\n * authentication completes and re-initialize with a fresh token.\n \n @returns Promise resolving to StandardAuthToken or throws on failure\n \n @example\n * ```typescript\n * const token = await this.authBase.refreshToken();\n * return token.idToken; // Always succeeds or throws\n * ```\n /\n async refreshToken(): Promise<StandardAuthToken> {\n // Try silent refresh\n const result = await this.refreshTokenInternal();\n\n if (result.success && result.token) {\n // Update state if refresh succeeded\n try {\n const userInfo = await this.extractUserInfoInternal();\n if (userInfo) {\n this.updateUserInfo(userInfo);\n }\n } catch {\n // User info update failed, but token refresh succeeded\n // Don't fail the entire refresh for this\n }\n\n return result.token;\n }\n\n // Silent refresh failed - check if we can handle session expiry\n const errorType = result.error?.type;\n if (errorType === 'TOKEN_EXPIRED' \|\| errorType === 'INTERACTION_REQUIRED') {\n // Let provider handle session expiry (may redirect and never return)\n await this.handleSessionExpiryInternal();\n\n // If we reach here (didn't redirect), retry refresh once\n const retryResult = await this.refreshTokenInternal();\n if (retryResult.success && retryResult.token) {\n // Update state with new token\n try {\n const userInfo = await this.extractUserInfoInternal();\n if (userInfo) {\n this.updateUserInfo(userInfo);\n }\n } catch {\n // Ignore user info update errors\n }\n\n return retryResult.token;\n }\n }\n\n // Complete failure - throw error\n throw new Error(result.error?.userMessage \|\| 'Token refresh failed');\n }\n\n /\n Classify an error into standard error type\n \n Converts provider-specific errors into semantic categories.\n * Eliminates need for consumers to check error.name or error types.\n \n @example\n * ```typescript\n * const authError = this.authBase.classifyError(err);\n * if (authError.type === AuthErrorType.TOKEN_EXPIRED) {\n * this.showMessage(authError.userMessage);\n * }\n * ```\n /\n classifyError(error: unknown): StandardAuthError {\n return this.classifyErrorInternal(error);\n }\n\n /\n Get profile picture URL from auth provider\n \n Returns the user's profile picture URL if available from the auth provider.\n * This abstracts away provider-specific logic:\n * - Microsoft/MSAL: Fetches from Graph API\n * - Auth0/Okta: Returns from user claims\n \n @returns Promise resolving to image URL or null if not available\n \n @example\n * ```typescript\n * const pictureUrl = await this.authBase.getProfilePictureUrl();\n * if (pictureUrl) {\n * this.userAvatar = pictureUrl;\n * }\n * ```\n /\n async getProfilePictureUrl(): Promise<string \| null> {\n return this.getProfilePictureUrlInternal();\n }\n\n // ============================================================================\n // HELPER METHODS (For subclasses to update state)\n // ============================================================================\n\n /\n Update authentication state\n \n Subclasses should call this when authentication state changes\n * (after login, logout, session check, etc.)\n /\n protected updateAuthState(isAuthenticated: boolean): void {\n this.isAuthenticated$.next(isAuthenticated);\n }\n\n /\n Update user info\n \n Subclasses should call this when user info is retrieved or updated.\n * This automatically updates the email stream as well.\n /\n protected updateUserInfo(userInfo: StandardUserInfo \| null): void {\n this.userInfo$.next(userInfo);\n\n if (userInfo?.email) {\n this.userEmail$.next(userInfo.email);\n } else {\n this.userEmail$.next('');\n }\n }\n\n // ============================================================================\n // CONFIGURATION & VALIDATION\n // ============================================================================\n\n /\n Get required configuration fields\n \n Default implementation requires clientId.\n * Subclasses can override to add provider-specific requirements.\n /\n getRequiredConfig(): string[] {\n return ['clientId'];\n }\n\n /\n Validate provider configuration\n \n Checks that all required fields are present and non-empty.\n * Subclasses can override to add custom validation logic.\n */\n validateConfig(config: Record<string, unknown>): boolean {\n const requiredFields = this.getRequiredConfig();\n return requiredFields.every(field =>\n config[field] !== undefined && config[field] !== ''\n );\n }\n}\n"]}

package/dist/lib/providers/mjexplorer-auth0-provider.service.d.ts CHANGED Viewed

@@ -43,7 +43,7 @@ export declare class MJAuth0Provider extends MJAuthBase {
     constructor(auth: AuthService);
     initialize(): Promise<void>;
     protected loginInternal(options?: Record<string, unknown>): Promise<void>;
-    logout(): Promise<void>;
+    protected logoutInternal(): Promise<void>;
     handleCallback(): Promise<void>;
     /**
      * Extract ID token from Auth0's storage

package/dist/lib/providers/mjexplorer-auth0-provider.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mjexplorer-auth0-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-auth0-provider.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAiB,SAAS,EAAyC,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAI1J,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,eAAgB,SAAQ,UAAU;IA+C1B,IAAI,EAAE,WAAW;IA9CpC,MAAM,CAAC,QAAQ,CAAC,aAAa,WAAW;IACxC,QAAQ,CAAC,IAAI,WAAiC;IAC9C,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;SAoCnE;gBAEiB,IAAI,EAAE,WAAW;IAY9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA0CjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;~~IAKzE~~,~~MAAM~~,IAAI,OAAO,CAAC,IAAI,CAAC;~~IAIvB~~,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IASrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;;OAKG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA6CnE;;;;OAIG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;YAgEpD,iBAAiB;IAM/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;~~yCA1WvD~~,eAAe;6CAAf,eAAe;~~CA8W3B~~"}
1	+ {"version":3,"file":"mjexplorer-auth0-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-auth0-provider.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAiB,SAAS,EAAyC,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAI1J,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,eAAgB,SAAQ,UAAU;IA+C1B,IAAI,EAAE,WAAW;IA9CpC,MAAM,CAAC,QAAQ,CAAC,aAAa,WAAW;IACxC,QAAQ,CAAC,IAAI,WAAiC;IAC9C,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;SAoCnE;gBAEiB,IAAI,EAAE,WAAW;IAY9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA0CjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAK/D,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAWzC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IASrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;;OAKG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA6CnE;;;;OAIG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;YAgEpD,iBAAiB;IAM/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;yCAjXvD,eAAe;6CAAf,eAAe;CAqX3B"}

package/dist/lib/providers/mjexplorer-auth0-provider.service.js CHANGED Viewed

@@ -115,8 +115,14 @@ let MJAuth0Provider = class MJAuth0Provider extends MJAuthBase {
         await this.ensureInitialized();
         this.auth.loginWithRedirect(options);
     }
-    async logout() {
-        this.auth.logout({ logoutParams: { returnTo: document.location.origin } });
+    async logoutInternal() {
+        // Subscribe to the Observable so Auth0 Angular SDK v2's authState.refresh() fires.
+        try {
+            await firstValueFrom(this.auth.logout({ logoutParams: { returnTo: document.location.origin } }));
+        }
+        catch {
+            // Expected when Auth0 redirects the browser before the Observable completes.
+        }
     }
     async handleCallback() {
         // Auth0 Angular SDK handles callbacks internally via interceptors

package/dist/lib/providers/mjexplorer-auth0-provider.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mjexplorer-auth0-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-auth0-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAiB,SAAS,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1J,OAAO,EAAkB,cAAc,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,UAAU;;IA+C1B;IA9CnB,MAAM,CAAU,aAAa,GAAG,OAAO,CAAC;IAC/B,IAAI,GAAG,iBAAe,CAAC,aAAa,CAAC;IACtC,YAAY,GAAG,KAAK,CAAC;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE;QACvE,gDAAgD;QAChD,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAElF,OAAO;YACL,WAAW;YACX,SAAS;YACT;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,QAAQ,EAAE;oBACR,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC;oBACnC,QAAQ,EAAE,WAAW,CAAC,gBAAgB,CAAC;oBACvC,mBAAmB,EAAE;wBACnB,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;wBACpC,KAAK,EAAE,qCAAqC;wBAC5C,yEAAyE;wBACzE,iEAAiE;qBAClE;oBACD,aAAa,EAAE,cAAc;oBAC7B,mFAAmF;oBACnF,gBAAgB,EAAE,IAAI;oBACtB,kDAAkD;oBAClD,wBAAwB,EAAE,IAAI;oBAC9B,4EAA4E;oBAC5E,8EAA8E;oBAC9E,0EAA0E;oBAC1E,6DAA6D;oBAC7D,oBAAoB,EAAE,kBAAkB;iBACzC;aACF;YACD;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,kBAAkB,CAAC,YAAY;gBAC3C,IAAI,EAAE,CAAC,gBAAgB,CAAC;aACzB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,YAAmB,IAAiB;QAClC,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,iBAAe,CAAC,aAAa;YACnC,IAAI,EAAE,iBAAe,CAAC,aAAa;SACpC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;IAMpC,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,mEAAmE;QACnE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAC3B,IAAI,CAAC,CAAC,CAAC,CACR,CAAC,CAAC;QAEH,mCAAmC;QACnC,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEzE,6DAA6D;QAC7D,wEAAwE;QACxE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,kEAAkE;QAClE,iDAAiD;IACnD,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,kDAAkD;YAClD,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B;gBACzE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YAEtD,yCAAyC;YACzC,qFAAqF;YACrF,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC;gBACpD,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC,CAAC;YAEJ,0DAA0D;YAC1D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAEvD,oDAAoD;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,0DAA0D;wBACnE,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE;gBAC9C,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aACnD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAEtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAW,IAAI,EAAE,CAAC;QAEtD,0CAA0C;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,iCAAiC;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,kBAAkB,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,2DAA2D;aACzE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,IAAU;QACvC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,iBAAiB,EAAE,IAAI,CAAC,QAAQ;YAChC,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,iDAAiD;QACjD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;yGA7WU,eAAe;gEAAf,eAAe,WAAf,eAAe,mBAHd,MAAM;;AAGP,eAAe;IAD3B,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC;GACtB,eAAe,CA8W3B;;iFA9WY,eAAe;cAJ3B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { AuthService, IdToken, User, AuthGuard, AuthConfigService, Auth0ClientService, Auth0ClientFactory, AuthClientConfig } from '@auth0/auth0-angular';\nimport { Observable, of, firstValueFrom } from 'rxjs';\nimport { take, filter } from 'rxjs/operators';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n AuthErrorType,\n TokenRefreshResult\n} from '../auth-types';\n/*\n Auth0 authentication provider implementation - v3.0.0\n \n Implements the abstract methods from MJAuthBase to hide Auth0-specific details.\n * The key abstraction is that Auth0 stores the JWT in `idTokenClaims.__raw`,\n * but consumers never need to know this detail.\n /\n@Injectable({\n providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'auth0')\nexport class MJAuth0Provider extends MJAuthBase {\n static readonly PROVIDER_TYPE = 'auth0';\n readonly type = MJAuth0Provider.PROVIDER_TYPE;\n private _initialized = false;\n\n /\n Factory function to provide Angular dependencies required by Auth0\n * Stored as a static property for the factory to access without instantiation\n /\n static angularProviderFactory = (environment: Record<string, unknown>) => {\n // Check if we're on the MCP OAuth callback path\n const isMCPOAuthCallback = window.location.pathname.startsWith('/oauth/callback');\n\n return [\n AuthService,\n AuthGuard,\n {\n provide: AuthConfigService,\n useValue: {\n domain: environment['AUTH0_DOMAIN'],\n clientId: environment['AUTH0_CLIENTID'],\n authorizationParams: {\n redirect_uri: window.location.origin,\n scope: 'openid profile email offline_access',\n // No audience parameter - uses ID tokens (matches pre-refactor behavior)\n // ID tokens have aud=clientId by default and contain user claims\n },\n cacheLocation: 'localstorage',\n // Enable refresh tokens so we can refresh without relying on Auth0 session cookies\n useRefreshTokens: true,\n // Use rotating refresh tokens for better security\n useRefreshTokensFallback: true,\n // CRITICAL: Skip Auth0's redirect callback handling for MCP OAuth callbacks\n // The /oauth/callback path is used by MCP OAuth, not Auth0. If we don't skip,\n // Auth0 will consume the code parameter and redirect to /, preventing the\n // OAuthCallbackComponent from processing the MCP OAuth flow.\n skipRedirectCallback: isMCPOAuthCallback,\n },\n },\n {\n provide: Auth0ClientService,\n useFactory: Auth0ClientFactory.createClient,\n deps: [AuthClientConfig],\n }\n ];\n };\n\n constructor(public auth: AuthService) {\n const config: AngularAuthProviderConfig = {\n name: MJAuth0Provider.PROVIDER_TYPE,\n type: MJAuth0Provider.PROVIDER_TYPE\n };\n super(config);\n }\n\n // ============================================================================\n // LIFECYCLE METHODS\n // ============================================================================\n\n async initialize(): Promise<void> {\n if (this._initialized) {\n return;\n }\n\n // CRITICAL: Wait for Auth0 SDK to process any redirect callback\n // The SDK handles this internally and updates isLoading$ when done\n await firstValueFrom(this.auth.isLoading$.pipe(\n filter(loading => !loading),\n take(1)\n ));\n\n // Get current authentication state\n const isAuthenticated = await firstValueFrom(this.auth.isAuthenticated$);\n\n // CRITICAL: Get current user BEFORE setting up subscriptions\n // This ensures userInfo$ has a value before app.component.ts subscribes\n if (isAuthenticated) {\n const user = await firstValueFrom(this.auth.user$);\n if (user) {\n const userInfo = this.mapAuth0UserToStandard(user);\n this.updateUserInfo(userInfo);\n }\n }\n\n // Subscribe to authentication state and user info for future changes\n this.auth.isAuthenticated$.subscribe((loggedIn) => {\n this.updateAuthState(loggedIn);\n });\n\n this.auth.user$.subscribe((user) => {\n if (user) {\n const userInfo = this.mapAuth0UserToStandard(user);\n this.updateUserInfo(userInfo);\n } else {\n this.updateUserInfo(null);\n }\n });\n\n this._initialized = true;\n }\n\n protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n await this.ensureInitialized();\n this.auth.loginWithRedirect(options);\n }\n\n async logout(): Promise<void> {\n this.auth.logout({ logoutParams: { returnTo: document.location.origin } });\n }\n\n async handleCallback(): Promise<void> {\n // Auth0 Angular SDK handles callbacks internally via interceptors\n // This method exists for interface compatibility\n }\n\n // ============================================================================\n // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n // ============================================================================\n\n /\n Extract ID token from Auth0's storage\n \n Auth0 stores the JWT string in idTokenClaims.__raw\n * This is the key abstraction - consumers never need to know about __raw!\n /\n protected async extractIdTokenInternal(): Promise<string \| null> {\n try {\n const claims = await firstValueFrom(this.auth.idTokenClaims$);\n // Auth0-specific detail: JWT is in __raw property\n return claims?.__raw \|\| null;\n } catch (error) {\n console.error('[Auth0] Error extracting ID token:', error);\n return null;\n }\n }\n\n /\n Extract complete token info from Auth0\n \n Maps Auth0's token structure to StandardAuthToken\n /\n protected async extractTokenInfoInternal(): Promise<StandardAuthToken \| null> {\n try {\n const claims = await firstValueFrom(this.auth.idTokenClaims$);\n if (!claims) {\n return null;\n }\n\n const idToken = claims.__raw;\n if (!idToken) {\n return null;\n }\n\n return {\n idToken,\n expiresAt: claims.exp ? claims.exp 1000 : 0, // Convert to milliseconds\n scopes: claims.scope ? claims.scope.split(' ') : undefined\n };\n } catch (error) {\n console.error('[Auth0] Error extracting token info:', error);\n return null;\n }\n }\n\n /*\n Extract user info from Auth0 claims\n \n Maps Auth0's user object structure to StandardUserInfo\n /\n protected async extractUserInfoInternal(): Promise<StandardUserInfo \| null> {\n try {\n const user = await firstValueFrom(this.auth.user$);\n if (!user) {\n return null;\n }\n\n return this.mapAuth0UserToStandard(user);\n } catch (error) {\n console.error('[Auth0] Error extracting user info:', error);\n return null;\n }\n }\n\n /\n Refresh token using Auth0's silent authentication\n \n Uses cacheMode: 'off' to bypass cache and force token refresh\n * With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n /\n protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n try {\n console.log('[Auth0] Attempting to refresh token...');\n\n // Force token refresh by bypassing cache\n // With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n await firstValueFrom(this.auth.getAccessTokenSilently({\n cacheMode: 'off'\n }));\n\n // Small delay to ensure Auth0 SDK has updated observables\n await new Promise(resolve => setTimeout(resolve, 100));\n\n // Extract fresh token info from updated observables\n const token = await this.extractTokenInfoInternal();\n\n if (!token) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'Token refresh succeeded but could not extract token info',\n userMessage: 'Session refresh failed. Please log in again.'\n }\n };\n }\n\n console.log('[Auth0] Token refresh successful', {\n expiresAt: new Date(token.expiresAt).toISOString()\n });\n\n return {\n success: true,\n token\n };\n } catch (error) {\n console.error('[Auth0] Token refresh failed:', error);\n\n return {\n success: false,\n error: this.classifyErrorInternal(error)\n };\n }\n }\n\n /\n Classify Auth0-specific errors into semantic types\n \n Maps Auth0 error patterns to AuthErrorType enum\n /\n protected classifyErrorInternal(error: unknown): StandardAuthError {\n const errorObj = error as Record<string, unknown>;\n const message = errorObj?.['message'] as string \|\| 'Unknown error';\n const errorType = errorObj?.['error'] as string \|\| '';\n\n // Check for specific Auth0 error patterns\n if (message.includes('jwt expired') \|\| message.includes('token expired')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (errorType === 'login_required' \|\| message.includes('login_required')) {\n return {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message,\n originalError: error,\n userMessage: 'You need to log in to continue.'\n };\n }\n\n if (errorType === 'consent_required' \|\| message.includes('consent_required')) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Additional permissions are required. Please log in again.'\n };\n }\n\n if (message.includes('user closed') \|\| message.includes('cancelled')) {\n return {\n type: AuthErrorType.USER_CANCELLED,\n message,\n originalError: error,\n userMessage: 'Login was cancelled.'\n };\n }\n\n if (message.includes('network') \|\| message.includes('fetch')) {\n return {\n type: AuthErrorType.NETWORK_ERROR,\n message,\n originalError: error,\n userMessage: 'Network error. Please check your connection and try again.'\n };\n }\n\n // Default to unknown error\n return {\n type: AuthErrorType.UNKNOWN_ERROR,\n message,\n originalError: error,\n userMessage: 'An unexpected error occurred. Please try again.'\n };\n }\n\n // ============================================================================\n // HELPER METHODS\n // ============================================================================\n\n private async ensureInitialized(): Promise<void> {\n if (!this._initialized) {\n await this.initialize();\n }\n }\n\n /\n Map Auth0 User object to StandardUserInfo\n /\n private mapAuth0UserToStandard(user: User): StandardUserInfo {\n return {\n id: user.sub \|\| '',\n email: user.email \|\| '',\n name: user.name \|\| '',\n givenName: user.given_name,\n familyName: user.family_name,\n preferredUsername: user.nickname,\n pictureUrl: user.picture,\n locale: user.locale,\n emailVerified: user.email_verified\n };\n }\n\n /\n Get profile picture URL from Auth0\n \n Auth0 includes the picture URL directly in user claims.\n * No additional API call needed.\n /\n protected async getProfilePictureUrlInternal(): Promise<string \| null> {\n try {\n const user = await firstValueFrom(this.auth.user$);\n return user?.picture \|\| null;\n } catch (error) {\n console.error('[Auth0] Error getting profile picture:', error);\n return null;\n }\n }\n\n /\n Handle session expiry - no-op for Auth0\n \n Auth0 uses refresh tokens (offline_access scope), so it doesn't need\n * interactive re-authentication when tokens expire. If refresh fails,\n * the base class will throw an error and the user must log out/in manually.\n */\n protected async handleSessionExpiryInternal(): Promise<void> {\n // No-op - Auth0 doesn't need interactive re-auth\n return;\n }\n\n // ============================================================================\n // CONFIGURATION\n // ============================================================================\n\n override getRequiredConfig(): string[] {\n return ['clientId', 'domain'];\n }\n\n override validateConfig(_config: Record<string, unknown>): boolean {\n // Auth0 configuration is handled by Angular module providers\n return true;\n }\n}\n"]}
1	+ {"version":3,"file":"mjexplorer-auth0-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-auth0-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAiB,SAAS,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1J,OAAO,EAAkB,cAAc,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,UAAU;;IA+C1B;IA9CnB,MAAM,CAAU,aAAa,GAAG,OAAO,CAAC;IAC/B,IAAI,GAAG,iBAAe,CAAC,aAAa,CAAC;IACtC,YAAY,GAAG,KAAK,CAAC;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE;QACvE,gDAAgD;QAChD,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAElF,OAAO;YACL,WAAW;YACX,SAAS;YACT;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,QAAQ,EAAE;oBACR,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC;oBACnC,QAAQ,EAAE,WAAW,CAAC,gBAAgB,CAAC;oBACvC,mBAAmB,EAAE;wBACnB,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;wBACpC,KAAK,EAAE,qCAAqC;wBAC5C,yEAAyE;wBACzE,iEAAiE;qBAClE;oBACD,aAAa,EAAE,cAAc;oBAC7B,mFAAmF;oBACnF,gBAAgB,EAAE,IAAI;oBACtB,kDAAkD;oBAClD,wBAAwB,EAAE,IAAI;oBAC9B,4EAA4E;oBAC5E,8EAA8E;oBAC9E,0EAA0E;oBAC1E,6DAA6D;oBAC7D,oBAAoB,EAAE,kBAAkB;iBACzC;aACF;YACD;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,kBAAkB,CAAC,YAAY;gBAC3C,IAAI,EAAE,CAAC,gBAAgB,CAAC;aACzB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,YAAmB,IAAiB;QAClC,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,iBAAe,CAAC,aAAa;YACnC,IAAI,EAAE,iBAAe,CAAC,aAAa;SACpC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;IAMpC,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,mEAAmE;QACnE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAC3B,IAAI,CAAC,CAAC,CAAC,CACR,CAAC,CAAC;QAEH,mCAAmC;QACnC,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEzE,6DAA6D;QAC7D,wEAAwE;QACxE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,mFAAmF;QACnF,IAAI,CAAC;YACH,MAAM,cAAc,CAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAC3E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,kEAAkE;QAClE,iDAAiD;IACnD,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,kDAAkD;YAClD,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B;gBACzE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YAEtD,yCAAyC;YACzC,qFAAqF;YACrF,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC;gBACpD,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC,CAAC;YAEJ,0DAA0D;YAC1D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAEvD,oDAAoD;YACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,0DAA0D;wBACnE,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE;gBAC9C,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aACnD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAEtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAW,IAAI,EAAE,CAAC;QAEtD,0CAA0C;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,iCAAiC;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,kBAAkB,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,2DAA2D;aACzE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,cAAc;gBAClC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,sBAAsB;aACpC,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,IAAU;QACvC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,iBAAiB,EAAE,IAAI,CAAC,QAAQ;YAChC,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,iDAAiD;QACjD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;yGApXU,eAAe;gEAAf,eAAe,WAAf,eAAe,mBAHd,MAAM;;AAGP,eAAe;IAD3B,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC;GACtB,eAAe,CAqX3B;;iFArXY,eAAe;cAJ3B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { AuthService, IdToken, User, AuthGuard, AuthConfigService, Auth0ClientService, Auth0ClientFactory, AuthClientConfig } from '@auth0/auth0-angular';\nimport { Observable, of, firstValueFrom } from 'rxjs';\nimport { take, filter } from 'rxjs/operators';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n AuthErrorType,\n TokenRefreshResult\n} from '../auth-types';\n/*\n Auth0 authentication provider implementation - v3.0.0\n \n Implements the abstract methods from MJAuthBase to hide Auth0-specific details.\n * The key abstraction is that Auth0 stores the JWT in `idTokenClaims.__raw`,\n * but consumers never need to know this detail.\n /\n@Injectable({\n providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'auth0')\nexport class MJAuth0Provider extends MJAuthBase {\n static readonly PROVIDER_TYPE = 'auth0';\n readonly type = MJAuth0Provider.PROVIDER_TYPE;\n private _initialized = false;\n\n /\n Factory function to provide Angular dependencies required by Auth0\n * Stored as a static property for the factory to access without instantiation\n /\n static angularProviderFactory = (environment: Record<string, unknown>) => {\n // Check if we're on the MCP OAuth callback path\n const isMCPOAuthCallback = window.location.pathname.startsWith('/oauth/callback');\n\n return [\n AuthService,\n AuthGuard,\n {\n provide: AuthConfigService,\n useValue: {\n domain: environment['AUTH0_DOMAIN'],\n clientId: environment['AUTH0_CLIENTID'],\n authorizationParams: {\n redirect_uri: window.location.origin,\n scope: 'openid profile email offline_access',\n // No audience parameter - uses ID tokens (matches pre-refactor behavior)\n // ID tokens have aud=clientId by default and contain user claims\n },\n cacheLocation: 'localstorage',\n // Enable refresh tokens so we can refresh without relying on Auth0 session cookies\n useRefreshTokens: true,\n // Use rotating refresh tokens for better security\n useRefreshTokensFallback: true,\n // CRITICAL: Skip Auth0's redirect callback handling for MCP OAuth callbacks\n // The /oauth/callback path is used by MCP OAuth, not Auth0. If we don't skip,\n // Auth0 will consume the code parameter and redirect to /, preventing the\n // OAuthCallbackComponent from processing the MCP OAuth flow.\n skipRedirectCallback: isMCPOAuthCallback,\n },\n },\n {\n provide: Auth0ClientService,\n useFactory: Auth0ClientFactory.createClient,\n deps: [AuthClientConfig],\n }\n ];\n };\n\n constructor(public auth: AuthService) {\n const config: AngularAuthProviderConfig = {\n name: MJAuth0Provider.PROVIDER_TYPE,\n type: MJAuth0Provider.PROVIDER_TYPE\n };\n super(config);\n }\n\n // ============================================================================\n // LIFECYCLE METHODS\n // ============================================================================\n\n async initialize(): Promise<void> {\n if (this._initialized) {\n return;\n }\n\n // CRITICAL: Wait for Auth0 SDK to process any redirect callback\n // The SDK handles this internally and updates isLoading$ when done\n await firstValueFrom(this.auth.isLoading$.pipe(\n filter(loading => !loading),\n take(1)\n ));\n\n // Get current authentication state\n const isAuthenticated = await firstValueFrom(this.auth.isAuthenticated$);\n\n // CRITICAL: Get current user BEFORE setting up subscriptions\n // This ensures userInfo$ has a value before app.component.ts subscribes\n if (isAuthenticated) {\n const user = await firstValueFrom(this.auth.user$);\n if (user) {\n const userInfo = this.mapAuth0UserToStandard(user);\n this.updateUserInfo(userInfo);\n }\n }\n\n // Subscribe to authentication state and user info for future changes\n this.auth.isAuthenticated$.subscribe((loggedIn) => {\n this.updateAuthState(loggedIn);\n });\n\n this.auth.user$.subscribe((user) => {\n if (user) {\n const userInfo = this.mapAuth0UserToStandard(user);\n this.updateUserInfo(userInfo);\n } else {\n this.updateUserInfo(null);\n }\n });\n\n this._initialized = true;\n }\n\n protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n await this.ensureInitialized();\n this.auth.loginWithRedirect(options);\n }\n\n protected async logoutInternal(): Promise<void> {\n // Subscribe to the Observable so Auth0 Angular SDK v2's authState.refresh() fires.\n try {\n await firstValueFrom(\n this.auth.logout({ logoutParams: { returnTo: document.location.origin } })\n );\n } catch {\n // Expected when Auth0 redirects the browser before the Observable completes.\n }\n }\n\n async handleCallback(): Promise<void> {\n // Auth0 Angular SDK handles callbacks internally via interceptors\n // This method exists for interface compatibility\n }\n\n // ============================================================================\n // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n // ============================================================================\n\n /\n Extract ID token from Auth0's storage\n \n Auth0 stores the JWT string in idTokenClaims.__raw\n * This is the key abstraction - consumers never need to know about __raw!\n /\n protected async extractIdTokenInternal(): Promise<string \| null> {\n try {\n const claims = await firstValueFrom(this.auth.idTokenClaims$);\n // Auth0-specific detail: JWT is in __raw property\n return claims?.__raw \|\| null;\n } catch (error) {\n console.error('[Auth0] Error extracting ID token:', error);\n return null;\n }\n }\n\n /\n Extract complete token info from Auth0\n \n Maps Auth0's token structure to StandardAuthToken\n /\n protected async extractTokenInfoInternal(): Promise<StandardAuthToken \| null> {\n try {\n const claims = await firstValueFrom(this.auth.idTokenClaims$);\n if (!claims) {\n return null;\n }\n\n const idToken = claims.__raw;\n if (!idToken) {\n return null;\n }\n\n return {\n idToken,\n expiresAt: claims.exp ? claims.exp 1000 : 0, // Convert to milliseconds\n scopes: claims.scope ? claims.scope.split(' ') : undefined\n };\n } catch (error) {\n console.error('[Auth0] Error extracting token info:', error);\n return null;\n }\n }\n\n /*\n Extract user info from Auth0 claims\n \n Maps Auth0's user object structure to StandardUserInfo\n /\n protected async extractUserInfoInternal(): Promise<StandardUserInfo \| null> {\n try {\n const user = await firstValueFrom(this.auth.user$);\n if (!user) {\n return null;\n }\n\n return this.mapAuth0UserToStandard(user);\n } catch (error) {\n console.error('[Auth0] Error extracting user info:', error);\n return null;\n }\n }\n\n /\n Refresh token using Auth0's silent authentication\n \n Uses cacheMode: 'off' to bypass cache and force token refresh\n * With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n /\n protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n try {\n console.log('[Auth0] Attempting to refresh token...');\n\n // Force token refresh by bypassing cache\n // With useRefreshTokens: true and offline_access scope, this will use refresh tokens\n await firstValueFrom(this.auth.getAccessTokenSilently({\n cacheMode: 'off'\n }));\n\n // Small delay to ensure Auth0 SDK has updated observables\n await new Promise(resolve => setTimeout(resolve, 100));\n\n // Extract fresh token info from updated observables\n const token = await this.extractTokenInfoInternal();\n\n if (!token) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'Token refresh succeeded but could not extract token info',\n userMessage: 'Session refresh failed. Please log in again.'\n }\n };\n }\n\n console.log('[Auth0] Token refresh successful', {\n expiresAt: new Date(token.expiresAt).toISOString()\n });\n\n return {\n success: true,\n token\n };\n } catch (error) {\n console.error('[Auth0] Token refresh failed:', error);\n\n return {\n success: false,\n error: this.classifyErrorInternal(error)\n };\n }\n }\n\n /\n Classify Auth0-specific errors into semantic types\n \n Maps Auth0 error patterns to AuthErrorType enum\n /\n protected classifyErrorInternal(error: unknown): StandardAuthError {\n const errorObj = error as Record<string, unknown>;\n const message = errorObj?.['message'] as string \|\| 'Unknown error';\n const errorType = errorObj?.['error'] as string \|\| '';\n\n // Check for specific Auth0 error patterns\n if (message.includes('jwt expired') \|\| message.includes('token expired')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (errorType === 'login_required' \|\| message.includes('login_required')) {\n return {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message,\n originalError: error,\n userMessage: 'You need to log in to continue.'\n };\n }\n\n if (errorType === 'consent_required' \|\| message.includes('consent_required')) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Additional permissions are required. Please log in again.'\n };\n }\n\n if (message.includes('user closed') \|\| message.includes('cancelled')) {\n return {\n type: AuthErrorType.USER_CANCELLED,\n message,\n originalError: error,\n userMessage: 'Login was cancelled.'\n };\n }\n\n if (message.includes('network') \|\| message.includes('fetch')) {\n return {\n type: AuthErrorType.NETWORK_ERROR,\n message,\n originalError: error,\n userMessage: 'Network error. Please check your connection and try again.'\n };\n }\n\n // Default to unknown error\n return {\n type: AuthErrorType.UNKNOWN_ERROR,\n message,\n originalError: error,\n userMessage: 'An unexpected error occurred. Please try again.'\n };\n }\n\n // ============================================================================\n // HELPER METHODS\n // ============================================================================\n\n private async ensureInitialized(): Promise<void> {\n if (!this._initialized) {\n await this.initialize();\n }\n }\n\n /\n Map Auth0 User object to StandardUserInfo\n /\n private mapAuth0UserToStandard(user: User): StandardUserInfo {\n return {\n id: user.sub \|\| '',\n email: user.email \|\| '',\n name: user.name \|\| '',\n givenName: user.given_name,\n familyName: user.family_name,\n preferredUsername: user.nickname,\n pictureUrl: user.picture,\n locale: user.locale,\n emailVerified: user.email_verified\n };\n }\n\n /\n Get profile picture URL from Auth0\n \n Auth0 includes the picture URL directly in user claims.\n * No additional API call needed.\n /\n protected async getProfilePictureUrlInternal(): Promise<string \| null> {\n try {\n const user = await firstValueFrom(this.auth.user$);\n return user?.picture \|\| null;\n } catch (error) {\n console.error('[Auth0] Error getting profile picture:', error);\n return null;\n }\n }\n\n /\n Handle session expiry - no-op for Auth0\n \n Auth0 uses refresh tokens (offline_access scope), so it doesn't need\n * interactive re-authentication when tokens expire. If refresh fails,\n * the base class will throw an error and the user must log out/in manually.\n */\n protected async handleSessionExpiryInternal(): Promise<void> {\n // No-op - Auth0 doesn't need interactive re-auth\n return;\n }\n\n // ============================================================================\n // CONFIGURATION\n // ============================================================================\n\n override getRequiredConfig(): string[] {\n return ['clientId', 'domain'];\n }\n\n override validateConfig(_config: Record<string, unknown>): boolean {\n // Auth0 configuration is handled by Angular module providers\n return true;\n }\n}\n"]}

package/dist/lib/providers/mjexplorer-msal-provider.service.d.ts CHANGED Viewed

@@ -47,7 +47,7 @@ export declare class MJMSALProvider extends MJAuthBase implements OnDestroy {
     initialize(): Promise<void>;
     private _performInitialization;
     protected loginInternal(options?: Record<string, unknown>): Promise<void>;
-    logout(): Promise<void>;
+    protected logoutInternal(): Promise<void>;
     handleCallback(): Promise<void>;
     /**
      * Extract ID token from MSAL's storage

package/dist/lib/providers/mjexplorer-msal-provider.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mjexplorer-msal-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,SAAS,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAA6D,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAuF,uBAAuB,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAGtL,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAW,YAAW,SAAS;IA+C9C,IAAI,EAAE,WAAW;IAAE,OAAO,CAAC,oBAAoB;IA9ClE,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAE7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,YAAY,CAA8B;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;SAiCnE;gBAEiB,IAAI,EAAE,WAAW,EAAU,oBAAoB,EAAE,oBAAoB;IAYlF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YASnB,sBAAsB;cAkEpB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;~~IAqBzE~~,~~MAAM~~,IAAI,OAAO,CAAC,IAAI,CAAC;~~IAOvB~~,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAUrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkDhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA4C7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAgB3E;;;;;;;;;;;;;OAaG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwGnE;;;;;OAKG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;YAiHpD,iBAAiB;IAQ/B;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAepB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqCtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IASlE,WAAW,IAAI,IAAI;yCA3pBR,cAAc;6CAAd,cAAc;CAiqB1B"}
1	+ {"version":3,"file":"mjexplorer-msal-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,SAAS,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAA6D,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAuF,uBAAuB,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAGtL,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAW,YAAW,SAAS;IA+C9C,IAAI,EAAE,WAAW;IAAE,OAAO,CAAC,oBAAoB;IA9ClE,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAE7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,YAAY,CAA8B;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;SAiCnE;gBAEiB,IAAI,EAAE,WAAW,EAAU,oBAAoB,EAAE,oBAAoB;IAYlF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YASnB,sBAAsB;cAkEpB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAqB/D,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAOzC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAUrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkDhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA4C7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAgB3E;;;;;;;;;;;;;OAaG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwGnE;;;;;OAKG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;YAiHpD,iBAAiB;IAQ/B;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAepB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqCtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IASlE,WAAW,IAAI,IAAI;yCA3pBR,cAAc;6CAAd,cAAc;CAiqB1B"}

package/dist/lib/providers/mjexplorer-msal-provider.service.js CHANGED Viewed

@@ -160,7 +160,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
             });
         });
     }
-    async logout() {
+    async logoutInternal() {
         await this.ensureInitialized();
         this.auth.logoutRedirect().subscribe(() => {
             // Logout will trigger a redirect

package/dist/lib/providers/mjexplorer-msal-provider.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mjexplorer-msal-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAc,OAAO,EAAc,MAAM,EAA6B,SAAS,EAAQ,MAAM,MAAM,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtL,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IA+CzB;IAA2B;IA9C9C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IAE5B,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACnC,yBAAyB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACzE,YAAY,GAAyB,IAAI,CAAC;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI,uBAAuB,CAAC;gBACpC,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAW;oBAC5C,SAAS,EAAE,WAAW,CAAC,kBAAkB,CAAW;oBACpD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;iBACpC;gBACD,KAAK,EAAE;oBACL,aAAa,EAAE,cAAc;iBAC9B;aACF,CAAC;SACH;QACD;YACE,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,WAAW,EAAE;oBACX,MAAM,EAAE,CAAC,WAAW,CAAC;iBACtB;aACF;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;aACxF;SACF;QACD,WAAW;QACX,SAAS;QACT,oBAAoB;KACrB,CAAC;IAEF,YAAmB,IAAiB,EAAU,oBAA0C;QACtF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;QAAU,yBAAoB,GAApB,oBAAoB,CAAsB;IAMxF,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAElD,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACjD,mCAAmC;YACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAE3B,gCAAgC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAE3B,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,oBAAoB,CAAC,WAAW;aAClC,IAAI,CACH,MAAM,CAAC,CAAC,MAAyB,EAAE,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI,CAAC,EACxE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAC7B;aACA,SAAS,CAAC,GAAG,EAAE;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAEnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,GAAG,EAAE;oBACT,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,iCAAiC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6CAA6C;YAC7C,wDAAwD;YACxD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,4EAA4E;gBAC5E,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACzB,CAAC;gBAED,wDAAwD;gBACxD,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;wBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;wBACzC,OAAO,EAAE,OAAO;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;gBAClC,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,YAAY,CAAC,CAAC;oBAC5F,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,mDAAmD;YACnD,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,oDAAoD;gBACpD,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,CAAC,EAAE,6BAA6B;oBAC3C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,yBAAyB;wBAClC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,yDAAyD;YACzD,oEAAoE;YACpE,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,kDAAkD;wBAC3D,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;gBAC5F,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,4CAA4C;wBACrD,WAAW,EAAE,mDAAmD;qBACjE;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAsB;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAErD,4DAA4D;YAC5D,kFAAkF;YAClF,2DAA2D;YAC3D,gDAAgD;YAChD,iDAAiD;YACjD,mEAAmE;YACnE,MAAM,SAAS,GAAI,KAAiC,EAAE,SAA+B,CAAC;YACtF,MAAM,wBAAwB,GAAG;gBAC/B,wBAAwB;gBACxB,WAAW;gBACX,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;gBAClB,wBAAwB,CAAE,kDAAkD;aAC7E,CAAC;YAEF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBACxG,uFAAuF;gBACvF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,uDAAuD,SAAS,IAAI,SAAS,GAAG;wBACzF,WAAW,EAAE,mDAAmD;wBAChE,aAAa,EAAE,KAAK;qBACrB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAE1D,sCAAsC;QACtC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,wBAAwB,EAAE,CAAC;gBAC3C,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,8CAA8C;YAC9C,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,cAAc;oBAClC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,sBAAsB;iBACpC,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,MAAM,wBAAwB,GAAG;gBAC/B,WAAW;gBACX,wBAAwB;gBACxB,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;aACnB,CAAC;YACF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4CAA4C;aAC1D,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,KAAa,EAAE,gBAAwB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC;YAC/D,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAoB;QACnD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa;YACnD,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,YAAY,CAAW;YAC1D,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,aAAa,CAAW;YAC5D,iBAAiB,EAAE,OAAO,CAAC,QAAQ;YACnC,aAAa,EAAE,IAAI,CAAC,yCAAyC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uCAAuC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;gBACpF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,WAAW,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAEhF,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,SAAS,CAAC;YACX,KAAK,EAAE,CAAC,aAAa,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,gFAAgF;QAChF,OAAO,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAE/E,WAAW;QACT,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;wGAhqBU,cAAc;gEAAd,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAiqB1B;;iFAjqBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable, OnDestroy } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { BehaviorSubject, Observable, Subject, catchError, filter, from, map, of, throwError, takeUntil, take } from 'rxjs';\nimport { MsalBroadcastService, MsalService, MSAL_INSTANCE, MSAL_GUARD_CONFIG, MSAL_INTERCEPTOR_CONFIG, MsalGuard } from '@azure/msal-angular';\nimport { AccountInfo, AuthenticationResult } from '@azure/msal-common';\nimport { CacheLookupPolicy, ClientAuthError, InteractionRequiredAuthError, InteractionStatus, PublicClientApplication, InteractionType, BrowserAuthError } from '@azure/msal-browser';\nimport { LogError } from '@memberjunction/core';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n AuthErrorType,\n TokenRefreshResult\n} from '../auth-types';\n/*\n MSAL (Microsoft Authentication Library) provider implementation - v3.0.0\n \n Implements the abstract methods from MJAuthBase to hide MSAL-specific details.\n * The key abstraction is that MSAL stores the JWT in AuthenticationResult.idToken,\n * but consumers never need to know this detail.\n /\n@Injectable({\n providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'msal')\nexport class MJMSALProvider extends MJAuthBase implements OnDestroy {\n static readonly PROVIDER_TYPE = 'msal';\n readonly type = MJMSALProvider.PROVIDER_TYPE;\n\n private readonly _destroying$ = new Subject<void>();\n private readonly _initializationCompleted$ = new BehaviorSubject<boolean>(false);\n private _initPromise: Promise<void> \| null = null;\n\n /\n Factory function to provide Angular dependencies required by MSAL\n * Stored as a static property for the factory to access without instantiation\n /\n static angularProviderFactory = (environment: Record<string, unknown>) => [\n {\n provide: MSAL_INSTANCE,\n useValue: new PublicClientApplication({\n auth: {\n clientId: environment['CLIENT_ID'] as string,\n authority: environment['CLIENT_AUTHORITY'] as string,\n redirectUri: window.location.origin,\n },\n cache: {\n cacheLocation: 'localStorage',\n },\n }),\n },\n {\n provide: MSAL_GUARD_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n authRequest: {\n scopes: ['User.Read'],\n },\n },\n },\n {\n provide: MSAL_INTERCEPTOR_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n protectedResourceMap: new Map([['https://graph.microsoft.com/v1.0/me', ['user.read']]]),\n },\n },\n MsalService,\n MsalGuard,\n MsalBroadcastService\n ];\n\n constructor(public auth: MsalService, private msalBroadcastService: MsalBroadcastService) {\n const config: AngularAuthProviderConfig = {\n name: MJMSALProvider.PROVIDER_TYPE,\n type: MJMSALProvider.PROVIDER_TYPE\n };\n super(config);\n }\n\n // ============================================================================\n // LIFECYCLE METHODS\n // ============================================================================\n\n async initialize(): Promise<void> {\n if (this._initPromise) {\n return this._initPromise;\n }\n\n this._initPromise = this._performInitialization();\n return this._initPromise;\n }\n\n private async _performInitialization(): Promise<void> {\n console.debug('[MSAL] Starting initialization...');\n await this.auth.instance.initialize();\n console.debug('[MSAL] MSAL instance initialized');\n\n // Handle redirect immediately after initialization\n const redirectResponse = await this.auth.instance.handleRedirectPromise();\n console.debug('[MSAL] Redirect response:', redirectResponse ? 'Found' : 'None');\n\n if (redirectResponse && redirectResponse.account) {\n // User just logged in via redirect\n console.debug('[MSAL] Processing redirect login');\n this.auth.instance.setActiveAccount(redirectResponse.account);\n this.updateAuthState(true);\n\n // Update user info from account\n const userInfo = this.mapMSALAccountToStandard(redirectResponse.account);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (redirect login)');\n } else {\n // Set active account if we have one from cache\n const accounts = this.auth.instance.getAllAccounts();\n console.debug('[MSAL] Cached accounts found:', accounts.length);\n\n if (accounts.length > 0) {\n console.debug('[MSAL] Restoring session from cached account:', accounts[0].username);\n this.auth.instance.setActiveAccount(accounts[0]);\n this.updateAuthState(true);\n\n // Update user info from cached account\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (cached session restored)');\n } else {\n console.debug('[MSAL] No cached accounts, user needs to log in');\n }\n }\n\n // Subscribe to broadcast service for ongoing auth state changes\n this.msalBroadcastService.inProgress$\n .pipe(\n filter((status: InteractionStatus) => status === InteractionStatus.None),\n takeUntil(this._destroying$)\n )\n .subscribe(() => {\n const accounts = this.auth.instance.getAllAccounts();\n const isAuth = accounts.length > 0;\n\n this.updateAuthState(isAuth);\n\n if (isAuth) {\n this.auth.instance.setActiveAccount(accounts[0]);\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n } else {\n this.updateUserInfo(null);\n }\n\n this._initializationCompleted$.next(true);\n });\n }\n\n protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n await this.ensureInitialized();\n\n const silentRequest = {\n scopes: ['User.Read', 'email', 'profile'],\n ...options\n };\n\n return new Promise((resolve, reject) => {\n this.auth.loginRedirect(silentRequest).subscribe({\n next: () => {\n resolve();\n },\n error: (error) => {\n LogError(error);\n reject(error);\n }\n });\n });\n }\n\n async logout(): Promise<void> {\n await this.ensureInitialized();\n this.auth.logoutRedirect().subscribe(() => {\n // Logout will trigger a redirect\n });\n }\n\n async handleCallback(): Promise<void> {\n // MSAL Angular handles callbacks internally through its broadcast service\n // The handleRedirectPromise is called in initialize()\n await this.ensureInitialized();\n }\n\n // ============================================================================\n // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n // ============================================================================\n\n /\n Extract ID token from MSAL's storage\n \n MSAL stores the JWT in AuthenticationResult.idToken\n * This is the key abstraction - consumers never need to know about MSAL's structure!\n /\n protected async extractIdTokenInternal(): Promise<string \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // First try to get cached token from account\n // This avoids unnecessary iframe calls that can timeout\n if (account.idToken) {\n // Check if token is expired or about to expire (within 5-minute buffer)\n // This prevents the race condition where proactive refresh hasn't completed\n // but the cached token is already expired\n if (this.isTokenValid(account.idToken, 300)) {\n return account.idToken;\n }\n\n // Token expired or near-expiry — force a silent refresh\n console.debug('[MSAL] Cached token expired or near-expiry, forcing silent refresh');\n try {\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n return response.idToken \|\| null;\n } catch (refreshError) {\n console.warn('[MSAL] Silent refresh failed, returning expired cached token:', refreshError);\n // Fall through to existing cache-only acquisition below\n }\n }\n\n // If not in account, try silent token acquisition from cache only\n // Use CacheLookupPolicy.AccessToken to avoid iframe calls\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n // MSAL-specific detail: JWT is in idToken property\n return response.idToken \|\| null;\n } catch (error) {\n console.error('[MSAL] Error extracting ID token:', error);\n return null;\n }\n }\n\n /\n Extract complete token info from MSAL\n \n Maps MSAL's AuthenticationResult to StandardAuthToken\n /\n protected async extractTokenInfoInternal(): Promise<StandardAuthToken \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Use cache-only lookup to avoid iframe timeouts during normal token extraction\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n if (!response.idToken) {\n return null;\n }\n\n return {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n } catch (error) {\n // If acquireTokenSilent fails (e.g., iframe timeout), try to use cached account data\n console.error('[MSAL] Error extracting token info:', error);\n\n const account = this.auth.instance.getActiveAccount();\n if (account?.idToken) {\n // Return basic token info from account if available\n return {\n idToken: account.idToken,\n expiresAt: 0, // Unknown from account alone\n scopes: []\n };\n }\n\n return null;\n }\n }\n\n /\n Extract user info from MSAL account\n \n Maps MSAL's AccountInfo structure to StandardUserInfo\n /\n protected async extractUserInfoInternal(): Promise<StandardUserInfo \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n return this.mapMSALAccountToStandard(account);\n } catch (error) {\n console.error('[MSAL] Error extracting user info:', error);\n return null;\n }\n }\n\n /\n Refresh token using MSAL's silent token acquisition\n \n MSAL 5.x Best Practices:\n * - Pass account parameter for reliable silent acquisition\n * - Use forceRefresh: true to bypass cache and get fresh tokens from Azure AD\n * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)\n \n IMPORTANT: This method is called when the server has already rejected the current\n * token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a\n * cached ID token that is still expired (e.g. when the access token has a longer\n * lifetime than the ID token). forceRefresh: true ensures a network round-trip to\n * Azure AD so both the access token and ID token are genuinely refreshed.\n /\n protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'No active account found',\n userMessage: 'You need to log in to continue.'\n }\n };\n }\n\n // MSAL 5.x: Pass account for reliable silent acquisition\n // Use forceRefresh to bypass cache and ensure a network round-trip.\n // This is critical because this method is called after the server rejected\n // the current token — returning a cached (potentially stale) ID token would\n // cause the retry to fail with the same JWT_EXPIRED error.\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n\n if (!response.idToken) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'Token refresh succeeded but no ID token returned',\n userMessage: 'Session refresh failed. Please log in again.'\n }\n };\n }\n\n // Safety net: verify the refreshed token is actually valid.\n // This should always pass after a forced refresh, but guards against\n // edge cases like severe clock skew between client and Azure AD.\n if (!this.isTokenValid(response.idToken)) {\n console.warn('[MSAL] Forced refresh returned an expired ID token — requesting interaction');\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: 'Token refresh returned an expired ID token',\n userMessage: 'Your session has expired. Redirecting to login...'\n }\n };\n }\n\n const token: StandardAuthToken = {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n\n return {\n success: true,\n token\n };\n } catch (error) {\n console.error('[MSAL] Token refresh failed:', error);\n\n // Handle MSAL 5.x error codes that require user interaction\n // - timed_out: MSAL 5.x iframe timeout (replaces monitor_window_timeout from 3.x)\n // - monitor_window_timeout: Legacy MSAL 3.x iframe timeout\n // - no_tokens_found: No cached tokens available\n // - no_account_error: Account not found in cache\n // - InteractionRequiredAuthError: Server requires user interaction\n const errorCode = (error as Record<string, unknown>)?.errorCode as string \| undefined;\n const interactionRequiredCodes = [\n 'monitor_window_timeout',\n 'timed_out',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required',\n 'token_refresh_required' // ClientAuthError when cached token needs refresh\n ];\n\n if (interactionRequiredCodes.includes(errorCode \|\| '') \|\| error instanceof InteractionRequiredAuthError) {\n // Return INTERACTION_REQUIRED error - base class will call handleSessionExpiryInternal\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: `Silent token refresh failed - interaction required (${errorCode \|\| 'unknown'})`,\n userMessage: 'Your session has expired. Redirecting to login...',\n originalError: error\n }\n };\n }\n\n return {\n success: false,\n error: this.classifyErrorInternal(error)\n };\n }\n }\n\n /\n Classify MSAL-specific errors into semantic types\n \n Maps MSAL error classes to AuthErrorType enum.\n * Updated for MSAL 5.x error codes.\n /\n protected classifyErrorInternal(error: unknown): StandardAuthError {\n const errorObj = error as Record<string, unknown>;\n const message = errorObj?.['message'] as string \|\| 'Unknown error';\n const errorCode = errorObj?.['errorCode'] as string \|\| '';\n\n // Check for specific MSAL error types\n if (error instanceof InteractionRequiredAuthError) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Additional authentication is required. Please log in again.'\n };\n }\n\n // ClientAuthError — covers codes like token_refresh_required that are not\n // surfaced through BrowserAuthError or InteractionRequiredAuthError.\n if (error instanceof ClientAuthError) {\n if (errorCode === 'token_refresh_required') {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (error instanceof BrowserAuthError) {\n // Check specific error codes - MSAL 5.x codes\n if (errorCode === 'user_cancelled' \|\| message.includes('user cancelled')) {\n return {\n type: AuthErrorType.USER_CANCELLED,\n message,\n originalError: error,\n userMessage: 'Login was cancelled.'\n };\n }\n\n // MSAL 5.x timeout and session errors that require interaction\n const interactionRequiredCodes = [\n 'timed_out',\n 'monitor_window_timeout',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required'\n ];\n if (interactionRequiredCodes.includes(errorCode)) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message,\n originalError: error,\n userMessage: 'Authentication error. Please log in again.'\n };\n }\n\n // Check message patterns\n if (message.includes('token') && message.includes('expired')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (message.includes('network') \|\| message.includes('fetch')) {\n return {\n type: AuthErrorType.NETWORK_ERROR,\n message,\n originalError: error,\n userMessage: 'Network error. Please check your connection and try again.'\n };\n }\n\n if (message.includes('you need to be authorized')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n // Default to unknown error\n return {\n type: AuthErrorType.UNKNOWN_ERROR,\n message,\n originalError: error,\n userMessage: 'An unexpected error occurred. Please try again.'\n };\n }\n\n // ============================================================================\n // HELPER METHODS\n // ============================================================================\n\n private async ensureInitialized(): Promise<void> {\n if (!this._initPromise) {\n await this.initialize();\n } else if (!this._initializationCompleted$.value) {\n await this._initPromise;\n }\n }\n\n /\n Check if a JWT token is still valid with an optional buffer period.\n * Decodes the payload to read the `exp` claim without cryptographic verification\n * (expiry is a timing check, not an authenticity check).\n \n @param token - The JWT string to check\n * @param bufferSeconds - Number of seconds before actual expiry to consider the token invalid (default: 0)\n * @returns true if the token's exp claim is beyond (now + buffer), false otherwise\n /\n private isTokenValid(token: string, bufferSeconds: number = 0): boolean {\n try {\n const parts = token.split('.');\n if (parts.length !== 3) {\n return false;\n }\n const payload = JSON.parse(atob(parts[1])) as { exp?: number };\n const expiresAtMs = (payload.exp ?? 0) 1000;\n return expiresAtMs > Date.now() + (bufferSeconds * 1000);\n } catch {\n // If we can't decode the token, treat it as invalid\n return false;\n }\n }\n\n /*\n Map MSAL AccountInfo to StandardUserInfo\n /\n private mapMSALAccountToStandard(account: AccountInfo): StandardUserInfo {\n return {\n id: account.localAccountId \|\| account.homeAccountId,\n email: account.username \|\| '',\n name: account.name \|\| account.username \|\| '',\n givenName: account.idTokenClaims?.['given_name'] as string,\n familyName: account.idTokenClaims?.['family_name'] as string,\n preferredUsername: account.username,\n emailVerified: true // MSAL doesn't provide this, assume true\n };\n }\n\n /\n Get profile picture URL from Microsoft Graph API\n \n MSAL requires fetching the photo from Microsoft Graph.\n * This is the key advantage of encapsulation - consumers don't need\n * to know about Graph API, they just call getProfilePictureUrl()!\n /\n protected async getProfilePictureUrlInternal(): Promise<string \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Get access token for Microsoft Graph\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read'],\n account: account,\n forceRefresh: false\n });\n\n if (!response.accessToken) {\n return null;\n }\n\n // Fetch photo from Microsoft Graph\n const graphResponse = await fetch('https://graph.microsoft.com/v1.0/me/photo/$value', {\n headers: { 'Authorization': `Bearer ${response.accessToken}` }\n });\n\n if (graphResponse.ok) {\n const blob = await graphResponse.blob();\n return URL.createObjectURL(blob);\n }\n\n return null;\n } catch (error) {\n console.error('[MSAL] Error getting profile picture:', error);\n return null;\n }\n }\n\n /\n Handle session expiry by redirecting to Microsoft login\n \n This method is called by the base class when silent token refresh fails\n * with INTERACTION_REQUIRED error. It redirects to Microsoft login and never returns.\n * After authentication, the app will reload and re-initialize with a fresh token.\n */\n protected async handleSessionExpiryInternal(): Promise<void> {\n console.debug('[MSAL] Redirecting to Microsoft login for re-authentication...');\n\n // Initiate redirect authentication - page will navigate away\n this.auth.loginRedirect({\n scopes: ['User.Read', 'email', 'profile'],\n prompt: 'select_account'\n }).subscribe({\n error: (redirectError) => {\n console.error('[MSAL] Redirect initiation failed:', redirectError);\n }\n });\n\n // Return a promise that never resolves - page will navigate before this matters\n return new Promise<void>(() => {});\n }\n\n // ============================================================================\n // CONFIGURATION\n // ============================================================================\n\n override getRequiredConfig(): string[] {\n return ['clientId', 'tenantId'];\n }\n\n override validateConfig(_config: Record<string, unknown>): boolean {\n // MSAL configuration is handled by Angular module providers\n return true;\n }\n\n // ============================================================================\n // CLEANUP\n // ============================================================================\n\n ngOnDestroy(): void {\n this._destroying$.next();\n this._destroying$.complete();\n this._initPromise = null;\n this._initializationCompleted$.complete();\n }\n}"]}
1	+ {"version":3,"file":"mjexplorer-msal-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAc,OAAO,EAAc,MAAM,EAA6B,SAAS,EAAQ,MAAM,MAAM,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtL,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IA+CzB;IAA2B;IA9C9C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IAE5B,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACnC,yBAAyB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACzE,YAAY,GAAyB,IAAI,CAAC;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI,uBAAuB,CAAC;gBACpC,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAW;oBAC5C,SAAS,EAAE,WAAW,CAAC,kBAAkB,CAAW;oBACpD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;iBACpC;gBACD,KAAK,EAAE;oBACL,aAAa,EAAE,cAAc;iBAC9B;aACF,CAAC;SACH;QACD;YACE,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,WAAW,EAAE;oBACX,MAAM,EAAE,CAAC,WAAW,CAAC;iBACtB;aACF;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;aACxF;SACF;QACD,WAAW;QACX,SAAS;QACT,oBAAoB;KACrB,CAAC;IAEF,YAAmB,IAAiB,EAAU,oBAA0C;QACtF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;QAAU,yBAAoB,GAApB,oBAAoB,CAAsB;IAMxF,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAElD,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACjD,mCAAmC;YACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAE3B,gCAAgC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAE3B,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,oBAAoB,CAAC,WAAW;aAClC,IAAI,CACH,MAAM,CAAC,CAAC,MAAyB,EAAE,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI,CAAC,EACxE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAC7B;aACA,SAAS,CAAC,GAAG,EAAE;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAEnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,GAAG,EAAE;oBACT,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,iCAAiC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6CAA6C;YAC7C,wDAAwD;YACxD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,4EAA4E;gBAC5E,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACzB,CAAC;gBAED,wDAAwD;gBACxD,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;wBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;wBACzC,OAAO,EAAE,OAAO;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;gBAClC,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,YAAY,CAAC,CAAC;oBAC5F,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,mDAAmD;YACnD,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,oDAAoD;gBACpD,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,CAAC,EAAE,6BAA6B;oBAC3C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,yBAAyB;wBAClC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,yDAAyD;YACzD,oEAAoE;YACpE,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,kDAAkD;wBAC3D,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;gBAC5F,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,4CAA4C;wBACrD,WAAW,EAAE,mDAAmD;qBACjE;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAsB;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAErD,4DAA4D;YAC5D,kFAAkF;YAClF,2DAA2D;YAC3D,gDAAgD;YAChD,iDAAiD;YACjD,mEAAmE;YACnE,MAAM,SAAS,GAAI,KAAiC,EAAE,SAA+B,CAAC;YACtF,MAAM,wBAAwB,GAAG;gBAC/B,wBAAwB;gBACxB,WAAW;gBACX,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;gBAClB,wBAAwB,CAAE,kDAAkD;aAC7E,CAAC;YAEF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBACxG,uFAAuF;gBACvF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,uDAAuD,SAAS,IAAI,SAAS,GAAG;wBACzF,WAAW,EAAE,mDAAmD;wBAChE,aAAa,EAAE,KAAK;qBACrB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAE1D,sCAAsC;QACtC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,wBAAwB,EAAE,CAAC;gBAC3C,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,8CAA8C;YAC9C,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,cAAc;oBAClC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,sBAAsB;iBACpC,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,MAAM,wBAAwB,GAAG;gBAC/B,WAAW;gBACX,wBAAwB;gBACxB,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;aACnB,CAAC;YACF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4CAA4C;aAC1D,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,KAAa,EAAE,gBAAwB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC;YAC/D,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAoB;QACnD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa;YACnD,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,YAAY,CAAW;YAC1D,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,aAAa,CAAW;YAC5D,iBAAiB,EAAE,OAAO,CAAC,QAAQ;YACnC,aAAa,EAAE,IAAI,CAAC,yCAAyC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uCAAuC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;gBACpF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,WAAW,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAEhF,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,SAAS,CAAC;YACX,KAAK,EAAE,CAAC,aAAa,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,gFAAgF;QAChF,OAAO,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAE/E,WAAW;QACT,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;wGAhqBU,cAAc;gEAAd,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAiqB1B;;iFAjqBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable, OnDestroy } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { BehaviorSubject, Observable, Subject, catchError, filter, from, map, of, throwError, takeUntil, take } from 'rxjs';\nimport { MsalBroadcastService, MsalService, MSAL_INSTANCE, MSAL_GUARD_CONFIG, MSAL_INTERCEPTOR_CONFIG, MsalGuard } from '@azure/msal-angular';\nimport { AccountInfo, AuthenticationResult } from '@azure/msal-common';\nimport { CacheLookupPolicy, ClientAuthError, InteractionRequiredAuthError, InteractionStatus, PublicClientApplication, InteractionType, BrowserAuthError } from '@azure/msal-browser';\nimport { LogError } from '@memberjunction/core';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n AuthErrorType,\n TokenRefreshResult\n} from '../auth-types';\n/*\n MSAL (Microsoft Authentication Library) provider implementation - v3.0.0\n \n Implements the abstract methods from MJAuthBase to hide MSAL-specific details.\n * The key abstraction is that MSAL stores the JWT in AuthenticationResult.idToken,\n * but consumers never need to know this detail.\n /\n@Injectable({\n providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'msal')\nexport class MJMSALProvider extends MJAuthBase implements OnDestroy {\n static readonly PROVIDER_TYPE = 'msal';\n readonly type = MJMSALProvider.PROVIDER_TYPE;\n\n private readonly _destroying$ = new Subject<void>();\n private readonly _initializationCompleted$ = new BehaviorSubject<boolean>(false);\n private _initPromise: Promise<void> \| null = null;\n\n /\n Factory function to provide Angular dependencies required by MSAL\n * Stored as a static property for the factory to access without instantiation\n /\n static angularProviderFactory = (environment: Record<string, unknown>) => [\n {\n provide: MSAL_INSTANCE,\n useValue: new PublicClientApplication({\n auth: {\n clientId: environment['CLIENT_ID'] as string,\n authority: environment['CLIENT_AUTHORITY'] as string,\n redirectUri: window.location.origin,\n },\n cache: {\n cacheLocation: 'localStorage',\n },\n }),\n },\n {\n provide: MSAL_GUARD_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n authRequest: {\n scopes: ['User.Read'],\n },\n },\n },\n {\n provide: MSAL_INTERCEPTOR_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n protectedResourceMap: new Map([['https://graph.microsoft.com/v1.0/me', ['user.read']]]),\n },\n },\n MsalService,\n MsalGuard,\n MsalBroadcastService\n ];\n\n constructor(public auth: MsalService, private msalBroadcastService: MsalBroadcastService) {\n const config: AngularAuthProviderConfig = {\n name: MJMSALProvider.PROVIDER_TYPE,\n type: MJMSALProvider.PROVIDER_TYPE\n };\n super(config);\n }\n\n // ============================================================================\n // LIFECYCLE METHODS\n // ============================================================================\n\n async initialize(): Promise<void> {\n if (this._initPromise) {\n return this._initPromise;\n }\n\n this._initPromise = this._performInitialization();\n return this._initPromise;\n }\n\n private async _performInitialization(): Promise<void> {\n console.debug('[MSAL] Starting initialization...');\n await this.auth.instance.initialize();\n console.debug('[MSAL] MSAL instance initialized');\n\n // Handle redirect immediately after initialization\n const redirectResponse = await this.auth.instance.handleRedirectPromise();\n console.debug('[MSAL] Redirect response:', redirectResponse ? 'Found' : 'None');\n\n if (redirectResponse && redirectResponse.account) {\n // User just logged in via redirect\n console.debug('[MSAL] Processing redirect login');\n this.auth.instance.setActiveAccount(redirectResponse.account);\n this.updateAuthState(true);\n\n // Update user info from account\n const userInfo = this.mapMSALAccountToStandard(redirectResponse.account);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (redirect login)');\n } else {\n // Set active account if we have one from cache\n const accounts = this.auth.instance.getAllAccounts();\n console.debug('[MSAL] Cached accounts found:', accounts.length);\n\n if (accounts.length > 0) {\n console.debug('[MSAL] Restoring session from cached account:', accounts[0].username);\n this.auth.instance.setActiveAccount(accounts[0]);\n this.updateAuthState(true);\n\n // Update user info from cached account\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (cached session restored)');\n } else {\n console.debug('[MSAL] No cached accounts, user needs to log in');\n }\n }\n\n // Subscribe to broadcast service for ongoing auth state changes\n this.msalBroadcastService.inProgress$\n .pipe(\n filter((status: InteractionStatus) => status === InteractionStatus.None),\n takeUntil(this._destroying$)\n )\n .subscribe(() => {\n const accounts = this.auth.instance.getAllAccounts();\n const isAuth = accounts.length > 0;\n\n this.updateAuthState(isAuth);\n\n if (isAuth) {\n this.auth.instance.setActiveAccount(accounts[0]);\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n } else {\n this.updateUserInfo(null);\n }\n\n this._initializationCompleted$.next(true);\n });\n }\n\n protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n await this.ensureInitialized();\n\n const silentRequest = {\n scopes: ['User.Read', 'email', 'profile'],\n ...options\n };\n\n return new Promise((resolve, reject) => {\n this.auth.loginRedirect(silentRequest).subscribe({\n next: () => {\n resolve();\n },\n error: (error) => {\n LogError(error);\n reject(error);\n }\n });\n });\n }\n\n protected async logoutInternal(): Promise<void> {\n await this.ensureInitialized();\n this.auth.logoutRedirect().subscribe(() => {\n // Logout will trigger a redirect\n });\n }\n\n async handleCallback(): Promise<void> {\n // MSAL Angular handles callbacks internally through its broadcast service\n // The handleRedirectPromise is called in initialize()\n await this.ensureInitialized();\n }\n\n // ============================================================================\n // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n // ============================================================================\n\n /\n Extract ID token from MSAL's storage\n \n MSAL stores the JWT in AuthenticationResult.idToken\n * This is the key abstraction - consumers never need to know about MSAL's structure!\n /\n protected async extractIdTokenInternal(): Promise<string \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // First try to get cached token from account\n // This avoids unnecessary iframe calls that can timeout\n if (account.idToken) {\n // Check if token is expired or about to expire (within 5-minute buffer)\n // This prevents the race condition where proactive refresh hasn't completed\n // but the cached token is already expired\n if (this.isTokenValid(account.idToken, 300)) {\n return account.idToken;\n }\n\n // Token expired or near-expiry — force a silent refresh\n console.debug('[MSAL] Cached token expired or near-expiry, forcing silent refresh');\n try {\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n return response.idToken \|\| null;\n } catch (refreshError) {\n console.warn('[MSAL] Silent refresh failed, returning expired cached token:', refreshError);\n // Fall through to existing cache-only acquisition below\n }\n }\n\n // If not in account, try silent token acquisition from cache only\n // Use CacheLookupPolicy.AccessToken to avoid iframe calls\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n // MSAL-specific detail: JWT is in idToken property\n return response.idToken \|\| null;\n } catch (error) {\n console.error('[MSAL] Error extracting ID token:', error);\n return null;\n }\n }\n\n /\n Extract complete token info from MSAL\n \n Maps MSAL's AuthenticationResult to StandardAuthToken\n /\n protected async extractTokenInfoInternal(): Promise<StandardAuthToken \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Use cache-only lookup to avoid iframe timeouts during normal token extraction\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n if (!response.idToken) {\n return null;\n }\n\n return {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n } catch (error) {\n // If acquireTokenSilent fails (e.g., iframe timeout), try to use cached account data\n console.error('[MSAL] Error extracting token info:', error);\n\n const account = this.auth.instance.getActiveAccount();\n if (account?.idToken) {\n // Return basic token info from account if available\n return {\n idToken: account.idToken,\n expiresAt: 0, // Unknown from account alone\n scopes: []\n };\n }\n\n return null;\n }\n }\n\n /\n Extract user info from MSAL account\n \n Maps MSAL's AccountInfo structure to StandardUserInfo\n /\n protected async extractUserInfoInternal(): Promise<StandardUserInfo \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n return this.mapMSALAccountToStandard(account);\n } catch (error) {\n console.error('[MSAL] Error extracting user info:', error);\n return null;\n }\n }\n\n /\n Refresh token using MSAL's silent token acquisition\n \n MSAL 5.x Best Practices:\n * - Pass account parameter for reliable silent acquisition\n * - Use forceRefresh: true to bypass cache and get fresh tokens from Azure AD\n * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)\n \n IMPORTANT: This method is called when the server has already rejected the current\n * token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a\n * cached ID token that is still expired (e.g. when the access token has a longer\n * lifetime than the ID token). forceRefresh: true ensures a network round-trip to\n * Azure AD so both the access token and ID token are genuinely refreshed.\n /\n protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'No active account found',\n userMessage: 'You need to log in to continue.'\n }\n };\n }\n\n // MSAL 5.x: Pass account for reliable silent acquisition\n // Use forceRefresh to bypass cache and ensure a network round-trip.\n // This is critical because this method is called after the server rejected\n // the current token — returning a cached (potentially stale) ID token would\n // cause the retry to fail with the same JWT_EXPIRED error.\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n\n if (!response.idToken) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'Token refresh succeeded but no ID token returned',\n userMessage: 'Session refresh failed. Please log in again.'\n }\n };\n }\n\n // Safety net: verify the refreshed token is actually valid.\n // This should always pass after a forced refresh, but guards against\n // edge cases like severe clock skew between client and Azure AD.\n if (!this.isTokenValid(response.idToken)) {\n console.warn('[MSAL] Forced refresh returned an expired ID token — requesting interaction');\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: 'Token refresh returned an expired ID token',\n userMessage: 'Your session has expired. Redirecting to login...'\n }\n };\n }\n\n const token: StandardAuthToken = {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n\n return {\n success: true,\n token\n };\n } catch (error) {\n console.error('[MSAL] Token refresh failed:', error);\n\n // Handle MSAL 5.x error codes that require user interaction\n // - timed_out: MSAL 5.x iframe timeout (replaces monitor_window_timeout from 3.x)\n // - monitor_window_timeout: Legacy MSAL 3.x iframe timeout\n // - no_tokens_found: No cached tokens available\n // - no_account_error: Account not found in cache\n // - InteractionRequiredAuthError: Server requires user interaction\n const errorCode = (error as Record<string, unknown>)?.errorCode as string \| undefined;\n const interactionRequiredCodes = [\n 'monitor_window_timeout',\n 'timed_out',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required',\n 'token_refresh_required' // ClientAuthError when cached token needs refresh\n ];\n\n if (interactionRequiredCodes.includes(errorCode \|\| '') \|\| error instanceof InteractionRequiredAuthError) {\n // Return INTERACTION_REQUIRED error - base class will call handleSessionExpiryInternal\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: `Silent token refresh failed - interaction required (${errorCode \|\| 'unknown'})`,\n userMessage: 'Your session has expired. Redirecting to login...',\n originalError: error\n }\n };\n }\n\n return {\n success: false,\n error: this.classifyErrorInternal(error)\n };\n }\n }\n\n /\n Classify MSAL-specific errors into semantic types\n \n Maps MSAL error classes to AuthErrorType enum.\n * Updated for MSAL 5.x error codes.\n /\n protected classifyErrorInternal(error: unknown): StandardAuthError {\n const errorObj = error as Record<string, unknown>;\n const message = errorObj?.['message'] as string \|\| 'Unknown error';\n const errorCode = errorObj?.['errorCode'] as string \|\| '';\n\n // Check for specific MSAL error types\n if (error instanceof InteractionRequiredAuthError) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Additional authentication is required. Please log in again.'\n };\n }\n\n // ClientAuthError — covers codes like token_refresh_required that are not\n // surfaced through BrowserAuthError or InteractionRequiredAuthError.\n if (error instanceof ClientAuthError) {\n if (errorCode === 'token_refresh_required') {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (error instanceof BrowserAuthError) {\n // Check specific error codes - MSAL 5.x codes\n if (errorCode === 'user_cancelled' \|\| message.includes('user cancelled')) {\n return {\n type: AuthErrorType.USER_CANCELLED,\n message,\n originalError: error,\n userMessage: 'Login was cancelled.'\n };\n }\n\n // MSAL 5.x timeout and session errors that require interaction\n const interactionRequiredCodes = [\n 'timed_out',\n 'monitor_window_timeout',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required'\n ];\n if (interactionRequiredCodes.includes(errorCode)) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message,\n originalError: error,\n userMessage: 'Authentication error. Please log in again.'\n };\n }\n\n // Check message patterns\n if (message.includes('token') && message.includes('expired')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (message.includes('network') \|\| message.includes('fetch')) {\n return {\n type: AuthErrorType.NETWORK_ERROR,\n message,\n originalError: error,\n userMessage: 'Network error. Please check your connection and try again.'\n };\n }\n\n if (message.includes('you need to be authorized')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n // Default to unknown error\n return {\n type: AuthErrorType.UNKNOWN_ERROR,\n message,\n originalError: error,\n userMessage: 'An unexpected error occurred. Please try again.'\n };\n }\n\n // ============================================================================\n // HELPER METHODS\n // ============================================================================\n\n private async ensureInitialized(): Promise<void> {\n if (!this._initPromise) {\n await this.initialize();\n } else if (!this._initializationCompleted$.value) {\n await this._initPromise;\n }\n }\n\n /\n Check if a JWT token is still valid with an optional buffer period.\n * Decodes the payload to read the `exp` claim without cryptographic verification\n * (expiry is a timing check, not an authenticity check).\n \n @param token - The JWT string to check\n * @param bufferSeconds - Number of seconds before actual expiry to consider the token invalid (default: 0)\n * @returns true if the token's exp claim is beyond (now + buffer), false otherwise\n /\n private isTokenValid(token: string, bufferSeconds: number = 0): boolean {\n try {\n const parts = token.split('.');\n if (parts.length !== 3) {\n return false;\n }\n const payload = JSON.parse(atob(parts[1])) as { exp?: number };\n const expiresAtMs = (payload.exp ?? 0) 1000;\n return expiresAtMs > Date.now() + (bufferSeconds * 1000);\n } catch {\n // If we can't decode the token, treat it as invalid\n return false;\n }\n }\n\n /*\n Map MSAL AccountInfo to StandardUserInfo\n /\n private mapMSALAccountToStandard(account: AccountInfo): StandardUserInfo {\n return {\n id: account.localAccountId \|\| account.homeAccountId,\n email: account.username \|\| '',\n name: account.name \|\| account.username \|\| '',\n givenName: account.idTokenClaims?.['given_name'] as string,\n familyName: account.idTokenClaims?.['family_name'] as string,\n preferredUsername: account.username,\n emailVerified: true // MSAL doesn't provide this, assume true\n };\n }\n\n /\n Get profile picture URL from Microsoft Graph API\n \n MSAL requires fetching the photo from Microsoft Graph.\n * This is the key advantage of encapsulation - consumers don't need\n * to know about Graph API, they just call getProfilePictureUrl()!\n /\n protected async getProfilePictureUrlInternal(): Promise<string \| null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Get access token for Microsoft Graph\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read'],\n account: account,\n forceRefresh: false\n });\n\n if (!response.accessToken) {\n return null;\n }\n\n // Fetch photo from Microsoft Graph\n const graphResponse = await fetch('https://graph.microsoft.com/v1.0/me/photo/$value', {\n headers: { 'Authorization': `Bearer ${response.accessToken}` }\n });\n\n if (graphResponse.ok) {\n const blob = await graphResponse.blob();\n return URL.createObjectURL(blob);\n }\n\n return null;\n } catch (error) {\n console.error('[MSAL] Error getting profile picture:', error);\n return null;\n }\n }\n\n /\n Handle session expiry by redirecting to Microsoft login\n \n This method is called by the base class when silent token refresh fails\n * with INTERACTION_REQUIRED error. It redirects to Microsoft login and never returns.\n * After authentication, the app will reload and re-initialize with a fresh token.\n */\n protected async handleSessionExpiryInternal(): Promise<void> {\n console.debug('[MSAL] Redirecting to Microsoft login for re-authentication...');\n\n // Initiate redirect authentication - page will navigate away\n this.auth.loginRedirect({\n scopes: ['User.Read', 'email', 'profile'],\n prompt: 'select_account'\n }).subscribe({\n error: (redirectError) => {\n console.error('[MSAL] Redirect initiation failed:', redirectError);\n }\n });\n\n // Return a promise that never resolves - page will navigate before this matters\n return new Promise<void>(() => {});\n }\n\n // ============================================================================\n // CONFIGURATION\n // ============================================================================\n\n override getRequiredConfig(): string[] {\n return ['clientId', 'tenantId'];\n }\n\n override validateConfig(_config: Record<string, unknown>): boolean {\n // MSAL configuration is handled by Angular module providers\n return true;\n }\n\n // ============================================================================\n // CLEANUP\n // ============================================================================\n\n ngOnDestroy(): void {\n this._destroying$.next();\n this._destroying$.complete();\n this._initPromise = null;\n this._initializationCompleted$.complete();\n }\n}"]}

package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts CHANGED Viewed

@@ -34,7 +34,7 @@ export declare class MJOktaProvider extends MJAuthBase {
     });
     initialize(): Promise<void>;
     protected loginInternal(options?: Record<string, unknown>): Promise<void>;
-    logout(): Promise<void>;
+    protected logoutInternal(): Promise<void>;
     handleCallback(): Promise<void>;
     /**
      * Extract ID token from Okta's storage

package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mjexplorer-okta-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAiB,EAAE,eAAe,EAAwB,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAU;IAuBV,OAAO,CAAC,UAAU;IAtBpD,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;QAWnE;gBAEwC,UAAU,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyCrF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4DjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;~~IAoBzE~~,~~MAAM~~,IAAI,OAAO,CAAC,IAAI,CAAC;~~IAuBvB~~,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAqB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;OAIG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwFnE;;;;;;;;;OASG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;IA8FlE;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;yCApgBtD,cAAc;6CAAd,cAAc;CAugB1B"}
1	+ {"version":3,"file":"mjexplorer-okta-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAiB,EAAE,eAAe,EAAwB,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAU;IAuBV,OAAO,CAAC,UAAU;IAtBpD,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;QAWnE;gBAEwC,UAAU,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyCrF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4DjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAoB/D,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBzC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAqB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;OAIG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwFnE;;;;;;;;;OASG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;IA8FlE;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;yCApgBtD,cAAc;6CAAd,cAAc;CAugB1B"}

package/dist/lib/providers/mjexplorer-okta-provider.service.js CHANGED Viewed

@@ -150,7 +150,7 @@ let MJOktaProvider = class MJOktaProvider extends MJAuthBase {
             throw error;
         }
     }
-    async logout() {
+    async logoutInternal() {
         try {
             // Clear the local authentication state immediately
             this.updateAuthState(false);