@memberjunction/ng-auth-services 6.2.0-edge.0 → 6.2.0-edge.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. package/dist/lib/AngularAuthProviderFactory.d.ts +12 -0
  2. package/dist/lib/AngularAuthProviderFactory.d.ts.map +1 -1
  3. package/dist/lib/AngularAuthProviderFactory.js +31 -7
  4. package/dist/lib/AngularAuthProviderFactory.js.map +1 -1
  5. package/dist/lib/IAuthProvider.js.map +1 -1
  6. package/dist/lib/auth-services.module.d.ts +2 -0
  7. package/dist/lib/auth-services.module.d.ts.map +1 -1
  8. package/dist/lib/auth-services.module.js +7 -3
  9. package/dist/lib/auth-services.module.js.map +1 -1
  10. package/dist/lib/catalog-environment.d.ts +4 -0
  11. package/dist/lib/catalog-environment.d.ts.map +1 -1
  12. package/dist/lib/catalog-environment.js +11 -3
  13. package/dist/lib/catalog-environment.js.map +1 -1
  14. package/dist/lib/providers/mjexplorer-auth0-provider.service.d.ts +11 -3
  15. package/dist/lib/providers/mjexplorer-auth0-provider.service.d.ts.map +1 -1
  16. package/dist/lib/providers/mjexplorer-auth0-provider.service.js +32 -16
  17. package/dist/lib/providers/mjexplorer-auth0-provider.service.js.map +1 -1
  18. package/dist/lib/providers/mjexplorer-cognito-provider.service.d.ts +11 -1
  19. package/dist/lib/providers/mjexplorer-cognito-provider.service.d.ts.map +1 -1
  20. package/dist/lib/providers/mjexplorer-cognito-provider.service.js +9 -1
  21. package/dist/lib/providers/mjexplorer-cognito-provider.service.js.map +1 -1
  22. package/dist/lib/providers/mjexplorer-magic-link-provider.service.d.ts +2 -0
  23. package/dist/lib/providers/mjexplorer-magic-link-provider.service.d.ts.map +1 -1
  24. package/dist/lib/providers/mjexplorer-magic-link-provider.service.js +5 -1
  25. package/dist/lib/providers/mjexplorer-magic-link-provider.service.js.map +1 -1
  26. package/dist/lib/providers/mjexplorer-msal-provider.service.d.ts +49 -3
  27. package/dist/lib/providers/mjexplorer-msal-provider.service.d.ts.map +1 -1
  28. package/dist/lib/providers/mjexplorer-msal-provider.service.js +41 -25
  29. package/dist/lib/providers/mjexplorer-msal-provider.service.js.map +1 -1
  30. package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts +23 -1
  31. package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts.map +1 -1
  32. package/dist/lib/providers/mjexplorer-okta-provider.service.js +9 -1
  33. package/dist/lib/providers/mjexplorer-okta-provider.service.js.map +1 -1
  34. package/dist/lib/providers/mjexplorer-workos-provider.service.d.ts +21 -1
  35. package/dist/lib/providers/mjexplorer-workos-provider.service.d.ts.map +1 -1
  36. package/dist/lib/providers/mjexplorer-workos-provider.service.js +9 -1
  37. package/dist/lib/providers/mjexplorer-workos-provider.service.js.map +1 -1
  38. package/dist/lib/redirect.component.d.ts +5 -1
  39. package/dist/lib/redirect.component.d.ts.map +1 -1
  40. package/dist/lib/redirect.component.js +11 -3
  41. package/dist/lib/redirect.component.js.map +1 -1
  42. package/package.json +4 -4
package/dist/lib/providers/mjexplorer-msal-provider.service.js CHANGED
@@ -24,7 +24,7 @@ import * as i1 from "@azure/msal-angular";
24
24
  */
25
25
  let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
26
26
  static { MJMSALProvider_1 = this; }
27
- auth;
27
+ Auth;
28
28
  msalBroadcastService;
29
29
  static PROVIDER_TYPE = 'msal';
30
30
  type = MJMSALProvider_1.PROVIDER_TYPE;
@@ -35,7 +35,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
35
35
  * Factory function to provide Angular dependencies required by MSAL
36
36
  * Stored as a static property for the factory to access without instantiation
37
37
  */
38
- static angularProviderFactory = (environment) => [
38
+ static AngularProviderFactory = (environment) => [
39
39
  {
40
40
  provide: MSAL_INSTANCE,
41
41
  useValue: new PublicClientApplication({
@@ -69,6 +69,14 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
69
69
  MsalGuard,
70
70
  MsalBroadcastService
71
71
  ];
72
+ /** @deprecated Use {@link AngularProviderFactory}. */
73
+ static get angularProviderFactory() {
74
+ return this.AngularProviderFactory;
75
+ }
76
+ /** @deprecated Use {@link AngularProviderFactory}. */
77
+ static set angularProviderFactory(value) {
78
+ this.AngularProviderFactory = value;
79
+ }
72
80
  /**
73
81
  * Maps a catalog row onto the unprefixed keys `angularProviderFactory` reads (`CLIENT_ID` /
74
82
  * `CLIENT_AUTHORITY`), which predate the `<DRIVER>_*` convention the generic overlay emits —
@@ -97,15 +105,23 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
97
105
  }
98
106
  return overlay;
99
107
  }
100
- constructor(auth, msalBroadcastService) {
108
+ constructor(Auth, msalBroadcastService) {
101
109
  const config = {
102
110
  name: MJMSALProvider_1.PROVIDER_TYPE,
103
111
  type: MJMSALProvider_1.PROVIDER_TYPE
104
112
  };
105
113
  super(config);
106
- this.auth = auth;
114
+ this.Auth = Auth;
107
115
  this.msalBroadcastService = msalBroadcastService;
108
116
  }
117
+ /** @deprecated Use {@link Auth}. */
118
+ get auth() {
119
+ return this.Auth;
120
+ }
121
+ /** @deprecated Use {@link Auth}. */
122
+ set auth(value) {
123
+ this.Auth = value;
124
+ }
109
125
  // ============================================================================
110
126
  // LIFECYCLE METHODS
111
127
  // ============================================================================
@@ -118,15 +134,15 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
118
134
  }
119
135
  async _performInitialization() {
120
136
  console.debug('[MSAL] Starting initialization...');
121
- await this.auth.instance.initialize();
137
+ await this.Auth.instance.initialize();
122
138
  console.debug('[MSAL] MSAL instance initialized');
123
139
  // Handle redirect immediately after initialization
124
- const redirectResponse = await this.auth.instance.handleRedirectPromise();
140
+ const redirectResponse = await this.Auth.instance.handleRedirectPromise();
125
141
  console.debug('[MSAL] Redirect response:', redirectResponse ? 'Found' : 'None');
126
142
  if (redirectResponse && redirectResponse.account) {
127
143
  // User just logged in via redirect
128
144
  console.debug('[MSAL] Processing redirect login');
129
- this.auth.instance.setActiveAccount(redirectResponse.account);
145
+ this.Auth.instance.setActiveAccount(redirectResponse.account);
130
146
  this.updateAuthState(true);
131
147
  // Update user info from account
132
148
  const userInfo = this.mapMSALAccountToStandard(redirectResponse.account);
@@ -136,11 +152,11 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
136
152
  }
137
153
  else {
138
154
  // Set active account if we have one from cache
139
- const accounts = this.auth.instance.getAllAccounts();
155
+ const accounts = this.Auth.instance.getAllAccounts();
140
156
  console.debug('[MSAL] Cached accounts found:', accounts.length);
141
157
  if (accounts.length > 0) {
142
158
  console.debug('[MSAL] Restoring session from cached account:', accounts[0].username);
143
- this.auth.instance.setActiveAccount(accounts[0]);
159
+ this.Auth.instance.setActiveAccount(accounts[0]);
144
160
  this.updateAuthState(true);
145
161
  // Update user info from cached account
146
162
  const userInfo = this.mapMSALAccountToStandard(accounts[0]);
@@ -156,11 +172,11 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
156
172
  this.msalBroadcastService.inProgress$
157
173
  .pipe(filter((status) => status === InteractionStatus.None), takeUntil(this._destroying$))
158
174
  .subscribe(() => {
159
- const accounts = this.auth.instance.getAllAccounts();
175
+ const accounts = this.Auth.instance.getAllAccounts();
160
176
  const isAuth = accounts.length > 0;
161
177
  this.updateAuthState(isAuth);
162
178
  if (isAuth) {
163
- this.auth.instance.setActiveAccount(accounts[0]);
179
+ this.Auth.instance.setActiveAccount(accounts[0]);
164
180
  const userInfo = this.mapMSALAccountToStandard(accounts[0]);
165
181
  this.updateUserInfo(userInfo);
166
182
  }
@@ -177,7 +193,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
177
193
  ...options
178
194
  };
179
195
  return new Promise((resolve, reject) => {
180
- this.auth.loginRedirect(silentRequest).subscribe({
196
+ this.Auth.loginRedirect(silentRequest).subscribe({
181
197
  next: () => {
182
198
  resolve();
183
199
  },
@@ -190,7 +206,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
190
206
  }
191
207
  async logoutInternal() {
192
208
  await this.ensureInitialized();
193
- this.auth.logoutRedirect().subscribe(() => {
209
+ this.Auth.logoutRedirect().subscribe(() => {
194
210
  // Logout will trigger a redirect
195
211
  });
196
212
  }
@@ -211,7 +227,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
211
227
  async extractIdTokenInternal() {
212
228
  try {
213
229
  await this.ensureInitialized();
214
- const account = this.auth.instance.getActiveAccount();
230
+ const account = this.Auth.instance.getActiveAccount();
215
231
  if (!account) {
216
232
  return null;
217
233
  }
@@ -227,7 +243,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
227
243
  // Token expired or near-expiry — force a silent refresh
228
244
  console.debug('[MSAL] Cached token expired or near-expiry, forcing silent refresh');
229
245
  try {
230
- const response = await this.auth.instance.acquireTokenSilent({
246
+ const response = await this.Auth.instance.acquireTokenSilent({
231
247
  scopes: ['User.Read', 'email', 'profile'],
232
248
  account: account,
233
249
  forceRefresh: true
@@ -241,7 +257,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
241
257
  }
242
258
  // If not in account, try silent token acquisition from cache only
243
259
  // Use CacheLookupPolicy.AccessToken to avoid iframe calls
244
- const response = await this.auth.instance.acquireTokenSilent({
260
+ const response = await this.Auth.instance.acquireTokenSilent({
245
261
  scopes: ['User.Read', 'email', 'profile'],
246
262
  account: account,
247
263
  cacheLookupPolicy: CacheLookupPolicy.AccessToken
@@ -262,12 +278,12 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
262
278
  async extractTokenInfoInternal() {
263
279
  try {
264
280
  await this.ensureInitialized();
265
- const account = this.auth.instance.getActiveAccount();
281
+ const account = this.Auth.instance.getActiveAccount();
266
282
  if (!account) {
267
283
  return null;
268
284
  }
269
285
  // Use cache-only lookup to avoid iframe timeouts during normal token extraction
270
- const response = await this.auth.instance.acquireTokenSilent({
286
+ const response = await this.Auth.instance.acquireTokenSilent({
271
287
  scopes: ['User.Read', 'email', 'profile'],
272
288
  account: account,
273
289
  cacheLookupPolicy: CacheLookupPolicy.AccessToken
@@ -285,7 +301,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
285
301
  catch (error) {
286
302
  // If acquireTokenSilent fails (e.g., iframe timeout), try to use cached account data
287
303
  console.error('[MSAL] Error extracting token info:', error);
288
- const account = this.auth.instance.getActiveAccount();
304
+ const account = this.Auth.instance.getActiveAccount();
289
305
  if (account?.idToken) {
290
306
  // Return basic token info from account if available
291
307
  return {
@@ -305,7 +321,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
305
321
  async extractUserInfoInternal() {
306
322
  try {
307
323
  await this.ensureInitialized();
308
- const account = this.auth.instance.getActiveAccount();
324
+ const account = this.Auth.instance.getActiveAccount();
309
325
  if (!account) {
310
326
  return null;
311
327
  }
@@ -333,7 +349,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
333
349
  async refreshTokenInternal() {
334
350
  try {
335
351
  await this.ensureInitialized();
336
- const account = this.auth.instance.getActiveAccount();
352
+ const account = this.Auth.instance.getActiveAccount();
337
353
  if (!account) {
338
354
  return {
339
355
  success: false,
@@ -349,7 +365,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
349
365
  // This is critical because this method is called after the server rejected
350
366
  // the current token — returning a cached (potentially stale) ID token would
351
367
  // cause the retry to fail with the same JWT_EXPIRED error.
352
- const response = await this.auth.instance.acquireTokenSilent({
368
+ const response = await this.Auth.instance.acquireTokenSilent({
353
369
  scopes: ['User.Read', 'email', 'profile'],
354
370
  account: account,
355
371
  forceRefresh: true
@@ -588,12 +604,12 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
588
604
  async getProfilePictureUrlInternal() {
589
605
  try {
590
606
  await this.ensureInitialized();
591
- const account = this.auth.instance.getActiveAccount();
607
+ const account = this.Auth.instance.getActiveAccount();
592
608
  if (!account) {
593
609
  return null;
594
610
  }
595
611
  // Get access token for Microsoft Graph
596
- const response = await this.auth.instance.acquireTokenSilent({
612
+ const response = await this.Auth.instance.acquireTokenSilent({
597
613
  scopes: ['User.Read'],
598
614
  account: account,
599
615
  forceRefresh: false
@@ -626,7 +642,7 @@ let MJMSALProvider = class MJMSALProvider extends MJAuthBase {
626
642
  async handleSessionExpiryInternal() {
627
643
  console.debug('[MSAL] Redirecting to Microsoft login for re-authentication...');
628
644
  // Initiate redirect authentication - page will navigate away
629
- this.auth.loginRedirect({
645
+ this.Auth.loginRedirect({
630
646
  scopes: ['User.Read', 'email', 'profile'],
631
647
  prompt: 'select_account'
632
648
  }).subscribe({
package/dist/lib/providers/mjexplorer-msal-provider.service.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"mjexplorer-msal-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAc,OAAO,EAAc,MAAM,EAA6B,SAAS,EAAQ,MAAM,MAAM,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtL,OAAO,EAAE,QAAQ,EAA+B,MAAM,sBAAsB,CAAC;AAE7E,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IAgFzB;IAA2B;IA/E9C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IAE5B,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACnC,yBAAyB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACzE,YAAY,GAAyB,IAAI,CAAC;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI,uBAAuB,CAAC;gBACpC,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAW;oBAC5C,SAAS,EAAE,WAAW,CAAC,kBAAkB,CAAW;oBACpD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;iBACpC;gBACD,KAAK,EAAE;oBACL,aAAa,EAAE,cAAc;iBAC9B;aACF,CAAC;SACH;QACD;YACE,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,WAAW,EAAE;oBACX,MAAM,EAAE,CAAC,WAAW,CAAC;iBACtB;aACF;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;aACxF;SACF;QACD,WAAW;QACX,SAAS;QACT,oBAAoB;KACrB,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAA4B;QACxD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAE5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,SAAS,GACb,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC;YACvE,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;QAC1C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAmB,IAAiB,EAAU,oBAA0C;QACtF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;QAAU,yBAAoB,GAApB,oBAAoB,CAAsB;IAMxF,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAElD,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACjD,mCAAmC;YACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAE3B,gCAAgC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAE3B,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,oBAAoB,CAAC,WAAW;aAClC,IAAI,CACH,MAAM,CAAC,CAAC,MAAyB,EAAE,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI,CAAC,EACxE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAC7B;aACA,SAAS,CAAC,GAAG,EAAE;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAEnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,GAAG,EAAE;oBACT,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,iCAAiC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6CAA6C;YAC7C,wDAAwD;YACxD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,4EAA4E;gBAC5E,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACzB,CAAC;gBAED,wDAAwD;gBACxD,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;wBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;wBACzC,OAAO,EAAE,OAAO;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;gBAClC,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,YAAY,CAAC,CAAC;oBAC5F,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,mDAAmD;YACnD,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,oDAAoD;gBACpD,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,CAAC,EAAE,6BAA6B;oBAC3C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,yBAAyB;wBAClC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,yDAAyD;YACzD,oEAAoE;YACpE,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,kDAAkD;wBAC3D,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;gBAC5F,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,4CAA4C;wBACrD,WAAW,EAAE,mDAAmD;qBACjE;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAsB;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAErD,4DAA4D;YAC5D,kFAAkF;YAClF,2DAA2D;YAC3D,gDAAgD;YAChD,iDAAiD;YACjD,mEAAmE;YACnE,MAAM,SAAS,GAAI,KAAiC,EAAE,SAA+B,CAAC;YACtF,MAAM,wBAAwB,GAAG;gBAC/B,wBAAwB;gBACxB,WAAW;gBACX,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;gBAClB,wBAAwB,CAAE,kDAAkD;aAC7E,CAAC;YAEF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBACxG,uFAAuF;gBACvF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,uDAAuD,SAAS,IAAI,SAAS,GAAG;wBACzF,WAAW,EAAE,mDAAmD;wBAChE,aAAa,EAAE,KAAK;qBACrB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAE1D,sCAAsC;QACtC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,wBAAwB,EAAE,CAAC;gBAC3C,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,8CAA8C;YAC9C,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,cAAc;oBAClC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,sBAAsB;iBACpC,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,MAAM,wBAAwB,GAAG;gBAC/B,WAAW;gBACX,wBAAwB;gBACxB,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;aACnB,CAAC;YACF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4CAA4C;aAC1D,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,KAAa,EAAE,gBAAwB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC;YAC/D,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAoB;QACnD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa;YACnD,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,YAAY,CAAW;YAC1D,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,aAAa,CAAW;YAC5D,iBAAiB,EAAE,OAAO,CAAC,QAAQ;YACnC,aAAa,EAAE,IAAI,CAAC,yCAAyC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uCAAuC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;gBACpF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,WAAW,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAEhF,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,SAAS,CAAC;YACX,KAAK,EAAE,CAAC,aAAa,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,gFAAgF;QAChF,OAAO,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAE/E,WAAW;QACT,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;wGAjsBU,cAAc;gEAAd,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAksB1B;;iFAlsBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable, OnDestroy } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { BehaviorSubject, Observable, Subject, catchError, filter, from, map, of, throwError, takeUntil, take } from 'rxjs';\nimport { MsalBroadcastService, MsalService, MSAL_INSTANCE, MSAL_GUARD_CONFIG, MSAL_INTERCEPTOR_CONFIG, MsalGuard } from '@azure/msal-angular';\nimport { AccountInfo, AuthenticationResult } from '@azure/msal-common';\nimport { CacheLookupPolicy, ClientAuthError, InteractionRequiredAuthError, InteractionStatus, PublicClientApplication, InteractionType, BrowserAuthError } from '@azure/msal-browser';\nimport { LogError, type PublicAuthProviderInfo } from '@memberjunction/core';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n AuthErrorType,\n TokenRefreshResult\n} from '../auth-types';\n/**\n * MSAL (Microsoft Authentication Library) provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide MSAL-specific details.\n * The key abstraction is that MSAL stores the JWT in AuthenticationResult.idToken,\n * but consumers never need to know this detail.\n */\n@Injectable({\n providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'msal')\nexport class MJMSALProvider extends MJAuthBase implements OnDestroy {\n static readonly PROVIDER_TYPE = 'msal';\n readonly type = MJMSALProvider.PROVIDER_TYPE;\n\n private readonly _destroying$ = new Subject<void>();\n private readonly _initializationCompleted$ = new BehaviorSubject<boolean>(false);\n private _initPromise: Promise<void> | null = null;\n\n /**\n * Factory function to provide Angular dependencies required by MSAL\n * Stored as a static property for the factory to access without instantiation\n */\n static angularProviderFactory = (environment: Record<string, unknown>) => [\n {\n provide: MSAL_INSTANCE,\n useValue: new PublicClientApplication({\n auth: {\n clientId: environment['CLIENT_ID'] as string,\n authority: environment['CLIENT_AUTHORITY'] as string,\n redirectUri: window.location.origin,\n },\n cache: {\n cacheLocation: 'localStorage',\n },\n }),\n },\n {\n provide: MSAL_GUARD_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n authRequest: {\n scopes: ['User.Read'],\n },\n },\n },\n {\n provide: MSAL_INTERCEPTOR_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n protectedResourceMap: new Map([['https://graph.microsoft.com/v1.0/me', ['user.read']]]),\n },\n },\n MsalService,\n MsalGuard,\n MsalBroadcastService\n ];\n\n /**\n * Maps a catalog row onto the unprefixed keys `angularProviderFactory` reads (`CLIENT_ID` /\n * `CLIENT_AUTHORITY`), which predate the `<DRIVER>_*` convention the generic overlay emits —\n * without this mapping a metadata-configured row would be silently ignored in favour of the\n * compiled environment.\n *\n * The authority comes from `ClientConfiguration.authority` when the row supplies one; otherwise\n * it is derived from the Issuer by stripping the trailing `/v2.0` — an Entra issuer is\n * `https://login.microsoftonline.com/<tenantId>/v2.0`, and MSAL's authority is that same URL\n * without the version suffix. That derivation only holds for standard Entra tenants: rows for\n * Azure AD B2C or v1 `sts.windows.net` issuers must set `ClientConfiguration.authority`\n * explicitly, because their issuer is not a usable authority (and B2C additionally needs\n * `knownAuthorities`, which this driver does not yet plumb).\n */\n static EnvironmentFromCatalog(info: PublicAuthProviderInfo): Record<string, unknown> {\n const overlay: Record<string, unknown> = {};\n\n if (info.clientId) {\n overlay['CLIENT_ID'] = info.clientId;\n }\n\n const configuredAuthority = info.clientConfiguration?.['authority'];\n const authority =\n typeof configuredAuthority === 'string' && configuredAuthority.length > 0\n ? configuredAuthority\n : info.issuer?.replace(/\\/v2\\.0\\/?$/, '');\n if (authority) {\n overlay['CLIENT_AUTHORITY'] = authority;\n }\n\n return overlay;\n }\n\n constructor(public auth: MsalService, private msalBroadcastService: MsalBroadcastService) {\n const config: AngularAuthProviderConfig = {\n name: MJMSALProvider.PROVIDER_TYPE,\n type: MJMSALProvider.PROVIDER_TYPE\n };\n super(config);\n }\n\n // ============================================================================\n // LIFECYCLE METHODS\n // ============================================================================\n\n async initialize(): Promise<void> {\n if (this._initPromise) {\n return this._initPromise;\n }\n\n this._initPromise = this._performInitialization();\n return this._initPromise;\n }\n\n private async _performInitialization(): Promise<void> {\n console.debug('[MSAL] Starting initialization...');\n await this.auth.instance.initialize();\n console.debug('[MSAL] MSAL instance initialized');\n\n // Handle redirect immediately after initialization\n const redirectResponse = await this.auth.instance.handleRedirectPromise();\n console.debug('[MSAL] Redirect response:', redirectResponse ? 'Found' : 'None');\n\n if (redirectResponse && redirectResponse.account) {\n // User just logged in via redirect\n console.debug('[MSAL] Processing redirect login');\n this.auth.instance.setActiveAccount(redirectResponse.account);\n this.updateAuthState(true);\n\n // Update user info from account\n const userInfo = this.mapMSALAccountToStandard(redirectResponse.account);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (redirect login)');\n } else {\n // Set active account if we have one from cache\n const accounts = this.auth.instance.getAllAccounts();\n console.debug('[MSAL] Cached accounts found:', accounts.length);\n\n if (accounts.length > 0) {\n console.debug('[MSAL] Restoring session from cached account:', accounts[0].username);\n this.auth.instance.setActiveAccount(accounts[0]);\n this.updateAuthState(true);\n\n // Update user info from cached account\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (cached session restored)');\n } else {\n console.debug('[MSAL] No cached accounts, user needs to log in');\n }\n }\n\n // Subscribe to broadcast service for ongoing auth state changes\n this.msalBroadcastService.inProgress$\n .pipe(\n filter((status: InteractionStatus) => status === InteractionStatus.None),\n takeUntil(this._destroying$)\n )\n .subscribe(() => {\n const accounts = this.auth.instance.getAllAccounts();\n const isAuth = accounts.length > 0;\n\n this.updateAuthState(isAuth);\n\n if (isAuth) {\n this.auth.instance.setActiveAccount(accounts[0]);\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n } else {\n this.updateUserInfo(null);\n }\n\n this._initializationCompleted$.next(true);\n });\n }\n\n protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n await this.ensureInitialized();\n\n const silentRequest = {\n scopes: ['User.Read', 'email', 'profile'],\n ...options\n };\n\n return new Promise((resolve, reject) => {\n this.auth.loginRedirect(silentRequest).subscribe({\n next: () => {\n resolve();\n },\n error: (error) => {\n LogError(error);\n reject(error);\n }\n });\n });\n }\n\n protected async logoutInternal(): Promise<void> {\n await this.ensureInitialized();\n this.auth.logoutRedirect().subscribe(() => {\n // Logout will trigger a redirect\n });\n }\n\n async handleCallback(): Promise<void> {\n // MSAL Angular handles callbacks internally through its broadcast service\n // The handleRedirectPromise is called in initialize()\n await this.ensureInitialized();\n }\n\n // ============================================================================\n // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n // ============================================================================\n\n /**\n * Extract ID token from MSAL's storage\n *\n * MSAL stores the JWT in AuthenticationResult.idToken\n * This is the key abstraction - consumers never need to know about MSAL's structure!\n */\n protected async extractIdTokenInternal(): Promise<string | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // First try to get cached token from account\n // This avoids unnecessary iframe calls that can timeout\n if (account.idToken) {\n // Check if token is expired or about to expire (within 5-minute buffer)\n // This prevents the race condition where proactive refresh hasn't completed\n // but the cached token is already expired\n if (this.isTokenValid(account.idToken, 300)) {\n return account.idToken;\n }\n\n // Token expired or near-expiry — force a silent refresh\n console.debug('[MSAL] Cached token expired or near-expiry, forcing silent refresh');\n try {\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n return response.idToken || null;\n } catch (refreshError) {\n console.warn('[MSAL] Silent refresh failed, returning expired cached token:', refreshError);\n // Fall through to existing cache-only acquisition below\n }\n }\n\n // If not in account, try silent token acquisition from cache only\n // Use CacheLookupPolicy.AccessToken to avoid iframe calls\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n // MSAL-specific detail: JWT is in idToken property\n return response.idToken || null;\n } catch (error) {\n console.error('[MSAL] Error extracting ID token:', error);\n return null;\n }\n }\n\n /**\n * Extract complete token info from MSAL\n *\n * Maps MSAL's AuthenticationResult to StandardAuthToken\n */\n protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Use cache-only lookup to avoid iframe timeouts during normal token extraction\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n if (!response.idToken) {\n return null;\n }\n\n return {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n } catch (error) {\n // If acquireTokenSilent fails (e.g., iframe timeout), try to use cached account data\n console.error('[MSAL] Error extracting token info:', error);\n\n const account = this.auth.instance.getActiveAccount();\n if (account?.idToken) {\n // Return basic token info from account if available\n return {\n idToken: account.idToken,\n expiresAt: 0, // Unknown from account alone\n scopes: []\n };\n }\n\n return null;\n }\n }\n\n /**\n * Extract user info from MSAL account\n *\n * Maps MSAL's AccountInfo structure to StandardUserInfo\n */\n protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n return this.mapMSALAccountToStandard(account);\n } catch (error) {\n console.error('[MSAL] Error extracting user info:', error);\n return null;\n }\n }\n\n /**\n * Refresh token using MSAL's silent token acquisition\n *\n * MSAL 5.x Best Practices:\n * - Pass account parameter for reliable silent acquisition\n * - Use forceRefresh: true to bypass cache and get fresh tokens from Azure AD\n * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)\n *\n * IMPORTANT: This method is called when the server has already rejected the current\n * token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a\n * cached ID token that is still expired (e.g. when the access token has a longer\n * lifetime than the ID token). forceRefresh: true ensures a network round-trip to\n * Azure AD so both the access token and ID token are genuinely refreshed.\n */\n protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'No active account found',\n userMessage: 'You need to log in to continue.'\n }\n };\n }\n\n // MSAL 5.x: Pass account for reliable silent acquisition\n // Use forceRefresh to bypass cache and ensure a network round-trip.\n // This is critical because this method is called after the server rejected\n // the current token — returning a cached (potentially stale) ID token would\n // cause the retry to fail with the same JWT_EXPIRED error.\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n\n if (!response.idToken) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'Token refresh succeeded but no ID token returned',\n userMessage: 'Session refresh failed. Please log in again.'\n }\n };\n }\n\n // Safety net: verify the refreshed token is actually valid.\n // This should always pass after a forced refresh, but guards against\n // edge cases like severe clock skew between client and Azure AD.\n if (!this.isTokenValid(response.idToken)) {\n console.warn('[MSAL] Forced refresh returned an expired ID token — requesting interaction');\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: 'Token refresh returned an expired ID token',\n userMessage: 'Your session has expired. Redirecting to login...'\n }\n };\n }\n\n const token: StandardAuthToken = {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n\n return {\n success: true,\n token\n };\n } catch (error) {\n console.error('[MSAL] Token refresh failed:', error);\n\n // Handle MSAL 5.x error codes that require user interaction\n // - timed_out: MSAL 5.x iframe timeout (replaces monitor_window_timeout from 3.x)\n // - monitor_window_timeout: Legacy MSAL 3.x iframe timeout\n // - no_tokens_found: No cached tokens available\n // - no_account_error: Account not found in cache\n // - InteractionRequiredAuthError: Server requires user interaction\n const errorCode = (error as Record<string, unknown>)?.errorCode as string | undefined;\n const interactionRequiredCodes = [\n 'monitor_window_timeout',\n 'timed_out',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required',\n 'token_refresh_required' // ClientAuthError when cached token needs refresh\n ];\n\n if (interactionRequiredCodes.includes(errorCode || '') || error instanceof InteractionRequiredAuthError) {\n // Return INTERACTION_REQUIRED error - base class will call handleSessionExpiryInternal\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: `Silent token refresh failed - interaction required (${errorCode || 'unknown'})`,\n userMessage: 'Your session has expired. Redirecting to login...',\n originalError: error\n }\n };\n }\n\n return {\n success: false,\n error: this.classifyErrorInternal(error)\n };\n }\n }\n\n /**\n * Classify MSAL-specific errors into semantic types\n *\n * Maps MSAL error classes to AuthErrorType enum.\n * Updated for MSAL 5.x error codes.\n */\n protected classifyErrorInternal(error: unknown): StandardAuthError {\n const errorObj = error as Record<string, unknown>;\n const message = errorObj?.['message'] as string || 'Unknown error';\n const errorCode = errorObj?.['errorCode'] as string || '';\n\n // Check for specific MSAL error types\n if (error instanceof InteractionRequiredAuthError) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Additional authentication is required. Please log in again.'\n };\n }\n\n // ClientAuthError — covers codes like token_refresh_required that are not\n // surfaced through BrowserAuthError or InteractionRequiredAuthError.\n if (error instanceof ClientAuthError) {\n if (errorCode === 'token_refresh_required') {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (error instanceof BrowserAuthError) {\n // Check specific error codes - MSAL 5.x codes\n if (errorCode === 'user_cancelled' || message.includes('user cancelled')) {\n return {\n type: AuthErrorType.USER_CANCELLED,\n message,\n originalError: error,\n userMessage: 'Login was cancelled.'\n };\n }\n\n // MSAL 5.x timeout and session errors that require interaction\n const interactionRequiredCodes = [\n 'timed_out',\n 'monitor_window_timeout',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required'\n ];\n if (interactionRequiredCodes.includes(errorCode)) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message,\n originalError: error,\n userMessage: 'Authentication error. Please log in again.'\n };\n }\n\n // Check message patterns\n if (message.includes('token') && message.includes('expired')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (message.includes('network') || message.includes('fetch')) {\n return {\n type: AuthErrorType.NETWORK_ERROR,\n message,\n originalError: error,\n userMessage: 'Network error. Please check your connection and try again.'\n };\n }\n\n if (message.includes('you need to be authorized')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n // Default to unknown error\n return {\n type: AuthErrorType.UNKNOWN_ERROR,\n message,\n originalError: error,\n userMessage: 'An unexpected error occurred. Please try again.'\n };\n }\n\n // ============================================================================\n // HELPER METHODS\n // ============================================================================\n\n private async ensureInitialized(): Promise<void> {\n if (!this._initPromise) {\n await this.initialize();\n } else if (!this._initializationCompleted$.value) {\n await this._initPromise;\n }\n }\n\n /**\n * Check if a JWT token is still valid with an optional buffer period.\n * Decodes the payload to read the `exp` claim without cryptographic verification\n * (expiry is a timing check, not an authenticity check).\n *\n * @param token - The JWT string to check\n * @param bufferSeconds - Number of seconds before actual expiry to consider the token invalid (default: 0)\n * @returns true if the token's exp claim is beyond (now + buffer), false otherwise\n */\n private isTokenValid(token: string, bufferSeconds: number = 0): boolean {\n try {\n const parts = token.split('.');\n if (parts.length !== 3) {\n return false;\n }\n const payload = JSON.parse(atob(parts[1])) as { exp?: number };\n const expiresAtMs = (payload.exp ?? 0) * 1000;\n return expiresAtMs > Date.now() + (bufferSeconds * 1000);\n } catch {\n // If we can't decode the token, treat it as invalid\n return false;\n }\n }\n\n /**\n * Map MSAL AccountInfo to StandardUserInfo\n */\n private mapMSALAccountToStandard(account: AccountInfo): StandardUserInfo {\n return {\n id: account.localAccountId || account.homeAccountId,\n email: account.username || '',\n name: account.name || account.username || '',\n givenName: account.idTokenClaims?.['given_name'] as string,\n familyName: account.idTokenClaims?.['family_name'] as string,\n preferredUsername: account.username,\n emailVerified: true // MSAL doesn't provide this, assume true\n };\n }\n\n /**\n * Get profile picture URL from Microsoft Graph API\n *\n * MSAL requires fetching the photo from Microsoft Graph.\n * This is the key advantage of encapsulation - consumers don't need\n * to know about Graph API, they just call getProfilePictureUrl()!\n */\n protected async getProfilePictureUrlInternal(): Promise<string | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Get access token for Microsoft Graph\n const response = await this.auth.instance.acquireTokenSilent({\n scopes: ['User.Read'],\n account: account,\n forceRefresh: false\n });\n\n if (!response.accessToken) {\n return null;\n }\n\n // Fetch photo from Microsoft Graph\n const graphResponse = await fetch('https://graph.microsoft.com/v1.0/me/photo/$value', {\n headers: { 'Authorization': `Bearer ${response.accessToken}` }\n });\n\n if (graphResponse.ok) {\n const blob = await graphResponse.blob();\n return URL.createObjectURL(blob);\n }\n\n return null;\n } catch (error) {\n console.error('[MSAL] Error getting profile picture:', error);\n return null;\n }\n }\n\n /**\n * Handle session expiry by redirecting to Microsoft login\n *\n * This method is called by the base class when silent token refresh fails\n * with INTERACTION_REQUIRED error. It redirects to Microsoft login and never returns.\n * After authentication, the app will reload and re-initialize with a fresh token.\n */\n protected async handleSessionExpiryInternal(): Promise<void> {\n console.debug('[MSAL] Redirecting to Microsoft login for re-authentication...');\n\n // Initiate redirect authentication - page will navigate away\n this.auth.loginRedirect({\n scopes: ['User.Read', 'email', 'profile'],\n prompt: 'select_account'\n }).subscribe({\n error: (redirectError) => {\n console.error('[MSAL] Redirect initiation failed:', redirectError);\n }\n });\n\n // Return a promise that never resolves - page will navigate before this matters\n return new Promise<void>(() => {});\n }\n\n // ============================================================================\n // CONFIGURATION\n // ============================================================================\n\n override getRequiredConfig(): string[] {\n return ['clientId', 'tenantId'];\n }\n\n override validateConfig(_config: Record<string, unknown>): boolean {\n // MSAL configuration is handled by Angular module providers\n return true;\n }\n\n // ============================================================================\n // CLEANUP\n // ============================================================================\n\n ngOnDestroy(): void {\n this._destroying$.next();\n this._destroying$.complete();\n this._initPromise = null;\n this._initializationCompleted$.complete();\n }\n}"]}
1
+ {"version":3,"file":"mjexplorer-msal-provider.service.js","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-msal-provider.service.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAc,OAAO,EAAc,MAAM,EAA6B,SAAS,EAAQ,MAAM,MAAM,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9I,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtL,OAAO,EAAE,QAAQ,EAA+B,MAAM,sBAAsB,CAAC;AAE7E,OAAO,EAIL,aAAa,EAEd,MAAM,eAAe,CAAC;;;AACvB;;;;;;GAMG;AAKI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,UAAU;;IAyFzB;IAA2B;IAxF9C,MAAM,CAAU,aAAa,GAAG,MAAM,CAAC;IAC9B,IAAI,GAAG,gBAAc,CAAC,aAAa,CAAC;IAE5B,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACnC,yBAAyB,GAAG,IAAI,eAAe,CAAU,KAAK,CAAC,CAAC;IACzE,YAAY,GAAyB,IAAI,CAAC;IAElD;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAG,CAAC,WAAoC,EAAE,EAAE,CAAC;QACxE;YACE,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,IAAI,uBAAuB,CAAC;gBACpC,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAW;oBAC5C,SAAS,EAAE,WAAW,CAAC,kBAAkB,CAAW;oBACpD,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;iBACpC;gBACD,KAAK,EAAE;oBACL,aAAa,EAAE,cAAc;iBAC9B;aACF,CAAC;SACH;QACD;YACE,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,WAAW,EAAE;oBACX,MAAM,EAAE,CAAC,WAAW,CAAC;iBACtB;aACF;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE;gBACR,eAAe,EAAE,eAAe,CAAC,QAAQ;gBACzC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;aACxF;SACF;QACD,WAAW;QACX,SAAS;QACT,oBAAoB;KACrB,CAAC;IAEF,sDAAsD;IACtD,MAAM,KAAK,sBAAsB;QAC/B,OAAO,IAAI,CAAC,sBAAsB,CAAC;IACrC,CAAC;IACD,sDAAsD;IACtD,MAAM,KAAK,sBAAsB,CAAC,KAAK;QACrC,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAA4B;QACxD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAE5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,SAAS,GACb,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC;YACvE,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;QAC1C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAmB,IAAiB,EAAU,oBAA0C;QACtF,MAAM,MAAM,GAA8B;YACxC,IAAI,EAAE,gBAAc,CAAC,aAAa;YAClC,IAAI,EAAE,gBAAc,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,CAAC;QALG,SAAI,GAAJ,IAAI,CAAa;QAAU,yBAAoB,GAApB,oBAAoB,CAAsB;IAMxF,CAAC;IAED,oCAAoC;IACpC,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,oCAAoC;IACpC,IAAW,IAAI,CAAC,KAAkB;QAChC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,+EAA+E;IAC/E,oBAAoB;IACpB,+EAA+E;IAE/E,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAElD,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACjD,mCAAmC;YACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAE3B,gCAAgC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAE3B,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAE9B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,oBAAoB,CAAC,WAAW;aAClC,IAAI,CACH,MAAM,CAAC,CAAC,MAAyB,EAAE,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI,CAAC,EACxE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAC7B;aACA,SAAS,CAAC,GAAG,EAAE;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAEnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAiC;QAC7D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,GAAG,EAAE;oBACT,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,iCAAiC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;;;;OAKG;IACO,KAAK,CAAC,sBAAsB;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6CAA6C;YAC7C,wDAAwD;YACxD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,4EAA4E;gBAC5E,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACzB,CAAC;gBAED,wDAAwD;gBACxD,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;wBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;wBACzC,OAAO,EAAE,OAAO;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;gBAClC,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,YAAY,CAAC,CAAC;oBAC5F,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,mDAAmD;YACnD,OAAO,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,wBAAwB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,iBAAiB,EAAE,iBAAiB,CAAC,WAAW;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,oDAAoD;gBACpD,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,SAAS,EAAE,CAAC,EAAE,6BAA6B;oBAC3C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,uBAAuB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,KAAK,CAAC,oBAAoB;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,yBAAyB;wBAClC,WAAW,EAAE,iCAAiC;qBAC/C;iBACF,CAAC;YACJ,CAAC;YAED,yDAAyD;YACzD,oEAAoE;YACpE,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;gBACzC,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;wBACrC,OAAO,EAAE,kDAAkD;wBAC3D,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;gBAC5F,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,4CAA4C;wBACrD,WAAW,EAAE,mDAAmD;qBACjE;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAsB;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAErD,4DAA4D;YAC5D,kFAAkF;YAClF,2DAA2D;YAC3D,gDAAgD;YAChD,iDAAiD;YACjD,mEAAmE;YACnE,MAAM,SAAS,GAAI,KAAiC,EAAE,SAA+B,CAAC;YACtF,MAAM,wBAAwB,GAAG;gBAC/B,wBAAwB;gBACxB,WAAW;gBACX,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;gBAClB,wBAAwB,CAAE,kDAAkD;aAC7E,CAAC;YAEF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBACxG,uFAAuF;gBACvF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;wBACxC,OAAO,EAAE,uDAAuD,SAAS,IAAI,SAAS,GAAG;wBACzF,WAAW,EAAE,mDAAmD;wBAChE,aAAa,EAAE,KAAK;qBACrB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACO,qBAAqB,CAAC,KAAc;QAC5C,MAAM,QAAQ,GAAG,KAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,SAAS,CAAW,IAAI,eAAe,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAW,IAAI,EAAE,CAAC;QAE1D,sCAAsC;QACtC,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;gBACxC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,6DAA6D;aAC3E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,wBAAwB,EAAE,CAAC;gBAC3C,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,8CAA8C;YAC9C,IAAI,SAAS,KAAK,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,cAAc;oBAClC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,sBAAsB;iBACpC,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,MAAM,wBAAwB,GAAG;gBAC/B,WAAW;gBACX,wBAAwB;gBACxB,iBAAiB;gBACjB,kBAAkB;gBAClB,gBAAgB;gBAChB,kBAAkB;aACnB,CAAC;YACF,IAAI,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACL,IAAI,EAAE,aAAa,CAAC,oBAAoB;oBACxC,OAAO;oBACP,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,gDAAgD;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,iBAAiB;gBACrC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4CAA4C;aAC1D,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,4DAA4D;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,aAAa,CAAC,aAAa;gBACjC,OAAO;gBACP,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,gDAAgD;aAC9D,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,aAAa;YACjC,OAAO;YACP,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,iDAAiD;SAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAEvE,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,KAAa,EAAE,gBAAwB,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC;YAC/D,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAoB;QACnD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa;YACnD,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC5C,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,YAAY,CAAW;YAC1D,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,aAAa,CAAW;YAC5D,iBAAiB,EAAE,OAAO,CAAC,QAAQ;YACnC,aAAa,EAAE,IAAI,CAAC,yCAAyC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,4BAA4B;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uCAAuC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAC3D,MAAM,EAAE,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;gBACpF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,QAAQ,CAAC,WAAW,EAAE,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,2BAA2B;QACzC,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAEhF,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC,SAAS,CAAC;YACX,KAAK,EAAE,CAAC,aAAa,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,gFAAgF;QAChF,OAAO,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,+EAA+E;IAEtE,iBAAiB;QACxB,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAEQ,cAAc,CAAC,OAAgC;QACtD,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAE/E,WAAW;QACT,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;wGAntBU,cAAc;gEAAd,cAAc,WAAd,cAAc,mBAHb,MAAM;;AAGP,cAAc;IAD1B,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC;GACrB,cAAc,CAotB1B;;iFAptBY,cAAc;cAJ1B,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB","sourcesContent":["import { Injectable, OnDestroy } from '@angular/core';\nimport { RegisterClass } from '@memberjunction/global';\nimport { MJAuthBase } from '../mjexplorer-auth-base.service';\nimport { BehaviorSubject, Observable, Subject, catchError, filter, from, map, of, throwError, takeUntil, take } from 'rxjs';\nimport { MsalBroadcastService, MsalService, MSAL_INSTANCE, MSAL_GUARD_CONFIG, MSAL_INTERCEPTOR_CONFIG, MsalGuard } from '@azure/msal-angular';\nimport { AccountInfo, AuthenticationResult } from '@azure/msal-common';\nimport { CacheLookupPolicy, ClientAuthError, InteractionRequiredAuthError, InteractionStatus, PublicClientApplication, InteractionType, BrowserAuthError } from '@azure/msal-browser';\nimport { LogError, type PublicAuthProviderInfo } from '@memberjunction/core';\nimport { AngularAuthProviderConfig } from '../IAuthProvider';\nimport {\n StandardUserInfo,\n StandardAuthToken,\n StandardAuthError,\n AuthErrorType,\n TokenRefreshResult\n} from '../auth-types';\n/**\n * MSAL (Microsoft Authentication Library) provider implementation - v3.0.0\n *\n * Implements the abstract methods from MJAuthBase to hide MSAL-specific details.\n * The key abstraction is that MSAL stores the JWT in AuthenticationResult.idToken,\n * but consumers never need to know this detail.\n */\n@Injectable({\n providedIn: 'root'\n})\n@RegisterClass(MJAuthBase, 'msal')\nexport class MJMSALProvider extends MJAuthBase implements OnDestroy {\n static readonly PROVIDER_TYPE = 'msal';\n readonly type = MJMSALProvider.PROVIDER_TYPE;\n\n private readonly _destroying$ = new Subject<void>();\n private readonly _initializationCompleted$ = new BehaviorSubject<boolean>(false);\n private _initPromise: Promise<void> | null = null;\n\n /**\n * Factory function to provide Angular dependencies required by MSAL\n * Stored as a static property for the factory to access without instantiation\n */\n static AngularProviderFactory = (environment: Record<string, unknown>) => [\n {\n provide: MSAL_INSTANCE,\n useValue: new PublicClientApplication({\n auth: {\n clientId: environment['CLIENT_ID'] as string,\n authority: environment['CLIENT_AUTHORITY'] as string,\n redirectUri: window.location.origin,\n },\n cache: {\n cacheLocation: 'localStorage',\n },\n }),\n },\n {\n provide: MSAL_GUARD_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n authRequest: {\n scopes: ['User.Read'],\n },\n },\n },\n {\n provide: MSAL_INTERCEPTOR_CONFIG,\n useValue: {\n interactionType: InteractionType.Redirect,\n protectedResourceMap: new Map([['https://graph.microsoft.com/v1.0/me', ['user.read']]]),\n },\n },\n MsalService,\n MsalGuard,\n MsalBroadcastService\n ];\n\n /** @deprecated Use {@link AngularProviderFactory}. */\n static get angularProviderFactory() {\n return this.AngularProviderFactory;\n }\n /** @deprecated Use {@link AngularProviderFactory}. */\n static set angularProviderFactory(value) {\n this.AngularProviderFactory = value;\n }\n\n /**\n * Maps a catalog row onto the unprefixed keys `angularProviderFactory` reads (`CLIENT_ID` /\n * `CLIENT_AUTHORITY`), which predate the `<DRIVER>_*` convention the generic overlay emits —\n * without this mapping a metadata-configured row would be silently ignored in favour of the\n * compiled environment.\n *\n * The authority comes from `ClientConfiguration.authority` when the row supplies one; otherwise\n * it is derived from the Issuer by stripping the trailing `/v2.0` — an Entra issuer is\n * `https://login.microsoftonline.com/<tenantId>/v2.0`, and MSAL's authority is that same URL\n * without the version suffix. That derivation only holds for standard Entra tenants: rows for\n * Azure AD B2C or v1 `sts.windows.net` issuers must set `ClientConfiguration.authority`\n * explicitly, because their issuer is not a usable authority (and B2C additionally needs\n * `knownAuthorities`, which this driver does not yet plumb).\n */\n static EnvironmentFromCatalog(info: PublicAuthProviderInfo): Record<string, unknown> {\n const overlay: Record<string, unknown> = {};\n\n if (info.clientId) {\n overlay['CLIENT_ID'] = info.clientId;\n }\n\n const configuredAuthority = info.clientConfiguration?.['authority'];\n const authority =\n typeof configuredAuthority === 'string' && configuredAuthority.length > 0\n ? configuredAuthority\n : info.issuer?.replace(/\\/v2\\.0\\/?$/, '');\n if (authority) {\n overlay['CLIENT_AUTHORITY'] = authority;\n }\n\n return overlay;\n }\n\n constructor(public Auth: MsalService, private msalBroadcastService: MsalBroadcastService) {\n const config: AngularAuthProviderConfig = {\n name: MJMSALProvider.PROVIDER_TYPE,\n type: MJMSALProvider.PROVIDER_TYPE\n };\n super(config);\n }\n\n /** @deprecated Use {@link Auth}. */\n public get auth(): MsalService {\n return this.Auth;\n }\n /** @deprecated Use {@link Auth}. */\n public set auth(value: MsalService) {\n this.Auth = value;\n }\n\n // ============================================================================\n // LIFECYCLE METHODS\n // ============================================================================\n\n async initialize(): Promise<void> {\n if (this._initPromise) {\n return this._initPromise;\n }\n\n this._initPromise = this._performInitialization();\n return this._initPromise;\n }\n\n private async _performInitialization(): Promise<void> {\n console.debug('[MSAL] Starting initialization...');\n await this.Auth.instance.initialize();\n console.debug('[MSAL] MSAL instance initialized');\n\n // Handle redirect immediately after initialization\n const redirectResponse = await this.Auth.instance.handleRedirectPromise();\n console.debug('[MSAL] Redirect response:', redirectResponse ? 'Found' : 'None');\n\n if (redirectResponse && redirectResponse.account) {\n // User just logged in via redirect\n console.debug('[MSAL] Processing redirect login');\n this.Auth.instance.setActiveAccount(redirectResponse.account);\n this.updateAuthState(true);\n\n // Update user info from account\n const userInfo = this.mapMSALAccountToStandard(redirectResponse.account);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (redirect login)');\n } else {\n // Set active account if we have one from cache\n const accounts = this.Auth.instance.getAllAccounts();\n console.debug('[MSAL] Cached accounts found:', accounts.length);\n\n if (accounts.length > 0) {\n console.debug('[MSAL] Restoring session from cached account:', accounts[0].username);\n this.Auth.instance.setActiveAccount(accounts[0]);\n this.updateAuthState(true);\n\n // Update user info from cached account\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n\n this._initializationCompleted$.next(true);\n console.debug('[MSAL] Initialization completed (cached session restored)');\n } else {\n console.debug('[MSAL] No cached accounts, user needs to log in');\n }\n }\n\n // Subscribe to broadcast service for ongoing auth state changes\n this.msalBroadcastService.inProgress$\n .pipe(\n filter((status: InteractionStatus) => status === InteractionStatus.None),\n takeUntil(this._destroying$)\n )\n .subscribe(() => {\n const accounts = this.Auth.instance.getAllAccounts();\n const isAuth = accounts.length > 0;\n\n this.updateAuthState(isAuth);\n\n if (isAuth) {\n this.Auth.instance.setActiveAccount(accounts[0]);\n const userInfo = this.mapMSALAccountToStandard(accounts[0]);\n this.updateUserInfo(userInfo);\n } else {\n this.updateUserInfo(null);\n }\n\n this._initializationCompleted$.next(true);\n });\n }\n\n protected async loginInternal(options?: Record<string, unknown>): Promise<void> {\n await this.ensureInitialized();\n\n const silentRequest = {\n scopes: ['User.Read', 'email', 'profile'],\n ...options\n };\n\n return new Promise((resolve, reject) => {\n this.Auth.loginRedirect(silentRequest).subscribe({\n next: () => {\n resolve();\n },\n error: (error) => {\n LogError(error);\n reject(error);\n }\n });\n });\n }\n\n protected async logoutInternal(): Promise<void> {\n await this.ensureInitialized();\n this.Auth.logoutRedirect().subscribe(() => {\n // Logout will trigger a redirect\n });\n }\n\n async handleCallback(): Promise<void> {\n // MSAL Angular handles callbacks internally through its broadcast service\n // The handleRedirectPromise is called in initialize()\n await this.ensureInitialized();\n }\n\n // ============================================================================\n // ABSTRACT METHOD IMPLEMENTATIONS (v3.0.0)\n // ============================================================================\n\n /**\n * Extract ID token from MSAL's storage\n *\n * MSAL stores the JWT in AuthenticationResult.idToken\n * This is the key abstraction - consumers never need to know about MSAL's structure!\n */\n protected async extractIdTokenInternal(): Promise<string | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.Auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // First try to get cached token from account\n // This avoids unnecessary iframe calls that can timeout\n if (account.idToken) {\n // Check if token is expired or about to expire (within 5-minute buffer)\n // This prevents the race condition where proactive refresh hasn't completed\n // but the cached token is already expired\n if (this.isTokenValid(account.idToken, 300)) {\n return account.idToken;\n }\n\n // Token expired or near-expiry — force a silent refresh\n console.debug('[MSAL] Cached token expired or near-expiry, forcing silent refresh');\n try {\n const response = await this.Auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n return response.idToken || null;\n } catch (refreshError) {\n console.warn('[MSAL] Silent refresh failed, returning expired cached token:', refreshError);\n // Fall through to existing cache-only acquisition below\n }\n }\n\n // If not in account, try silent token acquisition from cache only\n // Use CacheLookupPolicy.AccessToken to avoid iframe calls\n const response = await this.Auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n // MSAL-specific detail: JWT is in idToken property\n return response.idToken || null;\n } catch (error) {\n console.error('[MSAL] Error extracting ID token:', error);\n return null;\n }\n }\n\n /**\n * Extract complete token info from MSAL\n *\n * Maps MSAL's AuthenticationResult to StandardAuthToken\n */\n protected async extractTokenInfoInternal(): Promise<StandardAuthToken | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.Auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Use cache-only lookup to avoid iframe timeouts during normal token extraction\n const response = await this.Auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n cacheLookupPolicy: CacheLookupPolicy.AccessToken\n });\n\n if (!response.idToken) {\n return null;\n }\n\n return {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n } catch (error) {\n // If acquireTokenSilent fails (e.g., iframe timeout), try to use cached account data\n console.error('[MSAL] Error extracting token info:', error);\n\n const account = this.Auth.instance.getActiveAccount();\n if (account?.idToken) {\n // Return basic token info from account if available\n return {\n idToken: account.idToken,\n expiresAt: 0, // Unknown from account alone\n scopes: []\n };\n }\n\n return null;\n }\n }\n\n /**\n * Extract user info from MSAL account\n *\n * Maps MSAL's AccountInfo structure to StandardUserInfo\n */\n protected async extractUserInfoInternal(): Promise<StandardUserInfo | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.Auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n return this.mapMSALAccountToStandard(account);\n } catch (error) {\n console.error('[MSAL] Error extracting user info:', error);\n return null;\n }\n }\n\n /**\n * Refresh token using MSAL's silent token acquisition\n *\n * MSAL 5.x Best Practices:\n * - Pass account parameter for reliable silent acquisition\n * - Use forceRefresh: true to bypass cache and get fresh tokens from Azure AD\n * - Handle MSAL 5.x specific error codes (timed_out, no_tokens_found, etc.)\n *\n * IMPORTANT: This method is called when the server has already rejected the current\n * token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a\n * cached ID token that is still expired (e.g. when the access token has a longer\n * lifetime than the ID token). forceRefresh: true ensures a network round-trip to\n * Azure AD so both the access token and ID token are genuinely refreshed.\n */\n protected async refreshTokenInternal(): Promise<TokenRefreshResult> {\n try {\n await this.ensureInitialized();\n\n const account = this.Auth.instance.getActiveAccount();\n if (!account) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'No active account found',\n userMessage: 'You need to log in to continue.'\n }\n };\n }\n\n // MSAL 5.x: Pass account for reliable silent acquisition\n // Use forceRefresh to bypass cache and ensure a network round-trip.\n // This is critical because this method is called after the server rejected\n // the current token — returning a cached (potentially stale) ID token would\n // cause the retry to fail with the same JWT_EXPIRED error.\n const response = await this.Auth.instance.acquireTokenSilent({\n scopes: ['User.Read', 'email', 'profile'],\n account: account,\n forceRefresh: true\n });\n\n if (!response.idToken) {\n return {\n success: false,\n error: {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message: 'Token refresh succeeded but no ID token returned',\n userMessage: 'Session refresh failed. Please log in again.'\n }\n };\n }\n\n // Safety net: verify the refreshed token is actually valid.\n // This should always pass after a forced refresh, but guards against\n // edge cases like severe clock skew between client and Azure AD.\n if (!this.isTokenValid(response.idToken)) {\n console.warn('[MSAL] Forced refresh returned an expired ID token — requesting interaction');\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: 'Token refresh returned an expired ID token',\n userMessage: 'Your session has expired. Redirecting to login...'\n }\n };\n }\n\n const token: StandardAuthToken = {\n idToken: response.idToken,\n accessToken: response.accessToken,\n expiresAt: response.expiresOn ? response.expiresOn.getTime() : 0,\n scopes: response.scopes\n };\n\n return {\n success: true,\n token\n };\n } catch (error) {\n console.error('[MSAL] Token refresh failed:', error);\n\n // Handle MSAL 5.x error codes that require user interaction\n // - timed_out: MSAL 5.x iframe timeout (replaces monitor_window_timeout from 3.x)\n // - monitor_window_timeout: Legacy MSAL 3.x iframe timeout\n // - no_tokens_found: No cached tokens available\n // - no_account_error: Account not found in cache\n // - InteractionRequiredAuthError: Server requires user interaction\n const errorCode = (error as Record<string, unknown>)?.errorCode as string | undefined;\n const interactionRequiredCodes = [\n 'monitor_window_timeout',\n 'timed_out',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required',\n 'token_refresh_required' // ClientAuthError when cached token needs refresh\n ];\n\n if (interactionRequiredCodes.includes(errorCode || '') || error instanceof InteractionRequiredAuthError) {\n // Return INTERACTION_REQUIRED error - base class will call handleSessionExpiryInternal\n return {\n success: false,\n error: {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message: `Silent token refresh failed - interaction required (${errorCode || 'unknown'})`,\n userMessage: 'Your session has expired. Redirecting to login...',\n originalError: error\n }\n };\n }\n\n return {\n success: false,\n error: this.classifyErrorInternal(error)\n };\n }\n }\n\n /**\n * Classify MSAL-specific errors into semantic types\n *\n * Maps MSAL error classes to AuthErrorType enum.\n * Updated for MSAL 5.x error codes.\n */\n protected classifyErrorInternal(error: unknown): StandardAuthError {\n const errorObj = error as Record<string, unknown>;\n const message = errorObj?.['message'] as string || 'Unknown error';\n const errorCode = errorObj?.['errorCode'] as string || '';\n\n // Check for specific MSAL error types\n if (error instanceof InteractionRequiredAuthError) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Additional authentication is required. Please log in again.'\n };\n }\n\n // ClientAuthError — covers codes like token_refresh_required that are not\n // surfaced through BrowserAuthError or InteractionRequiredAuthError.\n if (error instanceof ClientAuthError) {\n if (errorCode === 'token_refresh_required') {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (error instanceof BrowserAuthError) {\n // Check specific error codes - MSAL 5.x codes\n if (errorCode === 'user_cancelled' || message.includes('user cancelled')) {\n return {\n type: AuthErrorType.USER_CANCELLED,\n message,\n originalError: error,\n userMessage: 'Login was cancelled.'\n };\n }\n\n // MSAL 5.x timeout and session errors that require interaction\n const interactionRequiredCodes = [\n 'timed_out',\n 'monitor_window_timeout',\n 'no_tokens_found',\n 'no_account_error',\n 'login_required',\n 'consent_required'\n ];\n if (interactionRequiredCodes.includes(errorCode)) {\n return {\n type: AuthErrorType.INTERACTION_REQUIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n return {\n type: AuthErrorType.NO_ACTIVE_SESSION,\n message,\n originalError: error,\n userMessage: 'Authentication error. Please log in again.'\n };\n }\n\n // Check message patterns\n if (message.includes('token') && message.includes('expired')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n if (message.includes('network') || message.includes('fetch')) {\n return {\n type: AuthErrorType.NETWORK_ERROR,\n message,\n originalError: error,\n userMessage: 'Network error. Please check your connection and try again.'\n };\n }\n\n if (message.includes('you need to be authorized')) {\n return {\n type: AuthErrorType.TOKEN_EXPIRED,\n message,\n originalError: error,\n userMessage: 'Your session has expired. Please log in again.'\n };\n }\n\n // Default to unknown error\n return {\n type: AuthErrorType.UNKNOWN_ERROR,\n message,\n originalError: error,\n userMessage: 'An unexpected error occurred. Please try again.'\n };\n }\n\n // ============================================================================\n // HELPER METHODS\n // ============================================================================\n\n private async ensureInitialized(): Promise<void> {\n if (!this._initPromise) {\n await this.initialize();\n } else if (!this._initializationCompleted$.value) {\n await this._initPromise;\n }\n }\n\n /**\n * Check if a JWT token is still valid with an optional buffer period.\n * Decodes the payload to read the `exp` claim without cryptographic verification\n * (expiry is a timing check, not an authenticity check).\n *\n * @param token - The JWT string to check\n * @param bufferSeconds - Number of seconds before actual expiry to consider the token invalid (default: 0)\n * @returns true if the token's exp claim is beyond (now + buffer), false otherwise\n */\n private isTokenValid(token: string, bufferSeconds: number = 0): boolean {\n try {\n const parts = token.split('.');\n if (parts.length !== 3) {\n return false;\n }\n const payload = JSON.parse(atob(parts[1])) as { exp?: number };\n const expiresAtMs = (payload.exp ?? 0) * 1000;\n return expiresAtMs > Date.now() + (bufferSeconds * 1000);\n } catch {\n // If we can't decode the token, treat it as invalid\n return false;\n }\n }\n\n /**\n * Map MSAL AccountInfo to StandardUserInfo\n */\n private mapMSALAccountToStandard(account: AccountInfo): StandardUserInfo {\n return {\n id: account.localAccountId || account.homeAccountId,\n email: account.username || '',\n name: account.name || account.username || '',\n givenName: account.idTokenClaims?.['given_name'] as string,\n familyName: account.idTokenClaims?.['family_name'] as string,\n preferredUsername: account.username,\n emailVerified: true // MSAL doesn't provide this, assume true\n };\n }\n\n /**\n * Get profile picture URL from Microsoft Graph API\n *\n * MSAL requires fetching the photo from Microsoft Graph.\n * This is the key advantage of encapsulation - consumers don't need\n * to know about Graph API, they just call getProfilePictureUrl()!\n */\n protected async getProfilePictureUrlInternal(): Promise<string | null> {\n try {\n await this.ensureInitialized();\n\n const account = this.Auth.instance.getActiveAccount();\n if (!account) {\n return null;\n }\n\n // Get access token for Microsoft Graph\n const response = await this.Auth.instance.acquireTokenSilent({\n scopes: ['User.Read'],\n account: account,\n forceRefresh: false\n });\n\n if (!response.accessToken) {\n return null;\n }\n\n // Fetch photo from Microsoft Graph\n const graphResponse = await fetch('https://graph.microsoft.com/v1.0/me/photo/$value', {\n headers: { 'Authorization': `Bearer ${response.accessToken}` }\n });\n\n if (graphResponse.ok) {\n const blob = await graphResponse.blob();\n return URL.createObjectURL(blob);\n }\n\n return null;\n } catch (error) {\n console.error('[MSAL] Error getting profile picture:', error);\n return null;\n }\n }\n\n /**\n * Handle session expiry by redirecting to Microsoft login\n *\n * This method is called by the base class when silent token refresh fails\n * with INTERACTION_REQUIRED error. It redirects to Microsoft login and never returns.\n * After authentication, the app will reload and re-initialize with a fresh token.\n */\n protected async handleSessionExpiryInternal(): Promise<void> {\n console.debug('[MSAL] Redirecting to Microsoft login for re-authentication...');\n\n // Initiate redirect authentication - page will navigate away\n this.Auth.loginRedirect({\n scopes: ['User.Read', 'email', 'profile'],\n prompt: 'select_account'\n }).subscribe({\n error: (redirectError) => {\n console.error('[MSAL] Redirect initiation failed:', redirectError);\n }\n });\n\n // Return a promise that never resolves - page will navigate before this matters\n return new Promise<void>(() => {});\n }\n\n // ============================================================================\n // CONFIGURATION\n // ============================================================================\n\n override getRequiredConfig(): string[] {\n return ['clientId', 'tenantId'];\n }\n\n override validateConfig(_config: Record<string, unknown>): boolean {\n // MSAL configuration is handled by Angular module providers\n return true;\n }\n\n // ============================================================================\n // CLEANUP\n // ============================================================================\n\n ngOnDestroy(): void {\n this._destroying$.next();\n this._destroying$.complete();\n this._initPromise = null;\n this._initializationCompleted$.complete();\n }\n}"]}
package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts CHANGED
@@ -19,7 +19,7 @@ export declare class MJOktaProvider extends MJAuthBase {
19
19
  * Factory function to provide Angular dependencies required by Okta
20
20
  * Stored as a static property for the factory to access without instantiation
21
21
  */
22
- static angularProviderFactory: (environment: Record<string, unknown>) => {
22
+ static AngularProviderFactory: (environment: Record<string, unknown>) => {
23
23
  provide: string;
24
24
  useValue: {
25
25
  clientId: unknown;
@@ -29,6 +29,28 @@ export declare class MJOktaProvider extends MJAuthBase {
29
29
  scopes: {};
30
30
  };
31
31
  }[];
32
+ /** @deprecated Use {@link AngularProviderFactory}. */
33
+ static get angularProviderFactory(): (environment: Record<string, unknown>) => {
34
+ provide: string;
35
+ useValue: {
36
+ clientId: unknown;
37
+ domain: unknown;
38
+ issuer: {};
39
+ redirectUri: {};
40
+ scopes: {};
41
+ };
42
+ }[];
43
+ /** @deprecated Use {@link AngularProviderFactory}. */
44
+ static set angularProviderFactory(value: (environment: Record<string, unknown>) => {
45
+ provide: string;
46
+ useValue: {
47
+ clientId: unknown;
48
+ domain: unknown;
49
+ issuer: {};
50
+ redirectUri: {};
51
+ scopes: {};
52
+ };
53
+ }[]);
32
54
  constructor(oktaConfig: OktaAuthOptions & {
33
55
  domain?: string;
34
56
  });
package/dist/lib/providers/mjexplorer-okta-provider.service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"mjexplorer-okta-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAiB,EAAE,eAAe,EAAwB,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAU;IAuBV,OAAO,CAAC,UAAU;IAtBpD,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;QAWnE;gBAEwC,UAAU,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyCrF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4DjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAoB/D,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBzC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAqB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;OAIG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwFnE;;;;;;;;;OASG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;IA8FlE;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;yCApgBtD,cAAc;6CAAd,cAAc;CAugB1B"}
1
+ {"version":3,"file":"mjexplorer-okta-provider.service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/mjexplorer-okta-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAiB,EAAE,eAAe,EAAwB,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;;AACvB;;;;;;GAMG;AACH,qBAIa,cAAe,SAAQ,UAAU;IAgCV,OAAO,CAAC,UAAU;IA/BpD,MAAM,CAAC,QAAQ,CAAC,aAAa,UAAU;IACvC,QAAQ,CAAC,IAAI,UAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,YAAY,CAAS;IAE7B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,GAAI,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;QAWnE;IAEF,sDAAsD;IACtD,MAAM,KAAK,sBAAsB,kBAda,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;QAgBpE;IACD,sDAAsD;IACtD,MAAM,KAAK,sBAAsB,CAAC,KAAK,gBAlBO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;OAkB9B,EAEtC;gBAEyC,UAAU,EAAE,eAAe,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyCrF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4DjB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;cAoB/D,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBzC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrC;;;;;OAKG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhE;;;;OAIG;cACa,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAqB7E;;;;OAIG;cACa,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAc3E;;;;OAIG;cACa,oBAAoB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwFnE;;;;;;;;;OASG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB;IA8FlE;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;OAKG;cACa,4BAA4B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBtE;;;;;;OAMG;cACa,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASnD,iBAAiB,IAAI,MAAM,EAAE;IAI7B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;yCA7gBtD,cAAc;6CAAd,cAAc;CAghB1B"}
package/dist/lib/providers/mjexplorer-okta-provider.service.js CHANGED
@@ -29,7 +29,7 @@ let MJOktaProvider = class MJOktaProvider extends MJAuthBase {
29
29
  * Factory function to provide Angular dependencies required by Okta
30
30
  * Stored as a static property for the factory to access without instantiation
31
31
  */
32
- static angularProviderFactory = (environment) => [
32
+ static AngularProviderFactory = (environment) => [
33
33
  {
34
34
  provide: 'oktaConfig',
35
35
  useValue: {
@@ -41,6 +41,14 @@ let MJOktaProvider = class MJOktaProvider extends MJAuthBase {
41
41
  }
42
42
  }
43
43
  ];
44
+ /** @deprecated Use {@link AngularProviderFactory}. */
45
+ static get angularProviderFactory() {
46
+ return this.AngularProviderFactory;
47
+ }
48
+ /** @deprecated Use {@link AngularProviderFactory}. */
49
+ static set angularProviderFactory(value) {
50
+ this.AngularProviderFactory = value;
51
+ }
44
52
  constructor(oktaConfig) {
45
53
  const config = {
46
54
  name: MJOktaProvider_1.PROVIDER_TYPE,