@meshmakers/shared-auth 3.3.33 → 3.3.380

package/fesm2022/meshmakers-shared-auth.mjs

@@ -1,14 +1,7 @@
 import * as i0 from '@angular/core';
-import { inject, Injectable, Component, NgModule } from '@angular/core';
-import { BehaviorSubject, firstValueFrom } from 'rxjs';
-import { filter, map } from 'rxjs/operators';
-import * as i1$1 from 'angular-oauth2-oidc';
-import { OAuthService, OAuthModule } from 'angular-oauth2-oidc';
-import * as i1 from '@angular/common';
-import { CommonModule } from '@angular/common';
-import * as i2 from '@angular/router';
-import { Router, RouterLink } from '@angular/router';
-import { HttpClientModule } from '@angular/common/http';
+import { inject, signal, computed, Injectable, makeEnvironmentProviders } from '@angular/core';
+import { OAuthService, provideOAuthClient } from 'angular-oauth2-oidc';
+import { Router } from '@angular/router';
 
 class AuthorizeOptions {
     wellKnownServiceUris;
@@ -24,20 +17,52 @@ class AuthorizeOptions {
     scope;
     showDebugInformation;
     sessionChecksEnabled;
-    // Use popup flow for Office Add-Ins to avoid iframe issues
-    usePopupFlow;
 }
 class AuthorizeService {
     oauthService = inject(OAuthService);
-    _isAuthenticated = new BehaviorSubject(false);
-    _issuer = new BehaviorSubject(null);
-    _accessToken = new BehaviorSubject(null);
-    _user = new BehaviorSubject(null);
-    _userInitials = new BehaviorSubject(null);
-    _isInitialized = new BehaviorSubject(false);
-    _isInitializing = new BehaviorSubject(false);
-    _sessionLoading = new BehaviorSubject(false);
+    // =============================================================================
+    // INTERNAL STATE (Writable Signals)
+    // =============================================================================
+    _isAuthenticated = signal(false, ...(ngDevMode ? [{ debugName: "_isAuthenticated" }] : []));
+    _issuer = signal(null, ...(ngDevMode ? [{ debugName: "_issuer" }] : []));
+    _accessToken = signal(null, ...(ngDevMode ? [{ debugName: "_accessToken" }] : []));
+    _user = signal(null, ...(ngDevMode ? [{ debugName: "_user" }] : []));
+    _userInitials = signal(null, ...(ngDevMode ? [{ debugName: "_userInitials" }] : []));
+    _isInitialized = signal(false, ...(ngDevMode ? [{ debugName: "_isInitialized" }] : []));
+    _isInitializing = signal(false, ...(ngDevMode ? [{ debugName: "_isInitializing" }] : []));
+    _sessionLoading = signal(false, ...(ngDevMode ? [{ debugName: "_sessionLoading" }] : []));
     authorizeOptions = null;
+    // =============================================================================
+    // PUBLIC API (Readonly Signals) - NEW API
+    // =============================================================================
+    /**
+     * Signal indicating whether the user is currently authenticated.
+     */
+    isAuthenticated = this._isAuthenticated.asReadonly();
+    /**
+     * Signal containing the issuer URL.
+     */
+    issuer = this._issuer.asReadonly();
+    /**
+     * Signal containing the current access token.
+     */
+    accessToken = this._accessToken.asReadonly();
+    /**
+     * Signal containing the current user information.
+     */
+    user = this._user.asReadonly();
+    /**
+     * Computed signal containing the user's initials (e.g., "JD" for John Doe).
+     */
+    userInitials = this._userInitials.asReadonly();
+    /**
+     * Signal indicating whether the session is currently loading.
+     */
+    sessionLoading = this._sessionLoading.asReadonly();
+    /**
+     * Computed signal containing the user's roles.
+     */
+    roles = computed(() => this._user()?.role ?? [], ...(ngDevMode ? [{ debugName: "roles" }] : []));
     constructor() {
         console.debug("AuthorizeService::created");
         this.oauthService.discoveryDocumentLoaded$.subscribe((_) => {
@@ -46,89 +71,122 @@ class AuthorizeService {
         this.oauthService.events.subscribe((e) => {
             console.debug("oauth/oidc event", e);
         });
-        this.oauthService.events.pipe(filter((e) => e.type === "session_terminated")).subscribe((_) => {
-            console.debug("Your session has been terminated!");
-            this._accessToken.next(null);
-            this._user.next(null);
-            this._isAuthenticated.next(false);
-        });
-        this.oauthService.events.pipe(filter((e) => e.type === "token_received")).subscribe(async (_) => {
-            await this.loadUserAsync();
+        this.oauthService.events
+            .pipe((source) => source)
+            .subscribe((e) => {
+            if (e.type === "session_terminated") {
+                console.debug("Your session has been terminated!");
+                this._accessToken.set(null);
+                this._user.set(null);
+                this._isAuthenticated.set(false);
+                // Reload the page to trigger the auth flow and redirect to login
+                this.reloadPage();
+            }
         });
-        this.oauthService.events.pipe(filter((e) => e.type === "session_unchanged")).subscribe(async (_) => {
-            if (this._user.value == null) {
+        this.oauthService.events.subscribe(async (e) => {
+            if (e.type === "token_received") {
                 await this.loadUserAsync();
             }
         });
-        this.oauthService.events.pipe(filter((e) => e.type === "logout")).subscribe((_) => {
-            this._accessToken.next(null);
-            this._user.next(null);
-            this._isAuthenticated.next(false);
+        this.oauthService.events.subscribe(async (e) => {
+            if (e.type === "session_unchanged") {
+                if (this._user() == null) {
+                    await this.loadUserAsync();
+                }
+            }
         });
+        this.oauthService.events.subscribe((e) => {
+            if (e.type === "logout") {
+                console.debug("AuthorizeService: Logout event received");
+                this._accessToken.set(null);
+                this._user.set(null);
+                this._isAuthenticated.set(false);
+                // Reload the page to trigger the auth flow and redirect to login
+                this.reloadPage();
+            }
+        });
+        // Listen for storage events from other tabs (e.g., SLO logout callback)
+        // This enables immediate cross-tab logout detection
+        window.addEventListener('storage', (event) => {
+            console.debug("AuthorizeService: Storage event received", event.key, event.newValue);
+            // Check if access_token was removed (logout in another tab)
+            // Note: OAuth library may set to empty string or null when clearing
+            if (event.key === 'access_token' && (event.newValue === null || event.newValue === '') && this._isAuthenticated()) {
+                console.debug("AuthorizeService: Access token removed in another tab - logging out and reloading");
+                this._accessToken.set(null);
+                this._user.set(null);
+                this._isAuthenticated.set(false);
+                // Reload the page to trigger the auth flow and redirect to login
+                this.reloadPage();
+            }
+        });
+        // Also listen for BroadcastChannel messages for cross-tab logout
+        // This is more reliable than storage events for iframe-based SLO
+        if (typeof BroadcastChannel !== 'undefined') {
+            console.debug("AuthorizeService: Setting up BroadcastChannel listener for 'octo-auth-logout'");
+            const logoutChannel = new BroadcastChannel('octo-auth-logout');
+            logoutChannel.onmessage = (event) => {
+                console.debug("AuthorizeService: BroadcastChannel message received", event.data);
+                if (event.data?.type === 'logout' && this._isAuthenticated()) {
+                    console.debug("AuthorizeService: Logout broadcast received - reloading");
+                    this._accessToken.set(null);
+                    this._user.set(null);
+                    this._isAuthenticated.set(false);
+                    this.reloadPage();
+                }
+            };
+        }
+        else {
+            console.warn("AuthorizeService: BroadcastChannel not supported in this browser");
+        }
     }
+    /**
+     * Checks if the current user has the specified role.
+     */
     isInRole(role) {
-        return this._user?.value?.role?.includes(role) ?? false;
-    }
-    getRoles() {
-        return this.user.pipe(map((u) => (u?.role != null ? u.role : new Array())));
+        return this._user()?.role?.includes(role) ?? false;
     }
+    /**
+     * Gets the configured service URIs that should receive the authorization token.
+     */
     getServiceUris() {
         return this.authorizeOptions?.wellKnownServiceUris ?? null;
     }
-    get issuer() {
-        return this._issuer;
-    }
-    get isAuthenticated() {
-        return this._isAuthenticated;
-    }
-    get sessionLoading() {
-        return this._sessionLoading;
-    }
-    get accessToken() {
-        return this._accessToken;
-    }
-    get user() {
-        return this._user;
-    }
-    get userInitials() {
-        return this._userInitials;
+    /**
+     * Gets the current access token synchronously.
+     * Use this for functional interceptors that need immediate access to the token.
+     *
+     * @returns The current access token or null if not authenticated
+     */
+    getAccessTokenSync() {
+        return this._accessToken();
     }
+    /**
+     * Initiates the login flow.
+     */
     login() {
-        if (this.authorizeOptions?.usePopupFlow) {
-            this.loginWithPopup();
-        }
-        else {
-            this.oauthService.initImplicitFlow();
-        }
-    }
-    loginWithPopup() {
-        // Initiate login flow and get the authorization URL
-        this.oauthService.initLoginFlow();
-        // For popup flow, we need to handle the callback differently
-        // The popup will redirect back, and we need to process the code
-        window.addEventListener('storage', (e) => {
-            if (e.key === 'oauth_code_received') {
-                // Process the authentication after popup closes
-                this.oauthService.tryLoginCodeFlow().then(() => {
-                    localStorage.removeItem('oauth_code_received');
-                });
-            }
-        });
+        this.oauthService.initImplicitFlow();
     }
+    /**
+     * Logs out the current user.
+     */
     logout() {
         this.oauthService.logOut(false);
     }
+    /**
+     * Initializes the authorization service with the specified options.
+     */
     async initialize(authorizeOptions) {
         console.debug("AuthorizeService::initialize::started");
         await this.uninitialize();
-        if (await firstValueFrom(this._isInitializing)) {
+        if (this._isInitializing()) {
             return;
         }
-        if (await firstValueFrom(this._isInitialized)) {
+        if (this._isInitialized()) {
             console.debug("AuthorizeService::initialize::alreadyInitialized");
             return;
         }
-        this._isInitializing.next(true);
+        this._isInitializing.set(true);
         try {
             const config = {
                 responseType: "code",
@@ -149,39 +207,42 @@ class AuthorizeService {
             await this.oauthService.loadDiscoveryDocumentAndTryLogin();
             console.debug("AuthorizeService::initialize::setupAutomaticSilentRefresh");
             this.oauthService.setupAutomaticSilentRefresh();
-            this._issuer.next(authorizeOptions.issuer ?? null);
+            this._issuer.set(authorizeOptions.issuer ?? null);
             if (this.oauthService.hasValidIdToken()) {
                 // if the idToken is still valid, we can use the session
                 console.debug("AuthorizeService::initialize::hasValidIdToken");
-                this._sessionLoading.next(true);
+                this._sessionLoading.set(true);
                 await this.oauthService.refreshToken();
             }
-            this._isInitialized.next(true);
+            this._isInitialized.set(true);
             console.debug("AuthorizeService::initialize::done");
         }
         finally {
-            this._isInitializing.next(false);
+            this._isInitializing.set(false);
         }
         console.debug("AuthorizeService::initialize::completed");
     }
+    /**
+     * Uninitializes the authorization service.
+     */
     async uninitialize() {
         console.debug("AuthorizeService::uninitialize::started");
-        if (await firstValueFrom(this._isInitializing)) {
+        if (this._isInitializing()) {
             return;
         }
-        if (!await firstValueFrom(this._isInitialized)) {
+        if (!this._isInitialized()) {
             console.debug("AuthorizeService::uninitialize::alreadyUninitialized");
             return;
         }
         try {
-            this._isInitializing.next(true);
+            this._isInitializing.set(true);
             this.oauthService.stopAutomaticRefresh();
             this.authorizeOptions = null;
-            this._isInitialized.next(false);
+            this._isInitialized.set(false);
             console.debug("AuthorizeService::uninitialize::done");
         }
         finally {
-            this._isInitializing.next(false);
+            this._isInitializing.set(false);
         }
         console.debug("AuthorizeService::uninitialize::completed");
     }
@@ -194,22 +255,29 @@ class AuthorizeService {
         const user = claims;
         if (user.family_name && user.given_name) {
             const initials = user.given_name.charAt(0) + user.family_name.charAt(0);
-            this._userInitials.next(initials);
+            this._userInitials.set(initials);
         }
         else {
-            this._userInitials.next(user.name.charAt(0) + user.name.charAt(1));
+            this._userInitials.set(user.name.charAt(0) + user.name.charAt(1));
         }
         const accessToken = this.oauthService.getAccessToken();
-        this._user.next(user);
-        this._accessToken.next(accessToken);
-        this._isAuthenticated.next(true);
-        this._sessionLoading.next(false);
+        this._user.set(user);
+        this._accessToken.set(accessToken);
+        this._isAuthenticated.set(true);
+        this._sessionLoading.set(false);
         console.debug("AuthorizeService::loadUserAsync::done");
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeService });
+    /**
+     * Reloads the page. This method is protected to allow mocking in tests.
+     * @internal
+     */
+    reloadPage() {
+        window.location.reload();
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.5", ngImport: i0, type: AuthorizeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.5", ngImport: i0, type: AuthorizeService });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.5", ngImport: i0, type: AuthorizeService, decorators: [{
             type: Injectable
         }], ctorParameters: () => [] });
 
@@ -225,172 +293,200 @@ var Roles;
     Roles["Development"] = "Development";
 })(Roles || (Roles = {}));
 
-class LoginMenuComponent {
-    authorizeService = inject(AuthorizeService);
-    isAuthenticated;
-    userName;
-    constructor() {
-        this.isAuthenticated = this.authorizeService.isAuthenticated;
-        this.userName = this.authorizeService.user.pipe(map((u) => u?.name ?? null));
-    }
-    ngOnInit() {
-        const isIFrame = window.self !== window.top;
-        console.log('app-login-menu::created');
-        this.isAuthenticated.subscribe((x) => {
-            console.log(`isAuthenticated changed to ${x} (iframe ${isIFrame})`);
-        });
-    }
-    login() {
-        this.authorizeService.login();
-    }
-    logout() {
-        this.authorizeService.logout();
-    }
-    register() { }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: LoginMenuComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "20.3.12", type: LoginMenuComponent, isStandalone: false, selector: "mm-login-menu", ngImport: i0, template: "<ul *ngIf=\"isAuthenticated | async\" class=\"navbar-nav\">\n  <li class=\"nav-item dropdown\">\n    <a aria-expanded=\"false\" aria-haspopup=\"true\" class=\"nav-link dropdown-toggle\" data-toggle=\"dropdown\" href=\"#\"\n       id=\"navbarDropdownLogin\" role=\"button\">\n      {{ userName | async }} <b class=\"caret\"></b>\n    </a>\n    <div aria-labelledby=\"navbarDropdown\" class=\"dropdown-menu\">\n      <!--<a class=\"dropdown-item\" asp-action=\"Index\" asp-area=\"Authentication\" asp-controller=\"Grants\">Client Application Access</a>-->\n      <!--<a class=\"dropdown-item\" [routerLink]='[\"/authentication/profile\"]' title=\"Manage\">Manage</a>-->\n      <!--<a class=\"dropdown-item\" asp-action=\"Index\" asp-area=\"Authentication\" asp-controller=\"Diagnostics\">Diagnostics</a>-->\n      <div class=\"dropdown-divider\"></div>\n      <a (click)='logout()' class=\"dropdown-item\" routerLink=\"\" title=\"Logout\">Logout</a>\n    </div>\n  </li>\n</ul>\n<ul *ngIf=\"!(isAuthenticated | async)\" class=\"navbar-nav\">\n  <li class=\"nav-item\">\n    <a (click)='register()' class=\"nav-link\" routerLink=\"\">Register</a>\n  </li>\n  <li class=\"nav-item\">\n    <a (click)='login()' class=\"nav-link\" routerLink=\"\">Login</a>\n  </li>\n</ul>\n", styles: [""], dependencies: [{ kind: "directive", type: i1.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "directive", type: i2.RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "routerLink"] }, { kind: "pipe", type: i1.AsyncPipe, name: "async" }] });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: LoginMenuComponent, decorators: [{
-            type: Component,
-            args: [{ selector: 'mm-login-menu', standalone: false, template: "<ul *ngIf=\"isAuthenticated | async\" class=\"navbar-nav\">\n  <li class=\"nav-item dropdown\">\n    <a aria-expanded=\"false\" aria-haspopup=\"true\" class=\"nav-link dropdown-toggle\" data-toggle=\"dropdown\" href=\"#\"\n       id=\"navbarDropdownLogin\" role=\"button\">\n      {{ userName | async }} <b class=\"caret\"></b>\n    </a>\n    <div aria-labelledby=\"navbarDropdown\" class=\"dropdown-menu\">\n      <!--<a class=\"dropdown-item\" asp-action=\"Index\" asp-area=\"Authentication\" asp-controller=\"Grants\">Client Application Access</a>-->\n      <!--<a class=\"dropdown-item\" [routerLink]='[\"/authentication/profile\"]' title=\"Manage\">Manage</a>-->\n      <!--<a class=\"dropdown-item\" asp-action=\"Index\" asp-area=\"Authentication\" asp-controller=\"Diagnostics\">Diagnostics</a>-->\n      <div class=\"dropdown-divider\"></div>\n      <a (click)='logout()' class=\"dropdown-item\" routerLink=\"\" title=\"Logout\">Logout</a>\n    </div>\n  </li>\n</ul>\n<ul *ngIf=\"!(isAuthenticated | async)\" class=\"navbar-nav\">\n  <li class=\"nav-item\">\n    <a (click)='register()' class=\"nav-link\" routerLink=\"\">Register</a>\n  </li>\n  <li class=\"nav-item\">\n    <a (click)='login()' class=\"nav-link\" routerLink=\"\">Login</a>\n  </li>\n</ul>\n" }]
-        }], ctorParameters: () => [] });
-
-class AuthorizeGuard {
-    authorizeService = inject(AuthorizeService);
-    router = inject(Router);
-    canActivate(next, state) {
-        const url = state.url;
-        return this.handleAuthorization(next, url);
-    }
-    canActivateChild(next, state) {
-        return this.canActivate(next, state);
+// =============================================================================
+// URL MATCHING UTILITIES
+// =============================================================================
+/**
+ * Checks if the request URL is from the same origin as the application.
+ */
+function isSameOriginUrl(req) {
+    // It's an absolute url with the same origin.
+    if (req.url.startsWith(`${window.location.origin}/`)) {
+        return true;
     }
-    canDeactivate(_component, _currentRoute, _currentState, _nextState) {
+    // It's a protocol relative url with the same origin.
+    // For example: //www.example.com/api/Products
+    if (req.url.startsWith(`//${window.location.host}/`)) {
         return true;
     }
-    canLoad(_route, _segments) {
+    // It's a relative url like /api/Products
+    if (/^\/[^/].*/.test(req.url)) {
         return true;
     }
-    async handleAuthorization(route, _url) {
-        const isAuthenticated = await firstValueFrom(this.authorizeService.isAuthenticated);
-        if (isAuthenticated) {
-            const userRoles = await firstValueFrom(this.authorizeService.getRoles());
-            if (route.data['roles'] && !route.data['roles'].some((role) => userRoles.includes(role))) {
-                await this.router.navigate(['']);
-                return false;
+    // It's an absolute or protocol relative url that doesn't have the same origin.
+    return false;
+}
+/**
+ * Checks if the request URL matches any of the known service URIs.
+ */
+function isKnownServiceUri(req, serviceUris) {
+    if (serviceUris != null) {
+        for (const serviceUri of serviceUris) {
+            if (req.url.startsWith(serviceUri)) {
+                return true;
             }
-            return true;
         }
-        else {
-            this.authorizeService.login();
-        }
-        return false;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeGuard, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeGuard });
+    return false;
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeGuard, decorators: [{
-            type: Injectable
-        }] });
-
-class AuthorizeInterceptor {
-    authorize = inject(AuthorizeService);
-    accessToken;
-    constructor() {
-        const authorize = this.authorize;
-        this.accessToken = null;
-        authorize.accessToken.subscribe((value) => (this.accessToken = value));
+// =============================================================================
+// FUNCTIONAL INTERCEPTOR (RECOMMENDED)
+// =============================================================================
+/**
+ * Functional HTTP interceptor that adds Bearer token to authorized requests.
+ *
+ * Adds the Authorization header to requests that are either:
+ * - Same-origin requests (relative URLs or same host)
+ * - Requests to known service URIs configured in AuthorizeOptions
+ *
+ * @example
+ * ```typescript
+ * // app.config.ts
+ * import { provideHttpClient, withInterceptors } from '@angular/common/http';
+ * import { authorizeInterceptor } from '@meshmakers/shared-auth';
+ *
+ * export const appConfig: ApplicationConfig = {
+ *   providers: [
+ *     provideHttpClient(withInterceptors([authorizeInterceptor])),
+ *     provideMmSharedAuth(),
+ *   ]
+ * };
+ * ```
+ */
+const authorizeInterceptor = (req, next) => {
+    const authorizeService = inject(AuthorizeService);
+    const token = authorizeService.getAccessTokenSync();
+    const serviceUris = authorizeService.getServiceUris();
+    if (token && (isSameOriginUrl(req) || isKnownServiceUri(req, serviceUris))) {
+        req = req.clone({
+            setHeaders: {
+                Authorization: `Bearer ${token}`
+            }
+        });
     }
-    static isSameOriginUrl(req) {
-        // It's an absolute url with the same origin.
-        if (req.url.startsWith(`${window.location.origin}/`)) {
-            return true;
-        }
-        // It's a protocol relative url with the same origin.
-        // For example: //www.example.com/api/Products
-        if (req.url.startsWith(`//${window.location.host}/`)) {
-            return true;
-        }
-        // It's a relative url like /api/Products
-        if (/^\/[^/].*/.test(req.url)) {
-            return true;
-        }
-        // It's an absolute or protocol relative url that
-        // doesn't have the same origin.
+    return next(req);
+};
+
+/**
+ * Handles authorization check for route activation.
+ * Redirects to login if not authenticated, or to home if user lacks required roles.
+ *
+ * @param route - The activated route snapshot containing route data
+ * @returns true if authorized, false otherwise
+ *
+ * @example
+ * ```typescript
+ * // Route without role requirements
+ * { path: 'dashboard', component: DashboardComponent, canActivate: [authorizeGuard] }
+ *
+ * // Route with role requirements
+ * { path: 'admin', component: AdminComponent, canActivate: [authorizeGuard], data: { roles: ['AdminPanelManagement'] } }
+ * ```
+ */
+const authorizeGuard = async (route) => {
+    const authorizeService = inject(AuthorizeService);
+    const router = inject(Router);
+    // Use signal directly (synchronous)
+    const isAuthenticated = authorizeService.isAuthenticated();
+    if (!isAuthenticated) {
+        authorizeService.login();
         return false;
     }
-    // Checks if there is an access_token available in the authorize service
-    // and adds it to the request in case it's targeted at the same origin as the
-    intercept(req, next) {
-        return this.processRequestWithToken(this.accessToken, req, next);
-    }
-    // single page application.
-    processRequestWithToken(token, req, next) {
-        if (!!token && (AuthorizeInterceptor.isSameOriginUrl(req) || this.isKnownServiceUri(req))) {
-            req = req.clone({
-                setHeaders: {
-                    Authorization: `Bearer ${token}`
-                }
-            });
-        }
-        return next.handle(req);
-    }
-    isKnownServiceUri(req) {
-        const serviceUris = this.authorize.getServiceUris();
-        if (serviceUris != null) {
-            for (const serviceUri of serviceUris) {
-                if (req.url.startsWith(`${serviceUri}`)) {
-                    return true;
-                }
-            }
-        }
-        // It's an absolute or protocol relative url that
-        // doesn't have the same origin.
+    // Use roles signal directly (synchronous)
+    const userRoles = authorizeService.roles();
+    const requiredRoles = route.data['roles'];
+    if (requiredRoles && !requiredRoles.some(role => userRoles.includes(role))) {
+        await router.navigate(['']);
         return false;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeInterceptor });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AuthorizeInterceptor, decorators: [{
-            type: Injectable
-        }], ctorParameters: () => [] });
-
-class SharedAuthModule {
-    static forRoot(authorizeOptions) {
-        return {
-            ngModule: SharedAuthModule,
-            providers: [
-                {
-                    provide: AuthorizeOptions,
-                    useValue: authorizeOptions
-                },
-                AuthorizeService,
-                AuthorizeInterceptor,
-                AuthorizeGuard
-            ]
-        };
+    return true;
+};
+/**
+ * Guard for child routes. Delegates to authorizeGuard.
+ *
+ * @example
+ * ```typescript
+ * {
+ *   path: 'parent',
+ *   canActivateChild: [authorizeChildGuard],
+ *   children: [
+ *     { path: 'child', component: ChildComponent, data: { roles: ['RequiredRole'] } }
+ *   ]
+ * }
+ * ```
+ */
+const authorizeChildGuard = authorizeGuard;
+/**
+ * Guard for lazy-loaded routes. Checks if user is authenticated.
+ * Replaces the deprecated canLoad guard.
+ *
+ * @example
+ * ```typescript
+ * {
+ *   path: 'lazy',
+ *   loadChildren: () => import('./lazy/lazy.routes'),
+ *   canMatch: [authorizeMatchGuard]
+ * }
+ * ```
+ */
+const authorizeMatchGuard = () => {
+    const authorizeService = inject(AuthorizeService);
+    // Use signal directly (synchronous)
+    const isAuthenticated = authorizeService.isAuthenticated();
+    if (!isAuthenticated) {
+        authorizeService.login();
+        return false;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: SharedAuthModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
-    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "20.3.12", ngImport: i0, type: SharedAuthModule, declarations: [LoginMenuComponent], imports: [CommonModule, HttpClientModule, i1$1.OAuthModule, RouterLink], exports: [LoginMenuComponent] });
-    static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: SharedAuthModule, imports: [CommonModule, HttpClientModule, OAuthModule.forRoot()] });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: SharedAuthModule, decorators: [{
-            type: NgModule,
-            args: [{
-                    declarations: [LoginMenuComponent],
-                    exports: [LoginMenuComponent],
-                    providers: [],
-                    imports: [CommonModule, HttpClientModule, OAuthModule.forRoot(), RouterLink]
-                }]
-        }] });
+    return true;
+};
+/**
+ * Guard that always allows deactivation.
+ * Use this as a placeholder or override in specific routes.
+ *
+ * @example
+ * ```typescript
+ * { path: 'form', component: FormComponent, canDeactivate: [authorizeDeactivateGuard] }
+ * ```
+ */
+const authorizeDeactivateGuard = () => true;
 
 /*
  * Public API Surface of shared-auth
  */
+// UI Components (Kendo) - available via '@meshmakers/shared-auth/login-ui'
+// import { LoginAppBarSectionComponent } from '@meshmakers/shared-auth/login-ui';
+/**
+ * Provides all shared-auth dependencies.
+ *
+ * @example
+ * ```typescript
+ * // app.config.ts
+ * import { provideHttpClient, withInterceptors } from '@angular/common/http';
+ * import { provideMmSharedAuth, authorizeInterceptor } from '@meshmakers/shared-auth';
+ *
+ * export const appConfig: ApplicationConfig = {
+ *   providers: [
+ *     provideHttpClient(withInterceptors([authorizeInterceptor])),
+ *     provideMmSharedAuth(),
+ *     // ... other providers
+ *   ]
+ * };
+ * ```
+ *
+ * @remarks
+ * Functional guards and interceptors don't need to be provided - they use inject() internally.
+ * For the functional interceptor, use `provideHttpClient(withInterceptors([authorizeInterceptor]))`.
+ */
+function provideMmSharedAuth() {
+    return makeEnvironmentProviders([
+        provideOAuthClient(),
+        AuthorizeService
+    ]);
+}
 
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { AuthorizeGuard, AuthorizeInterceptor, AuthorizeOptions, AuthorizeService, LoginMenuComponent, Roles, SharedAuthModule };
+export { AuthorizeOptions, AuthorizeService, Roles, authorizeChildGuard, authorizeDeactivateGuard, authorizeGuard, authorizeInterceptor, authorizeMatchGuard, provideMmSharedAuth };
 //# sourceMappingURL=meshmakers-shared-auth.mjs.map