@nativelement/capacitor-msal-entra 0.0.0-stage → 1.0.1

package/android/src/main/java/io/nativelement/msalentra/MsalAuthPlugin.kt

@@ -0,0 +1,273 @@
+package io.nativelement.msalentra
+
+import android.util.Log
+import com.getcapacitor.JSArray
+import com.getcapacitor.JSObject
+import com.getcapacitor.Plugin
+import com.getcapacitor.PluginCall
+import com.getcapacitor.PluginMethod
+import com.getcapacitor.annotation.CapacitorPlugin
+import com.microsoft.identity.client.AuthenticationCallback
+import com.microsoft.identity.client.IAccount
+import com.microsoft.identity.client.IAuthenticationResult
+import com.microsoft.identity.client.IMultipleAccountPublicClientApplication
+import com.microsoft.identity.client.IPublicClientApplication
+import com.microsoft.identity.client.PublicClientApplication
+import com.microsoft.identity.client.SilentAuthenticationCallback
+import com.microsoft.identity.client.exception.MsalClientException
+import com.microsoft.identity.client.exception.MsalException
+import com.microsoft.identity.client.exception.MsalUiRequiredException
+import org.json.JSONObject
+
+/**
+ * Wraps the MSAL Android SDK (com.microsoft.identity.client:msal) so the
+ * Ionic/Angular layer only ever deals with plain JS objects and promises.
+ *
+ * Requires:
+ *   implementation 'com.microsoft.identity.client:msal:5.+'
+ * and a msal_config.json under android/app/src/main/res/raw/ describing
+ * the client id, redirect uri, and Entra External ID authority.
+ */
+@CapacitorPlugin(name = "MsalAuth")
+class MsalAuthPlugin : Plugin() {
+
+    private var pca: IMultipleAccountPublicClientApplication? = null
+    private val TAG = "MsalAuthPlugin"
+
+    override fun load() {
+        super.load()
+        val configResId = context.resources.getIdentifier(
+            "msal_config", "raw", context.packageName
+        )
+        PublicClientApplication.createMultipleAccountPublicClientApplication(
+            context,
+            configResId,
+            object : IPublicClientApplication.IMultipleAccountApplicationCreatedListener {
+                override fun onCreated(application: IMultipleAccountPublicClientApplication) {
+                    pca = application
+                }
+
+                override fun onError(exception: MsalException) {
+                    Log.e(TAG, "Failed to initialize MSAL", exception)
+                }
+            }
+        )
+    }
+
+    @PluginMethod
+    fun signIn(call: PluginCall) {
+        // 'openid', 'profile' and 'offline_access' are reserved scopes MSAL
+        // adds automatically, and callers should only pass scopes for a
+        // specific resource - but unlike MSAL iOS (which accepts an empty
+        // array), MSAL Android's TokenParameters.withScopes() throws
+        // IllegalArgumentException on an empty list. Default to "openid" -
+        // a standard, always-safe OIDC scope - so a caller passing [] (the
+        // common case for a bare sign-in) works on both platforms.
+        val requestedScopes = call.getArray("scopes")?.toList<String>() ?: emptyList()
+        val scopes = requestedScopes.ifEmpty { listOf("openid") }
+        val application = pca
+        if (application == null) {
+            call.reject("MSAL not initialized yet, try again shortly", "NOT_INITIALIZED")
+            return
+        }
+
+        val activity = activity ?: run {
+            call.reject("No current activity to launch sign-in from")
+            return
+        }
+
+        val parameters = com.microsoft.identity.client.AcquireTokenParameters.Builder()
+            .startAuthorizationFromActivity(activity)
+            .withScopes(scopes)
+            .withCallback(object : AuthenticationCallback {
+                override fun onSuccess(authenticationResult: IAuthenticationResult) {
+                    call.resolve(toResultJson(authenticationResult))
+                }
+
+                override fun onError(exception: MsalException) {
+                    call.reject(exception.message, exception.errorCode, exception)
+                }
+
+                override fun onCancel() {
+                    call.reject("User cancelled sign-in", "USER_CANCELLED")
+                }
+            })
+            .build()
+
+        application.acquireToken(parameters)
+    }
+
+    @PluginMethod
+    fun acquireTokenSilent(call: PluginCall) {
+        val requestedScopes = call.getArray("scopes")?.toList<String>() ?: emptyList()
+        val scopes = requestedScopes.ifEmpty { listOf("openid") }
+        val application = pca
+        if (application == null) {
+            call.reject("MSAL not initialized yet, try again shortly", "NOT_INITIALIZED")
+            return
+        }
+
+        application.getAccounts(object : IPublicClientApplication.LoadAccountsCallback {
+            override fun onTaskCompleted(accounts: MutableList<IAccount>) {
+                val account = accounts.firstOrNull()
+                if (account == null) {
+                    call.reject("No cached account, call signIn() first", "UI_REQUIRED")
+                    return
+                }
+
+                val silentParameters = com.microsoft.identity.client.AcquireTokenSilentParameters.Builder()
+                    .forAccount(account)
+                    .fromAuthority(account.authority)
+                    .withScopes(scopes)
+                    .withCallback(object : SilentAuthenticationCallback {
+                        override fun onSuccess(authenticationResult: IAuthenticationResult) {
+                            call.resolve(toResultJson(authenticationResult))
+                        }
+
+                        override fun onError(exception: MsalException) {
+                            if (exception is MsalUiRequiredException) {
+                                call.reject("Interactive sign-in required", "UI_REQUIRED", exception)
+                            } else {
+                                call.reject(exception.message, "SILENT_FAILED", exception)
+                            }
+                        }
+                    })
+                    .build()
+
+                application.acquireTokenSilentAsync(silentParameters)
+            }
+
+            override fun onError(exception: MsalException) {
+                call.reject(exception.message, "SILENT_FAILED", exception)
+            }
+        })
+    }
+
+    @PluginMethod
+    fun getAccount(call: PluginCall) {
+        val application = pca ?: run {
+            call.resolve(JSObject().put("value", null))
+            return
+        }
+        application.getAccounts(object : IPublicClientApplication.LoadAccountsCallback {
+            override fun onTaskCompleted(accounts: MutableList<IAccount>) {
+                val account = accounts.firstOrNull()
+                if (account == null) {
+                    call.resolve(JSObject().put("value", null))
+                    return
+                }
+                val result = JSObject()
+                result.put("accountId", account.id)
+                result.put("username", account.username)
+                val claims = JSObject()
+                account.claims?.forEach { (k, v) -> claims.put(k, claimValueToJson(v)) }
+                result.put("idTokenClaims", claims)
+                val wrapper = JSObject()
+                wrapper.put("value", result)
+                call.resolve(wrapper)
+            }
+
+            override fun onError(exception: MsalException) {
+                call.reject(exception.message, "GET_ACCOUNT_FAILED", exception)
+            }
+        })
+    }
+
+    @PluginMethod
+    fun signOut(call: PluginCall) {
+        val application = pca ?: run {
+            call.resolve()
+            return
+        }
+        application.getAccounts(object : IPublicClientApplication.LoadAccountsCallback {
+            override fun onTaskCompleted(accounts: MutableList<IAccount>) {
+                if (accounts.isEmpty()) {
+                    call.resolve()
+                    return
+                }
+                // Remove every cached account, not just the first - MSAL's
+                // encrypted cache can accumulate more than one account over
+                // time, and signOut() must guarantee no account remains
+                // afterward, not just remove whichever one happens to be
+                // first in the list. Callbacks land on the main thread (MSAL
+                // Android convention), so plain vars are safe here without
+                // atomics.
+                var remaining = accounts.size
+                var failed = false
+                for (account in accounts) {
+                    application.removeAccount(
+                        account,
+                        object : IMultipleAccountPublicClientApplication.RemoveAccountCallback {
+                            override fun onRemoved() {
+                                remaining--
+                                if (remaining == 0 && !failed) {
+                                    call.resolve()
+                                }
+                            }
+
+                            override fun onError(exception: MsalException) {
+                                if (!failed) {
+                                    failed = true
+                                    call.reject(exception.message, "SIGN_OUT_FAILED", exception)
+                                }
+                            }
+                        }
+                    )
+                }
+            }
+
+            override fun onError(exception: MsalException) {
+                call.reject(exception.message, "SIGN_OUT_FAILED", exception)
+            }
+        })
+    }
+
+    private fun toResultJson(result: IAuthenticationResult): JSObject {
+        val json = JSObject()
+        json.put("accessToken", result.accessToken)
+        // IAccount extends IClaimable, whose getIdToken() returns the raw JWT id_token
+        // directly - IAuthenticationResult itself has no idToken accessor, and the
+        // claims map (IClaimable.getClaims()) holds *decoded* claims, not the raw JWT
+        // under an "id_token" key.
+        json.put("idToken", result.account.idToken ?: "")
+        json.put("expiresOn", result.expiresOn.time)
+        json.put("accountId", result.account.id)
+        json.put("scopes", JSArray(result.scope.toList()))
+        return json
+    }
+
+    private inline fun <reified T> JSArray.toList(): List<T> {
+        val out = mutableListOf<T>()
+        for (i in 0 until this.length()) {
+            out.add(this.get(i) as T)
+        }
+        return out
+    }
+
+    // account.claims (IClaimable.getClaims()) is a Map<String, ?> decoded from JSON:
+    // non-string claims (amr, groups, roles, nested objects) come through as List/Map,
+    // not String - a plain toString() would mangle them instead of preserving their
+    // shape as real JSON arrays/objects for the JS side.
+    private fun claimValueToJson(value: Any?): Any {
+        return when (value) {
+            null -> JSONObject.NULL
+            is String, is Boolean, is Int, is Long, is Double, is Float -> value
+            is Map<*, *> -> {
+                val obj = JSObject()
+                value.forEach { (k, v) -> obj.put(k.toString(), claimValueToJson(v)) }
+                obj
+            }
+            is Collection<*> -> {
+                val arr = JSArray()
+                value.forEach { arr.put(claimValueToJson(it)) }
+                arr
+            }
+            is Array<*> -> {
+                val arr = JSArray()
+                value.forEach { arr.put(claimValueToJson(it)) }
+                arr
+            }
+            else -> value.toString()
+        }
+    }
+}

package/android/src/main/res/raw/msal_config.json

@@ -0,0 +1,14 @@
+{
+  "client_id": "<ANDROID_APP_CLIENT_ID>",
+  "authorization_user_agent": "DEFAULT",
+  "redirect_uri": "msauth://com.example.myapp/<BASE64_URL_ENCODED_SIGNATURE_HASH>",
+  "account_mode": "MULTIPLE",
+  "broker_redirect_uri_registered": false,
+  "authorities": [
+    {
+      "type": "CIAM",
+      "default": true,
+      "authority_url": "https://<your-tenant-subdomain>.ciamlogin.com/<your-tenant-subdomain>.onmicrosoft.com/"
+    }
+  ]
+}

package/dist/esm/definitions.d.ts

@@ -0,0 +1,93 @@
+export interface AcquireTokenOptions {
+    /**
+     * Delegated scopes to request, e.g. ['api://<api-client-id>/access_as_user'].
+     * Do NOT include 'openid', 'profile', or 'offline_access' - MSAL adds these
+     * reserved scopes to every request automatically. On iOS, explicitly
+     * specifying them is rejected outright; pass an empty array for a basic
+     * sign-in that only needs an ID token. On Android, MSAL's
+     * TokenParameters.withScopes() throws on an empty list (no equivalent
+     * "reserved scopes" carve-out), so the native Android plugin substitutes
+     * 'openid' when this is empty - callers on both platforms can still just
+     * pass [] for a basic sign-in.
+     */
+    scopes: string[];
+    /**
+     * Optional `domain_hint` sent to the Entra External ID authorize endpoint
+     * as an extra query parameter, on iOS and web. When the tenant's user flow
+     * has a social identity provider configured, this skips the Entra
+     * account-picker page and routes the user straight to that provider's own
+     * login screen. For social/federated IdPs this is Microsoft's "issuer
+     * acceleration" mechanism and takes a bare provider name, NOT a domain -
+     * use exactly 'Google' (capital G - case-sensitive, 'google' fails with
+     * AADSTS90023), 'facebook', or 'apple'. ('<domain>.com' values are a
+     * *different* mechanism reserved for custom SAML/WS-Fed IdPs matched by a
+     * configured domain - passing e.g. 'apple.com' here can misroute to an
+     * unrelated domain-based lookup instead of Sign in with Apple.) For a
+     * custom OIDC provider, use the domain segment of its issuer URI instead
+     * (e.g. 'www.linkedin.com'). Has no effect on `acquireTokenSilent()`.
+     * Ignored on Android (see the plugin README's Known gaps).
+     */
+    domainHint?: string;
+    /**
+     * Optional `prompt` sent to the Entra External ID authorize endpoint,
+     * currently **web only**. Indicates the type of user interaction
+     * required - the value most relevant here is `'create'`, which sends the
+     * user straight to the tenant's account-creation form instead of the
+     * sign-in form (requires the user flow to be a "Sign up and sign in"
+     * flow). Other values MSAL recognizes: `'login'` (force credential entry,
+     * skip SSO), `'none'` (silent-only, rejects with an error if interaction
+     * would be needed), `'consent'`, `'select_account'`.
+     *
+     * Caveat: unlike `domainHint`, `prompt: 'create'` has been reported as
+     * unreliable on some tenants (Microsoft Q&A has multiple reports of it
+     * working, then silently stopping) - treat it as best-effort, e.g. for an
+     * explicit "Create account" button next to "Sign in", not as something to
+     * design a flow around depending on. Has no effect on
+     * `acquireTokenSilent()`. Ignored on iOS/Android for now - native support
+     * would mirror how `domainHint` was added to `MSALInteractiveTokenParameters`
+     * (iOS) if/when needed.
+     */
+    prompt?: string;
+}
+export interface AcquireTokenResult {
+    accessToken: string;
+    idToken: string;
+    expiresOn: number;
+    /** stable per-user identifier, maps to the token's oid claim */
+    accountId: string;
+    scopes: string[];
+}
+export interface AccountInfo {
+    accountId: string;
+    username: string | null;
+    idTokenClaims: Record<string, unknown> | null;
+}
+export interface SignOutOptions {
+    /** if true, also clears the Entra browser session, not just local cache */
+    clearBrowserSession?: boolean;
+}
+export interface MsalAuthPlugin {
+    /**
+     * Interactive sign-in/sign-up. Launches the platform browser
+     * (ASWebAuthenticationSession / Chrome Custom Tabs via the native MSAL SDK)
+     * against the Entra External ID user flow configured in msal_config.json.
+     */
+    signIn(options: AcquireTokenOptions): Promise<AcquireTokenResult>;
+    /**
+     * Silent token acquisition using the cached account + refresh token.
+     * Rejects with code 'UI_REQUIRED' if silent renewal fails and an
+     * interactive signIn() is needed (e.g. revoked consent, expired session).
+     */
+    acquireTokenSilent(options: AcquireTokenOptions): Promise<AcquireTokenResult>;
+    /**
+     * Returns the currently cached account, if any, without a network call.
+     * Wrapped in `{ value }` (matching Capacitor's own `Preferences.get()`
+     * convention) because the native bridge can only resolve a call with an
+     * object, never a bare `null` - unwrap `.value` at the call site.
+     */
+    getAccount(): Promise<{
+        value: AccountInfo | null;
+    }>;
+    /** Clears the local token cache, and optionally the browser session. */
+    signOut(options?: SignOutOptions): Promise<void>;
+}

package/dist/esm/definitions.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/index.d.ts

@@ -0,0 +1,4 @@
+import type { MsalAuthPlugin } from './definitions';
+declare const MsalAuth: MsalAuthPlugin;
+export * from './definitions';
+export { MsalAuth };

package/dist/esm/index.js

@@ -0,0 +1,6 @@
+import { registerPlugin } from '@capacitor/core';
+const MsalAuth = registerPlugin('MsalAuth', {
+    web: () => import('./web').then((m) => new m.MsalAuthWeb()),
+});
+export * from './definitions';
+export { MsalAuth };

package/dist/esm/web.d.ts

@@ -0,0 +1,41 @@
+import { WebPlugin } from '@capacitor/core';
+import type { MsalAuthPlugin, AcquireTokenOptions, AcquireTokenResult, AccountInfo, SignOutOptions } from './definitions';
+/**
+ * Web/PWA implementation backed by `@azure/msal-browser`, kept behind the
+ * same `MsalAuthPlugin` contract the native iOS/Android implementations use
+ * so callers (see `home.page.ts`, `auth.interceptor.ts`) don't need
+ * platform-specific branches.
+ *
+ * Interactive sign-in/sign-out use msal-browser's *redirect* APIs
+ * (`loginRedirect`/`logoutRedirect`), not popups. Microsoft's own MSAL.js
+ * guidance is that popups are "unreliable in Safari and mobile browsers due
+ * to popup blocker and gesture constraints," while redirect is "the most
+ * reliable interaction type across browsers, including Safari and mobile
+ * browsers" - the deciding factor for a PWA target.
+ *
+ * The tradeoff: `loginRedirect()`/`logoutRedirect()` navigate the browser
+ * away before their promises would otherwise resolve, so `signIn()` and
+ * `signOut({ clearBrowserSession: true })` below deliberately never resolve
+ * on web - unlike native, where the OS browser overlay returns control to
+ * the same JS context. The signed-in result is instead recovered on the
+ * *next* page load, once `handleRedirectPromise()` has processed it during
+ * initialization (see `createInstance()`). Callers must not block UI on
+ * `signIn()`'s promise settling on web; they should instead call
+ * `getAccount()` on app startup to pick up a just-completed redirect.
+ */
+export declare class MsalAuthWeb extends WebPlugin implements MsalAuthPlugin {
+    private initPromise;
+    signIn(options: AcquireTokenOptions): Promise<AcquireTokenResult>;
+    acquireTokenSilent(options: AcquireTokenOptions): Promise<AcquireTokenResult>;
+    getAccount(): Promise<{
+        value: AccountInfo | null;
+    }>;
+    signOut(options?: SignOutOptions): Promise<void>;
+    private getInstance;
+    private createInstance;
+    private loadConfig;
+    private toResult;
+    private toAccountInfo;
+    private rejection;
+    private messageOf;
+}

package/dist/esm/web.js

@@ -0,0 +1,187 @@
+import { WebPlugin } from '@capacitor/core';
+import { BrowserCacheLocation, InteractionRequiredAuthError, createStandardPublicClientApplication, } from '@azure/msal-browser';
+const CONFIG_PATH = 'assets/msal_config.json';
+/**
+ * Web/PWA implementation backed by `@azure/msal-browser`, kept behind the
+ * same `MsalAuthPlugin` contract the native iOS/Android implementations use
+ * so callers (see `home.page.ts`, `auth.interceptor.ts`) don't need
+ * platform-specific branches.
+ *
+ * Interactive sign-in/sign-out use msal-browser's *redirect* APIs
+ * (`loginRedirect`/`logoutRedirect`), not popups. Microsoft's own MSAL.js
+ * guidance is that popups are "unreliable in Safari and mobile browsers due
+ * to popup blocker and gesture constraints," while redirect is "the most
+ * reliable interaction type across browsers, including Safari and mobile
+ * browsers" - the deciding factor for a PWA target.
+ *
+ * The tradeoff: `loginRedirect()`/`logoutRedirect()` navigate the browser
+ * away before their promises would otherwise resolve, so `signIn()` and
+ * `signOut({ clearBrowserSession: true })` below deliberately never resolve
+ * on web - unlike native, where the OS browser overlay returns control to
+ * the same JS context. The signed-in result is instead recovered on the
+ * *next* page load, once `handleRedirectPromise()` has processed it during
+ * initialization (see `createInstance()`). Callers must not block UI on
+ * `signIn()`'s promise settling on web; they should instead call
+ * `getAccount()` on app startup to pick up a just-completed redirect.
+ */
+export class MsalAuthWeb extends WebPlugin {
+    constructor() {
+        super(...arguments);
+        this.initPromise = null;
+    }
+    async signIn(options) {
+        var _a;
+        const pca = await this.getInstance();
+        try {
+            await pca.loginRedirect({
+                scopes: (_a = options.scopes) !== null && _a !== void 0 ? _a : [],
+                domainHint: options.domainHint,
+                prompt: options.prompt,
+            });
+        }
+        catch (error) {
+            throw this.rejection('SIGN_IN_FAILED', this.messageOf(error));
+        }
+        // Unreachable in practice: loginRedirect() above navigates the page away
+        // first. Nothing after this point runs in this JS context.
+        return new Promise(() => undefined);
+    }
+    async acquireTokenSilent(options) {
+        var _a, _b;
+        const pca = await this.getInstance();
+        const account = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0];
+        if (!account) {
+            throw this.rejection('UI_REQUIRED', 'No cached account - call signIn() first.');
+        }
+        try {
+            const result = await pca.acquireTokenSilent({ account, scopes: (_b = options.scopes) !== null && _b !== void 0 ? _b : [] });
+            return this.toResult(result);
+        }
+        catch (error) {
+            if (error instanceof InteractionRequiredAuthError) {
+                throw this.rejection('UI_REQUIRED', error.message);
+            }
+            throw this.rejection('SILENT_FAILED', this.messageOf(error));
+        }
+    }
+    async getAccount() {
+        var _a, _b;
+        const pca = await this.getInstance();
+        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : null;
+        return { value: account ? this.toAccountInfo(account) : null };
+    }
+    async signOut(options) {
+        var _a, _b;
+        const pca = await this.getInstance();
+        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : undefined;
+        try {
+            if (options === null || options === void 0 ? void 0 : options.clearBrowserSession) {
+                // Ends the Entra browser SSO session too, not just the local cache -
+                // like signIn() above, this navigates away and never returns here.
+                await pca.logoutRedirect({ account });
+                return new Promise(() => undefined);
+            }
+            // Local-only sign-out: clears this account's cached tokens without any
+            // network call or navigation, matching native signOut()'s default
+            // "local cache only" behavior.
+            await pca.clearCache({ account });
+        }
+        catch (error) {
+            throw this.rejection('SIGN_OUT_FAILED', this.messageOf(error));
+        }
+    }
+    async getInstance() {
+        if (!this.initPromise) {
+            // Memoize per page load, but let a failed attempt be retried instead
+            // of permanently poisoning every later call with the same rejection.
+            this.initPromise = this.createInstance().catch((error) => {
+                this.initPromise = null;
+                throw error;
+            });
+        }
+        return this.initPromise;
+    }
+    async createInstance() {
+        var _a, _b, _c;
+        const config = await this.loadConfig();
+        const redirectUri = (_a = config.redirect_uri) !== null && _a !== void 0 ? _a : window.location.origin;
+        const pca = await createStandardPublicClientApplication({
+            auth: {
+                clientId: config.client_id,
+                authority: config.authority_url,
+                knownAuthorities: (_b = config.known_authorities) !== null && _b !== void 0 ? _b : [],
+                redirectUri,
+                postLogoutRedirectUri: (_c = config.post_logout_redirect_uri) !== null && _c !== void 0 ? _c : redirectUri,
+            },
+            cache: {
+                // localStorage (not the sessionStorage default) so a signed-in user
+                // stays signed in across app relaunches/tab closes, matching native
+                // MSAL's persistent Keychain/EncryptedSharedPreferences cache - the
+                // PWA equivalent of "not native" would otherwise re-prompt every
+                // fresh tab, unlike iOS/Android.
+                cacheLocation: BrowserCacheLocation.LocalStorage,
+            },
+        });
+        // Must run exactly once per page load, before any other account-reading
+        // call - this is what completes the loginRedirect()/logoutRedirect()
+        // round trip from the previous page load, if one is in flight. A failure
+        // here (e.g. the user denied consent on the Entra page) shouldn't break
+        // the whole plugin instance - it's swallowed so getAccount() simply comes
+        // back null and the app can prompt sign-in again, mirroring how a
+        // rejected native signIn() call leaves the app just as unauthenticated.
+        try {
+            const redirectResult = await pca.handleRedirectPromise();
+            if (redirectResult === null || redirectResult === void 0 ? void 0 : redirectResult.account) {
+                pca.setActiveAccount(redirectResult.account);
+            }
+        }
+        catch (error) {
+            console.warn('[MsalAuthWeb] handleRedirectPromise() failed', error);
+        }
+        return pca;
+    }
+    async loadConfig() {
+        const help = `Add a web msal_config.json at "${CONFIG_PATH}" (e.g. src/assets/msal_config.json in an Ionic/Angular app) - see the plugin README's "Web / PWA setup" section.`;
+        let response;
+        try {
+            response = await fetch(CONFIG_PATH);
+        }
+        catch (error) {
+            throw this.rejection('NOT_INITIALIZED', `Could not load ${CONFIG_PATH}: ${this.messageOf(error)}. ${help}`);
+        }
+        if (!response.ok) {
+            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} returned HTTP ${response.status}. ${help}`);
+        }
+        const config = (await response.json());
+        if (!config.client_id || !config.authority_url) {
+            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} is missing client_id or authority_url. ${help}`);
+        }
+        return config;
+    }
+    toResult(result) {
+        var _a, _b;
+        return {
+            accessToken: result.accessToken,
+            idToken: result.idToken,
+            expiresOn: result.expiresOn ? result.expiresOn.getTime() : Date.now(),
+            // Local MSAL account identifier, not the raw `oid` claim - matches the
+            // native implementations' accountId semantics (see definitions.ts).
+            accountId: (_b = (_a = result.account) === null || _a === void 0 ? void 0 : _a.homeAccountId) !== null && _b !== void 0 ? _b : '',
+            scopes: result.scopes,
+        };
+    }
+    toAccountInfo(account) {
+        var _a, _b;
+        return {
+            accountId: account.homeAccountId,
+            username: (_a = account.username) !== null && _a !== void 0 ? _a : null,
+            idTokenClaims: (_b = account.idTokenClaims) !== null && _b !== void 0 ? _b : null,
+        };
+    }
+    rejection(code, message) {
+        return Object.assign(new Error(message), { code });
+    }
+    messageOf(error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}