@nativelement/capacitor-msal-entra 0.0.0-stage → 1.0.1

package/dist/plugin.cjs.js

@@ -0,0 +1,202 @@
+'use strict';
+
+var core = require('@capacitor/core');
+var msalBrowser = require('@azure/msal-browser');
+
+const MsalAuth = core.registerPlugin('MsalAuth', {
+    web: () => Promise.resolve().then(function () { return web; }).then((m) => new m.MsalAuthWeb()),
+});
+
+const CONFIG_PATH = 'assets/msal_config.json';
+/**
+ * Web/PWA implementation backed by `@azure/msal-browser`, kept behind the
+ * same `MsalAuthPlugin` contract the native iOS/Android implementations use
+ * so callers (see `home.page.ts`, `auth.interceptor.ts`) don't need
+ * platform-specific branches.
+ *
+ * Interactive sign-in/sign-out use msal-browser's *redirect* APIs
+ * (`loginRedirect`/`logoutRedirect`), not popups. Microsoft's own MSAL.js
+ * guidance is that popups are "unreliable in Safari and mobile browsers due
+ * to popup blocker and gesture constraints," while redirect is "the most
+ * reliable interaction type across browsers, including Safari and mobile
+ * browsers" - the deciding factor for a PWA target.
+ *
+ * The tradeoff: `loginRedirect()`/`logoutRedirect()` navigate the browser
+ * away before their promises would otherwise resolve, so `signIn()` and
+ * `signOut({ clearBrowserSession: true })` below deliberately never resolve
+ * on web - unlike native, where the OS browser overlay returns control to
+ * the same JS context. The signed-in result is instead recovered on the
+ * *next* page load, once `handleRedirectPromise()` has processed it during
+ * initialization (see `createInstance()`). Callers must not block UI on
+ * `signIn()`'s promise settling on web; they should instead call
+ * `getAccount()` on app startup to pick up a just-completed redirect.
+ */
+class MsalAuthWeb extends core.WebPlugin {
+    constructor() {
+        super(...arguments);
+        this.initPromise = null;
+    }
+    async signIn(options) {
+        var _a;
+        const pca = await this.getInstance();
+        try {
+            await pca.loginRedirect({
+                scopes: (_a = options.scopes) !== null && _a !== void 0 ? _a : [],
+                domainHint: options.domainHint,
+                prompt: options.prompt,
+            });
+        }
+        catch (error) {
+            throw this.rejection('SIGN_IN_FAILED', this.messageOf(error));
+        }
+        // Unreachable in practice: loginRedirect() above navigates the page away
+        // first. Nothing after this point runs in this JS context.
+        return new Promise(() => undefined);
+    }
+    async acquireTokenSilent(options) {
+        var _a, _b;
+        const pca = await this.getInstance();
+        const account = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0];
+        if (!account) {
+            throw this.rejection('UI_REQUIRED', 'No cached account - call signIn() first.');
+        }
+        try {
+            const result = await pca.acquireTokenSilent({ account, scopes: (_b = options.scopes) !== null && _b !== void 0 ? _b : [] });
+            return this.toResult(result);
+        }
+        catch (error) {
+            if (error instanceof msalBrowser.InteractionRequiredAuthError) {
+                throw this.rejection('UI_REQUIRED', error.message);
+            }
+            throw this.rejection('SILENT_FAILED', this.messageOf(error));
+        }
+    }
+    async getAccount() {
+        var _a, _b;
+        const pca = await this.getInstance();
+        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : null;
+        return { value: account ? this.toAccountInfo(account) : null };
+    }
+    async signOut(options) {
+        var _a, _b;
+        const pca = await this.getInstance();
+        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : undefined;
+        try {
+            if (options === null || options === void 0 ? void 0 : options.clearBrowserSession) {
+                // Ends the Entra browser SSO session too, not just the local cache -
+                // like signIn() above, this navigates away and never returns here.
+                await pca.logoutRedirect({ account });
+                return new Promise(() => undefined);
+            }
+            // Local-only sign-out: clears this account's cached tokens without any
+            // network call or navigation, matching native signOut()'s default
+            // "local cache only" behavior.
+            await pca.clearCache({ account });
+        }
+        catch (error) {
+            throw this.rejection('SIGN_OUT_FAILED', this.messageOf(error));
+        }
+    }
+    async getInstance() {
+        if (!this.initPromise) {
+            // Memoize per page load, but let a failed attempt be retried instead
+            // of permanently poisoning every later call with the same rejection.
+            this.initPromise = this.createInstance().catch((error) => {
+                this.initPromise = null;
+                throw error;
+            });
+        }
+        return this.initPromise;
+    }
+    async createInstance() {
+        var _a, _b, _c;
+        const config = await this.loadConfig();
+        const redirectUri = (_a = config.redirect_uri) !== null && _a !== void 0 ? _a : window.location.origin;
+        const pca = await msalBrowser.createStandardPublicClientApplication({
+            auth: {
+                clientId: config.client_id,
+                authority: config.authority_url,
+                knownAuthorities: (_b = config.known_authorities) !== null && _b !== void 0 ? _b : [],
+                redirectUri,
+                postLogoutRedirectUri: (_c = config.post_logout_redirect_uri) !== null && _c !== void 0 ? _c : redirectUri,
+            },
+            cache: {
+                // localStorage (not the sessionStorage default) so a signed-in user
+                // stays signed in across app relaunches/tab closes, matching native
+                // MSAL's persistent Keychain/EncryptedSharedPreferences cache - the
+                // PWA equivalent of "not native" would otherwise re-prompt every
+                // fresh tab, unlike iOS/Android.
+                cacheLocation: msalBrowser.BrowserCacheLocation.LocalStorage,
+            },
+        });
+        // Must run exactly once per page load, before any other account-reading
+        // call - this is what completes the loginRedirect()/logoutRedirect()
+        // round trip from the previous page load, if one is in flight. A failure
+        // here (e.g. the user denied consent on the Entra page) shouldn't break
+        // the whole plugin instance - it's swallowed so getAccount() simply comes
+        // back null and the app can prompt sign-in again, mirroring how a
+        // rejected native signIn() call leaves the app just as unauthenticated.
+        try {
+            const redirectResult = await pca.handleRedirectPromise();
+            if (redirectResult === null || redirectResult === void 0 ? void 0 : redirectResult.account) {
+                pca.setActiveAccount(redirectResult.account);
+            }
+        }
+        catch (error) {
+            console.warn('[MsalAuthWeb] handleRedirectPromise() failed', error);
+        }
+        return pca;
+    }
+    async loadConfig() {
+        const help = `Add a web msal_config.json at "${CONFIG_PATH}" (e.g. src/assets/msal_config.json in an Ionic/Angular app) - see the plugin README's "Web / PWA setup" section.`;
+        let response;
+        try {
+            response = await fetch(CONFIG_PATH);
+        }
+        catch (error) {
+            throw this.rejection('NOT_INITIALIZED', `Could not load ${CONFIG_PATH}: ${this.messageOf(error)}. ${help}`);
+        }
+        if (!response.ok) {
+            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} returned HTTP ${response.status}. ${help}`);
+        }
+        const config = (await response.json());
+        if (!config.client_id || !config.authority_url) {
+            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} is missing client_id or authority_url. ${help}`);
+        }
+        return config;
+    }
+    toResult(result) {
+        var _a, _b;
+        return {
+            accessToken: result.accessToken,
+            idToken: result.idToken,
+            expiresOn: result.expiresOn ? result.expiresOn.getTime() : Date.now(),
+            // Local MSAL account identifier, not the raw `oid` claim - matches the
+            // native implementations' accountId semantics (see definitions.ts).
+            accountId: (_b = (_a = result.account) === null || _a === void 0 ? void 0 : _a.homeAccountId) !== null && _b !== void 0 ? _b : '',
+            scopes: result.scopes,
+        };
+    }
+    toAccountInfo(account) {
+        var _a, _b;
+        return {
+            accountId: account.homeAccountId,
+            username: (_a = account.username) !== null && _a !== void 0 ? _a : null,
+            idTokenClaims: (_b = account.idTokenClaims) !== null && _b !== void 0 ? _b : null,
+        };
+    }
+    rejection(code, message) {
+        return Object.assign(new Error(message), { code });
+    }
+    messageOf(error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+
+var web = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    MsalAuthWeb: MsalAuthWeb
+});
+
+exports.MsalAuth = MsalAuth;
+//# sourceMappingURL=plugin.cjs.js.map

package/dist/plugin.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.cjs.js","sources":["esm/index.js","esm/web.js"],"sourcesContent":["import { registerPlugin } from '@capacitor/core';\nconst MsalAuth = registerPlugin('MsalAuth', {\n    web: () => import('./web').then((m) => new m.MsalAuthWeb()),\n});\nexport * from './definitions';\nexport { MsalAuth };\n","import { WebPlugin } from '@capacitor/core';\nimport { BrowserCacheLocation, InteractionRequiredAuthError, createStandardPublicClientApplication, } from '@azure/msal-browser';\nconst CONFIG_PATH = 'assets/msal_config.json';\n/**\n * Web/PWA implementation backed by `@azure/msal-browser`, kept behind the\n * same `MsalAuthPlugin` contract the native iOS/Android implementations use\n * so callers (see `home.page.ts`, `auth.interceptor.ts`) don't need\n * platform-specific branches.\n *\n * Interactive sign-in/sign-out use msal-browser's *redirect* APIs\n * (`loginRedirect`/`logoutRedirect`), not popups. Microsoft's own MSAL.js\n * guidance is that popups are \"unreliable in Safari and mobile browsers due\n * to popup blocker and gesture constraints,\" while redirect is \"the most\n * reliable interaction type across browsers, including Safari and mobile\n * browsers\" - the deciding factor for a PWA target.\n *\n * The tradeoff: `loginRedirect()`/`logoutRedirect()` navigate the browser\n * away before their promises would otherwise resolve, so `signIn()` and\n * `signOut({ clearBrowserSession: true })` below deliberately never resolve\n * on web - unlike native, where the OS browser overlay returns control to\n * the same JS context. The signed-in result is instead recovered on the\n * *next* page load, once `handleRedirectPromise()` has processed it during\n * initialization (see `createInstance()`). Callers must not block UI on\n * `signIn()`'s promise settling on web; they should instead call\n * `getAccount()` on app startup to pick up a just-completed redirect.\n */\nexport class MsalAuthWeb extends WebPlugin {\n    constructor() {\n        super(...arguments);\n        this.initPromise = null;\n    }\n    async signIn(options) {\n        var _a;\n        const pca = await this.getInstance();\n        try {\n            await pca.loginRedirect({\n                scopes: (_a = options.scopes) !== null && _a !== void 0 ? _a : [],\n                domainHint: options.domainHint,\n                prompt: options.prompt,\n            });\n        }\n        catch (error) {\n            throw this.rejection('SIGN_IN_FAILED', this.messageOf(error));\n        }\n        // Unreachable in practice: loginRedirect() above navigates the page away\n        // first. Nothing after this point runs in this JS context.\n        return new Promise(() => undefined);\n    }\n    async acquireTokenSilent(options) {\n        var _a, _b;\n        const pca = await this.getInstance();\n        const account = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0];\n        if (!account) {\n            throw this.rejection('UI_REQUIRED', 'No cached account - call signIn() first.');\n        }\n        try {\n            const result = await pca.acquireTokenSilent({ account, scopes: (_b = options.scopes) !== null && _b !== void 0 ? _b : [] });\n            return this.toResult(result);\n        }\n        catch (error) {\n            if (error instanceof InteractionRequiredAuthError) {\n                throw this.rejection('UI_REQUIRED', error.message);\n            }\n            throw this.rejection('SILENT_FAILED', this.messageOf(error));\n        }\n    }\n    async getAccount() {\n        var _a, _b;\n        const pca = await this.getInstance();\n        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : null;\n        return { value: account ? this.toAccountInfo(account) : null };\n    }\n    async signOut(options) {\n        var _a, _b;\n        const pca = await this.getInstance();\n        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : undefined;\n        try {\n            if (options === null || options === void 0 ? void 0 : options.clearBrowserSession) {\n                // Ends the Entra browser SSO session too, not just the local cache -\n                // like signIn() above, this navigates away and never returns here.\n                await pca.logoutRedirect({ account });\n                return new Promise(() => undefined);\n            }\n            // Local-only sign-out: clears this account's cached tokens without any\n            // network call or navigation, matching native signOut()'s default\n            // \"local cache only\" behavior.\n            await pca.clearCache({ account });\n        }\n        catch (error) {\n            throw this.rejection('SIGN_OUT_FAILED', this.messageOf(error));\n        }\n    }\n    async getInstance() {\n        if (!this.initPromise) {\n            // Memoize per page load, but let a failed attempt be retried instead\n            // of permanently poisoning every later call with the same rejection.\n            this.initPromise = this.createInstance().catch((error) => {\n                this.initPromise = null;\n                throw error;\n            });\n        }\n        return this.initPromise;\n    }\n    async createInstance() {\n        var _a, _b, _c;\n        const config = await this.loadConfig();\n        const redirectUri = (_a = config.redirect_uri) !== null && _a !== void 0 ? _a : window.location.origin;\n        const pca = await createStandardPublicClientApplication({\n            auth: {\n                clientId: config.client_id,\n                authority: config.authority_url,\n                knownAuthorities: (_b = config.known_authorities) !== null && _b !== void 0 ? _b : [],\n                redirectUri,\n                postLogoutRedirectUri: (_c = config.post_logout_redirect_uri) !== null && _c !== void 0 ? _c : redirectUri,\n            },\n            cache: {\n                // localStorage (not the sessionStorage default) so a signed-in user\n                // stays signed in across app relaunches/tab closes, matching native\n                // MSAL's persistent Keychain/EncryptedSharedPreferences cache - the\n                // PWA equivalent of \"not native\" would otherwise re-prompt every\n                // fresh tab, unlike iOS/Android.\n                cacheLocation: BrowserCacheLocation.LocalStorage,\n            },\n        });\n        // Must run exactly once per page load, before any other account-reading\n        // call - this is what completes the loginRedirect()/logoutRedirect()\n        // round trip from the previous page load, if one is in flight. A failure\n        // here (e.g. the user denied consent on the Entra page) shouldn't break\n        // the whole plugin instance - it's swallowed so getAccount() simply comes\n        // back null and the app can prompt sign-in again, mirroring how a\n        // rejected native signIn() call leaves the app just as unauthenticated.\n        try {\n            const redirectResult = await pca.handleRedirectPromise();\n            if (redirectResult === null || redirectResult === void 0 ? void 0 : redirectResult.account) {\n                pca.setActiveAccount(redirectResult.account);\n            }\n        }\n        catch (error) {\n            console.warn('[MsalAuthWeb] handleRedirectPromise() failed', error);\n        }\n        return pca;\n    }\n    async loadConfig() {\n        const help = `Add a web msal_config.json at \"${CONFIG_PATH}\" (e.g. src/assets/msal_config.json in an Ionic/Angular app) - see the plugin README's \"Web / PWA setup\" section.`;\n        let response;\n        try {\n            response = await fetch(CONFIG_PATH);\n        }\n        catch (error) {\n            throw this.rejection('NOT_INITIALIZED', `Could not load ${CONFIG_PATH}: ${this.messageOf(error)}. ${help}`);\n        }\n        if (!response.ok) {\n            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} returned HTTP ${response.status}. ${help}`);\n        }\n        const config = (await response.json());\n        if (!config.client_id || !config.authority_url) {\n            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} is missing client_id or authority_url. ${help}`);\n        }\n        return config;\n    }\n    toResult(result) {\n        var _a, _b;\n        return {\n            accessToken: result.accessToken,\n            idToken: result.idToken,\n            expiresOn: result.expiresOn ? result.expiresOn.getTime() : Date.now(),\n            // Local MSAL account identifier, not the raw `oid` claim - matches the\n            // native implementations' accountId semantics (see definitions.ts).\n            accountId: (_b = (_a = result.account) === null || _a === void 0 ? void 0 : _a.homeAccountId) !== null && _b !== void 0 ? _b : '',\n            scopes: result.scopes,\n        };\n    }\n    toAccountInfo(account) {\n        var _a, _b;\n        return {\n            accountId: account.homeAccountId,\n            username: (_a = account.username) !== null && _a !== void 0 ? _a : null,\n            idTokenClaims: (_b = account.idTokenClaims) !== null && _b !== void 0 ? _b : null,\n        };\n    }\n    rejection(code, message) {\n        return Object.assign(new Error(message), { code });\n    }\n    messageOf(error) {\n        return error instanceof Error ? error.message : String(error);\n    }\n}\n"],"names":["registerPlugin","WebPlugin","InteractionRequiredAuthError","createStandardPublicClientApplication","BrowserCacheLocation"],"mappings":";;;;;AACK,MAAC,QAAQ,GAAGA,mBAAc,CAAC,UAAU,EAAE;AAC5C,IAAI,GAAG,EAAE,MAAM,mDAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;;ACDD,MAAM,WAAW,GAAG,yBAAyB;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,WAAW,SAASC,cAAS,CAAC;AAC3C,IAAI,WAAW,GAAG;AAClB,QAAQ,KAAK,CAAC,GAAG,SAAS,CAAC;AAC3B,QAAQ,IAAI,CAAC,WAAW,GAAG,IAAI;AAC/B,IAAI;AACJ,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE;AAC1B,QAAQ,IAAI,EAAE;AACd,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;AAC5C,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,CAAC,aAAa,CAAC;AACpC,gBAAgB,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE;AACjF,gBAAgB,UAAU,EAAE,OAAO,CAAC,UAAU;AAC9C,gBAAgB,MAAM,EAAE,OAAO,CAAC,MAAM;AACtC,aAAa,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,KAAK,EAAE;AACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACzE,QAAQ;AACR;AACA;AACA,QAAQ,OAAO,IAAI,OAAO,CAAC,MAAM,SAAS,CAAC;AAC3C,IAAI;AACJ,IAAI,MAAM,kBAAkB,CAAC,OAAO,EAAE;AACtC,QAAQ,IAAI,EAAE,EAAE,EAAE;AAClB,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;AAC5C,QAAQ,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAC9G,QAAQ,IAAI,CAAC,OAAO,EAAE;AACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,0CAA0C,CAAC;AAC3F,QAAQ;AACR,QAAQ,IAAI;AACZ,YAAY,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;AACvI,YAAY,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;AACxC,QAAQ;AACR,QAAQ,OAAO,KAAK,EAAE;AACtB,YAAY,IAAI,KAAK,YAAYC,wCAA4B,EAAE;AAC/D,gBAAgB,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC;AAClE,YAAY;AACZ,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxE,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,IAAI,EAAE,EAAE,EAAE;AAClB,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;AAC5C,QAAQ,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI;AAC3J,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE;AACtE,IAAI;AACJ,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE;AAC3B,QAAQ,IAAI,EAAE,EAAE,EAAE;AAClB,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;AAC5C,QAAQ,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,SAAS;AAChK,QAAQ,IAAI;AACZ,YAAY,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,mBAAmB,EAAE;AAC/F;AACA;AACA,gBAAgB,MAAM,GAAG,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;AACrD,gBAAgB,OAAO,IAAI,OAAO,CAAC,MAAM,SAAS,CAAC;AACnD,YAAY;AACZ;AACA;AACA;AACA,YAAY,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;AAC7C,QAAQ;AACR,QAAQ,OAAO,KAAK,EAAE;AACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1E,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;AAC/B;AACA;AACA,YAAY,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK;AACtE,gBAAgB,IAAI,CAAC,WAAW,GAAG,IAAI;AACvC,gBAAgB,MAAM,KAAK;AAC3B,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,WAAW;AAC/B,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE;AACtB,QAAQ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;AAC9C,QAAQ,MAAM,WAAW,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;AAC9G,QAAQ,MAAM,GAAG,GAAG,MAAMC,iDAAqC,CAAC;AAChE,YAAY,IAAI,EAAE;AAClB,gBAAgB,QAAQ,EAAE,MAAM,CAAC,SAAS;AAC1C,gBAAgB,SAAS,EAAE,MAAM,CAAC,aAAa;AAC/C,gBAAgB,gBAAgB,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,iBAAiB,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE;AACrG,gBAAgB,WAAW;AAC3B,gBAAgB,qBAAqB,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,wBAAwB,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,WAAW;AAC1H,aAAa;AACb,YAAY,KAAK,EAAE;AACnB;AACA;AACA;AACA;AACA;AACA,gBAAgB,aAAa,EAAEC,gCAAoB,CAAC,YAAY;AAChE,aAAa;AACb,SAAS,CAAC;AACV;AACA;AACA;AACA;AACA;AACA;AACA;AACA,QAAQ,IAAI;AACZ,YAAY,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,qBAAqB,EAAE;AACpE,YAAY,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE;AACxG,gBAAgB,GAAG,CAAC,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC;AAC5D,YAAY;AACZ,QAAQ;AACR,QAAQ,OAAO,KAAK,EAAE;AACtB,YAAY,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,CAAC;AAC/E,QAAQ;AACR,QAAQ,OAAO,GAAG;AAClB,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,IAAI,GAAG,CAAC,+BAA+B,EAAE,WAAW,CAAC,iHAAiH,CAAC;AACrL,QAAQ,IAAI,QAAQ;AACpB,QAAQ,IAAI;AACZ,YAAY,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;AAC/C,QAAQ;AACR,QAAQ,OAAO,KAAK,EAAE;AACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AACvH,QAAQ;AACR,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;AAC1B,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,EAAE,WAAW,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/G,QAAQ;AACR,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC9C,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;AACxD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,EAAE,WAAW,CAAC,wCAAwC,EAAE,IAAI,CAAC,CAAC,CAAC;AACpH,QAAQ;AACR,QAAQ,OAAO,MAAM;AACrB,IAAI;AACJ,IAAI,QAAQ,CAAC,MAAM,EAAE;AACrB,QAAQ,IAAI,EAAE,EAAE,EAAE;AAClB,QAAQ,OAAO;AACf,YAAY,WAAW,EAAE,MAAM,CAAC,WAAW;AAC3C,YAAY,OAAO,EAAE,MAAM,CAAC,OAAO;AACnC,YAAY,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;AACjF;AACA;AACA,YAAY,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,aAAa,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE;AAC7I,YAAY,MAAM,EAAE,MAAM,CAAC,MAAM;AACjC,SAAS;AACT,IAAI;AACJ,IAAI,aAAa,CAAC,OAAO,EAAE;AAC3B,QAAQ,IAAI,EAAE,EAAE,EAAE;AAClB,QAAQ,OAAO;AACf,YAAY,SAAS,EAAE,OAAO,CAAC,aAAa;AAC5C,YAAY,QAAQ,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI;AACnF,YAAY,aAAa,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,aAAa,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI;AAC7F,SAAS;AACT,IAAI;AACJ,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE;AAC7B,QAAQ,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AAC1D,IAAI;AACJ,IAAI,SAAS,CAAC,KAAK,EAAE;AACrB,QAAQ,OAAO,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;AACrE,IAAI;AACJ;;;;;;;"}

package/dist/plugin.js

@@ -0,0 +1,204 @@
+var capacitorMsalEntraPlugin = (function (exports, core, msalBrowser) {
+    'use strict';
+
+    const MsalAuth = core.registerPlugin('MsalAuth', {
+        web: () => Promise.resolve().then(function () { return web; }).then((m) => new m.MsalAuthWeb()),
+    });
+
+    const CONFIG_PATH = 'assets/msal_config.json';
+    /**
+     * Web/PWA implementation backed by `@azure/msal-browser`, kept behind the
+     * same `MsalAuthPlugin` contract the native iOS/Android implementations use
+     * so callers (see `home.page.ts`, `auth.interceptor.ts`) don't need
+     * platform-specific branches.
+     *
+     * Interactive sign-in/sign-out use msal-browser's *redirect* APIs
+     * (`loginRedirect`/`logoutRedirect`), not popups. Microsoft's own MSAL.js
+     * guidance is that popups are "unreliable in Safari and mobile browsers due
+     * to popup blocker and gesture constraints," while redirect is "the most
+     * reliable interaction type across browsers, including Safari and mobile
+     * browsers" - the deciding factor for a PWA target.
+     *
+     * The tradeoff: `loginRedirect()`/`logoutRedirect()` navigate the browser
+     * away before their promises would otherwise resolve, so `signIn()` and
+     * `signOut({ clearBrowserSession: true })` below deliberately never resolve
+     * on web - unlike native, where the OS browser overlay returns control to
+     * the same JS context. The signed-in result is instead recovered on the
+     * *next* page load, once `handleRedirectPromise()` has processed it during
+     * initialization (see `createInstance()`). Callers must not block UI on
+     * `signIn()`'s promise settling on web; they should instead call
+     * `getAccount()` on app startup to pick up a just-completed redirect.
+     */
+    class MsalAuthWeb extends core.WebPlugin {
+        constructor() {
+            super(...arguments);
+            this.initPromise = null;
+        }
+        async signIn(options) {
+            var _a;
+            const pca = await this.getInstance();
+            try {
+                await pca.loginRedirect({
+                    scopes: (_a = options.scopes) !== null && _a !== void 0 ? _a : [],
+                    domainHint: options.domainHint,
+                    prompt: options.prompt,
+                });
+            }
+            catch (error) {
+                throw this.rejection('SIGN_IN_FAILED', this.messageOf(error));
+            }
+            // Unreachable in practice: loginRedirect() above navigates the page away
+            // first. Nothing after this point runs in this JS context.
+            return new Promise(() => undefined);
+        }
+        async acquireTokenSilent(options) {
+            var _a, _b;
+            const pca = await this.getInstance();
+            const account = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0];
+            if (!account) {
+                throw this.rejection('UI_REQUIRED', 'No cached account - call signIn() first.');
+            }
+            try {
+                const result = await pca.acquireTokenSilent({ account, scopes: (_b = options.scopes) !== null && _b !== void 0 ? _b : [] });
+                return this.toResult(result);
+            }
+            catch (error) {
+                if (error instanceof msalBrowser.InteractionRequiredAuthError) {
+                    throw this.rejection('UI_REQUIRED', error.message);
+                }
+                throw this.rejection('SILENT_FAILED', this.messageOf(error));
+            }
+        }
+        async getAccount() {
+            var _a, _b;
+            const pca = await this.getInstance();
+            const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : null;
+            return { value: account ? this.toAccountInfo(account) : null };
+        }
+        async signOut(options) {
+            var _a, _b;
+            const pca = await this.getInstance();
+            const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : undefined;
+            try {
+                if (options === null || options === void 0 ? void 0 : options.clearBrowserSession) {
+                    // Ends the Entra browser SSO session too, not just the local cache -
+                    // like signIn() above, this navigates away and never returns here.
+                    await pca.logoutRedirect({ account });
+                    return new Promise(() => undefined);
+                }
+                // Local-only sign-out: clears this account's cached tokens without any
+                // network call or navigation, matching native signOut()'s default
+                // "local cache only" behavior.
+                await pca.clearCache({ account });
+            }
+            catch (error) {
+                throw this.rejection('SIGN_OUT_FAILED', this.messageOf(error));
+            }
+        }
+        async getInstance() {
+            if (!this.initPromise) {
+                // Memoize per page load, but let a failed attempt be retried instead
+                // of permanently poisoning every later call with the same rejection.
+                this.initPromise = this.createInstance().catch((error) => {
+                    this.initPromise = null;
+                    throw error;
+                });
+            }
+            return this.initPromise;
+        }
+        async createInstance() {
+            var _a, _b, _c;
+            const config = await this.loadConfig();
+            const redirectUri = (_a = config.redirect_uri) !== null && _a !== void 0 ? _a : window.location.origin;
+            const pca = await msalBrowser.createStandardPublicClientApplication({
+                auth: {
+                    clientId: config.client_id,
+                    authority: config.authority_url,
+                    knownAuthorities: (_b = config.known_authorities) !== null && _b !== void 0 ? _b : [],
+                    redirectUri,
+                    postLogoutRedirectUri: (_c = config.post_logout_redirect_uri) !== null && _c !== void 0 ? _c : redirectUri,
+                },
+                cache: {
+                    // localStorage (not the sessionStorage default) so a signed-in user
+                    // stays signed in across app relaunches/tab closes, matching native
+                    // MSAL's persistent Keychain/EncryptedSharedPreferences cache - the
+                    // PWA equivalent of "not native" would otherwise re-prompt every
+                    // fresh tab, unlike iOS/Android.
+                    cacheLocation: msalBrowser.BrowserCacheLocation.LocalStorage,
+                },
+            });
+            // Must run exactly once per page load, before any other account-reading
+            // call - this is what completes the loginRedirect()/logoutRedirect()
+            // round trip from the previous page load, if one is in flight. A failure
+            // here (e.g. the user denied consent on the Entra page) shouldn't break
+            // the whole plugin instance - it's swallowed so getAccount() simply comes
+            // back null and the app can prompt sign-in again, mirroring how a
+            // rejected native signIn() call leaves the app just as unauthenticated.
+            try {
+                const redirectResult = await pca.handleRedirectPromise();
+                if (redirectResult === null || redirectResult === void 0 ? void 0 : redirectResult.account) {
+                    pca.setActiveAccount(redirectResult.account);
+                }
+            }
+            catch (error) {
+                console.warn('[MsalAuthWeb] handleRedirectPromise() failed', error);
+            }
+            return pca;
+        }
+        async loadConfig() {
+            const help = `Add a web msal_config.json at "${CONFIG_PATH}" (e.g. src/assets/msal_config.json in an Ionic/Angular app) - see the plugin README's "Web / PWA setup" section.`;
+            let response;
+            try {
+                response = await fetch(CONFIG_PATH);
+            }
+            catch (error) {
+                throw this.rejection('NOT_INITIALIZED', `Could not load ${CONFIG_PATH}: ${this.messageOf(error)}. ${help}`);
+            }
+            if (!response.ok) {
+                throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} returned HTTP ${response.status}. ${help}`);
+            }
+            const config = (await response.json());
+            if (!config.client_id || !config.authority_url) {
+                throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} is missing client_id or authority_url. ${help}`);
+            }
+            return config;
+        }
+        toResult(result) {
+            var _a, _b;
+            return {
+                accessToken: result.accessToken,
+                idToken: result.idToken,
+                expiresOn: result.expiresOn ? result.expiresOn.getTime() : Date.now(),
+                // Local MSAL account identifier, not the raw `oid` claim - matches the
+                // native implementations' accountId semantics (see definitions.ts).
+                accountId: (_b = (_a = result.account) === null || _a === void 0 ? void 0 : _a.homeAccountId) !== null && _b !== void 0 ? _b : '',
+                scopes: result.scopes,
+            };
+        }
+        toAccountInfo(account) {
+            var _a, _b;
+            return {
+                accountId: account.homeAccountId,
+                username: (_a = account.username) !== null && _a !== void 0 ? _a : null,
+                idTokenClaims: (_b = account.idTokenClaims) !== null && _b !== void 0 ? _b : null,
+            };
+        }
+        rejection(code, message) {
+            return Object.assign(new Error(message), { code });
+        }
+        messageOf(error) {
+            return error instanceof Error ? error.message : String(error);
+        }
+    }
+
+    var web = /*#__PURE__*/Object.freeze({
+        __proto__: null,
+        MsalAuthWeb: MsalAuthWeb
+    });
+
+    exports.MsalAuth = MsalAuth;
+
+    return exports;
+
+})({}, capacitorExports, msal);
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sources":["esm/index.js","esm/web.js"],"sourcesContent":["import { registerPlugin } from '@capacitor/core';\nconst MsalAuth = registerPlugin('MsalAuth', {\n    web: () => import('./web').then((m) => new m.MsalAuthWeb()),\n});\nexport * from './definitions';\nexport { MsalAuth };\n","import { WebPlugin } from '@capacitor/core';\nimport { BrowserCacheLocation, InteractionRequiredAuthError, createStandardPublicClientApplication, } from '@azure/msal-browser';\nconst CONFIG_PATH = 'assets/msal_config.json';\n/**\n * Web/PWA implementation backed by `@azure/msal-browser`, kept behind the\n * same `MsalAuthPlugin` contract the native iOS/Android implementations use\n * so callers (see `home.page.ts`, `auth.interceptor.ts`) don't need\n * platform-specific branches.\n *\n * Interactive sign-in/sign-out use msal-browser's *redirect* APIs\n * (`loginRedirect`/`logoutRedirect`), not popups. Microsoft's own MSAL.js\n * guidance is that popups are \"unreliable in Safari and mobile browsers due\n * to popup blocker and gesture constraints,\" while redirect is \"the most\n * reliable interaction type across browsers, including Safari and mobile\n * browsers\" - the deciding factor for a PWA target.\n *\n * The tradeoff: `loginRedirect()`/`logoutRedirect()` navigate the browser\n * away before their promises would otherwise resolve, so `signIn()` and\n * `signOut({ clearBrowserSession: true })` below deliberately never resolve\n * on web - unlike native, where the OS browser overlay returns control to\n * the same JS context. The signed-in result is instead recovered on the\n * *next* page load, once `handleRedirectPromise()` has processed it during\n * initialization (see `createInstance()`). Callers must not block UI on\n * `signIn()`'s promise settling on web; they should instead call\n * `getAccount()` on app startup to pick up a just-completed redirect.\n */\nexport class MsalAuthWeb extends WebPlugin {\n    constructor() {\n        super(...arguments);\n        this.initPromise = null;\n    }\n    async signIn(options) {\n        var _a;\n        const pca = await this.getInstance();\n        try {\n            await pca.loginRedirect({\n                scopes: (_a = options.scopes) !== null && _a !== void 0 ? _a : [],\n                domainHint: options.domainHint,\n                prompt: options.prompt,\n            });\n        }\n        catch (error) {\n            throw this.rejection('SIGN_IN_FAILED', this.messageOf(error));\n        }\n        // Unreachable in practice: loginRedirect() above navigates the page away\n        // first. Nothing after this point runs in this JS context.\n        return new Promise(() => undefined);\n    }\n    async acquireTokenSilent(options) {\n        var _a, _b;\n        const pca = await this.getInstance();\n        const account = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0];\n        if (!account) {\n            throw this.rejection('UI_REQUIRED', 'No cached account - call signIn() first.');\n        }\n        try {\n            const result = await pca.acquireTokenSilent({ account, scopes: (_b = options.scopes) !== null && _b !== void 0 ? _b : [] });\n            return this.toResult(result);\n        }\n        catch (error) {\n            if (error instanceof InteractionRequiredAuthError) {\n                throw this.rejection('UI_REQUIRED', error.message);\n            }\n            throw this.rejection('SILENT_FAILED', this.messageOf(error));\n        }\n    }\n    async getAccount() {\n        var _a, _b;\n        const pca = await this.getInstance();\n        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : null;\n        return { value: account ? this.toAccountInfo(account) : null };\n    }\n    async signOut(options) {\n        var _a, _b;\n        const pca = await this.getInstance();\n        const account = (_b = (_a = pca.getActiveAccount()) !== null && _a !== void 0 ? _a : pca.getAllAccounts()[0]) !== null && _b !== void 0 ? _b : undefined;\n        try {\n            if (options === null || options === void 0 ? void 0 : options.clearBrowserSession) {\n                // Ends the Entra browser SSO session too, not just the local cache -\n                // like signIn() above, this navigates away and never returns here.\n                await pca.logoutRedirect({ account });\n                return new Promise(() => undefined);\n            }\n            // Local-only sign-out: clears this account's cached tokens without any\n            // network call or navigation, matching native signOut()'s default\n            // \"local cache only\" behavior.\n            await pca.clearCache({ account });\n        }\n        catch (error) {\n            throw this.rejection('SIGN_OUT_FAILED', this.messageOf(error));\n        }\n    }\n    async getInstance() {\n        if (!this.initPromise) {\n            // Memoize per page load, but let a failed attempt be retried instead\n            // of permanently poisoning every later call with the same rejection.\n            this.initPromise = this.createInstance().catch((error) => {\n                this.initPromise = null;\n                throw error;\n            });\n        }\n        return this.initPromise;\n    }\n    async createInstance() {\n        var _a, _b, _c;\n        const config = await this.loadConfig();\n        const redirectUri = (_a = config.redirect_uri) !== null && _a !== void 0 ? _a : window.location.origin;\n        const pca = await createStandardPublicClientApplication({\n            auth: {\n                clientId: config.client_id,\n                authority: config.authority_url,\n                knownAuthorities: (_b = config.known_authorities) !== null && _b !== void 0 ? _b : [],\n                redirectUri,\n                postLogoutRedirectUri: (_c = config.post_logout_redirect_uri) !== null && _c !== void 0 ? _c : redirectUri,\n            },\n            cache: {\n                // localStorage (not the sessionStorage default) so a signed-in user\n                // stays signed in across app relaunches/tab closes, matching native\n                // MSAL's persistent Keychain/EncryptedSharedPreferences cache - the\n                // PWA equivalent of \"not native\" would otherwise re-prompt every\n                // fresh tab, unlike iOS/Android.\n                cacheLocation: BrowserCacheLocation.LocalStorage,\n            },\n        });\n        // Must run exactly once per page load, before any other account-reading\n        // call - this is what completes the loginRedirect()/logoutRedirect()\n        // round trip from the previous page load, if one is in flight. A failure\n        // here (e.g. the user denied consent on the Entra page) shouldn't break\n        // the whole plugin instance - it's swallowed so getAccount() simply comes\n        // back null and the app can prompt sign-in again, mirroring how a\n        // rejected native signIn() call leaves the app just as unauthenticated.\n        try {\n            const redirectResult = await pca.handleRedirectPromise();\n            if (redirectResult === null || redirectResult === void 0 ? void 0 : redirectResult.account) {\n                pca.setActiveAccount(redirectResult.account);\n            }\n        }\n        catch (error) {\n            console.warn('[MsalAuthWeb] handleRedirectPromise() failed', error);\n        }\n        return pca;\n    }\n    async loadConfig() {\n        const help = `Add a web msal_config.json at \"${CONFIG_PATH}\" (e.g. src/assets/msal_config.json in an Ionic/Angular app) - see the plugin README's \"Web / PWA setup\" section.`;\n        let response;\n        try {\n            response = await fetch(CONFIG_PATH);\n        }\n        catch (error) {\n            throw this.rejection('NOT_INITIALIZED', `Could not load ${CONFIG_PATH}: ${this.messageOf(error)}. ${help}`);\n        }\n        if (!response.ok) {\n            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} returned HTTP ${response.status}. ${help}`);\n        }\n        const config = (await response.json());\n        if (!config.client_id || !config.authority_url) {\n            throw this.rejection('NOT_INITIALIZED', `${CONFIG_PATH} is missing client_id or authority_url. ${help}`);\n        }\n        return config;\n    }\n    toResult(result) {\n        var _a, _b;\n        return {\n            accessToken: result.accessToken,\n            idToken: result.idToken,\n            expiresOn: result.expiresOn ? result.expiresOn.getTime() : Date.now(),\n            // Local MSAL account identifier, not the raw `oid` claim - matches the\n            // native implementations' accountId semantics (see definitions.ts).\n            accountId: (_b = (_a = result.account) === null || _a === void 0 ? void 0 : _a.homeAccountId) !== null && _b !== void 0 ? _b : '',\n            scopes: result.scopes,\n        };\n    }\n    toAccountInfo(account) {\n        var _a, _b;\n        return {\n            accountId: account.homeAccountId,\n            username: (_a = account.username) !== null && _a !== void 0 ? _a : null,\n            idTokenClaims: (_b = account.idTokenClaims) !== null && _b !== void 0 ? _b : null,\n        };\n    }\n    rejection(code, message) {\n        return Object.assign(new Error(message), { code });\n    }\n    messageOf(error) {\n        return error instanceof Error ? error.message : String(error);\n    }\n}\n"],"names":["registerPlugin","WebPlugin","InteractionRequiredAuthError","createStandardPublicClientApplication","BrowserCacheLocation"],"mappings":";;;AACK,UAAC,QAAQ,GAAGA,mBAAc,CAAC,UAAU,EAAE;IAC5C,IAAI,GAAG,EAAE,MAAM,mDAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,CAAC;;ICDD,MAAM,WAAW,GAAG,yBAAyB;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACO,MAAM,WAAW,SAASC,cAAS,CAAC;IAC3C,IAAI,WAAW,GAAG;IAClB,QAAQ,KAAK,CAAC,GAAG,SAAS,CAAC;IAC3B,QAAQ,IAAI,CAAC,WAAW,GAAG,IAAI;IAC/B,IAAI;IACJ,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE;IAC1B,QAAQ,IAAI,EAAE;IACd,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;IAC5C,QAAQ,IAAI;IACZ,YAAY,MAAM,GAAG,CAAC,aAAa,CAAC;IACpC,gBAAgB,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE;IACjF,gBAAgB,UAAU,EAAE,OAAO,CAAC,UAAU;IAC9C,gBAAgB,MAAM,EAAE,OAAO,CAAC,MAAM;IACtC,aAAa,CAAC;IACd,QAAQ;IACR,QAAQ,OAAO,KAAK,EAAE;IACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzE,QAAQ;IACR;IACA;IACA,QAAQ,OAAO,IAAI,OAAO,CAAC,MAAM,SAAS,CAAC;IAC3C,IAAI;IACJ,IAAI,MAAM,kBAAkB,CAAC,OAAO,EAAE;IACtC,QAAQ,IAAI,EAAE,EAAE,EAAE;IAClB,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;IAC5C,QAAQ,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC9G,QAAQ,IAAI,CAAC,OAAO,EAAE;IACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,0CAA0C,CAAC;IAC3F,QAAQ;IACR,QAAQ,IAAI;IACZ,YAAY,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACvI,YAAY,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxC,QAAQ;IACR,QAAQ,OAAO,KAAK,EAAE;IACtB,YAAY,IAAI,KAAK,YAAYC,wCAA4B,EAAE;IAC/D,gBAAgB,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC;IAClE,YAAY;IACZ,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxE,QAAQ;IACR,IAAI;IACJ,IAAI,MAAM,UAAU,GAAG;IACvB,QAAQ,IAAI,EAAE,EAAE,EAAE;IAClB,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;IAC5C,QAAQ,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI;IAC3J,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE;IACtE,IAAI;IACJ,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE;IAC3B,QAAQ,IAAI,EAAE,EAAE,EAAE;IAClB,QAAQ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;IAC5C,QAAQ,MAAM,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,SAAS;IAChK,QAAQ,IAAI;IACZ,YAAY,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAC/F;IACA;IACA,gBAAgB,MAAM,GAAG,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IACrD,gBAAgB,OAAO,IAAI,OAAO,CAAC,MAAM,SAAS,CAAC;IACnD,YAAY;IACZ;IACA;IACA;IACA,YAAY,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7C,QAAQ;IACR,QAAQ,OAAO,KAAK,EAAE;IACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1E,QAAQ;IACR,IAAI;IACJ,IAAI,MAAM,WAAW,GAAG;IACxB,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;IAC/B;IACA;IACA,YAAY,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK;IACtE,gBAAgB,IAAI,CAAC,WAAW,GAAG,IAAI;IACvC,gBAAgB,MAAM,KAAK;IAC3B,YAAY,CAAC,CAAC;IACd,QAAQ;IACR,QAAQ,OAAO,IAAI,CAAC,WAAW;IAC/B,IAAI;IACJ,IAAI,MAAM,cAAc,GAAG;IAC3B,QAAQ,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE;IACtB,QAAQ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;IAC9C,QAAQ,MAAM,WAAW,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;IAC9G,QAAQ,MAAM,GAAG,GAAG,MAAMC,iDAAqC,CAAC;IAChE,YAAY,IAAI,EAAE;IAClB,gBAAgB,QAAQ,EAAE,MAAM,CAAC,SAAS;IAC1C,gBAAgB,SAAS,EAAE,MAAM,CAAC,aAAa;IAC/C,gBAAgB,gBAAgB,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,iBAAiB,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE;IACrG,gBAAgB,WAAW;IAC3B,gBAAgB,qBAAqB,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,wBAAwB,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,WAAW;IAC1H,aAAa;IACb,YAAY,KAAK,EAAE;IACnB;IACA;IACA;IACA;IACA;IACA,gBAAgB,aAAa,EAAEC,gCAAoB,CAAC,YAAY;IAChE,aAAa;IACb,SAAS,CAAC;IACV;IACA;IACA;IACA;IACA;IACA;IACA;IACA,QAAQ,IAAI;IACZ,YAAY,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,qBAAqB,EAAE;IACpE,YAAY,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE;IACxG,gBAAgB,GAAG,CAAC,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC;IAC5D,YAAY;IACZ,QAAQ;IACR,QAAQ,OAAO,KAAK,EAAE;IACtB,YAAY,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,CAAC;IAC/E,QAAQ;IACR,QAAQ,OAAO,GAAG;IAClB,IAAI;IACJ,IAAI,MAAM,UAAU,GAAG;IACvB,QAAQ,MAAM,IAAI,GAAG,CAAC,+BAA+B,EAAE,WAAW,CAAC,iHAAiH,CAAC;IACrL,QAAQ,IAAI,QAAQ;IACpB,QAAQ,IAAI;IACZ,YAAY,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;IAC/C,QAAQ;IACR,QAAQ,OAAO,KAAK,EAAE;IACtB,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvH,QAAQ;IACR,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;IAC1B,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,EAAE,WAAW,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/G,QAAQ;IACR,QAAQ,MAAM,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9C,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;IACxD,YAAY,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,EAAE,WAAW,CAAC,wCAAwC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpH,QAAQ;IACR,QAAQ,OAAO,MAAM;IACrB,IAAI;IACJ,IAAI,QAAQ,CAAC,MAAM,EAAE;IACrB,QAAQ,IAAI,EAAE,EAAE,EAAE;IAClB,QAAQ,OAAO;IACf,YAAY,WAAW,EAAE,MAAM,CAAC,WAAW;IAC3C,YAAY,OAAO,EAAE,MAAM,CAAC,OAAO;IACnC,YAAY,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;IACjF;IACA;IACA,YAAY,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,aAAa,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE;IAC7I,YAAY,MAAM,EAAE,MAAM,CAAC,MAAM;IACjC,SAAS;IACT,IAAI;IACJ,IAAI,aAAa,CAAC,OAAO,EAAE;IAC3B,QAAQ,IAAI,EAAE,EAAE,EAAE;IAClB,QAAQ,OAAO;IACf,YAAY,SAAS,EAAE,OAAO,CAAC,aAAa;IAC5C,YAAY,QAAQ,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI;IACnF,YAAY,aAAa,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,aAAa,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI;IAC7F,SAAS;IACT,IAAI;IACJ,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE;IAC7B,QAAQ,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI;IACJ,IAAI,SAAS,CAAC,KAAK,EAAE;IACrB,QAAQ,OAAO,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IACrE,IAAI;IACJ;;;;;;;;;;;"}