@nauth-toolkit/client-angular 0.1.63 → 0.1.65

package/fesm2022/nauth-toolkit-client-angular.mjs

@@ -2,13 +2,12 @@ import { NAuthErrorCode, NAuthClientError, NAuthClient } from '@nauth-toolkit/cl
 export * from '@nauth-toolkit/client';
 import * as i0 from '@angular/core';
 import { InjectionToken, Injectable, Inject, inject, Optional, NgModule, PLATFORM_ID } from '@angular/core';
-import { firstValueFrom, BehaviorSubject, Subject, catchError, from, switchMap, throwError, filter as filter$1, take } from 'rxjs';
+import { firstValueFrom, BehaviorSubject, Subject, from, map, of, switchMap, catchError, throwError, filter as filter$1, take } from 'rxjs';
 import { filter } from 'rxjs/operators';
 import * as i1 from '@angular/common/http';
 import { HttpErrorResponse, HTTP_INTERCEPTORS, HttpClientModule, HttpClient } from '@angular/common/http';
 import * as i3 from '@angular/router';
 import { Router } from '@angular/router';
-import { __decorate, __param } from 'tslib';
 import { isPlatformBrowser } from '@angular/common';
 
 /**
@@ -605,6 +604,22 @@ class AuthService {
         await this.client.clearStoredChallenge();
         this.challengeSubject.next(null);
     }
+    /**
+     * Get current access token (JSON mode only).
+     *
+     * This is primarily useful for consumers using Angular `HttpClient` directly
+     * (outside of the SDK methods) and relying on an interceptor to attach Bearer tokens.
+     *
+     * @returns Access token, or null if not available
+     *
+     * @example
+     * ```typescript
+     * const token = await this.auth.getAccessToken();
+     * ```
+     */
+    async getAccessToken() {
+        return await this.client.getAccessToken();
+    }
     // ============================================================================
     // Social Authentication
     // ============================================================================
@@ -947,20 +962,139 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 }] }, { type: AngularHttpAdapter }] });
 
 /**
- * Refresh state management.
+ * Shared interceptor logic for both:
+ * - Functional interceptor (Angular 17+ standalone)
+ * - Class-based interceptor (NgModule apps)
+ *
+ * WHY:
+ * - Keep one implementation for cookies + json mode behavior.
+ * - Avoid divergence between standalone and NgModule integrations.
  */
-let isRefreshing$1 = false;
-const refreshTokenSubject$1 = new BehaviorSubject(null);
-const retriedRequests$1 = new WeakSet();
+// ============================================================================
+// Refresh state management (module-level)
+// ============================================================================
+let isRefreshing = false;
+const refreshTokenSubject = new BehaviorSubject(null);
+const retriedRequests = new WeakSet();
 /**
  * Get CSRF token from cookie.
  */
-function getCsrfToken$1(cookieName) {
+function getCsrfToken(cookieName) {
     if (typeof document === 'undefined')
         return null;
     const match = document.cookie.match(new RegExp(`(^| )${cookieName}=([^;]+)`));
     return match ? decodeURIComponent(match[2]) : null;
 }
+/**
+ * Build retry request with appropriate auth.
+ *
+ * In cookies mode: Browser automatically sends updated httpOnly cookies (access/refresh tokens).
+ * We must re-read CSRF token after refresh to avoid stale headers.
+ *
+ * In JSON mode: Clones the request and adds the new Bearer token.
+ */
+function buildRetryRequest(originalReq, tokenDelivery, newToken, csrfConfig) {
+    if (tokenDelivery === 'json' && newToken && newToken !== 'success') {
+        return originalReq.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } });
+    }
+    if (tokenDelivery === 'cookies' && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(originalReq.method)) {
+        const csrfCookieName = csrfConfig?.cookieName ?? 'nauth_csrf_token';
+        const csrfHeaderName = csrfConfig?.headerName ?? 'x-csrf-token';
+        const freshCsrfToken = getCsrfToken(csrfCookieName);
+        if (freshCsrfToken) {
+            return originalReq.clone({ setHeaders: { [csrfHeaderName]: freshCsrfToken } });
+        }
+    }
+    return originalReq;
+}
+function createNAuthAuthHttpInterceptor(params) {
+    const { config, http, authService, router, next, req } = params;
+    const tokenDelivery = config.tokenDelivery;
+    const baseUrl = config.baseUrl;
+    const endpoints = config.endpoints ?? {};
+    const refreshPath = endpoints.refresh ?? '/refresh';
+    const loginPath = endpoints.login ?? '/login';
+    const signupPath = endpoints.signup ?? '/signup';
+    const socialExchangePath = endpoints.socialExchange ?? '/social/exchange';
+    const refreshUrl = `${baseUrl}${refreshPath}`;
+    const isAuthApiRequest = req.url.includes(baseUrl);
+    const isRefreshEndpoint = req.url.includes(refreshPath);
+    const isPublicEndpoint = req.url.includes(loginPath) || req.url.includes(signupPath) || req.url.includes(socialExchangePath);
+    // ============================================================================
+    // Build request for cookies mode (withCredentials + CSRF)
+    // ============================================================================
+    let authReq = req;
+    if (tokenDelivery === 'cookies') {
+        authReq = authReq.clone({ withCredentials: true });
+        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
+            const csrfCookieName = config.csrf?.cookieName ?? 'nauth_csrf_token';
+            const csrfHeaderName = config.csrf?.headerName ?? 'x-csrf-token';
+            const csrfToken = getCsrfToken(csrfCookieName);
+            if (csrfToken) {
+                authReq = authReq.clone({ setHeaders: { [csrfHeaderName]: csrfToken } });
+            }
+        }
+    }
+    // ============================================================================
+    // JSON mode: attach Authorization header for HttpClient calls
+    // ============================================================================
+    const attachJsonAuth$ = tokenDelivery === 'json' &&
+        isAuthApiRequest &&
+        !isRefreshEndpoint &&
+        !isPublicEndpoint &&
+        !authReq.headers.has('Authorization')
+        ? from(authService.getAccessToken()).pipe(map((token) => {
+            if (!token)
+                return authReq;
+            return authReq.clone({ setHeaders: { Authorization: `Bearer ${token}` } });
+        }))
+        : of(authReq);
+    return attachJsonAuth$.pipe(switchMap((requestWithAuth) => next(requestWithAuth).pipe(catchError((error) => {
+        const shouldHandle = error instanceof HttpErrorResponse &&
+            error.status === 401 &&
+            isAuthApiRequest &&
+            !isRefreshEndpoint &&
+            !isPublicEndpoint &&
+            !retriedRequests.has(req);
+        if (!shouldHandle) {
+            return throwError(() => error);
+        }
+        retriedRequests.add(req);
+        if (!isRefreshing) {
+            isRefreshing = true;
+            refreshTokenSubject.next(null);
+            // Refresh based on mode
+            const refresh$ = tokenDelivery === 'cookies'
+                ? http.post(refreshUrl, {}, { withCredentials: true })
+                : from(authService.refresh());
+            return refresh$.pipe(switchMap((response) => {
+                isRefreshing = false;
+                const newToken = 'accessToken' in response ? response.accessToken : 'success';
+                refreshTokenSubject.next(newToken ?? 'success');
+                const retryReq = buildRetryRequest(requestWithAuth, tokenDelivery, newToken, config.csrf);
+                return next(retryReq).pipe(catchError((retryErr) => {
+                    return throwError(() => retryErr);
+                }));
+            }), catchError((err) => {
+                isRefreshing = false;
+                refreshTokenSubject.next(null);
+                // Refresh failed -> redirect if configured
+                if (config.redirects?.sessionExpired) {
+                    router.navigateByUrl(config.redirects.sessionExpired).catch(() => { });
+                }
+                return throwError(() => err);
+            }));
+        }
+        // Wait for ongoing refresh
+        return refreshTokenSubject.pipe(filter$1((token) => token !== null), take(1), switchMap((token) => {
+            const retryReq = buildRetryRequest(requestWithAuth, tokenDelivery, token, config.csrf);
+            return next(retryReq).pipe(catchError((retryErr) => {
+                return throwError(() => retryErr);
+            }));
+        }));
+    }))));
+}
+
 /**
  * Class-based HTTP interceptor for NgModule apps (Angular < 17).
  *
@@ -991,52 +1125,14 @@ class AuthInterceptorClass {
         this.router = router;
     }
     intercept(req, next) {
-        const tokenDelivery = this.config.tokenDelivery;
-        const baseUrl = this.config.baseUrl;
-        // ============================================================================
-        // COOKIES MODE: withCredentials + CSRF token
-        // ============================================================================
-        if (tokenDelivery === 'cookies') {
-            let clonedReq = req.clone({ withCredentials: true });
-            // Add CSRF token header if it's a mutating request
-            if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
-                const csrfToken = getCsrfToken$1(this.config.csrf?.cookieName || 'XSRF-TOKEN');
-                if (csrfToken) {
-                    clonedReq = clonedReq.clone({
-                        setHeaders: { [this.config.csrf?.headerName || 'X-XSRF-TOKEN']: csrfToken },
-                    });
-                }
-            }
-            return next.handle(clonedReq).pipe(catchError((error) => {
-                if (error.status === 401 && !retriedRequests$1.has(req)) {
-                    retriedRequests$1.add(req);
-                    if (!isRefreshing$1) {
-                        isRefreshing$1 = true;
-                        refreshTokenSubject$1.next(null);
-                        return from(this.http
-                            .post(`${baseUrl}/refresh`, {}, { withCredentials: true })
-                            .toPromise()).pipe(switchMap(() => {
-                            isRefreshing$1 = false;
-                            refreshTokenSubject$1.next('refreshed');
-                            return next.handle(clonedReq);
-                        }), catchError((refreshError) => {
-                            isRefreshing$1 = false;
-                            this.authService.logout();
-                            this.router.navigate([this.config.redirects?.sessionExpired || '/login']);
-                            return throwError(() => refreshError);
-                        }));
-                    }
-                    else {
-                        return refreshTokenSubject$1.pipe(filter$1((token) => token !== null), take(1), switchMap(() => next.handle(clonedReq)));
-                    }
-                }
-                return throwError(() => error);
-            }));
-        }
-        // ============================================================================
-        // JSON MODE: Delegate to SDK for token handling
-        // ============================================================================
-        return next.handle(req);
+        return createNAuthAuthHttpInterceptor({
+            config: this.config,
+            http: this.http,
+            authService: this.authService,
+            router: this.router,
+            req,
+            next: (r) => next.handle(r),
+        });
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AuthInterceptorClass, deps: [{ token: NAUTH_CLIENT_CONFIG }, { token: i1.HttpClient }, { token: AuthService }, { token: i3.Router }], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AuthInterceptorClass });
@@ -1127,7 +1223,7 @@ function authGuard(redirectTo) {
  * export class FeatureModule {}
  * ```
  */
-let AuthGuard = class AuthGuard {
+class AuthGuard {
     auth;
     router;
     config;
@@ -1154,11 +1250,17 @@ let AuthGuard = class AuthGuard {
         const redirectPath = this.config?.redirects?.sessionExpired ?? '/login';
         return this.router.createUrlTree([redirectPath]);
     }
-};
-AuthGuard = __decorate([
-    __param(2, Optional()),
-    __param(2, Inject(NAUTH_CLIENT_CONFIG))
-], AuthGuard);
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AuthGuard, deps: [{ token: AuthService }, { token: i3.Router }, { token: NAUTH_CLIENT_CONFIG, optional: true }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AuthGuard });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AuthGuard, decorators: [{
+            type: Injectable
+        }], ctorParameters: () => [{ type: AuthService }, { type: i3.Router }, { type: undefined, decorators: [{
+                    type: Optional
+                }, {
+                    type: Inject,
+                    args: [NAUTH_CLIENT_CONFIG]
+                }] }] });
 
 /**
  * NgModule for nauth-toolkit Angular integration.
@@ -1220,25 +1322,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 }]
         }] });
 
-/**
- * Refresh state management.
- * BehaviorSubject pattern is the industry-standard for token refresh.
- */
-let isRefreshing = false;
-const refreshTokenSubject = new BehaviorSubject(null);
-/**
- * Track retried requests to prevent infinite loops.
- */
-const retriedRequests = new WeakSet();
-/**
- * Get CSRF token from cookie.
- */
-function getCsrfToken(cookieName) {
-    if (typeof document === 'undefined')
-        return null;
-    const match = document.cookie.match(new RegExp(`(^| )${cookieName}=([^;]+)`));
-    return match ? decodeURIComponent(match[2]) : null;
-}
 /**
  * Angular HTTP interceptor for nauth-toolkit.
  *
@@ -1256,248 +1339,8 @@ const authInterceptor = (req, next) => {
     if (!isBrowser) {
         return next(req);
     }
-    // #region agent log
-    if (req.url.includes('/profile') && req.method === 'PUT') {
-        fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                location: 'auth.interceptor.ts:entry',
-                message: 'Original request entry',
-                data: { reqBody: req.body, reqBodyType: typeof req.body, reqMethod: req.method, reqUrl: req.url },
-                timestamp: Date.now(),
-                sessionId: 'debug-session',
-                hypothesisId: 'A',
-            }),
-        }).catch(() => { });
-    }
-    // #endregion
-    const tokenDelivery = config.tokenDelivery;
-    const baseUrl = config.baseUrl;
-    const endpoints = config.endpoints ?? {};
-    const refreshPath = endpoints.refresh ?? '/refresh';
-    const loginPath = endpoints.login ?? '/login';
-    const signupPath = endpoints.signup ?? '/signup';
-    const socialExchangePath = endpoints.socialExchange ?? '/social/exchange';
-    const refreshUrl = `${baseUrl}${refreshPath}`;
-    const isAuthApiRequest = req.url.includes(baseUrl);
-    const isRefreshEndpoint = req.url.includes(refreshPath);
-    const isPublicEndpoint = req.url.includes(loginPath) || req.url.includes(signupPath) || req.url.includes(socialExchangePath);
-    // Build request with credentials (cookies mode only)
-    let authReq = req;
-    if (tokenDelivery === 'cookies') {
-        authReq = authReq.clone({ withCredentials: true });
-        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
-            const csrfCookieName = config.csrf?.cookieName ?? 'nauth_csrf_token';
-            const csrfHeaderName = config.csrf?.headerName ?? 'x-csrf-token';
-            const csrfToken = getCsrfToken(csrfCookieName);
-            if (csrfToken) {
-                authReq = authReq.clone({ setHeaders: { [csrfHeaderName]: csrfToken } });
-            }
-        }
-    }
-    return next(authReq).pipe(catchError((error) => {
-        const shouldHandle = error instanceof HttpErrorResponse &&
-            error.status === 401 &&
-            isAuthApiRequest &&
-            !isRefreshEndpoint &&
-            !isPublicEndpoint &&
-            !retriedRequests.has(req);
-        if (!shouldHandle) {
-            return throwError(() => error);
-        }
-        // Mark original request as retried to prevent infinite loops
-        retriedRequests.add(req);
-        if (config.debug) {
-            console.warn('[nauth-interceptor] 401 detected:', req.url);
-        }
-        if (!isRefreshing) {
-            isRefreshing = true;
-            refreshTokenSubject.next(null);
-            if (config.debug) {
-                console.warn('[nauth-interceptor] Starting refresh...');
-            }
-            // Refresh based on mode
-            const refresh$ = tokenDelivery === 'cookies'
-                ? http.post(refreshUrl, {}, { withCredentials: true })
-                : from(authService.refresh());
-            return refresh$.pipe(switchMap((response) => {
-                if (config.debug) {
-                    console.warn('[nauth-interceptor] Refresh successful');
-                }
-                isRefreshing = false;
-                // Get new token (JSON mode) or signal success (cookies mode)
-                const newToken = 'accessToken' in response ? response.accessToken : 'success';
-                refreshTokenSubject.next(newToken ?? 'success');
-                // #region agent log
-                fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        location: 'auth.interceptor.ts:125',
-                        message: 'Before buildRetryRequest',
-                        data: {
-                            authReqBody: authReq.body,
-                            authReqMethod: authReq.method,
-                            authReqUrl: authReq.url,
-                            authReqBodyType: typeof authReq.body,
-                        },
-                        timestamp: Date.now(),
-                        sessionId: 'debug-session',
-                        hypothesisId: 'A',
-                    }),
-                }).catch(() => { });
-                // #endregion
-                // Build retry request with fresh CSRF token (re-read from cookie after refresh)
-                const retryReq = buildRetryRequest(authReq, tokenDelivery, newToken, config.csrf);
-                // #region agent log
-                fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        location: 'auth.interceptor.ts:130',
-                        message: 'After buildRetryRequest',
-                        data: {
-                            retryReqBody: retryReq.body,
-                            retryReqMethod: retryReq.method,
-                            retryReqUrl: retryReq.url,
-                            retryReqBodyType: typeof retryReq.body,
-                            headersKeys: retryReq.headers.keys(),
-                        },
-                        timestamp: Date.now(),
-                        sessionId: 'debug-session',
-                        hypothesisId: 'B',
-                    }),
-                }).catch(() => { });
-                // #endregion
-                if (config.debug) {
-                    console.warn('[nauth-interceptor] Retrying:', req.url);
-                }
-                // Retry the request with fresh token/CSRF
-                // IMPORTANT: Errors from the retry (e.g., 400 validation) should NOT trigger
-                // session expiration redirect. Only the refresh failure should redirect.
-                return next(retryReq).pipe(catchError((retryErr) => {
-                    // Retry failed (could be 400, 403, 500, etc.)
-                    // Just propagate the error - don't redirect to login
-                    if (config.debug) {
-                        console.warn('[nauth-interceptor] Retry request failed:', retryErr);
-                    }
-                    return throwError(() => retryErr);
-                }));
-            }), catchError((err) => {
-                // This only catches REFRESH failures, not retry failures
-                if (config.debug) {
-                    console.error('[nauth-interceptor] Refresh failed:', err);
-                }
-                isRefreshing = false;
-                refreshTokenSubject.next(null);
-                // Handle session expiration - redirect to configured URL
-                // Only redirect if refresh itself failed (not if retry failed)
-                if (config.redirects?.sessionExpired) {
-                    router.navigateByUrl(config.redirects.sessionExpired).catch((navError) => {
-                        if (config.debug) {
-                            console.error('[nauth-interceptor] Navigation failed:', navError);
-                        }
-                    });
-                }
-                return throwError(() => err);
-            }));
-        }
-        else {
-            // Wait for ongoing refresh
-            if (config.debug) {
-                console.warn('[nauth-interceptor] Waiting for refresh...');
-            }
-            return refreshTokenSubject.pipe(filter$1((token) => token !== null), take(1), switchMap((token) => {
-                if (config.debug) {
-                    console.warn('[nauth-interceptor] Refresh done, retrying:', req.url);
-                }
-                const retryReq = buildRetryRequest(authReq, tokenDelivery, token, config.csrf);
-                // Retry the request - errors here should propagate normally
-                // without triggering session expiration redirect
-                return next(retryReq).pipe(catchError((retryErr) => {
-                    if (config.debug) {
-                        console.warn('[nauth-interceptor] Retry request failed:', retryErr);
-                    }
-                    return throwError(() => retryErr);
-                }));
-            }));
-        }
-    }));
+    return createNAuthAuthHttpInterceptor({ config, http, authService, router, next, req });
 };
-/**
- * Build retry request with appropriate auth.
- *
- * CRITICAL FIX: In cookies mode, after refresh the server may send updated cookies.
- * We MUST re-read the CSRF token from the cookie before retrying to ensure we have
- * the current CSRF token that matches what the server expects.
- *
- * In JSON mode: Clones the request and adds the new Bearer token.
- *
- * @param originalReq - The base request (already has withCredentials if cookies mode)
- * @param tokenDelivery - 'cookies' or 'json'
- * @param newToken - The new access token (JSON mode only)
- * @param csrfConfig - CSRF configuration to re-read token from cookie
- * @returns The request ready for retry with fresh auth
- */
-function buildRetryRequest(originalReq, tokenDelivery, newToken, csrfConfig) {
-    if (tokenDelivery === 'json' && newToken && newToken !== 'success') {
-        return originalReq.clone({
-            setHeaders: { Authorization: `Bearer ${newToken}` },
-        });
-    }
-    // Cookies mode: Browser automatically sends updated httpOnly cookies (access/refresh tokens).
-    // However, CSRF token must match the cookie value at the moment of retry.
-    // We ALWAYS re-read from document.cookie here (using defaults when csrfConfig
-    // is not provided) to avoid stale header values after refresh or across tabs.
-    if (tokenDelivery === 'cookies' && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(originalReq.method)) {
-        const csrfCookieName = csrfConfig?.cookieName ?? 'nauth_csrf_token';
-        const csrfHeaderName = csrfConfig?.headerName ?? 'x-csrf-token';
-        const freshCsrfToken = getCsrfToken(csrfCookieName);
-        // #region agent log
-        fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                location: 'auth.interceptor.ts:buildRetryRequest',
-                message: 'Inside buildRetryRequest cookies branch',
-                data: {
-                    originalReqBody: originalReq.body,
-                    originalReqBodyType: typeof originalReq.body,
-                    freshCsrfToken: freshCsrfToken?.substring(0, 8),
-                    method: originalReq.method,
-                },
-                timestamp: Date.now(),
-                sessionId: 'debug-session',
-                hypothesisId: 'C',
-            }),
-        }).catch(() => { });
-        // #endregion
-        if (freshCsrfToken) {
-            // Clone with fresh CSRF token in header
-            const cloned = originalReq.clone({
-                setHeaders: { [csrfHeaderName]: freshCsrfToken },
-            });
-            // #region agent log
-            fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    location: 'auth.interceptor.ts:buildRetryRequest:afterClone',
-                    message: 'After clone with setHeaders',
-                    data: { clonedBody: cloned.body, clonedBodyType: typeof cloned.body, originalBody: originalReq.body },
-                    timestamp: Date.now(),
-                    sessionId: 'debug-session',
-                    hypothesisId: 'D',
-                }),
-            }).catch(() => { });
-            // #endregion
-            return cloned;
-        }
-    }
-    // No changes needed (GET request or no CSRF token available)
-    return originalReq;
-}
 /**
  * Class-based interceptor for NgModule compatibility.
  */