@nauth-toolkit/client-angular 0.1.64 → 0.1.66

package/fesm2022/nauth-toolkit-client-angular.mjs

@@ -2,7 +2,7 @@ import { NAuthErrorCode, NAuthClientError, NAuthClient } from '@nauth-toolkit/cl
 export * from '@nauth-toolkit/client';
 import * as i0 from '@angular/core';
 import { InjectionToken, Injectable, Inject, inject, Optional, NgModule, PLATFORM_ID } from '@angular/core';
-import { firstValueFrom, BehaviorSubject, Subject, catchError, from, switchMap, throwError, filter as filter$1, take } from 'rxjs';
+import { firstValueFrom, BehaviorSubject, Subject, from, switchMap, of, map, catchError, throwError, finalize, shareReplay } from 'rxjs';
 import { filter } from 'rxjs/operators';
 import * as i1 from '@angular/common/http';
 import { HttpErrorResponse, HTTP_INTERCEPTORS, HttpClientModule, HttpClient } from '@angular/common/http';
@@ -535,7 +535,44 @@ class AuthService {
      * ```
      */
     async respondToChallenge(response) {
+        // #region agent log
+        fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                location: 'auth.service.ts:respondToChallenge:entry',
+                message: 'RespondToChallenge called',
+                data: {
+                    challengeType: response.type,
+                    hasSession: !!response.session,
+                },
+                timestamp: Date.now(),
+                sessionId: 'debug-session',
+                hypothesisId: 'H7',
+            }),
+        }).catch(() => { });
+        // #endregion
         const res = await this.client.respondToChallenge(response);
+        // #region agent log
+        fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                location: 'auth.service.ts:respondToChallenge:response',
+                message: 'RespondToChallenge response received',
+                data: {
+                    hasChallengeName: !!res.challengeName,
+                    challengeName: res.challengeName,
+                    hasAccessToken: !!res.accessToken,
+                    hasRefreshToken: !!res.refreshToken,
+                    hasUser: !!res.user,
+                },
+                timestamp: Date.now(),
+                sessionId: 'debug-session',
+                hypothesisId: 'H7',
+            }),
+        }).catch(() => { });
+        // #endregion
         return this.updateChallengeState(res);
     }
     /**
@@ -604,6 +641,22 @@ class AuthService {
         await this.client.clearStoredChallenge();
         this.challengeSubject.next(null);
     }
+    /**
+     * Get current access token (JSON mode only).
+     *
+     * This is primarily useful for consumers using Angular `HttpClient` directly
+     * (outside of the SDK methods) and relying on an interceptor to attach Bearer tokens.
+     *
+     * @returns Access token, or null if not available
+     *
+     * @example
+     * ```typescript
+     * const token = await this.auth.getAccessToken();
+     * ```
+     */
+    async getAccessToken() {
+        return await this.client.getAccessToken();
+    }
     // ============================================================================
     // Social Authentication
     // ============================================================================
@@ -946,20 +999,168 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 }] }, { type: AngularHttpAdapter }] });
 
 /**
- * Refresh state management.
+ * Shared interceptor logic for both:
+ * - Functional interceptor (Angular 17+ standalone)
+ * - Class-based interceptor (NgModule apps)
+ *
+ * WHY:
+ * - Keep one implementation for cookies + json mode behavior.
+ * - Avoid divergence between standalone and NgModule integrations.
  */
-let isRefreshing$1 = false;
-const refreshTokenSubject$1 = new BehaviorSubject(null);
-const retriedRequests$1 = new WeakSet();
+// ============================================================================
+// Refresh state management (module-level)
+// ============================================================================
+let isRefreshing = false;
+const refreshTokenSubject = new BehaviorSubject(null);
+let refreshInFlight$ = null;
+const retriedRequests = new WeakSet();
 /**
  * Get CSRF token from cookie.
  */
-function getCsrfToken$1(cookieName) {
+function getCsrfToken(cookieName) {
     if (typeof document === 'undefined')
         return null;
     const match = document.cookie.match(new RegExp(`(^| )${cookieName}=([^;]+)`));
     return match ? decodeURIComponent(match[2]) : null;
 }
+/**
+ * Build retry request with appropriate auth.
+ *
+ * In cookies mode: Browser automatically sends updated httpOnly cookies (access/refresh tokens).
+ * We must re-read CSRF token after refresh to avoid stale headers.
+ *
+ * In JSON mode: Clones the request and adds the new Bearer token.
+ */
+function buildRetryRequest(originalReq, tokenDelivery, newToken, csrfConfig) {
+    if (tokenDelivery === 'json' && newToken && newToken !== 'success') {
+        return originalReq.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } });
+    }
+    if (tokenDelivery === 'cookies' && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(originalReq.method)) {
+        const csrfCookieName = csrfConfig?.cookieName ?? 'nauth_csrf_token';
+        const csrfHeaderName = csrfConfig?.headerName ?? 'x-csrf-token';
+        const freshCsrfToken = getCsrfToken(csrfCookieName);
+        if (freshCsrfToken) {
+            return originalReq.clone({ setHeaders: { [csrfHeaderName]: freshCsrfToken } });
+        }
+    }
+    return originalReq;
+}
+function createNAuthAuthHttpInterceptor(params) {
+    const { config, authService, router, next, req } = params;
+    const tokenDelivery = config.tokenDelivery;
+    const baseUrl = config.baseUrl;
+    const endpoints = config.endpoints ?? {};
+    const authPathPrefix = config.authPathPrefix;
+    // Build refresh path with authPathPrefix if configured (matches core client buildUrl logic exactly)
+    // Use default '/refresh' if endpoints.refresh is not defined
+    const refreshPath = endpoints?.refresh ?? '/refresh';
+    const normalizedRefreshPath = refreshPath.startsWith('/') ? refreshPath : `/${refreshPath}`;
+    // Check if baseUrl already ends with authPathPrefix to avoid double-prefixing
+    // This must match the core client's buildUrl logic exactly
+    const baseUrlEndsWithPrefix = authPathPrefix && baseUrl.endsWith(authPathPrefix);
+    const shouldAddPrefix = authPathPrefix && !baseUrlEndsWithPrefix && !normalizedRefreshPath.startsWith(authPathPrefix);
+    const effectiveRefreshPath = shouldAddPrefix ? `${authPathPrefix}${normalizedRefreshPath}` : normalizedRefreshPath;
+    const loginPath = endpoints.login ?? '/login';
+    const signupPath = endpoints.signup ?? '/signup';
+    const socialExchangePath = endpoints.socialExchange ?? '/social/exchange';
+    const isAuthApiRequest = req.url.includes(baseUrl);
+    // Check if request is to refresh endpoint (using effective path with authPathPrefix)
+    const isRefreshEndpoint = req.url.includes(effectiveRefreshPath);
+    const isPublicEndpoint = req.url.includes(loginPath) || req.url.includes(signupPath) || req.url.includes(socialExchangePath);
+    const shouldIntercept = isAuthApiRequest && !isRefreshEndpoint && !isPublicEndpoint;
+    // ============================================================================
+    // Build request for cookies mode (withCredentials + CSRF)
+    // ============================================================================
+    let authReq = req;
+    if (tokenDelivery === 'cookies') {
+        authReq = authReq.clone({ withCredentials: true });
+        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
+            const csrfCookieName = config.csrf?.cookieName ?? 'nauth_csrf_token';
+            const csrfHeaderName = config.csrf?.headerName ?? 'x-csrf-token';
+            const csrfToken = getCsrfToken(csrfCookieName);
+            if (csrfToken) {
+                authReq = authReq.clone({ setHeaders: { [csrfHeaderName]: csrfToken } });
+            }
+        }
+    }
+    // ============================================================================
+    // JSON mode: attach Authorization header for HttpClient calls
+    // ============================================================================
+    // Simple approach: attach token if available, let backend validate
+    // Handle 401 reactively (matches old working implementation)
+    const attachJsonAuth$ = tokenDelivery === 'json' && shouldIntercept && !authReq.headers.has('Authorization')
+        ? from(authService.getAccessToken()).pipe(switchMap((token) => {
+            if (token) {
+                return of(authReq.clone({ setHeaders: { Authorization: `Bearer ${token}` } }));
+            }
+            return of(authReq);
+        }))
+        : of(authReq);
+    // ============================================================================
+    // Refresh coordination
+    // ============================================================================
+    const getOrStartRefresh$ = () => {
+        if (refreshInFlight$)
+            return refreshInFlight$;
+        // WHY: We want to ensure only one refresh request is in flight at any time.
+        // All requests (including those that haven't hit the backend yet) should wait for
+        // the same refresh result to avoid a burst of 401s and potential WAF/rate-limit issues.
+        isRefreshing = true;
+        refreshTokenSubject.next(null);
+        // WHY: Always refresh via the core client.
+        // - Ensures authPathPrefix + default endpoints are applied consistently (fixes /refresh vs /auth/refresh).
+        // - Centralizes CSRF + credentials handling in one place.
+        const refreshRequest$ = from(authService.getClient().refreshTokens());
+        refreshInFlight$ = refreshRequest$.pipe(map((response) => {
+            // Cookies mode: success is enough (tokens are in httpOnly cookies).
+            // JSON mode: we need the new access token to retry + unblock queued requests.
+            const newToken = tokenDelivery === 'json' ? response.accessToken : 'success';
+            if (tokenDelivery === 'json' && (!newToken || newToken === 'success')) {
+                // ⚠️ WARNING: Without an access token we cannot safely retry requests in JSON mode.
+                throw new Error('Token refresh did not return an access token');
+            }
+            refreshTokenSubject.next(newToken ?? 'success');
+            return newToken ?? 'success';
+        }), catchError((err) => {
+            refreshTokenSubject.next(null);
+            // Refresh failed -> redirect if configured
+            if (config.redirects?.sessionExpired) {
+                router.navigateByUrl(config.redirects.sessionExpired).catch(() => {
+                    // Ignore navigation errors
+                });
+            }
+            return throwError(() => err);
+        }), finalize(() => {
+            isRefreshing = false;
+            refreshInFlight$ = null;
+        }), shareReplay({ bufferSize: 1, refCount: false }));
+        return refreshInFlight$;
+    };
+    // ============================================================================
+    // Pre-request gating: block requests while refresh is in-flight
+    // ============================================================================
+    // WHY: Prevent multiple requests from hitting the backend with an expired token and returning 401.
+    // We queue all auth API calls during refresh and release them once refresh succeeds.
+    if (shouldIntercept && isRefreshing && refreshInFlight$) {
+        return refreshInFlight$.pipe(switchMap((token) => {
+            const gatedReq = buildRetryRequest(authReq, tokenDelivery, token, config.csrf);
+            return next(gatedReq);
+        }));
+    }
+    return attachJsonAuth$.pipe(switchMap((requestWithAuth) => next(requestWithAuth).pipe(catchError((error) => {
+        const shouldHandle = error instanceof HttpErrorResponse && error.status === 401 && shouldIntercept && !retriedRequests.has(req);
+        if (!shouldHandle) {
+            return throwError(() => error);
+        }
+        retriedRequests.add(req);
+        return getOrStartRefresh$().pipe(switchMap((token) => {
+            const retryReq = buildRetryRequest(requestWithAuth, tokenDelivery, token, config.csrf);
+            retriedRequests.add(retryReq);
+            return next(retryReq);
+        }));
+    }))));
+}
+
 /**
  * Class-based HTTP interceptor for NgModule apps (Angular < 17).
  *
@@ -990,52 +1191,14 @@ class AuthInterceptorClass {
         this.router = router;
     }
     intercept(req, next) {
-        const tokenDelivery = this.config.tokenDelivery;
-        const baseUrl = this.config.baseUrl;
-        // ============================================================================
-        // COOKIES MODE: withCredentials + CSRF token
-        // ============================================================================
-        if (tokenDelivery === 'cookies') {
-            let clonedReq = req.clone({ withCredentials: true });
-            // Add CSRF token header if it's a mutating request
-            if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
-                const csrfToken = getCsrfToken$1(this.config.csrf?.cookieName || 'XSRF-TOKEN');
-                if (csrfToken) {
-                    clonedReq = clonedReq.clone({
-                        setHeaders: { [this.config.csrf?.headerName || 'X-XSRF-TOKEN']: csrfToken },
-                    });
-                }
-            }
-            return next.handle(clonedReq).pipe(catchError((error) => {
-                if (error.status === 401 && !retriedRequests$1.has(req)) {
-                    retriedRequests$1.add(req);
-                    if (!isRefreshing$1) {
-                        isRefreshing$1 = true;
-                        refreshTokenSubject$1.next(null);
-                        return from(this.http
-                            .post(`${baseUrl}/refresh`, {}, { withCredentials: true })
-                            .toPromise()).pipe(switchMap(() => {
-                            isRefreshing$1 = false;
-                            refreshTokenSubject$1.next('refreshed');
-                            return next.handle(clonedReq);
-                        }), catchError((refreshError) => {
-                            isRefreshing$1 = false;
-                            this.authService.logout();
-                            this.router.navigate([this.config.redirects?.sessionExpired || '/login']);
-                            return throwError(() => refreshError);
-                        }));
-                    }
-                    else {
-                        return refreshTokenSubject$1.pipe(filter$1((token) => token !== null), take(1), switchMap(() => next.handle(clonedReq)));
-                    }
-                }
-                return throwError(() => error);
-            }));
-        }
-        // ============================================================================
-        // JSON MODE: Delegate to SDK for token handling
-        // ============================================================================
-        return next.handle(req);
+        return createNAuthAuthHttpInterceptor({
+            config: this.config,
+            http: this.http,
+            authService: this.authService,
+            router: this.router,
+            req,
+            next: (r) => next.handle(r),
+        });
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AuthInterceptorClass, deps: [{ token: NAUTH_CLIENT_CONFIG }, { token: i1.HttpClient }, { token: AuthService }, { token: i3.Router }], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AuthInterceptorClass });
@@ -1225,25 +1388,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 }]
         }] });
 
-/**
- * Refresh state management.
- * BehaviorSubject pattern is the industry-standard for token refresh.
- */
-let isRefreshing = false;
-const refreshTokenSubject = new BehaviorSubject(null);
-/**
- * Track retried requests to prevent infinite loops.
- */
-const retriedRequests = new WeakSet();
-/**
- * Get CSRF token from cookie.
- */
-function getCsrfToken(cookieName) {
-    if (typeof document === 'undefined')
-        return null;
-    const match = document.cookie.match(new RegExp(`(^| )${cookieName}=([^;]+)`));
-    return match ? decodeURIComponent(match[2]) : null;
-}
 /**
  * Angular HTTP interceptor for nauth-toolkit.
  *
@@ -1261,248 +1405,8 @@ const authInterceptor = (req, next) => {
     if (!isBrowser) {
         return next(req);
     }
-    // #region agent log
-    if (req.url.includes('/profile') && req.method === 'PUT') {
-        fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                location: 'auth.interceptor.ts:entry',
-                message: 'Original request entry',
-                data: { reqBody: req.body, reqBodyType: typeof req.body, reqMethod: req.method, reqUrl: req.url },
-                timestamp: Date.now(),
-                sessionId: 'debug-session',
-                hypothesisId: 'A',
-            }),
-        }).catch(() => { });
-    }
-    // #endregion
-    const tokenDelivery = config.tokenDelivery;
-    const baseUrl = config.baseUrl;
-    const endpoints = config.endpoints ?? {};
-    const refreshPath = endpoints.refresh ?? '/refresh';
-    const loginPath = endpoints.login ?? '/login';
-    const signupPath = endpoints.signup ?? '/signup';
-    const socialExchangePath = endpoints.socialExchange ?? '/social/exchange';
-    const refreshUrl = `${baseUrl}${refreshPath}`;
-    const isAuthApiRequest = req.url.includes(baseUrl);
-    const isRefreshEndpoint = req.url.includes(refreshPath);
-    const isPublicEndpoint = req.url.includes(loginPath) || req.url.includes(signupPath) || req.url.includes(socialExchangePath);
-    // Build request with credentials (cookies mode only)
-    let authReq = req;
-    if (tokenDelivery === 'cookies') {
-        authReq = authReq.clone({ withCredentials: true });
-        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
-            const csrfCookieName = config.csrf?.cookieName ?? 'nauth_csrf_token';
-            const csrfHeaderName = config.csrf?.headerName ?? 'x-csrf-token';
-            const csrfToken = getCsrfToken(csrfCookieName);
-            if (csrfToken) {
-                authReq = authReq.clone({ setHeaders: { [csrfHeaderName]: csrfToken } });
-            }
-        }
-    }
-    return next(authReq).pipe(catchError((error) => {
-        const shouldHandle = error instanceof HttpErrorResponse &&
-            error.status === 401 &&
-            isAuthApiRequest &&
-            !isRefreshEndpoint &&
-            !isPublicEndpoint &&
-            !retriedRequests.has(req);
-        if (!shouldHandle) {
-            return throwError(() => error);
-        }
-        // Mark original request as retried to prevent infinite loops
-        retriedRequests.add(req);
-        if (config.debug) {
-            console.warn('[nauth-interceptor] 401 detected:', req.url);
-        }
-        if (!isRefreshing) {
-            isRefreshing = true;
-            refreshTokenSubject.next(null);
-            if (config.debug) {
-                console.warn('[nauth-interceptor] Starting refresh...');
-            }
-            // Refresh based on mode
-            const refresh$ = tokenDelivery === 'cookies'
-                ? http.post(refreshUrl, {}, { withCredentials: true })
-                : from(authService.refresh());
-            return refresh$.pipe(switchMap((response) => {
-                if (config.debug) {
-                    console.warn('[nauth-interceptor] Refresh successful');
-                }
-                isRefreshing = false;
-                // Get new token (JSON mode) or signal success (cookies mode)
-                const newToken = 'accessToken' in response ? response.accessToken : 'success';
-                refreshTokenSubject.next(newToken ?? 'success');
-                // #region agent log
-                fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        location: 'auth.interceptor.ts:125',
-                        message: 'Before buildRetryRequest',
-                        data: {
-                            authReqBody: authReq.body,
-                            authReqMethod: authReq.method,
-                            authReqUrl: authReq.url,
-                            authReqBodyType: typeof authReq.body,
-                        },
-                        timestamp: Date.now(),
-                        sessionId: 'debug-session',
-                        hypothesisId: 'A',
-                    }),
-                }).catch(() => { });
-                // #endregion
-                // Build retry request with fresh CSRF token (re-read from cookie after refresh)
-                const retryReq = buildRetryRequest(authReq, tokenDelivery, newToken, config.csrf);
-                // #region agent log
-                fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        location: 'auth.interceptor.ts:130',
-                        message: 'After buildRetryRequest',
-                        data: {
-                            retryReqBody: retryReq.body,
-                            retryReqMethod: retryReq.method,
-                            retryReqUrl: retryReq.url,
-                            retryReqBodyType: typeof retryReq.body,
-                            headersKeys: retryReq.headers.keys(),
-                        },
-                        timestamp: Date.now(),
-                        sessionId: 'debug-session',
-                        hypothesisId: 'B',
-                    }),
-                }).catch(() => { });
-                // #endregion
-                if (config.debug) {
-                    console.warn('[nauth-interceptor] Retrying:', req.url);
-                }
-                // Retry the request with fresh token/CSRF
-                // IMPORTANT: Errors from the retry (e.g., 400 validation) should NOT trigger
-                // session expiration redirect. Only the refresh failure should redirect.
-                return next(retryReq).pipe(catchError((retryErr) => {
-                    // Retry failed (could be 400, 403, 500, etc.)
-                    // Just propagate the error - don't redirect to login
-                    if (config.debug) {
-                        console.warn('[nauth-interceptor] Retry request failed:', retryErr);
-                    }
-                    return throwError(() => retryErr);
-                }));
-            }), catchError((err) => {
-                // This only catches REFRESH failures, not retry failures
-                if (config.debug) {
-                    console.error('[nauth-interceptor] Refresh failed:', err);
-                }
-                isRefreshing = false;
-                refreshTokenSubject.next(null);
-                // Handle session expiration - redirect to configured URL
-                // Only redirect if refresh itself failed (not if retry failed)
-                if (config.redirects?.sessionExpired) {
-                    router.navigateByUrl(config.redirects.sessionExpired).catch((navError) => {
-                        if (config.debug) {
-                            console.error('[nauth-interceptor] Navigation failed:', navError);
-                        }
-                    });
-                }
-                return throwError(() => err);
-            }));
-        }
-        else {
-            // Wait for ongoing refresh
-            if (config.debug) {
-                console.warn('[nauth-interceptor] Waiting for refresh...');
-            }
-            return refreshTokenSubject.pipe(filter$1((token) => token !== null), take(1), switchMap((token) => {
-                if (config.debug) {
-                    console.warn('[nauth-interceptor] Refresh done, retrying:', req.url);
-                }
-                const retryReq = buildRetryRequest(authReq, tokenDelivery, token, config.csrf);
-                // Retry the request - errors here should propagate normally
-                // without triggering session expiration redirect
-                return next(retryReq).pipe(catchError((retryErr) => {
-                    if (config.debug) {
-                        console.warn('[nauth-interceptor] Retry request failed:', retryErr);
-                    }
-                    return throwError(() => retryErr);
-                }));
-            }));
-        }
-    }));
+    return createNAuthAuthHttpInterceptor({ config, http, authService, router, next, req });
 };
-/**
- * Build retry request with appropriate auth.
- *
- * CRITICAL FIX: In cookies mode, after refresh the server may send updated cookies.
- * We MUST re-read the CSRF token from the cookie before retrying to ensure we have
- * the current CSRF token that matches what the server expects.
- *
- * In JSON mode: Clones the request and adds the new Bearer token.
- *
- * @param originalReq - The base request (already has withCredentials if cookies mode)
- * @param tokenDelivery - 'cookies' or 'json'
- * @param newToken - The new access token (JSON mode only)
- * @param csrfConfig - CSRF configuration to re-read token from cookie
- * @returns The request ready for retry with fresh auth
- */
-function buildRetryRequest(originalReq, tokenDelivery, newToken, csrfConfig) {
-    if (tokenDelivery === 'json' && newToken && newToken !== 'success') {
-        return originalReq.clone({
-            setHeaders: { Authorization: `Bearer ${newToken}` },
-        });
-    }
-    // Cookies mode: Browser automatically sends updated httpOnly cookies (access/refresh tokens).
-    // However, CSRF token must match the cookie value at the moment of retry.
-    // We ALWAYS re-read from document.cookie here (using defaults when csrfConfig
-    // is not provided) to avoid stale header values after refresh or across tabs.
-    if (tokenDelivery === 'cookies' && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(originalReq.method)) {
-        const csrfCookieName = csrfConfig?.cookieName ?? 'nauth_csrf_token';
-        const csrfHeaderName = csrfConfig?.headerName ?? 'x-csrf-token';
-        const freshCsrfToken = getCsrfToken(csrfCookieName);
-        // #region agent log
-        fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                location: 'auth.interceptor.ts:buildRetryRequest',
-                message: 'Inside buildRetryRequest cookies branch',
-                data: {
-                    originalReqBody: originalReq.body,
-                    originalReqBodyType: typeof originalReq.body,
-                    freshCsrfToken: freshCsrfToken?.substring(0, 8),
-                    method: originalReq.method,
-                },
-                timestamp: Date.now(),
-                sessionId: 'debug-session',
-                hypothesisId: 'C',
-            }),
-        }).catch(() => { });
-        // #endregion
-        if (freshCsrfToken) {
-            // Clone with fresh CSRF token in header
-            const cloned = originalReq.clone({
-                setHeaders: { [csrfHeaderName]: freshCsrfToken },
-            });
-            // #region agent log
-            fetch('http://127.0.0.1:7242/ingest/97f9fe53-6a8b-43e2-ae9b-4b2d0f725816', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    location: 'auth.interceptor.ts:buildRetryRequest:afterClone',
-                    message: 'After clone with setHeaders',
-                    data: { clonedBody: cloned.body, clonedBodyType: typeof cloned.body, originalBody: originalReq.body },
-                    timestamp: Date.now(),
-                    sessionId: 'debug-session',
-                    hypothesisId: 'D',
-                }),
-            }).catch(() => { });
-            // #endregion
-            return cloned;
-        }
-    }
-    // No changes needed (GET request or no CSRF token available)
-    return originalReq;
-}
 /**
  * Class-based interceptor for NgModule compatibility.
  */