@sdcorejs/angular 19.0.0-rc.1

package/fesm2022/sdcorejs-angular-modules-authom.mjs

@@ -0,0 +1,360 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, inject, PLATFORM_ID, signal, computed, Injectable, provideAppInitializer, makeEnvironmentProviders, APP_INITIALIZER, NgModule } from '@angular/core';
+import { isPlatformBrowser } from '@angular/common';
+import { StringUtilities } from '@sdcorejs/utils/fns';
+
+const SD_AUTHOM_CONFIGURATION = new InjectionToken('sd-authom.configuration');
+
+const STORAGE_KEY_STATE = 'authom_state';
+const STORAGE_KEY_CODE_VERIFIER = 'authom_code_verifier';
+const STORAGE_KEY_RETURN_TO = 'authom_return_to';
+const DEFAULT_SCOPE = 'openid profile email';
+const DEFAULT_REFRESH_THRESHOLD_SECONDS = 30;
+const DEFAULT_AUTHORIZE_TIMEOUT_SECONDS = 5;
+class SdAuthOmService {
+    platformId = inject(PLATFORM_ID);
+    isBrowser = isPlatformBrowser(this.platformId);
+    accessToken = signal(null);
+    idTokenClaims = signal(null);
+    isAuthenticated = computed(() => this.accessToken() !== null);
+    config;
+    refreshTimer = null;
+    getAccessToken() {
+        return this.accessToken();
+    }
+    base64UrlEncode(bytes) {
+        let binary = '';
+        for (let i = 0; i < bytes.length; i++)
+            binary += String.fromCharCode(bytes[i]);
+        return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    }
+    generateCodeVerifier() {
+        const bytes = new Uint8Array(32);
+        crypto.getRandomValues(bytes);
+        return this.base64UrlEncode(bytes);
+    }
+    async generateCodeChallenge(verifier) {
+        return StringUtilities.sha256(verifier);
+    }
+    buildAuthorizeUrl(params) {
+        const search = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.config.clientId,
+            redirect_uri: params.redirectUri,
+            state: params.state,
+            code_challenge: params.codeChallenge,
+            code_challenge_method: 'S256',
+            scope: this.config.scope || DEFAULT_SCOPE,
+        });
+        if (this.config.audience)
+            search.set('audience', this.config.audience);
+        if (this.config.organization)
+            search.set('organization', this.config.organization);
+        if (params.prompt)
+            search.set('prompt', params.prompt);
+        return `https://${this.config.domain}/authorize?${search.toString()}`;
+    }
+    getDefaultRedirectUri() {
+        return this.config.redirectUri || window.location.origin;
+    }
+    getSilentRedirectUri() {
+        return this.config.silentRefreshRedirectUri || `${window.location.origin}/silent-authom.html`;
+    }
+    decodeJwtPayload(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3)
+                return null;
+            const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+            const json = atob(padded + '==='.slice((padded.length + 3) % 4));
+            return JSON.parse(json);
+        }
+        catch {
+            return null;
+        }
+    }
+    async login(options) {
+        if (!this.isBrowser)
+            return;
+        const state = crypto.randomUUID();
+        const codeVerifier = this.generateCodeVerifier();
+        const codeChallenge = await this.generateCodeChallenge(codeVerifier);
+        const returnTo = options?.returnTo || (window.location.pathname + window.location.search);
+        sessionStorage.setItem(STORAGE_KEY_STATE, state);
+        sessionStorage.setItem(STORAGE_KEY_CODE_VERIFIER, codeVerifier);
+        sessionStorage.setItem(STORAGE_KEY_RETURN_TO, returnTo);
+        window.location.href = this.buildAuthorizeUrl({
+            state,
+            codeChallenge,
+            redirectUri: this.getDefaultRedirectUri(),
+        });
+    }
+    logout(options) {
+        if (!this.isBrowser)
+            return;
+        this.accessToken.set(null);
+        this.idTokenClaims.set(null);
+        if (this.refreshTimer) {
+            clearTimeout(this.refreshTimer);
+            this.refreshTimer = null;
+        }
+        const returnTo = options?.returnTo || window.location.origin;
+        const search = new URLSearchParams({
+            client_id: this.config.clientId,
+            returnTo,
+        });
+        window.location.href = `https://${this.config.domain}/v2/logout?${search.toString()}`;
+    }
+    async exchangeCode(code, codeVerifier, redirectUri) {
+        try {
+            const body = new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                code_verifier: codeVerifier,
+                redirect_uri: redirectUri,
+                client_id: this.config.clientId,
+            });
+            const res = await fetch(`https://${this.config.domain}/oauth/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString(),
+            });
+            if (!res.ok)
+                return false;
+            const data = await res.json();
+            if (!data.access_token)
+                return false;
+            this.accessToken.set(data.access_token);
+            if (data.id_token) {
+                this.idTokenClaims.set(this.decodeJwtPayload(data.id_token));
+            }
+            this.scheduleRefresh(data.access_token);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    scheduleRefresh(token) {
+        if (this.refreshTimer) {
+            clearTimeout(this.refreshTimer);
+            this.refreshTimer = null;
+        }
+        const claims = this.decodeJwtPayload(token);
+        const exp = claims?.['exp'];
+        if (typeof exp !== 'number') {
+            // @i18n-ignore — dev console warning
+            console.warn('[SdAuthOmService] Token không có exp — bỏ qua auto-refresh');
+            return;
+        }
+        const threshold = this.config.refreshThresholdSeconds ?? DEFAULT_REFRESH_THRESHOLD_SECONDS;
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const delayMs = Math.max(0, (exp - nowSeconds - threshold) * 1000);
+        this.refreshTimer = setTimeout(() => {
+            this.silentRefresh();
+        }, delayMs);
+    }
+    silentRefresh() {
+        if (!this.isBrowser)
+            return Promise.resolve(false);
+        return new Promise(async (resolve) => {
+            const state = crypto.randomUUID();
+            const codeVerifier = this.generateCodeVerifier();
+            const codeChallenge = await this.generateCodeChallenge(codeVerifier);
+            const redirectUri = this.getSilentRedirectUri();
+            const timeoutMs = (this.config.authorizeTimeoutInSeconds ?? DEFAULT_AUTHORIZE_TIMEOUT_SECONDS) * 1000;
+            const iframe = document.createElement('iframe');
+            iframe.style.display = 'none';
+            let done = false;
+            const finish = (success) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+                iframe.remove();
+                window.removeEventListener('message', onMessage);
+                resolve(success);
+            };
+            const timer = setTimeout(() => finish(false), timeoutMs);
+            const onMessage = async (event) => {
+                if (event.origin !== window.location.origin)
+                    return;
+                const data = event.data;
+                if (!data || typeof data !== 'object')
+                    return;
+                if (data.type === 'AUTHOM_SILENT_SUCCESS' && data.code && data.state === state) {
+                    const ok = await this.exchangeCode(data.code, codeVerifier, redirectUri);
+                    if (!ok) {
+                        this.accessToken.set(null);
+                        this.idTokenClaims.set(null);
+                    }
+                    finish(ok);
+                }
+                else if (data.type === 'AUTHOM_SILENT_ERROR') {
+                    this.accessToken.set(null);
+                    this.idTokenClaims.set(null);
+                    finish(false);
+                }
+            };
+            window.addEventListener('message', onMessage);
+            iframe.src = this.buildAuthorizeUrl({
+                state,
+                codeChallenge,
+                redirectUri,
+                prompt: 'none',
+            });
+            document.body.appendChild(iframe);
+        });
+    }
+    async handleCallback() {
+        if (!this.isBrowser)
+            return false;
+        const params = new URLSearchParams(window.location.search);
+        const code = params.get('code');
+        const state = params.get('state');
+        if (!code)
+            return false;
+        const savedState = sessionStorage.getItem(STORAGE_KEY_STATE);
+        const codeVerifier = sessionStorage.getItem(STORAGE_KEY_CODE_VERIFIER);
+        const returnTo = sessionStorage.getItem(STORAGE_KEY_RETURN_TO);
+        sessionStorage.removeItem(STORAGE_KEY_STATE);
+        sessionStorage.removeItem(STORAGE_KEY_CODE_VERIFIER);
+        if (state !== savedState || !codeVerifier) {
+            window.history.replaceState({}, '', window.location.pathname);
+            sessionStorage.removeItem(STORAGE_KEY_RETURN_TO);
+            return false;
+        }
+        const redirectUri = this.getDefaultRedirectUri();
+        const ok = await this.exchangeCode(code, codeVerifier, redirectUri);
+        if (returnTo) {
+            sessionStorage.removeItem(STORAGE_KEY_RETURN_TO);
+            window.history.replaceState({}, '', returnTo);
+        }
+        else {
+            window.history.replaceState({}, '', window.location.pathname);
+        }
+        return ok;
+    }
+    async init(config) {
+        this.config = config;
+        if (!this.isBrowser)
+            return false;
+        const hasCode = new URLSearchParams(window.location.search).has('code');
+        if (hasCode) {
+            const ok = await this.handleCallback();
+            if (ok)
+                return true;
+        }
+        return this.silentRefresh();
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdAuthOmService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdAuthOmService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdAuthOmService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+const escapeRegExp = (str) => str.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+const matchGlob = (pattern, url) => {
+    const regexBody = pattern.split('*').map(escapeRegExp).join('.*');
+    return new RegExp(`^${regexBody}$`).test(url);
+};
+const SdAuthOmInterceptor = (req, next) => {
+    const authom = inject(SdAuthOmService);
+    const token = authom.getAccessToken();
+    const config = authom.config;
+    if (!token || !config)
+        return next(req);
+    const isSecure = config.secureRoutes?.some(pattern => matchGlob(pattern, req.url));
+    if (!isSecure)
+        return next(req);
+    const authReq = req.clone({
+        headers: req.headers.set('Authorization', `Bearer ${token}`),
+    });
+    return next(authReq);
+};
+
+function provideSdAuthOm(options) {
+    const providers = [SdAuthOmService];
+    if (options.useFactory) {
+        providers.push({ provide: SD_AUTHOM_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] });
+    }
+    else if (options.useClass) {
+        providers.push({ provide: SD_AUTHOM_CONFIGURATION, useClass: options.useClass });
+    }
+    providers.push(provideAppInitializer(() => {
+        const configLoader = inject(SD_AUTHOM_CONFIGURATION);
+        const authom = inject(SdAuthOmService);
+        return configLoader.loadTenantConfig().then((config) => authom.init(config));
+    }));
+    return makeEnvironmentProviders(providers);
+}
+class SdAuthOmModule {
+    static forRoot(options) {
+        return {
+            ngModule: SdAuthOmModule,
+            providers: [
+                SdAuthOmService,
+                ...(options.useFactory
+                    ? [{ provide: SD_AUTHOM_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] }]
+                    : [{ provide: SD_AUTHOM_CONFIGURATION, useClass: options.useClass }]),
+                {
+                    provide: APP_INITIALIZER,
+                    multi: true,
+                    useFactory: () => {
+                        const configLoader = inject(SD_AUTHOM_CONFIGURATION);
+                        const authom = inject(SdAuthOmService);
+                        return () => configLoader.loadTenantConfig().then((config) => authom.init(config));
+                    },
+                },
+            ],
+        };
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdAuthOmModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
+    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "19.2.21", ngImport: i0, type: SdAuthOmModule });
+    static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdAuthOmModule });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdAuthOmModule, decorators: [{
+            type: NgModule,
+            args: [{}]
+        }] });
+
+/**
+ * Module `authom` — OAuth 2.0 + PKCE authentication client cho AuthOM (Auth0-based).
+ *
+ * Cách dùng (standalone):
+ * ```ts
+ * import { provideHttpClient, withInterceptors } from '@angular/common/http';
+ * import { provideSdAuthOm, SdAuthOmInterceptor } from '@sdcorejs/angular/modules/authom';
+ *
+ * export const appConfig: ApplicationConfig = {
+ *   providers: [
+ *     provideHttpClient(withInterceptors([SdAuthOmInterceptor])),
+ *     provideSdAuthOm({
+ *       useFactory: () => ({
+ *         loadTenantConfig: () => Promise.resolve({
+ *           domain: 'login.example.com',
+ *           clientId: 'YOUR_CLIENT_ID',
+ *           audience: 'https://api.example.com',
+ *           organization: 'org_xxx',
+ *           scope: 'openid profile email offline_access',
+ *           secureRoutes: ['https://api.example.com/*'],
+ *         }),
+ *       }),
+ *     }),
+ *   ],
+ * };
+ * ```
+ *
+ * Yêu cầu setup thêm:
+ * 1. Copy file `silent-authom.html` từ source module này vào thư mục `public/` của app.
+ * 2. App phải chạy trên HTTPS (hoặc localhost) — Web Crypto API yêu cầu secure context.
+ */
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { SD_AUTHOM_CONFIGURATION, SdAuthOmInterceptor, SdAuthOmModule, SdAuthOmService, matchGlob, provideSdAuthOm };
+//# sourceMappingURL=sdcorejs-angular-modules-authom.mjs.map

package/fesm2022/sdcorejs-angular-modules-authom.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdcorejs-angular-modules-authom.mjs","sources":["../../../projects/sdcorejs-angular/modules/authom/authom.configuration.ts","../../../projects/sdcorejs-angular/modules/authom/authom.service.ts","../../../projects/sdcorejs-angular/modules/authom/authom.interceptor.ts","../../../projects/sdcorejs-angular/modules/authom/authom.module.ts","../../../projects/sdcorejs-angular/modules/authom/index.ts","../../../projects/sdcorejs-angular/modules/authom/sdcorejs-angular-modules-authom.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\n\nexport interface SdAuthOmTenantConfig {\n  domain: string;\n  clientId: string;\n\n  redirectUri?: string;\n  audience?: string;\n  organization?: string;\n  scope?: string;\n\n  secureRoutes?: string[];\n\n  silentRefreshRedirectUri?: string;\n  refreshThresholdSeconds?: number;\n  authorizeTimeoutInSeconds?: number;\n}\n\nexport interface ISdAuthOmConfiguration {\n  loadTenantConfig: () => Promise<SdAuthOmTenantConfig>;\n}\n\nexport const SD_AUTHOM_CONFIGURATION = new InjectionToken<ISdAuthOmConfiguration>('sd-authom.configuration');\n","import { Injectable, PLATFORM_ID, computed, inject, signal } from '@angular/core';\nimport { isPlatformBrowser } from '@angular/common';\nimport { SdAuthOmTenantConfig } from './authom.configuration';\nimport { StringUtilities } from '@sdcorejs/utils/fns';\n\nconst STORAGE_KEY_STATE = 'authom_state';\nconst STORAGE_KEY_CODE_VERIFIER = 'authom_code_verifier';\nconst STORAGE_KEY_RETURN_TO = 'authom_return_to';\n\nconst DEFAULT_SCOPE = 'openid profile email';\nconst DEFAULT_REFRESH_THRESHOLD_SECONDS = 30;\nconst DEFAULT_AUTHORIZE_TIMEOUT_SECONDS = 5;\n\n@Injectable({ providedIn: 'root' })\nexport class SdAuthOmService {\n  private readonly platformId = inject(PLATFORM_ID);\n  private readonly isBrowser = isPlatformBrowser(this.platformId);\n\n  readonly accessToken = signal<string | null>(null);\n  readonly idTokenClaims = signal<Record<string, unknown> | null>(null);\n  readonly isAuthenticated = computed(() => this.accessToken() !== null);\n\n  config!: SdAuthOmTenantConfig;\n  private refreshTimer: ReturnType<typeof setTimeout> | null = null;\n\n  getAccessToken(): string | null {\n    return this.accessToken();\n  }\n\n  private base64UrlEncode(bytes: Uint8Array): string {\n    let binary = '';\n    for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);\n    return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n  }\n\n  private generateCodeVerifier(): string {\n    const bytes = new Uint8Array(32);\n    crypto.getRandomValues(bytes);\n    return this.base64UrlEncode(bytes);\n  }\n\n  private async generateCodeChallenge(verifier: string): Promise<string> {\n    return StringUtilities.sha256(verifier);\n  }\n\n  private buildAuthorizeUrl(params: {\n    state: string;\n    codeChallenge: string;\n    redirectUri: string;\n    prompt?: 'none';\n  }): string {\n    const search = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: params.redirectUri,\n      state: params.state,\n      code_challenge: params.codeChallenge,\n      code_challenge_method: 'S256',\n      scope: this.config.scope || DEFAULT_SCOPE,\n    });\n    if (this.config.audience) search.set('audience', this.config.audience);\n    if (this.config.organization) search.set('organization', this.config.organization);\n    if (params.prompt) search.set('prompt', params.prompt);\n    return `https://${this.config.domain}/authorize?${search.toString()}`;\n  }\n\n  private getDefaultRedirectUri(): string {\n    return this.config.redirectUri || window.location.origin;\n  }\n\n  private getSilentRedirectUri(): string {\n    return this.config.silentRefreshRedirectUri || `${window.location.origin}/silent-authom.html`;\n  }\n\n  private decodeJwtPayload(token: string): Record<string, unknown> | null {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) return null;\n      const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');\n      const json = atob(padded + '==='.slice((padded.length + 3) % 4));\n      return JSON.parse(json);\n    } catch {\n      return null;\n    }\n  }\n\n  async login(options?: { returnTo?: string }): Promise<void> {\n    if (!this.isBrowser) return;\n\n    const state = crypto.randomUUID();\n    const codeVerifier = this.generateCodeVerifier();\n    const codeChallenge = await this.generateCodeChallenge(codeVerifier);\n    const returnTo = options?.returnTo || (window.location.pathname + window.location.search);\n\n    sessionStorage.setItem(STORAGE_KEY_STATE, state);\n    sessionStorage.setItem(STORAGE_KEY_CODE_VERIFIER, codeVerifier);\n    sessionStorage.setItem(STORAGE_KEY_RETURN_TO, returnTo);\n\n    window.location.href = this.buildAuthorizeUrl({\n      state,\n      codeChallenge,\n      redirectUri: this.getDefaultRedirectUri(),\n    });\n  }\n\n  logout(options?: { returnTo?: string }): void {\n    if (!this.isBrowser) return;\n\n    this.accessToken.set(null);\n    this.idTokenClaims.set(null);\n    if (this.refreshTimer) {\n      clearTimeout(this.refreshTimer);\n      this.refreshTimer = null;\n    }\n\n    const returnTo = options?.returnTo || window.location.origin;\n    const search = new URLSearchParams({\n      client_id: this.config.clientId,\n      returnTo,\n    });\n    window.location.href = `https://${this.config.domain}/v2/logout?${search.toString()}`;\n  }\n\n  private async exchangeCode(code: string, codeVerifier: string, redirectUri: string): Promise<boolean> {\n    try {\n      const body = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        code_verifier: codeVerifier,\n        redirect_uri: redirectUri,\n        client_id: this.config.clientId,\n      });\n      const res = await fetch(`https://${this.config.domain}/oauth/token`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: body.toString(),\n      });\n      if (!res.ok) return false;\n      const data = await res.json() as { access_token?: string; id_token?: string };\n      if (!data.access_token) return false;\n\n      this.accessToken.set(data.access_token);\n      if (data.id_token) {\n        this.idTokenClaims.set(this.decodeJwtPayload(data.id_token));\n      }\n      this.scheduleRefresh(data.access_token);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private scheduleRefresh(token: string): void {\n    if (this.refreshTimer) {\n      clearTimeout(this.refreshTimer);\n      this.refreshTimer = null;\n    }\n    const claims = this.decodeJwtPayload(token);\n    const exp = claims?.['exp'];\n    if (typeof exp !== 'number') {\n      // @i18n-ignore — dev console warning\n      console.warn('[SdAuthOmService] Token không có exp — bỏ qua auto-refresh');\n      return;\n    }\n    const threshold = this.config.refreshThresholdSeconds ?? DEFAULT_REFRESH_THRESHOLD_SECONDS;\n    const nowSeconds = Math.floor(Date.now() / 1000);\n    const delayMs = Math.max(0, (exp - nowSeconds - threshold) * 1000);\n    this.refreshTimer = setTimeout(() => {\n      this.silentRefresh();\n    }, delayMs);\n  }\n\n  silentRefresh(): Promise<boolean> {\n    if (!this.isBrowser) return Promise.resolve(false);\n\n    return new Promise(async (resolve) => {\n      const state = crypto.randomUUID();\n      const codeVerifier = this.generateCodeVerifier();\n      const codeChallenge = await this.generateCodeChallenge(codeVerifier);\n      const redirectUri = this.getSilentRedirectUri();\n      const timeoutMs = (this.config.authorizeTimeoutInSeconds ?? DEFAULT_AUTHORIZE_TIMEOUT_SECONDS) * 1000;\n\n      const iframe = document.createElement('iframe');\n      iframe.style.display = 'none';\n\n      let done = false;\n      const finish = (success: boolean) => {\n        if (done) return;\n        done = true;\n        clearTimeout(timer);\n        iframe.remove();\n        window.removeEventListener('message', onMessage);\n        resolve(success);\n      };\n\n      const timer = setTimeout(() => finish(false), timeoutMs);\n\n      const onMessage = async (event: MessageEvent) => {\n        if (event.origin !== window.location.origin) return;\n        const data = event.data as { type?: string; code?: string; state?: string } | null;\n        if (!data || typeof data !== 'object') return;\n\n        if (data.type === 'AUTHOM_SILENT_SUCCESS' && data.code && data.state === state) {\n          const ok = await this.exchangeCode(data.code, codeVerifier, redirectUri);\n          if (!ok) {\n            this.accessToken.set(null);\n            this.idTokenClaims.set(null);\n          }\n          finish(ok);\n        } else if (data.type === 'AUTHOM_SILENT_ERROR') {\n          this.accessToken.set(null);\n          this.idTokenClaims.set(null);\n          finish(false);\n        }\n      };\n\n      window.addEventListener('message', onMessage);\n\n      iframe.src = this.buildAuthorizeUrl({\n        state,\n        codeChallenge,\n        redirectUri,\n        prompt: 'none',\n      });\n      document.body.appendChild(iframe);\n    });\n  }\n\n  async handleCallback(): Promise<boolean> {\n    if (!this.isBrowser) return false;\n\n    const params = new URLSearchParams(window.location.search);\n    const code = params.get('code');\n    const state = params.get('state');\n    if (!code) return false;\n\n    const savedState = sessionStorage.getItem(STORAGE_KEY_STATE);\n    const codeVerifier = sessionStorage.getItem(STORAGE_KEY_CODE_VERIFIER);\n    const returnTo = sessionStorage.getItem(STORAGE_KEY_RETURN_TO);\n    sessionStorage.removeItem(STORAGE_KEY_STATE);\n    sessionStorage.removeItem(STORAGE_KEY_CODE_VERIFIER);\n\n    if (state !== savedState || !codeVerifier) {\n      window.history.replaceState({}, '', window.location.pathname);\n      sessionStorage.removeItem(STORAGE_KEY_RETURN_TO);\n      return false;\n    }\n\n    const redirectUri = this.getDefaultRedirectUri();\n    const ok = await this.exchangeCode(code, codeVerifier, redirectUri);\n\n    if (returnTo) {\n      sessionStorage.removeItem(STORAGE_KEY_RETURN_TO);\n      window.history.replaceState({}, '', returnTo);\n    } else {\n      window.history.replaceState({}, '', window.location.pathname);\n    }\n\n    return ok;\n  }\n\n  async init(config: SdAuthOmTenantConfig): Promise<boolean> {\n    this.config = config;\n    if (!this.isBrowser) return false;\n\n    const hasCode = new URLSearchParams(window.location.search).has('code');\n    if (hasCode) {\n      const ok = await this.handleCallback();\n      if (ok) return true;\n    }\n\n    return this.silentRefresh();\n  }\n}\n","import { HttpInterceptorFn } from '@angular/common/http';\nimport { inject } from '@angular/core';\nimport { SdAuthOmService } from './authom.service';\n\nconst escapeRegExp = (str: string): string => str.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\nexport const matchGlob = (pattern: string, url: string): boolean => {\n  const regexBody = pattern.split('*').map(escapeRegExp).join('.*');\n  return new RegExp(`^${regexBody}$`).test(url);\n};\n\nexport const SdAuthOmInterceptor: HttpInterceptorFn = (req, next) => {\n  const authom = inject(SdAuthOmService);\n  const token = authom.getAccessToken();\n  const config = authom.config;\n\n  if (!token || !config) return next(req);\n\n  const isSecure = config.secureRoutes?.some(pattern => matchGlob(pattern, req.url));\n  if (!isSecure) return next(req);\n\n  const authReq = req.clone({\n    headers: req.headers.set('Authorization', `Bearer ${token}`),\n  });\n  return next(authReq);\n};\n","import {\n  ModuleWithProviders,\n  NgModule,\n  Provider,\n  Type,\n  EnvironmentProviders,\n  makeEnvironmentProviders,\n  provideAppInitializer,\n  inject,\n  APP_INITIALIZER,\n} from '@angular/core';\nimport { ISdAuthOmConfiguration, SD_AUTHOM_CONFIGURATION } from './authom.configuration';\nimport { SdAuthOmService } from './authom.service';\n\ninterface ProvideOptions {\n  useClass?: Type<ISdAuthOmConfiguration>;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  useFactory?: (...args: any[]) => ISdAuthOmConfiguration;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  deps?: any[];\n}\n\nexport function provideSdAuthOm(options: ProvideOptions): EnvironmentProviders {\n  const providers: Array<Provider | EnvironmentProviders> = [SdAuthOmService];\n\n  if (options.useFactory) {\n    providers.push({ provide: SD_AUTHOM_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] });\n  } else if (options.useClass) {\n    providers.push({ provide: SD_AUTHOM_CONFIGURATION, useClass: options.useClass });\n  }\n\n  providers.push(\n    provideAppInitializer(() => {\n      const configLoader = inject(SD_AUTHOM_CONFIGURATION);\n      const authom = inject(SdAuthOmService);\n      return configLoader.loadTenantConfig().then((config) => authom.init(config));\n    })\n  );\n\n  return makeEnvironmentProviders(providers);\n}\n\n@NgModule({})\nexport class SdAuthOmModule {\n  static forRoot(options: ProvideOptions): ModuleWithProviders<SdAuthOmModule> {\n    return {\n      ngModule: SdAuthOmModule,\n      providers: [\n        SdAuthOmService,\n        ...(options.useFactory\n          ? [{ provide: SD_AUTHOM_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] }]\n          : [{ provide: SD_AUTHOM_CONFIGURATION, useClass: options.useClass! }]\n        ),\n        {\n          provide: APP_INITIALIZER,\n          multi: true,\n          useFactory: () => {\n            const configLoader = inject(SD_AUTHOM_CONFIGURATION);\n            const authom = inject(SdAuthOmService);\n            return () => configLoader.loadTenantConfig().then((config) => authom.init(config));\n          },\n        },\n      ],\n    };\n  }\n}\n","/**\n * Module `authom` — OAuth 2.0 + PKCE authentication client cho AuthOM (Auth0-based).\n *\n * Cách dùng (standalone):\n * ```ts\n * import { provideHttpClient, withInterceptors } from '@angular/common/http';\n * import { provideSdAuthOm, SdAuthOmInterceptor } from '@sdcorejs/angular/modules/authom';\n *\n * export const appConfig: ApplicationConfig = {\n *   providers: [\n *     provideHttpClient(withInterceptors([SdAuthOmInterceptor])),\n *     provideSdAuthOm({\n *       useFactory: () => ({\n *         loadTenantConfig: () => Promise.resolve({\n *           domain: 'login.example.com',\n *           clientId: 'YOUR_CLIENT_ID',\n *           audience: 'https://api.example.com',\n *           organization: 'org_xxx',\n *           scope: 'openid profile email offline_access',\n *           secureRoutes: ['https://api.example.com/*'],\n *         }),\n *       }),\n *     }),\n *   ],\n * };\n * ```\n *\n * Yêu cầu setup thêm:\n * 1. Copy file `silent-authom.html` từ source module này vào thư mục `public/` của app.\n * 2. App phải chạy trên HTTPS (hoặc localhost) — Web Crypto API yêu cầu secure context.\n */\nexport * from './authom.configuration';\nexport * from './authom.service';\nexport * from './authom.interceptor';\nexport * from './authom.module';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;MAsBa,uBAAuB,GAAG,IAAI,cAAc,CAAyB,yBAAyB;;ACjB3G,MAAM,iBAAiB,GAAG,cAAc;AACxC,MAAM,yBAAyB,GAAG,sBAAsB;AACxD,MAAM,qBAAqB,GAAG,kBAAkB;AAEhD,MAAM,aAAa,GAAG,sBAAsB;AAC5C,MAAM,iCAAiC,GAAG,EAAE;AAC5C,MAAM,iCAAiC,GAAG,CAAC;MAG9B,eAAe,CAAA;AACT,IAAA,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;AAChC,IAAA,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;AAEtD,IAAA,WAAW,GAAG,MAAM,CAAgB,IAAI,CAAC;AACzC,IAAA,aAAa,GAAG,MAAM,CAAiC,IAAI,CAAC;AAC5D,IAAA,eAAe,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;AAEtE,IAAA,MAAM;IACE,YAAY,GAAyC,IAAI;IAEjE,cAAc,GAAA;AACZ,QAAA,OAAO,IAAI,CAAC,WAAW,EAAE;IAC3B;AAEQ,IAAA,eAAe,CAAC,KAAiB,EAAA;QACvC,IAAI,MAAM,GAAG,EAAE;AACf,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAChF;IAEQ,oBAAoB,GAAA;AAC1B,QAAA,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC;AAChC,QAAA,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7B,QAAA,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC;IAEQ,MAAM,qBAAqB,CAAC,QAAgB,EAAA;AAClD,QAAA,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;IACzC;AAEQ,IAAA,iBAAiB,CAAC,MAKzB,EAAA;AACC,QAAA,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACjC,YAAA,aAAa,EAAE,MAAM;AACrB,YAAA,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,cAAc,EAAE,MAAM,CAAC,aAAa;AACpC,YAAA,qBAAqB,EAAE,MAAM;AAC7B,YAAA,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,aAAa;AAC1C,SAAA,CAAC;AACF,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;AACtE,QAAA,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAClF,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;AACtD,QAAA,OAAO,CAAA,QAAA,EAAW,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA,WAAA,EAAc,MAAM,CAAC,QAAQ,EAAE,CAAA,CAAE;IACvE;IAEQ,qBAAqB,GAAA;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;IAC1D;IAEQ,oBAAoB,GAAA;AAC1B,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,IAAI,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,qBAAqB;IAC/F;AAEQ,IAAA,gBAAgB,CAAC,KAAa,EAAA;AACpC,QAAA,IAAI;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9B,YAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;AAAE,gBAAA,OAAO,IAAI;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,YAAA,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACzB;AAAE,QAAA,MAAM;AACN,YAAA,OAAO,IAAI;QACb;IACF;IAEA,MAAM,KAAK,CAAC,OAA+B,EAAA;QACzC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE;AAErB,QAAA,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE;AACjC,QAAA,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE;QAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC;AACpE,QAAA,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;AAEzF,QAAA,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC;AAChD,QAAA,cAAc,CAAC,OAAO,CAAC,yBAAyB,EAAE,YAAY,CAAC;AAC/D,QAAA,cAAc,CAAC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC;QAEvD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;YAC5C,KAAK;YACL,aAAa;AACb,YAAA,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE;AAC1C,SAAA,CAAC;IACJ;AAEA,IAAA,MAAM,CAAC,OAA+B,EAAA;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE;AAErB,QAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;AAC1B,QAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,QAAA,IAAI,IAAI,CAAC,YAAY,EAAE;AACrB,YAAA,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/B,YAAA,IAAI,CAAC,YAAY,GAAG,IAAI;QAC1B;QAEA,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;AAC5D,QAAA,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;AACjC,YAAA,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,QAAQ;AACT,SAAA,CAAC;AACF,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA,WAAA,EAAc,MAAM,CAAC,QAAQ,EAAE,EAAE;IACvF;AAEQ,IAAA,MAAM,YAAY,CAAC,IAAY,EAAE,YAAoB,EAAE,WAAmB,EAAA;AAChF,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;AAC/B,gBAAA,UAAU,EAAE,oBAAoB;gBAChC,IAAI;AACJ,gBAAA,aAAa,EAAE,YAAY;AAC3B,gBAAA,YAAY,EAAE,WAAW;AACzB,gBAAA,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;AAChC,aAAA,CAAC;AACF,YAAA,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAA,QAAA,EAAW,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA,YAAA,CAAc,EAAE;AACnE,gBAAA,MAAM,EAAE,MAAM;AACd,gBAAA,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;AAChE,gBAAA,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;AACtB,aAAA,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;AAAE,gBAAA,OAAO,KAAK;AACzB,YAAA,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAkD;YAC7E,IAAI,CAAC,IAAI,CAAC,YAAY;AAAE,gBAAA,OAAO,KAAK;YAEpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;AACvC,YAAA,IAAI,IAAI,CAAC,QAAQ,EAAE;AACjB,gBAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D;AACA,YAAA,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;AACvC,YAAA,OAAO,IAAI;QACb;AAAE,QAAA,MAAM;AACN,YAAA,OAAO,KAAK;QACd;IACF;AAEQ,IAAA,eAAe,CAAC,KAAa,EAAA;AACnC,QAAA,IAAI,IAAI,CAAC,YAAY,EAAE;AACrB,YAAA,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/B,YAAA,IAAI,CAAC,YAAY,GAAG,IAAI;QAC1B;QACA,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;AAC3C,QAAA,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC;AAC3B,QAAA,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;;AAE3B,YAAA,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC;YAC1E;QACF;QACA,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,iCAAiC;AAC1F,QAAA,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,QAAA,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,UAAU,GAAG,SAAS,IAAI,IAAI,CAAC;AAClE,QAAA,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,MAAK;YAClC,IAAI,CAAC,aAAa,EAAE;QACtB,CAAC,EAAE,OAAO,CAAC;IACb;IAEA,aAAa,GAAA;QACX,IAAI,CAAC,IAAI,CAAC,SAAS;AAAE,YAAA,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;AAElD,QAAA,OAAO,IAAI,OAAO,CAAC,OAAO,OAAO,KAAI;AACnC,YAAA,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE;AACjC,YAAA,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE;YAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC;AACpE,YAAA,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,EAAE;AAC/C,YAAA,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,IAAI,iCAAiC,IAAI,IAAI;YAErG,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC;AAC/C,YAAA,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM;YAE7B,IAAI,IAAI,GAAG,KAAK;AAChB,YAAA,MAAM,MAAM,GAAG,CAAC,OAAgB,KAAI;AAClC,gBAAA,IAAI,IAAI;oBAAE;gBACV,IAAI,GAAG,IAAI;gBACX,YAAY,CAAC,KAAK,CAAC;gBACnB,MAAM,CAAC,MAAM,EAAE;AACf,gBAAA,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChD,OAAO,CAAC,OAAO,CAAC;AAClB,YAAA,CAAC;AAED,YAAA,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;AAExD,YAAA,MAAM,SAAS,GAAG,OAAO,KAAmB,KAAI;gBAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;oBAAE;AAC7C,gBAAA,MAAM,IAAI,GAAG,KAAK,CAAC,IAA+D;AAClF,gBAAA,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE;AAEvC,gBAAA,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE;AAC9E,oBAAA,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC;oBACxE,IAAI,CAAC,EAAE,EAAE;AACP,wBAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;AAC1B,wBAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC9B;oBACA,MAAM,CAAC,EAAE,CAAC;gBACZ;AAAO,qBAAA,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE;AAC9C,oBAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;AAC1B,oBAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC5B,MAAM,CAAC,KAAK,CAAC;gBACf;AACF,YAAA,CAAC;AAED,YAAA,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC;AAE7C,YAAA,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAClC,KAAK;gBACL,aAAa;gBACb,WAAW;AACX,gBAAA,MAAM,EAAE,MAAM;AACf,aAAA,CAAC;AACF,YAAA,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;AACnC,QAAA,CAAC,CAAC;IACJ;AAEA,IAAA,MAAM,cAAc,GAAA;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS;AAAE,YAAA,OAAO,KAAK;QAEjC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;AACjC,QAAA,IAAI,CAAC,IAAI;AAAE,YAAA,OAAO,KAAK;QAEvB,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC5D,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,yBAAyB,CAAC;QACtE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,qBAAqB,CAAC;AAC9D,QAAA,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC;AAC5C,QAAA,cAAc,CAAC,UAAU,CAAC,yBAAyB,CAAC;AAEpD,QAAA,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,YAAY,EAAE;AACzC,YAAA,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC7D,YAAA,cAAc,CAAC,UAAU,CAAC,qBAAqB,CAAC;AAChD,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,EAAE;AAChD,QAAA,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC;QAEnE,IAAI,QAAQ,EAAE;AACZ,YAAA,cAAc,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAChD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC;QAC/C;aAAO;AACL,YAAA,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/D;AAEA,QAAA,OAAO,EAAE;IACX;IAEA,MAAM,IAAI,CAAC,MAA4B,EAAA;AACrC,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS;AAAE,YAAA,OAAO,KAAK;AAEjC,QAAA,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QACvE,IAAI,OAAO,EAAE;AACX,YAAA,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE;AACtC,YAAA,IAAI,EAAE;AAAE,gBAAA,OAAO,IAAI;QACrB;AAEA,QAAA,OAAO,IAAI,CAAC,aAAa,EAAE;IAC7B;wGAlQW,eAAe,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAf,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,eAAe,cADF,MAAM,EAAA,CAAA;;4FACnB,eAAe,EAAA,UAAA,EAAA,CAAA;kBAD3B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACTlC,MAAM,YAAY,GAAG,CAAC,GAAW,KAAa,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC;MAE1E,SAAS,GAAG,CAAC,OAAe,EAAE,GAAW,KAAa;AACjE,IAAA,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACjE,IAAA,OAAO,IAAI,MAAM,CAAC,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,CAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC/C;MAEa,mBAAmB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AAClE,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC;AACtC,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,EAAE;AACrC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;AAE5B,IAAA,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAEvC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;AAClF,IAAA,IAAI,CAAC,QAAQ;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAE/B,IAAA,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;AACxB,QAAA,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAC;AAC7D,KAAA,CAAC;AACF,IAAA,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB;;ACHM,SAAU,eAAe,CAAC,OAAuB,EAAA;AACrD,IAAA,MAAM,SAAS,GAA2C,CAAC,eAAe,CAAC;AAE3E,IAAA,IAAI,OAAO,CAAC,UAAU,EAAE;QACtB,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAChH;AAAO,SAAA,IAAI,OAAO,CAAC,QAAQ,EAAE;AAC3B,QAAA,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAClF;AAEA,IAAA,SAAS,CAAC,IAAI,CACZ,qBAAqB,CAAC,MAAK;AACzB,QAAA,MAAM,YAAY,GAAG,MAAM,CAAC,uBAAuB,CAAC;AACpD,QAAA,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC;AACtC,QAAA,OAAO,YAAY,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC,CAAC,CACH;AAED,IAAA,OAAO,wBAAwB,CAAC,SAAS,CAAC;AAC5C;MAGa,cAAc,CAAA;IACzB,OAAO,OAAO,CAAC,OAAuB,EAAA;QACpC,OAAO;AACL,YAAA,QAAQ,EAAE,cAAc;AACxB,YAAA,SAAS,EAAE;gBACT,eAAe;gBACf,IAAI,OAAO,CAAC;sBACR,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE;AACjG,sBAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAS,EAAE,CAAC,CACtE;AACD,gBAAA;AACE,oBAAA,OAAO,EAAE,eAAe;AACxB,oBAAA,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,MAAK;AACf,wBAAA,MAAM,YAAY,GAAG,MAAM,CAAC,uBAAuB,CAAC;AACpD,wBAAA,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC;wBACtC,OAAO,MAAM,YAAY,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACpF,CAAC;AACF,iBAAA;AACF,aAAA;SACF;IACH;wGArBW,cAAc,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,QAAA,EAAA,CAAA;yGAAd,cAAc,EAAA,CAAA;yGAAd,cAAc,EAAA,CAAA;;4FAAd,cAAc,EAAA,UAAA,EAAA,CAAA;kBAD1B,QAAQ;mBAAC,EAAE;;;AC1CZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BG;;AC9BH;;AAEG;;;;"}

package/fesm2022/sdcorejs-angular-modules-keycloak.mjs

@@ -0,0 +1,127 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, Injectable, inject, provideAppInitializer, makeEnvironmentProviders, APP_INITIALIZER, NgModule } from '@angular/core';
+import Keycloak from 'keycloak-js';
+import { from, switchMap } from 'rxjs';
+
+const SD_KEYCLOAK_CONFIGURATION = new InjectionToken('sd-keycloak.configuration');
+
+class SdKeycloakService {
+    keycloak;
+    config;
+    async init(config) {
+        this.config = config;
+        // 1. Khởi tạo instance
+        this.keycloak = new Keycloak({
+            url: config.url,
+            realm: config.realm,
+            clientId: config.clientId,
+        });
+        // 2. Lắng nghe sự kiện hết hạn token để tự động làm mới ngầm
+        this.keycloak.onTokenExpired = () => {
+            this.keycloak.updateToken(30).catch(() => {
+                // @i18n-ignore — dev console warning
+                console.warn('Không thể làm mới token. Yêu cầu đăng nhập lại.');
+                this.keycloak.login();
+            });
+        };
+        // 3. Thực thi quá trình boot Keycloak
+        return this.keycloak.init({
+            onLoad: 'check-sso',
+            silentCheckSsoRedirectUri: window.location.origin + '/silent-renew.html',
+            checkLoginIframe: false, // Tắt check Iframe để chống lỗi vòng lặp
+        });
+    }
+    // Tiện ích nhanh cho Dev sử dụng
+    login() { return this.keycloak.login(); }
+    logout() { return this.keycloak.logout({ redirectUri: window.location.origin }); }
+    getToken() { return this.keycloak.token; }
+    getIsAuthenticated() { return this.keycloak.authenticated; }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdKeycloakService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdKeycloakService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdKeycloakService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+const SdKeycloakInterceptor = (req, next) => {
+    const keycloakService = inject(SdKeycloakService);
+    const { keycloak, config } = keycloakService;
+    // Nếu chưa init xong hoặc chưa đăng nhập -> cho request đi qua bình thường
+    if (!keycloak || !keycloak.authenticated || !config) {
+        return next(req);
+    }
+    // Kiểm tra xem URL của request có nằm trong mảng secureRoutes không
+    const isSecure = config.secureRoutes?.some(route => req.url.includes(route));
+    if (!isSecure) {
+        return next(req);
+    }
+    // Đảm bảo token luôn hợp lệ (cập nhật nếu token sẽ hết hạn trong 30s tới)
+    return from(keycloak.updateToken(30)).pipe(switchMap(() => {
+        const authReq = req.clone({
+            headers: req.headers.set('Authorization', `Bearer ${keycloak.token}`)
+        });
+        return next(authReq);
+    }));
+};
+
+// =======================================================================
+// CÁCH 1: Dùng cho Angular 19 Standalone (Gọi trong app.config.ts)
+// =======================================================================
+function provideSdKeycloak(options) {
+    // FIX 1: Khai báo mảng nhận cả Provider (cho Service/Token) lẫn EnvironmentProviders (cho AppInitializer)
+    const providers = [SdKeycloakService];
+    if (options.useFactory) {
+        providers.push({ provide: SD_KEYCLOAK_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] });
+    }
+    else if (options.useClass) {
+        providers.push({ provide: SD_KEYCLOAK_CONFIGURATION, useClass: options.useClass });
+    }
+    // Standalone dùng được provideAppInitializer ngon lành
+    providers.push(provideAppInitializer(() => {
+        const configLoader = inject(SD_KEYCLOAK_CONFIGURATION);
+        const keycloakService = inject(SdKeycloakService);
+        return configLoader.loadTenantConfig().then((config) => keycloakService.init(config));
+    }));
+    return makeEnvironmentProviders(providers);
+}
+// =======================================================================
+// CÁCH 2: Dùng cho kiến trúc NgModule cũ (Backward Compatibility)
+// =======================================================================
+class SdKeycloakModule {
+    static forRoot(options) {
+        return {
+            ngModule: SdKeycloakModule,
+            providers: [
+                SdKeycloakService,
+                ...(options.useFactory
+                    ? [{ provide: SD_KEYCLOAK_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] }]
+                    : [{ provide: SD_KEYCLOAK_CONFIGURATION, useClass: options.useClass }]),
+                // FIX 2: NgModule bắt buộc phải dùng APP_INITIALIZER (nhưng viết kiểu xịn của Angular 14+, dùng inject)
+                {
+                    provide: APP_INITIALIZER,
+                    multi: true,
+                    useFactory: () => {
+                        const configLoader = inject(SD_KEYCLOAK_CONFIGURATION);
+                        const keycloakService = inject(SdKeycloakService);
+                        return () => configLoader.loadTenantConfig().then((config) => keycloakService.init(config));
+                    }
+                }
+            ]
+        };
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdKeycloakModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
+    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "19.2.21", ngImport: i0, type: SdKeycloakModule });
+    static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdKeycloakModule });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "19.2.21", ngImport: i0, type: SdKeycloakModule, decorators: [{
+            type: NgModule,
+            args: [{}]
+        }] });
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { SD_KEYCLOAK_CONFIGURATION, SdKeycloakInterceptor, SdKeycloakModule, SdKeycloakService, provideSdKeycloak };
+//# sourceMappingURL=sdcorejs-angular-modules-keycloak.mjs.map

package/fesm2022/sdcorejs-angular-modules-keycloak.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdcorejs-angular-modules-keycloak.mjs","sources":["../../../projects/sdcorejs-angular/modules/keycloak/keycloak.configuration.ts","../../../projects/sdcorejs-angular/modules/keycloak/keycloak.service.ts","../../../projects/sdcorejs-angular/modules/keycloak/keycloak.interceptor.ts","../../../projects/sdcorejs-angular/modules/keycloak/keycloak.module.ts","../../../projects/sdcorejs-angular/modules/keycloak/sdcorejs-angular-modules-keycloak.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\n\nexport interface SdKeycloakTenantConfig {\n  url: string;\n  realm: string;\n  clientId: string;\n  secureRoutes?: string[]; // Các API cần đính token (vd: ['/api/v1'])\n}\n\nexport interface ISdKeycloakConfiguration {\n  loadTenantConfig: () => Promise<SdKeycloakTenantConfig>;\n}\n\nexport const SD_KEYCLOAK_CONFIGURATION = new InjectionToken<ISdKeycloakConfiguration>('sd-keycloak.configuration');","import { Injectable } from '@angular/core';\nimport Keycloak from 'keycloak-js'; // Import trực tiếp SDK gốc của Keycloak\nimport { SdKeycloakTenantConfig } from './keycloak.configuration';\n\n@Injectable({ providedIn: 'root' })\nexport class SdKeycloakService {\n  public keycloak!: Keycloak;\n  public config!: SdKeycloakTenantConfig;\n\n  async init(config: SdKeycloakTenantConfig): Promise<boolean> {\n    this.config = config;\n    \n    // 1. Khởi tạo instance\n    this.keycloak = new Keycloak({\n      url: config.url,\n      realm: config.realm,\n      clientId: config.clientId,\n    });\n\n    // 2. Lắng nghe sự kiện hết hạn token để tự động làm mới ngầm\n    this.keycloak.onTokenExpired = () => {\n      this.keycloak.updateToken(30).catch(() => {\n        // @i18n-ignore — dev console warning\n        console.warn('Không thể làm mới token. Yêu cầu đăng nhập lại.');\n        this.keycloak.login();\n      });\n    };\n\n    // 3. Thực thi quá trình boot Keycloak\n    return this.keycloak.init({\n      onLoad: 'check-sso',\n      silentCheckSsoRedirectUri: window.location.origin + '/silent-renew.html',\n      checkLoginIframe: false, // Tắt check Iframe để chống lỗi vòng lặp\n    });\n  }\n\n  // Tiện ích nhanh cho Dev sử dụng\n  login() { return this.keycloak.login(); }\n  logout() { return this.keycloak.logout({ redirectUri: window.location.origin }); }\n  getToken() { return this.keycloak.token; }\n  getIsAuthenticated() { return this.keycloak.authenticated; }\n}","import { HttpInterceptorFn } from '@angular/common/http';\nimport { inject } from '@angular/core';\nimport { from, switchMap } from 'rxjs';\nimport { SdKeycloakService } from './keycloak.service';\n\nexport const SdKeycloakInterceptor: HttpInterceptorFn = (req, next) => {\n  const keycloakService = inject(SdKeycloakService);\n  const { keycloak, config } = keycloakService;\n\n  // Nếu chưa init xong hoặc chưa đăng nhập -> cho request đi qua bình thường\n  if (!keycloak || !keycloak.authenticated || !config) {\n    return next(req);\n  }\n\n  // Kiểm tra xem URL của request có nằm trong mảng secureRoutes không\n  const isSecure = config.secureRoutes?.some(route => req.url.includes(route));\n  if (!isSecure) {\n    return next(req);\n  }\n\n  // Đảm bảo token luôn hợp lệ (cập nhật nếu token sẽ hết hạn trong 30s tới)\n  return from(keycloak.updateToken(30)).pipe(\n    switchMap(() => {\n      const authReq = req.clone({\n        headers: req.headers.set('Authorization', `Bearer ${keycloak.token}`)\n      });\n      return next(authReq);\n    })\n  );\n};","import { \n  ModuleWithProviders, \n  NgModule, \n  Provider, \n  Type, \n  EnvironmentProviders, \n  makeEnvironmentProviders, \n  provideAppInitializer, \n  inject,\n  APP_INITIALIZER\n} from '@angular/core';\nimport { ISdKeycloakConfiguration, SD_KEYCLOAK_CONFIGURATION } from './keycloak.configuration';\nimport { SdKeycloakService } from './keycloak.service';\n\n// =======================================================================\n// CÁCH 1: Dùng cho Angular 19 Standalone (Gọi trong app.config.ts)\n// =======================================================================\nexport function provideSdKeycloak(options: {\n  useClass?: Type<ISdKeycloakConfiguration>;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  useFactory?: (...args: any[]) => ISdKeycloakConfiguration;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  deps?: any[];\n}): EnvironmentProviders {\n  \n  // FIX 1: Khai báo mảng nhận cả Provider (cho Service/Token) lẫn EnvironmentProviders (cho AppInitializer)\n  const providers: Array<Provider | EnvironmentProviders> = [SdKeycloakService];\n\n  if (options.useFactory) {\n    providers.push({ provide: SD_KEYCLOAK_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] });\n  } else if (options.useClass) {\n    providers.push({ provide: SD_KEYCLOAK_CONFIGURATION, useClass: options.useClass });\n  }\n\n  // Standalone dùng được provideAppInitializer ngon lành\n  providers.push(\n    provideAppInitializer(() => {\n      const configLoader = inject(SD_KEYCLOAK_CONFIGURATION);\n      const keycloakService = inject(SdKeycloakService);\n      return configLoader.loadTenantConfig().then((config) => keycloakService.init(config));\n    })\n  );\n\n  return makeEnvironmentProviders(providers);\n}\n\n// =======================================================================\n// CÁCH 2: Dùng cho kiến trúc NgModule cũ (Backward Compatibility)\n// =======================================================================\n@NgModule({})\nexport class SdKeycloakModule {\n  static forRoot(options: {\n    useClass?: Type<ISdKeycloakConfiguration>;\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    useFactory?: (...args: any[]) => ISdKeycloakConfiguration;\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    deps?: any[];\n  }): ModuleWithProviders<SdKeycloakModule> {\n    \n    return {\n      ngModule: SdKeycloakModule,\n      providers: [\n        SdKeycloakService,\n        ...(options.useFactory \n          ? [{ provide: SD_KEYCLOAK_CONFIGURATION, useFactory: options.useFactory, deps: options.deps || [] }]\n          : [{ provide: SD_KEYCLOAK_CONFIGURATION, useClass: options.useClass! }]\n        ),\n        \n        // FIX 2: NgModule bắt buộc phải dùng APP_INITIALIZER (nhưng viết kiểu xịn của Angular 14+, dùng inject)\n        {\n          provide: APP_INITIALIZER,\n          multi: true,\n          useFactory: () => {\n            const configLoader = inject(SD_KEYCLOAK_CONFIGURATION);\n            const keycloakService = inject(SdKeycloakService);\n            return () => configLoader.loadTenantConfig().then((config) => keycloakService.init(config));\n          }\n        }\n      ]\n    };\n  }\n}","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;MAaa,yBAAyB,GAAG,IAAI,cAAc,CAA2B,2BAA2B;;MCRpG,iBAAiB,CAAA;AACrB,IAAA,QAAQ;AACR,IAAA,MAAM;IAEb,MAAM,IAAI,CAAC,MAA8B,EAAA;AACvC,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM;;AAGpB,QAAA,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC1B,SAAA,CAAC;;AAGF,QAAA,IAAI,CAAC,QAAQ,CAAC,cAAc,GAAG,MAAK;YAClC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAK;;AAEvC,gBAAA,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC;AAC/D,gBAAA,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;AACvB,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC;;AAGD,QAAA,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;AACxB,YAAA,MAAM,EAAE,WAAW;AACnB,YAAA,yBAAyB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,oBAAoB;YACxE,gBAAgB,EAAE,KAAK;AACxB,SAAA,CAAC;IACJ;;IAGA,KAAK,GAAA,EAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACxC,MAAM,GAAA,EAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjF,QAAQ,GAAA,EAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,kBAAkB,GAAA,EAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;wGAnChD,iBAAiB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAjB,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,iBAAiB,cADJ,MAAM,EAAA,CAAA;;4FACnB,iBAAiB,EAAA,UAAA,EAAA,CAAA;kBAD7B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;MCCrB,qBAAqB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AACpE,IAAA,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC;AACjD,IAAA,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,eAAe;;IAG5C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE;AACnD,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB;;IAGA,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ,EAAE;AACb,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB;;AAGA,IAAA,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACxC,SAAS,CAAC,MAAK;AACb,QAAA,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;AACxB,YAAA,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAA,OAAA,EAAU,QAAQ,CAAC,KAAK,EAAE;AACrE,SAAA,CAAC;AACF,QAAA,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC,CAAC,CACH;AACH;;ACfA;AACA;AACA;AACM,SAAU,iBAAiB,CAAC,OAMjC,EAAA;;AAGC,IAAA,MAAM,SAAS,GAA2C,CAAC,iBAAiB,CAAC;AAE7E,IAAA,IAAI,OAAO,CAAC,UAAU,EAAE;QACtB,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAClH;AAAO,SAAA,IAAI,OAAO,CAAC,QAAQ,EAAE;AAC3B,QAAA,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpF;;AAGA,IAAA,SAAS,CAAC,IAAI,CACZ,qBAAqB,CAAC,MAAK;AACzB,QAAA,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC;AACtD,QAAA,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC;AACjD,QAAA,OAAO,YAAY,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC,CAAC,CACH;AAED,IAAA,OAAO,wBAAwB,CAAC,SAAS,CAAC;AAC5C;AAEA;AACA;AACA;MAEa,gBAAgB,CAAA;IAC3B,OAAO,OAAO,CAAC,OAMd,EAAA;QAEC,OAAO;AACL,YAAA,QAAQ,EAAE,gBAAgB;AAC1B,YAAA,SAAS,EAAE;gBACT,iBAAiB;gBACjB,IAAI,OAAO,CAAC;sBACR,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE;AACnG,sBAAE,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAS,EAAE,CAAC,CACxE;;AAGD,gBAAA;AACE,oBAAA,OAAO,EAAE,eAAe;AACxB,oBAAA,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,MAAK;AACf,wBAAA,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC;AACtD,wBAAA,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC;wBACjD,OAAO,MAAM,YAAY,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7F;AACD;AACF;SACF;IACH;wGA9BW,gBAAgB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,QAAA,EAAA,CAAA;yGAAhB,gBAAgB,EAAA,CAAA;yGAAhB,gBAAgB,EAAA,CAAA;;4FAAhB,gBAAgB,EAAA,UAAA,EAAA,CAAA;kBAD5B,QAAQ;mBAAC,EAAE;;;ACjDZ;;AAEG;;;;"}