@syndew/oluso-auth 0.0.0-stage → 1.30.1

package/fesm2022/syndew-oluso-auth.mjs

@@ -0,0 +1,1985 @@
+import { of, ReplaySubject, timer, throwError, filter, lastValueFrom, catchError, Subject, defer, tap, take as take$1, timeout as timeout$1, map as map$1, switchMap as switchMap$1, from, firstValueFrom } from 'rxjs';
+import * as i0 from '@angular/core';
+import { Injectable, InjectionToken, Optional, Inject, inject, signal, computed } from '@angular/core';
+import { map, retry, switchMap, finalize, take, timeout, catchError as catchError$1, shareReplay } from 'rxjs/operators';
+import { HttpResponse, HttpErrorResponse, HttpClient, HttpHeaders } from '@angular/common/http';
+import { toSignal, toObservable } from '@angular/core/rxjs-interop';
+import { Router } from '@angular/router';
+import { PermissionsService, ToastService, SKIP_ERROR_TOAST } from '@syndew/oluso-ui-core';
+
+/**
+ * Implemented by the host app to bridge auth concerns to whatever auth library
+ * (angular-auth-oidc-client, MSAL, etc.) is in use. Keeps libs/auth free of
+ * library-specific dependencies — swapping providers is a single-file change.
+ */
+class AuthProvider {
+}
+class NoOpAuthProvider extends AuthProvider {
+    isAuthenticated$ = of(false);
+    getAccessToken() { return of(null); }
+    forceRefreshSession() {
+        return of({ isAuthenticated: false, accessToken: null });
+    }
+    switchTenant() {
+        return of({ isAuthenticated: false, accessToken: null });
+    }
+    authorize() { }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: NoOpAuthProvider, deps: null, target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: NoOpAuthProvider, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: NoOpAuthProvider, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+const ROTATION_ANSWER_TTL_MS = 60_000;
+const CHANNEL_NAME = 'oluso.token-rotation';
+class TokenRotationChannel {
+    answers = new Map();
+    waiters = new Map();
+    publications = new Map();
+    listeners = new Set();
+    channel;
+    constructor(channelName = CHANNEL_NAME) {
+        this.channel = typeof BroadcastChannel === 'undefined' ? null : new BroadcastChannel(channelName);
+        this.channel?.addEventListener('message', (event) => {
+            const message = event.data;
+            if (message?.type !== 'rotated')
+                return;
+            this.remember(message.id, { iv: message.iv, ciphertext: message.ciphertext, at: Date.now() });
+            this.listeners.forEach((listener) => listener(message.id));
+        });
+    }
+    /**
+     * Records that `spentRefreshToken` was exchanged for `tokens` and tells the other tabs. Resolves once the
+     * other tabs have been told.
+     */
+    async publish(spentRefreshToken, tokens) {
+        const id = await rotationId(spentRefreshToken);
+        const key = await rotationKey(spentRefreshToken);
+        const iv = crypto.getRandomValues(new Uint8Array(12)).buffer;
+        const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(JSON.stringify(tokens)));
+        this.remember(id, { iv, ciphertext, at: Date.now() });
+        this.channel?.postMessage({ type: 'rotated', id, iv, ciphertext });
+        this.publication(spentRefreshToken).resolve();
+    }
+    /** Resolves once this tab has published the rotation of `refreshToken`, or after `timeoutMs`. */
+    awaitPublished(refreshToken, timeoutMs) {
+        return new Promise((resolve) => {
+            const timer = setTimeout(resolve, timeoutMs);
+            void this.publication(refreshToken).done.then(() => { clearTimeout(timer); resolve(); });
+        });
+    }
+    /** What `refreshToken` was exchanged for, in this tab or another, while that answer is fresh; else null. */
+    async answerFor(refreshToken) {
+        const id = await rotationId(refreshToken);
+        const answer = this.answers.get(id);
+        if (!answer || Date.now() - answer.at > ROTATION_ANSWER_TTL_MS)
+            return null;
+        try {
+            const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: answer.iv }, await rotationKey(refreshToken), answer.ciphertext);
+            return JSON.parse(new TextDecoder().decode(plain));
+        }
+        catch {
+            return null;
+        }
+    }
+    /** {@link answerFor}, waiting up to `timeoutMs` for another tab's rotation of `refreshToken` to arrive. */
+    async waitForAnswer(refreshToken, timeoutMs) {
+        const id = await rotationId(refreshToken);
+        if (!this.answers.has(id)) {
+            await new Promise((resolve) => {
+                const waiter = () => { clearTimeout(timer); this.waiters.get(id)?.delete(waiter); resolve(); };
+                const timer = setTimeout(waiter, timeoutMs);
+                const set = this.waiters.get(id) ?? new Set();
+                set.add(waiter);
+                this.waiters.set(id, set);
+            });
+        }
+        return this.answerFor(refreshToken);
+    }
+    /** Calls `listener` with the id of every rotation that arrives from another tab. Returns the unsubscribe. */
+    onRotation(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    /** Whether `refreshToken` is the token a rotation with `id` spent. */
+    async isSpentBy(refreshToken, id) {
+        return (await rotationId(refreshToken)) === id;
+    }
+    remember(id, answer) {
+        this.answers.set(id, answer);
+        setTimeout(() => { if (this.answers.get(id) === answer)
+            this.answers.delete(id); }, ROTATION_ANSWER_TTL_MS);
+        this.waiters.get(id)?.forEach((wake) => wake());
+    }
+    publication(refreshToken) {
+        let publication = this.publications.get(refreshToken);
+        if (!publication) {
+            let resolve;
+            const done = new Promise((r) => (resolve = r));
+            publication = { done, resolve };
+            this.publications.set(refreshToken, publication);
+            setTimeout(() => this.publications.delete(refreshToken), ROTATION_ANSWER_TTL_MS);
+        }
+        return publication;
+    }
+}
+/** The channel the app's token storage and refresh interceptor share. */
+const tokenRotationChannel = new TokenRotationChannel();
+/** Overrides {@link tokenRotationChannel} for the token storage (tests stand up one per simulated tab). */
+const TOKEN_ROTATION_CHANNEL = new InjectionToken('TOKEN_ROTATION_CHANNEL');
+async function rotationId(refreshToken) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(`oluso.rotation.id:${refreshToken}`));
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+async function rotationKey(refreshToken) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(`oluso.rotation.key:${refreshToken}`));
+    return crypto.subtle.importKey('raw', digest, 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+
+/**
+ * Statuses meaning the token endpoint was briefly unavailable — a proxy or load balancer answering while the
+ * server restarts or deploys, a gateway timeout, or throttling — rather than refusing the grant.
+ */
+const TRANSIENT_STATUSES = new Set([408, 429, 502, 503, 504]);
+/** Longest wait between retries of our own choosing; short, so a renew follows the server back promptly. */
+const MAX_BACKOFF_MS = 10_000;
+/** Longest Retry-After honoured. */
+const MAX_RETRY_AFTER_MS = 30_000;
+/** How long a tab that has just finished a refresh may take to publish its rotation before another tab gives up waiting. */
+const ROTATION_SETTLE_MS$1 = 500;
+/** How long a refresh keeps other tabs waiting for its rotation to be stored and published. */
+const PUBLISH_TIMEOUT_MS = 10_000;
+/** Refresh exchanges in this tab by the refresh token they redeem, while running and for a while after they answer. */
+const exchanges = new Map();
+/**
+ * Makes each refresh token redeem exactly once across all of the app's tabs, and keeps that redemption alive
+ * through a brief server outage.
+ *
+ * Refresh tokens are single use. Three things would otherwise present one twice:
+ * - the OIDC client abandons a renew it considers slow (its periodic check cancels the request every few
+ *   seconds) and later starts another with the same token;
+ * - in one tab, a 401 and the background renew can both ask for a refresh;
+ * - tabs can hold the same token (a duplicated tab copies its opener's session; remembered sessions share one
+ *   store), and each renews on its own timer.
+ * So one exchange runs per refresh token whether or not its caller still listens, refreshes are taken in turn
+ * across tabs under a Web Lock, and a request for a token another exchange already redeemed — here or in
+ * another tab ({@link tokenRotationChannel}) — is answered with what it was exchanged for, its lifetime
+ * counted from when the server issued it.
+ *
+ * The client also deletes the session on any HTTP error, so a 502 from the proxy while the API restarts would
+ * sign the user out although the refresh token is still good. Transient statuses are retried after the
+ * server's Retry-After (up to 30 s), else 1 s doubling to 10 s; a refusal such as invalid_grant still reaches
+ * the client.
+ */
+const tokenRefreshRetryInterceptor = (req, next) => {
+    const refreshToken = refreshTokenOf$1(req);
+    if (refreshToken === null)
+        return next(req);
+    if (pendingTenantSwitch !== null) {
+        req = withTenant(req, pendingTenantSwitch);
+        pendingTenantSwitch = null;
+    }
+    // A tenant switch is its own request: another exchange of the same refresh token answered for the tenant
+    // the session was in, which is not what the switch asked for.
+    const key = exchangeKey(req, refreshToken);
+    let exchange = exchanges.get(key);
+    if (!exchange) {
+        exchange = startExchange(req, refreshToken, key, (r) => next(r), tokenRotationChannel);
+        exchanges.set(key, exchange);
+    }
+    const current = exchange;
+    return current.events$.pipe(map((event) => (event instanceof HttpResponse && current.receivedAt !== null ? aged(event, Date.now() - current.receivedAt) : event)));
+};
+function startExchange(req, refreshToken, key, send, rotations) {
+    const events$ = new ReplaySubject(1);
+    const exchange = { events$, receivedAt: null };
+    const answer = (response) => {
+        exchange.receivedAt = Date.now();
+        events$.next(response);
+        events$.complete();
+    };
+    void withRefreshLock(clientIdOf(req), async (waited) => {
+        const handedOver = waited
+            ? await rotations.waitForAnswer(refreshToken, ROTATION_SETTLE_MS$1)
+            : await rotations.answerFor(refreshToken);
+        let outgoing = req;
+        if (handedOver) {
+            // The refresh token was already redeemed. A plain refresh takes what it was exchanged for; a tenant
+            // switch is made with the refresh token that exchange left, since redeeming a spent one is refused.
+            const rotated = tenantOf(req) ? refreshTokenFrom(handedOver) : null;
+            if (!rotated) {
+                answer(tokenResponseFrom(handedOver));
+                return;
+            }
+            outgoing = withRefreshToken(req, rotated);
+        }
+        const exchangeOnce = (request) => send(request).pipe(retry({
+            delay: (error, attempt) => isTransient(error) ? timer(refreshRetryDelayMs(error, attempt)) : throwError(() => error),
+        }), filter((event) => event instanceof HttpResponse));
+        // A refused tenant switch leaves the refresh token unspent, so the session refreshes where it is instead:
+        // the client signs the user out on any failed refresh, and a switch that is not allowed must not do that.
+        const response = await lastValueFrom(exchangeOnce(outgoing).pipe(catchError((error) => tenantOf(outgoing) && isRefusal(error) ? exchangeOnce(withoutTenant(outgoing)) : throwError(() => error))));
+        answer(response);
+        await rotations.awaitPublished(refreshToken, PUBLISH_TIMEOUT_MS);
+    }).then(() => setTimeout(() => exchanges.delete(key), ROTATION_ANSWER_TTL_MS), (error) => {
+        exchanges.delete(key);
+        events$.error(error);
+    });
+    return exchange;
+}
+/**
+ * Runs `work` holding the app-wide refresh lock for `clientId`, telling it whether it had to wait for another
+ * tab. Browsers without Web Locks run it unserialised, which leaves only this tab's own exchanges deduplicated.
+ */
+async function withRefreshLock(clientId, work) {
+    const locks = typeof navigator === 'undefined' ? undefined : navigator.locks;
+    if (!locks)
+        return work(false);
+    const name = `oluso.token-refresh:${clientId}`;
+    const ranImmediately = await locks.request(name, { ifAvailable: true }, async (lock) => {
+        if (!lock)
+            return false;
+        await work(false);
+        return true;
+    });
+    if (!ranImmediately)
+        await locks.request(name, () => work(true));
+}
+/** The refresh token a token request redeems, or null for any other request. */
+function refreshTokenOf$1(req) {
+    if (req.method !== 'POST' || typeof req.body !== 'string')
+        return null;
+    const form = new URLSearchParams(req.body);
+    return form.get('grant_type') === 'refresh_token' ? form.get('refresh_token') : null;
+}
+/** The tenant the next refresh switches to, set for one request by {@link requestTenantSwitch}. */
+let pendingTenantSwitch = null;
+/**
+ * Makes the next refresh a switch to `tenantId` (the token endpoint's `tenant` parameter), or cancels a switch
+ * not yet sent. The parameter rides that one request only: the auth library never holds it, so later refreshes
+ * carry none (the refresh token remembers the tenant), and a refused switch never reaches the library as a
+ * failure — it is answered by a plain refresh instead.
+ */
+function requestTenantSwitch(tenantId) {
+    pendingTenantSwitch = tenantId;
+}
+/** The tenant a refresh asks to switch to (the token endpoint's `tenant` parameter), or null. */
+function tenantOf(req) {
+    return new URLSearchParams(req.body).get('tenant');
+}
+function exchangeKey(req, refreshToken) {
+    const tenant = tenantOf(req);
+    return tenant ? `${refreshToken}\ntenant:${tenant}` : refreshToken;
+}
+/** The refresh token another exchange left in storage, from the tokens it handed over. */
+function refreshTokenFrom(tokens) {
+    const token = tokens['authnResult']?.refresh_token;
+    return typeof token === 'string' && token ? token : null;
+}
+function withTenant(req, tenantId) {
+    const form = new URLSearchParams(req.body);
+    form.set('tenant', tenantId);
+    return req.clone({ body: form.toString() });
+}
+function withoutTenant(req) {
+    const form = new URLSearchParams(req.body);
+    form.delete('tenant');
+    return req.clone({ body: form.toString() });
+}
+/** The token endpoint turning the request down (invalid_request, access_denied), as opposed to failing. */
+function isRefusal(error) {
+    return error instanceof HttpErrorResponse && error.status === 400;
+}
+function withRefreshToken(req, refreshToken) {
+    const form = new URLSearchParams(req.body);
+    form.set('refresh_token', refreshToken);
+    return req.clone({ body: form.toString() });
+}
+function clientIdOf(req) {
+    return new URLSearchParams(req.body).get('client_id') ?? '';
+}
+/** Wait before retry number `attempt` (1-based): the server's Retry-After seconds when it sends them (at most
+ * 30 s), else 1 s doubling to 10 s. */
+function refreshRetryDelayMs(error, attempt) {
+    const retryAfterSeconds = Number(error.headers?.get('Retry-After'));
+    return Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+        ? Math.min(retryAfterSeconds * 1000, MAX_RETRY_AFTER_MS)
+        : Math.min(1000 * 2 ** (attempt - 1), MAX_BACKOFF_MS);
+}
+/** The token response a refresh produced, rebuilt from the tokens it left in storage. */
+function tokenResponseFrom(tokens) {
+    const authnResult = (tokens['authnResult'] ?? {});
+    const expiresAt = Number(tokens['access_token_expires_at']);
+    const body = Number.isFinite(expiresAt) && expiresAt > 0
+        ? { ...authnResult, expires_in: Math.max(Math.floor((expiresAt - Date.now()) / 1000), 1) }
+        : authnResult;
+    return new HttpResponse({ status: 200, body });
+}
+/** A token response handed out `elapsedMs` after it arrived: its lifetimes count from when the server issued it. */
+function aged(response, elapsedMs) {
+    const body = response.body;
+    const elapsedSeconds = Math.floor(elapsedMs / 1000);
+    if (elapsedSeconds <= 0 || !body || typeof body.expires_in !== 'number')
+        return response;
+    return response.clone({ body: { ...body, expires_in: Math.max(body.expires_in - elapsedSeconds, 1) } });
+}
+function isTransient(error) {
+    return error instanceof HttpErrorResponse && TRANSIENT_STATUSES.has(error.status);
+}
+
+/**
+ * Serialises token refreshes against the auth library's own background renew.
+ *
+ * With silent renew on, the library refreshes on a timer. If an API call fails
+ * with 401 while that renew is still in flight, a second refresh request is
+ * declined by the library, which reports "no session" even though the renew is
+ * about to succeed. Left alone, the interceptor would treat that as a signed-out
+ * user and redirect to login. Instead, wait for the running renew to settle and
+ * answer with the token it produced.
+ *
+ * Library-agnostic: the adapter supplies the "renew started" and "renew settled"
+ * streams and the single-shot refresh call.
+ */
+class RenewAwareAuthProvider extends AuthProvider {
+    /** How long to wait for a running renew before giving up; matches the library's own timeout. */
+    renewWaitMs = 20_000;
+    renewInFlight = false;
+    settled$ = new Subject();
+    /**
+     * Adapters call this once, in their constructor, with the library's events:
+     * `started$` whenever a background renew begins, `settled$` with true/false
+     * whenever a renew (or any authentication result) completes.
+     */
+    trackRenew(started$, settled$) {
+        started$.subscribe(() => {
+            this.renewInFlight = true;
+        });
+        settled$.subscribe((ok) => {
+            this.renewInFlight = false;
+            this.settled$.next(ok);
+        });
+    }
+    forceRefreshSession() {
+        if (this.renewInFlight) {
+            return this.awaitRenew();
+        }
+        return this.refreshOnce().pipe(switchMap((result) => {
+            if (result.isAuthenticated && result.accessToken) {
+                return of(result);
+            }
+            // The library declines a refresh while its own renew is running; if one
+            // started since we checked, its outcome is the answer, not this refusal.
+            return this.renewInFlight ? this.awaitRenew() : of(result);
+        }));
+    }
+    /**
+     * A refresh that switches tenant: {@link requestTenantSwitch} adds the token endpoint's `tenant` parameter to
+     * that one refresh request, outside the library, so the library neither keeps it for later refreshes nor sees
+     * a refusal (which it would answer by signing the user out). A renew already running is let finish first, so
+     * the switch redeems the refresh token it leaves behind. Errors unless the new token is for `tenantId`; the
+     * session is left where it was.
+     */
+    switchTenant(tenantId) {
+        const ready = this.renewInFlight ? this.awaitRenew() : of(null);
+        return ready.pipe(switchMap(() => defer(() => {
+            requestTenantSwitch(tenantId);
+            return this.refreshOnce();
+        }).pipe(finalize(() => requestTenantSwitch(null)))), switchMap((result) => result.isAuthenticated && result.accessToken && tenantOfToken(result.accessToken) === tenantId
+            ? of(result)
+            : throwError(() => new Error(`The session was not switched to tenant ${tenantId}`))));
+    }
+    awaitRenew() {
+        return this.settled$.pipe(take(1), timeout(this.renewWaitMs), catchError$1(() => of(false)), switchMap((ok) => ok
+            ? this.getAccessToken().pipe(take(1), map((token) => ({ isAuthenticated: !!token, accessToken: token ?? null })))
+            : of({ isAuthenticated: false, accessToken: null })));
+    }
+}
+/** The tenant an access token is for (its `tenant_id` claim), or null when it names none or is not a JWT. */
+function tenantOfToken(accessToken) {
+    const part = accessToken.split('.')[1];
+    if (!part)
+        return null;
+    try {
+        const json = atob(part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '='));
+        const tenant = JSON.parse(json).tenant_id;
+        return typeof tenant === 'string' ? tenant : null;
+    }
+    catch {
+        return null;
+    }
+}
+
+const REMEMBER_ME_CLAIM = 'remember_me';
+/** The entries of the stored state a refresh replaces; the rest (flow state, endpoints, keys) stays per tab. */
+const TOKEN_ENTRIES = ['authnResult', 'authzData', 'access_token_expires_at', 'userData', 'session_state'];
+/**
+ * The OIDC client stores a refresh result in several writes (the token response first, the access token and
+ * its expiry after), so a rotation is published once writes to that state have been quiet this long.
+ */
+const ROTATION_SETTLE_MS = 100;
+/**
+ * Token storage that follows the user's "Remember me" choice at sign-in.
+ *
+ * The OIDC client hands this one JSON blob per configuration. Until sign-in
+ * completes the blob only holds the pending state (nonce, code verifier) and
+ * stays in session storage, which the callback in the same tab can read. Once
+ * the blob contains a token response, the ID token says whether the sign-in was
+ * remembered: remembered sessions move to local storage, so they survive a
+ * browser restart and are shared across tabs; session-only sign-ins stay per
+ * tab and vanish when it closes. Sign-out removes both copies.
+ *
+ * Refresh tokens are single use, and tabs can hold the same one (a duplicated
+ * tab starts with a copy of its opener's session; remembered sessions share
+ * one store). When a write replaces the refresh token, the spent token and the
+ * new tokens go to the app's other tabs; a tab still holding the spent token
+ * takes the new ones, so it never presents a token the server has retired.
+ *
+ * Kept free of the OIDC library: it matches the storage contract by shape and
+ * is registered by the app's auth provider.
+ */
+class RememberMeSecurityStorage {
+    rotations;
+    pendingRotations = new Map();
+    constructor(rotations) {
+        this.rotations = rotations ?? tokenRotationChannel;
+        this.rotations.onRotation((id) => void this.adoptRotation(id));
+    }
+    read(key) {
+        return safe(() => localStorage.getItem(key)) ?? safe(() => sessionStorage.getItem(key));
+    }
+    write(key, value) {
+        const previous = refreshTokenOf(this.read(key));
+        this.store(key, value);
+        const current = refreshTokenOf(value);
+        const pending = this.pendingRotations.get(key);
+        const spent = pending?.spent ?? (previous && current && previous !== current ? previous : null);
+        if (!spent)
+            return;
+        if (pending)
+            clearTimeout(pending.timer);
+        const timer = setTimeout(() => this.publishRotation(key, spent), ROTATION_SETTLE_MS);
+        this.pendingRotations.set(key, { spent, timer });
+    }
+    publishRotation(key, spent) {
+        this.pendingRotations.delete(key);
+        const blob = this.read(key);
+        const current = refreshTokenOf(blob);
+        if (blob && current && current !== spent)
+            void this.rotations.publish(spent, tokenEntries(blob));
+    }
+    /** Takes the tokens another tab rotated to, for every stored session still holding the token it spent. */
+    async adoptRotation(id) {
+        for (const key of this.authKeys()) {
+            const blob = this.read(key);
+            const held = refreshTokenOf(blob);
+            if (!blob || !held || !(await this.rotations.isSpentBy(held, id)))
+                continue;
+            const tokens = await this.rotations.answerFor(held);
+            if (!tokens || refreshTokenOf(this.read(key)) !== held)
+                continue;
+            this.store(key, JSON.stringify({ ...JSON.parse(blob), ...tokens }));
+        }
+    }
+    authKeys() {
+        const keys = new Set();
+        for (const store of [safe(() => localStorage), safe(() => sessionStorage)]) {
+            if (!store)
+                continue;
+            for (let i = 0; i < store.length; i++) {
+                const key = store.key(i);
+                if (key && isAuthBlob(store.getItem(key)))
+                    keys.add(key);
+            }
+        }
+        return [...keys];
+    }
+    store(key, value) {
+        if (isRememberedSession(value)) {
+            safe(() => localStorage.setItem(key, value));
+            safe(() => sessionStorage.removeItem(key));
+        }
+        else {
+            safe(() => sessionStorage.setItem(key, value));
+            safe(() => localStorage.removeItem(key));
+        }
+    }
+    remove(key) {
+        safe(() => localStorage.removeItem(key));
+        safe(() => sessionStorage.removeItem(key));
+    }
+    clear() {
+        // Only our blobs leave local storage; other app preferences live there too.
+        safe(() => {
+            const ours = [];
+            for (let i = 0; i < localStorage.length; i++) {
+                const key = localStorage.key(i);
+                if (key && isAuthBlob(localStorage.getItem(key)))
+                    ours.push(key);
+            }
+            ours.forEach((key) => localStorage.removeItem(key));
+        });
+        safe(() => sessionStorage.clear());
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: RememberMeSecurityStorage, deps: [{ token: TOKEN_ROTATION_CHANNEL, optional: true }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: RememberMeSecurityStorage, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: RememberMeSecurityStorage, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [{ type: TokenRotationChannel, decorators: [{
+                    type: Optional
+                }, {
+                    type: Inject,
+                    args: [TOKEN_ROTATION_CHANNEL]
+                }] }] });
+function isRememberedSession(blob) {
+    try {
+        const parsed = JSON.parse(blob);
+        const idToken = parsed?.authnResult?.id_token;
+        if (typeof idToken !== 'string')
+            return false;
+        const payload = decodeJwtPayload(idToken);
+        const flag = payload?.[REMEMBER_ME_CLAIM];
+        return flag === true || flag === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+function refreshTokenOf(blob) {
+    if (!blob)
+        return null;
+    try {
+        const token = JSON.parse(blob)?.authnResult?.refresh_token;
+        return typeof token === 'string' && token ? token : null;
+    }
+    catch {
+        return null;
+    }
+}
+function tokenEntries(blob) {
+    const parsed = JSON.parse(blob);
+    return Object.fromEntries(TOKEN_ENTRIES.filter((k) => k in parsed).map((k) => [k, parsed[k]]));
+}
+function isAuthBlob(value) {
+    if (!value)
+        return false;
+    try {
+        const parsed = JSON.parse(value);
+        return !!parsed && typeof parsed === 'object' && ('authnResult' in parsed || 'authWellKnownEndPoints' in parsed);
+    }
+    catch {
+        return false;
+    }
+}
+function decodeJwtPayload(token) {
+    const part = token.split('.')[1];
+    if (!part)
+        return null;
+    const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    return JSON.parse(atob(padded));
+}
+function safe(fn) {
+    try {
+        return fn();
+    }
+    catch {
+        return null;
+    }
+}
+
+const CALLBACK_PARAMS = ['code', 'state', 'error'];
+/**
+ * The app's startup auth check. A stored access token that has expired (or is inside the renew window) makes the
+ * plain check report "signed out", and the app would send the user through sign-in again although the refresh
+ * token is good for days. When a refresh token is stored this renews with it instead, which also restarts the
+ * library's background renew. A sign-in callback is completed by the plain check alone, and a refresh the server
+ * refuses (refresh token expired or revoked) leaves the user signed out, as before.
+ *
+ * The refresh goes through the app's HttpClient, so the token-refresh interceptor still coordinates it with the
+ * app's other tabs.
+ */
+function checkAuthRenewingSession(client, url = typeof window !== 'undefined' ? window.location.href : '') {
+    return client.checkAuth().pipe(switchMap((result) => {
+        if (result.isAuthenticated || isCallback(url))
+            return of(result);
+        return client.getRefreshToken().pipe(take(1), switchMap((refreshToken) => refreshToken ? client.checkAuthIncludingServer().pipe(catchError$1(() => of(result))) : of(result)));
+    }));
+}
+function isCallback(url) {
+    if (!url)
+        return false;
+    const params = new URL(url, 'http://localhost').searchParams;
+    return CALLBACK_PARAMS.some((p) => params.has(p));
+}
+
+const STORAGE_KEY = 'oluso_auth';
+/**
+ * Auth Store
+ *
+ * Signal-based authentication state management.
+ * This mirrors the Zustand authSlice from the React codebase.
+ *
+ * Features:
+ * - Persistent state via localStorage
+ * - Tenant/organization context
+ * - Super admin support
+ */
+class AuthStore {
+    authProvider = inject(AuthProvider);
+    _user = signal(null, ...(ngDevMode ? [{ debugName: "_user" }] : /* istanbul ignore next */ []));
+    _accessToken = signal(null, ...(ngDevMode ? [{ debugName: "_accessToken" }] : /* istanbul ignore next */ []));
+    _refreshToken = signal(null, ...(ngDevMode ? [{ debugName: "_refreshToken" }] : /* istanbul ignore next */ []));
+    _idToken = signal(null, ...(ngDevMode ? [{ debugName: "_idToken" }] : /* istanbul ignore next */ []));
+    _isLoading = signal(false, ...(ngDevMode ? [{ debugName: "_isLoading" }] : /* istanbul ignore next */ []));
+    _error = signal(null, ...(ngDevMode ? [{ debugName: "_error" }] : /* istanbul ignore next */ []));
+    _currentTenantId = signal(null, ...(ngDevMode ? [{ debugName: "_currentTenantId" }] : /* istanbul ignore next */ []));
+    /** True once the user has picked a tenant in the UI; only then do requests carry X-Tenant-ID. */
+    _tenantSwitched = signal(false, ...(ngDevMode ? [{ debugName: "_tenantSwitched" }] : /* istanbul ignore next */ []));
+    _currentOrganization = signal(null, ...(ngDevMode ? [{ debugName: "_currentOrganization" }] : /* istanbul ignore next */ []));
+    _isSuperAdmin = signal(false, ...(ngDevMode ? [{ debugName: "_isSuperAdmin" }] : /* istanbul ignore next */ []));
+    _hasHydrated = signal(false, ...(ngDevMode ? [{ debugName: "_hasHydrated" }] : /* istanbul ignore next */ []));
+    /** Read-only computed state */
+    user = this._user.asReadonly();
+    accessToken = this._accessToken.asReadonly();
+    refreshToken = this._refreshToken.asReadonly();
+    idToken = this._idToken.asReadonly();
+    isLoading = this._isLoading.asReadonly();
+    error = this._error.asReadonly();
+    currentTenantId = this._currentTenantId.asReadonly();
+    tenantSwitched = this._tenantSwitched.asReadonly();
+    currentOrganization = this._currentOrganization.asReadonly();
+    isSuperAdmin = this._isSuperAdmin.asReadonly();
+    hasHydrated = this._hasHydrated.asReadonly();
+    isAuthenticated = toSignal(this.authProvider.isAuthenticated$, { initialValue: false });
+    /** Full state snapshot */
+    state = computed(() => ({
+        user: this._user(),
+        accessToken: this._accessToken(),
+        refreshToken: this._refreshToken(),
+        idToken: this._idToken(),
+        isAuthenticated: this.isAuthenticated(),
+        isLoading: this._isLoading(),
+        error: this._error(),
+        currentTenantId: this._currentTenantId(),
+        currentOrganization: this._currentOrganization(),
+        isSuperAdmin: this._isSuperAdmin(),
+    }), ...(ngDevMode ? [{ debugName: "state" }] : /* istanbul ignore next */ []));
+    constructor() {
+        this.hydrate();
+        // Auth-state clearing is handled explicitly by the host portal:
+        //   - /logout page's ngOnInit (post-redirect cleanup after oidcService.logoff)
+        //   - AdminAuthService.redirectToLogin() (silent-renew failure path)
+        //   - AdminAuthService.initialize() (callback / fresh-load cleanup)
+        // An automatic isAuthenticated$ → logout() subscription used to live here,
+        // but its synchronous 8-signal-write CD cascade fired during
+        // resetAuthorizationData() prevented the browser from committing the
+        // cross-origin redirect to /connect/endsession.
+    }
+    /**
+     * Set user and tokens after successful login.
+     * Extracts tenant_id from the JWT access token if present.
+     */
+    login(user, accessToken, refreshToken, idToken) {
+        this._user.set(user);
+        this._accessToken.set(accessToken);
+        this._refreshToken.set(refreshToken ?? null);
+        this._idToken.set(idToken ?? null);
+        this._error.set(null);
+        this.alignTenantWithToken(accessToken);
+        this.persist();
+    }
+    /**
+     * Makes the current tenant the one the token is for. A switch mints a token for its target, so a current
+     * tenant naming any other was left by an earlier session (or another app on the origin): it is replaced, and
+     * the session counts as not switched, so requests carry no X-Tenant-ID.
+     */
+    alignTenantWithToken(accessToken) {
+        const tokenTenantId = tenantOfToken(accessToken);
+        if (this._currentTenantId() !== tokenTenantId) {
+            this._currentTenantId.set(tokenTenantId);
+            this._tenantSwitched.set(false);
+            this.persist();
+        }
+    }
+    /**
+     * Clear authentication state on logout
+     */
+    logout() {
+        this._user.set(null);
+        this._accessToken.set(null);
+        this._refreshToken.set(null);
+        this._idToken.set(null);
+        this._currentTenantId.set(null);
+        this._tenantSwitched.set(false);
+        this._currentOrganization.set(null);
+        this._isSuperAdmin.set(false);
+        this._error.set(null);
+        this.clearStorage();
+    }
+    /**
+     * Update user information
+     */
+    setUser(user) {
+        this._user.set(user);
+        this.persist();
+    }
+    /**
+     * Update access token
+     */
+    setAccessToken(token) {
+        this._accessToken.set(token);
+        this.persist();
+    }
+    /**
+     * Update refresh token
+     */
+    setRefreshToken(token) {
+        this._refreshToken.set(token);
+        this.persist();
+    }
+    /**
+     * Set current tenant ID (for super admin)
+     */
+    setCurrentTenantId(tenantId) {
+        this._currentTenantId.set(tenantId);
+        this._tenantSwitched.set(tenantId !== null);
+        this.persist();
+    }
+    /**
+     * Adopt a tenant switch: the new context and the token minted for it.
+     *
+     * Both move together deliberately. Roles and permissions are per-tenant, so a
+     * moment where the header names one tenant and the token carries another
+     * either over-grants or under-grants — and a persist() between the two writes
+     * would make that state survive a reload.
+     */
+    switchTenant(tenantId, accessToken) {
+        this._currentTenantId.set(tenantId);
+        this._tenantSwitched.set(true);
+        this._accessToken.set(accessToken);
+        this.persist();
+    }
+    /**
+     * Set current organization context
+     */
+    setCurrentOrganization(organization) {
+        this._currentOrganization.set(organization);
+        this.persist();
+    }
+    /**
+     * Set super admin status
+     */
+    setSuperAdmin(isSuperAdmin) {
+        this._isSuperAdmin.set(isSuperAdmin);
+        this.persist();
+    }
+    /**
+     * Set loading state
+     */
+    setLoading(isLoading) {
+        this._isLoading.set(isLoading);
+    }
+    /**
+     * Set error message
+     */
+    setError(error) {
+        this._error.set(error);
+    }
+    /**
+     * Hydrate state from localStorage
+     */
+    hydrate() {
+        try {
+            const stored = localStorage.getItem(STORAGE_KEY);
+            if (stored) {
+                const data = JSON.parse(stored);
+                this._user.set(data.user ?? null);
+                this._accessToken.set(data.accessToken ?? null);
+                this._refreshToken.set(data.refreshToken ?? null);
+                this._idToken.set(data.idToken ?? null);
+                this._currentTenantId.set(data.currentTenantId ?? null);
+                this._tenantSwitched.set(data.tenantSwitched === true);
+                this._currentOrganization.set(data.currentOrganization ?? null);
+                this._isSuperAdmin.set(data.isSuperAdmin ?? false);
+            }
+        }
+        catch {
+            // Ignore hydration errors
+        }
+        finally {
+            this._hasHydrated.set(true);
+        }
+    }
+    /**
+     * Persist state to localStorage
+     */
+    persist() {
+        try {
+            const data = {
+                user: this._user(),
+                accessToken: this._accessToken(),
+                refreshToken: this._refreshToken(),
+                idToken: this._idToken(),
+                currentTenantId: this._currentTenantId(),
+                tenantSwitched: this._tenantSwitched(),
+                currentOrganization: this._currentOrganization(),
+                isSuperAdmin: this._isSuperAdmin(),
+            };
+            localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
+        }
+        catch {
+            // Ignore persistence errors
+        }
+    }
+    /**
+     * Clear localStorage
+     */
+    clearStorage() {
+        try {
+            localStorage.removeItem(STORAGE_KEY);
+        }
+        catch {
+            // Ignore errors
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: AuthStore, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: AuthStore, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: AuthStore, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
+        }], ctorParameters: () => [] });
+
+/**
+ * Auth Service
+ *
+ * Handles authentication operations including login, logout, token refresh,
+ * and user management.
+ *
+ * This mirrors the auth services from the React codebase.
+ */
+class AuthService {
+    http = inject(HttpClient);
+    authStore = inject(AuthStore);
+    apiBaseUrl = '/api/admin';
+    /**
+     * Configure the API base URL
+     */
+    setApiBaseUrl(url) {
+        this.apiBaseUrl = url;
+    }
+    /**
+     * Login with email and password
+     */
+    login(request) {
+        this.authStore.setLoading(true);
+        this.authStore.setError(null);
+        return this.http.post(`${this.apiBaseUrl}/auth/login`, request).pipe(tap((response) => {
+            this.authStore.login(response.user, response.accessToken, response.refreshToken, response.idToken);
+            // Set organization context from login response
+            const user = response.user;
+            if (user.organizationIds?.length && user.organizationRoles) {
+                // Pick the first org where user is owner or admin, otherwise first org
+                const adminOrgId = user.organizationIds.find((id) => user.organizationRoles?.[id] === 'owner' || user.organizationRoles?.[id] === 'admin') ?? user.organizationIds[0];
+                const role = user.organizationRoles[adminOrgId];
+                this.authStore.setCurrentOrganization({
+                    id: adminOrgId,
+                    name: adminOrgId, // Will be resolved later if needed
+                    role,
+                });
+            }
+        }), catchError((error) => {
+            this.authStore.setError(error.error?.message ?? 'Login failed');
+            this.authStore.setLoading(false);
+            return throwError(() => error);
+        }), tap(() => {
+            this.authStore.setLoading(false);
+        }));
+    }
+    /**
+     * Logout the current user
+     */
+    logout() {
+        const refreshToken = this.authStore.refreshToken();
+        return this.http
+            .post(`${this.apiBaseUrl}/auth/logout`, { refreshToken })
+            .pipe(tap(() => {
+            this.authStore.logout();
+        }), catchError((error) => {
+            // Still logout locally even if the API call fails
+            this.authStore.logout();
+            return throwError(() => error);
+        }));
+    }
+    /**
+     * Logout locally without API call
+     */
+    logoutLocal() {
+        this.authStore.logout();
+    }
+    /**
+     * Refresh the access token
+     */
+    refreshToken() {
+        const refreshToken = this.authStore.refreshToken();
+        if (!refreshToken) {
+            return throwError(() => new Error('No refresh token available'));
+        }
+        return this.http
+            .post(`${this.apiBaseUrl}/auth/refresh`, { refreshToken })
+            .pipe(tap((response) => {
+            this.authStore.setAccessToken(response.accessToken);
+            if (response.refreshToken) {
+                this.authStore.setRefreshToken(response.refreshToken);
+            }
+        }), catchError((error) => {
+            // If refresh fails, logout the user
+            this.authStore.logout();
+            return throwError(() => error);
+        }));
+    }
+    /**
+     * Get the current user profile
+     */
+    getProfile() {
+        return this.http.get(`${this.apiBaseUrl}/auth/profile`).pipe(tap((user) => {
+            this.authStore.setUser(user);
+        }));
+    }
+    /**
+     * Update the current user profile
+     */
+    updateProfile(data) {
+        return this.http.patch(`${this.apiBaseUrl}/auth/profile`, data).pipe(tap((user) => {
+            this.authStore.setUser(user);
+        }));
+    }
+    /**
+     * Check if the current access token is expired
+     */
+    isTokenExpired() {
+        const token = this.authStore.accessToken();
+        if (!token)
+            return true;
+        try {
+            const payload = this.decodeToken(token);
+            const currentTime = Math.floor(Date.now() / 1000);
+            return payload.exp < currentTime;
+        }
+        catch {
+            return true;
+        }
+    }
+    /**
+     * Decode a JWT token
+     */
+    decodeToken(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid token format');
+        }
+        const payload = parts[1];
+        const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+        return JSON.parse(decoded);
+    }
+    /**
+     * Get the current access token
+     */
+    getAccessToken() {
+        return this.authStore.accessToken();
+    }
+    /**
+     * Check if the user is authenticated
+     */
+    isAuthenticated() {
+        return this.authStore.isAuthenticated();
+    }
+    /**
+     * Get the current user
+     */
+    getUser() {
+        return this.authStore.user();
+    }
+    /**
+     * Check if the user is a super admin
+     */
+    isSuperAdmin() {
+        return this.authStore.isSuperAdmin();
+    }
+    /**
+     * Get the current tenant ID
+     */
+    getCurrentTenantId() {
+        return this.authStore.currentTenantId();
+    }
+    /**
+     * Set the current tenant ID (for super admin)
+     */
+    setCurrentTenantId(tenantId) {
+        this.authStore.setCurrentTenantId(tenantId);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: AuthService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: AuthService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.25", ngImport: i0, type: AuthService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
+        }] });
+
+/**
+ * Auth Guard
+ *
+ * Protects routes that require authentication.
+ * Redirects to login if user is not authenticated.
+ */
+const authGuard = (route, state) => {
+    const authStore = inject(AuthStore);
+    const router = inject(Router);
+    if (authStore.isAuthenticated()) {
+        return true;
+    }
+    // Store the attempted URL for redirecting after login
+    const returnUrl = state.url;
+    // Redirect to the login page with the return url
+    return router.createUrlTree(['/login'], {
+        queryParams: { returnUrl },
+    });
+};
+/**
+ * Guest Guard
+ *
+ * Protects routes that should only be accessible to non-authenticated users.
+ * Redirects to dashboard if user is already authenticated.
+ */
+const guestGuard = () => {
+    const authStore = inject(AuthStore);
+    const router = inject(Router);
+    if (!authStore.isAuthenticated()) {
+        return true;
+    }
+    // Redirect to dashboard if already authenticated
+    return router.createUrlTree(['/']);
+};
+/**
+ * Super Admin Guard
+ *
+ * Protects routes that require super admin privileges.
+ * Checks PermissionsService which is set during login/permission loading.
+ */
+const superAdminGuard = () => {
+    const permissionsService = inject(PermissionsService);
+    const authStore = inject(AuthStore);
+    const router = inject(Router);
+    // Check PermissionsService first (set during login), fallback to user roles
+    if (permissionsService.isSuperAdmin()) {
+        return true;
+    }
+    // Fallback: check user roles directly
+    const user = authStore.user();
+    if (user?.roles?.some(r => r.toLowerCase() === 'superadmin' || r.toLowerCase() === 'systemadmin')) {
+        return true;
+    }
+    // Redirect to dashboard if not super admin
+    return router.createUrlTree(['/']);
+};
+/**
+ * Org Admin Guard
+ *
+ * Protects routes that require org admin or super admin privileges.
+ * Super admins can also access org admin routes.
+ * Requires a valid organization context (currentOrganization) in the auth store.
+ */
+const orgAdminGuard = () => {
+    const permissionsService = inject(PermissionsService);
+    const authStore = inject(AuthStore);
+    const router = inject(Router);
+    // Super admins can also access org admin routes
+    if (permissionsService.isSuperAdmin())
+        return true;
+    const user = authStore.user();
+    if (user?.roles?.some(r => r.toLowerCase() === 'superadmin' || r.toLowerCase() === 'systemadmin'))
+        return true;
+    // Org admin: must have a current organization context set
+    const currentOrg = authStore.currentOrganization();
+    if (currentOrg?.id)
+        return true;
+    return router.createUrlTree(['/']);
+};
+
+/**
+ * How long a permission guard waits for the app to load the current user's
+ * permissions before denying. Override to tune per app.
+ */
+const PERMISSION_GUARD_TIMEOUT_MS = new InjectionToken('PERMISSION_GUARD_TIMEOUT_MS', { providedIn: 'root', factory: () => 15000 });
+/**
+ * Runs `check` once permissions are authoritative for the current user, and
+ * denies (redirect to /unauthorized) if they never arrive, failed to load, or
+ * were cleared. Must be called from a guard's injection context.
+ */
+function decideWhenPermissionsSettle(check) {
+    const permissionsService = inject(PermissionsService);
+    const router = inject(Router);
+    const waitMs = inject(PERMISSION_GUARD_TIMEOUT_MS);
+    const decide = () => permissionsService.isAuthoritative() && check(permissionsService)
+        ? true
+        : router.createUrlTree(['/unauthorized']);
+    if (permissionsService.isSettled()) {
+        return decide();
+    }
+    return toObservable(permissionsService.isSettled).pipe(filter(Boolean), take$1(1), timeout$1({ first: waitMs, with: () => of(false) }), map$1(() => decide()));
+}
+/**
+ * Permission Guard
+ *
+ * Protects routes that require specific permissions.
+ * Configure the required permission in route data.
+ *
+ * Usage:
+ * ```typescript
+ * {
+ *   path: 'users',
+ *   component: UsersPageComponent,
+ *   canActivate: [permissionGuard],
+ *   data: { permission: 'users.read' }
+ * }
+ * ```
+ */
+const permissionGuard = (route) => {
+    const permission = route.data['permission'];
+    const permissions = route.data['permissions'];
+    const requireAll = route.data['requireAll'];
+    // No permission required
+    if (!permission && !permissions) {
+        return true;
+    }
+    return decideWhenPermissionsSettle((permissionsService) => {
+        if (permission && permissionsService.hasPermission(permission)) {
+            return true;
+        }
+        if (permissions) {
+            return requireAll
+                ? permissionsService.hasAllPermissions(permissions)
+                : permissionsService.hasAnyPermission(permissions);
+        }
+        return false;
+    });
+};
+/**
+ * Any Permission Guard
+ *
+ * Allows access if user has any of the specified permissions.
+ *
+ * Usage:
+ * ```typescript
+ * {
+ *   path: 'resources',
+ *   component: ResourcesPageComponent,
+ *   canActivate: [anyPermissionGuard],
+ *   data: { permissions: ['resources.read', 'resources.write'] }
+ * }
+ * ```
+ */
+const anyPermissionGuard = (route) => {
+    const permissions = route.data['permissions'];
+    if (!permissions || permissions.length === 0) {
+        return true;
+    }
+    return decideWhenPermissionsSettle((permissionsService) => permissionsService.hasAnyPermission(permissions));
+};
+/**
+ * All Permissions Guard
+ *
+ * Allows access only if user has all of the specified permissions.
+ *
+ * Usage:
+ * ```typescript
+ * {
+ *   path: 'admin',
+ *   component: AdminPageComponent,
+ *   canActivate: [allPermissionsGuard],
+ *   data: { permissions: ['admin.read', 'admin.write'] }
+ * }
+ * ```
+ */
+const allPermissionsGuard = (route) => {
+    const permissions = route.data['permissions'];
+    if (!permissions || permissions.length === 0) {
+        return true;
+    }
+    return decideWhenPermissionsSettle((permissionsService) => permissionsService.hasAllPermissions(permissions));
+};
+
+/**
+ * Helpers for the tenant-aware SSO landing flow shared across host portals.
+ *
+ * The "Login with SSO" affordance on the landing page resolves a tenant by
+ * identifier and persists its issuer URI to sessionStorage. The host's OIDC
+ * config picks that up at module load (next page navigation) so the OIDC
+ * authority points at the tenant's identity-server subdomain instead of the
+ * platform default. After resolve + persist, the landing reloads with
+ * `pendingAuthorize` set so the post-load handler can call authorize() with
+ * the right authority and the tenant's domain_hint / policy / ui_mode.
+ */
+const KEY_IDENTIFIER = 'oluso.tenant.identifier';
+const KEY_ISSUER_URI = 'oluso.tenant.issuerUri';
+const KEY_DEFAULT_IDP_SCHEME = 'oluso.tenant.defaultIdpScheme';
+const KEY_DEFAULT_SIGN_IN_POLICY_ID = 'oluso.tenant.defaultSignInPolicyId';
+const KEY_DEFAULT_SSO_UI_MODE = 'oluso.tenant.defaultSsoUiMode';
+const KEY_PENDING_AUTHORIZE = 'oluso.tenant.pendingAuthorize';
+/**
+ * Extract tenant identifier from hostname subdomain.
+ * e.g., "acme.auth.example.com" → "acme"
+ * Returns undefined for localhost, IP addresses, or hostnames with fewer than 3 parts.
+ */
+function resolveTenantFromHostname() {
+    if (typeof window === 'undefined')
+        return undefined;
+    const host = window.location.hostname;
+    if (host === 'localhost' || host === '127.0.0.1')
+        return undefined;
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host))
+        return undefined;
+    const parts = host.split('.');
+    if (parts.length < 3)
+        return undefined;
+    return parts[0];
+}
+/**
+ * Returns the tenant SSO authority persisted in sessionStorage, or the given
+ * default. Safe in SSR / non-browser contexts.
+ */
+function resolveTenantSsoAuthority(defaultAuthority) {
+    if (typeof sessionStorage === 'undefined')
+        return defaultAuthority;
+    return sessionStorage.getItem(KEY_ISSUER_URI) || defaultAuthority;
+}
+/**
+ * Returns the tenant identifier, issuer URI, and any persisted SSO defaults,
+ * or null if none is set.
+ */
+function readTenantSso() {
+    if (typeof sessionStorage === 'undefined')
+        return null;
+    const identifier = sessionStorage.getItem(KEY_IDENTIFIER);
+    const issuerUri = sessionStorage.getItem(KEY_ISSUER_URI);
+    if (!identifier || !issuerUri)
+        return null;
+    const uiModeRaw = sessionStorage.getItem(KEY_DEFAULT_SSO_UI_MODE);
+    const uiMode = uiModeRaw === 'Journey' || uiModeRaw === 'Standalone' ? uiModeRaw : undefined;
+    return {
+        identifier,
+        issuerUri,
+        defaultIdpScheme: sessionStorage.getItem(KEY_DEFAULT_IDP_SCHEME) ?? undefined,
+        defaultSignInPolicyId: sessionStorage.getItem(KEY_DEFAULT_SIGN_IN_POLICY_ID) ?? undefined,
+        defaultSsoUiMode: uiMode,
+    };
+}
+/**
+ * Persists the tenant SSO context resolved by the landing page. Set
+ * `markPendingAuthorize` so the post-reload landing handler kicks off
+ * authorize() with the tenant's authority + the stored hints.
+ *
+ * Wipes angular-auth-oidc-client's cached well-known + state on the way
+ * out — the cache is keyed by config id, not authority, so switching
+ * tenants would otherwise reuse the previous authority's discovery doc
+ * and throw issuer-mismatch on the next authorize call.
+ */
+function writeTenantSso(sso, markPendingAuthorize = false) {
+    if (typeof sessionStorage === 'undefined')
+        return;
+    clearOidcLibraryCache();
+    sessionStorage.setItem(KEY_IDENTIFIER, sso.identifier);
+    sessionStorage.setItem(KEY_ISSUER_URI, sso.issuerUri);
+    if (sso.defaultIdpScheme) {
+        sessionStorage.setItem(KEY_DEFAULT_IDP_SCHEME, sso.defaultIdpScheme);
+    }
+    else {
+        sessionStorage.removeItem(KEY_DEFAULT_IDP_SCHEME);
+    }
+    if (sso.defaultSignInPolicyId) {
+        sessionStorage.setItem(KEY_DEFAULT_SIGN_IN_POLICY_ID, sso.defaultSignInPolicyId);
+    }
+    else {
+        sessionStorage.removeItem(KEY_DEFAULT_SIGN_IN_POLICY_ID);
+    }
+    if (sso.defaultSsoUiMode) {
+        sessionStorage.setItem(KEY_DEFAULT_SSO_UI_MODE, sso.defaultSsoUiMode);
+    }
+    else {
+        sessionStorage.removeItem(KEY_DEFAULT_SSO_UI_MODE);
+    }
+    if (markPendingAuthorize) {
+        sessionStorage.setItem(KEY_PENDING_AUTHORIZE, '1');
+    }
+}
+function clearOidcLibraryCache() {
+    if (typeof sessionStorage === 'undefined')
+        return;
+    // angular-auth-oidc-client bundles a config's entire cache (well-known
+    // endpoints, authn result, in-flight state, user data) into a single
+    // sessionStorage entry keyed "{configIndex}-{clientId}" (e.g. "0-admin-portal").
+    // Match that shape: leading digits, dash, anything else. App-owned keys
+    // here are namespaced "oluso.tenant.*" and never collide.
+    for (const key of Object.keys(sessionStorage)) {
+        if (/^\d+-/.test(key)) {
+            sessionStorage.removeItem(key);
+        }
+    }
+}
+/**
+ * Build the customParams object to pass to oidcSecurityService.authorize()
+ * from a remembered tenant SSO. Returns undefined if there's nothing worth
+ * passing. Callers feed this into the `customParams` field of the authorize
+ * call so domain_hint / policy / ui_mode reach /connect/authorize.
+ */
+function tenantSsoAuthorizeParams(sso) {
+    const params = {};
+    if (sso.defaultIdpScheme)
+        params['domain_hint'] = sso.defaultIdpScheme;
+    if (sso.defaultSignInPolicyId)
+        params['policy'] = sso.defaultSignInPolicyId;
+    if (sso.defaultSsoUiMode)
+        params['ui_mode'] = sso.defaultSsoUiMode;
+    return Object.keys(params).length ? params : undefined;
+}
+/**
+ * Returns true (and clears the flag) when a pending authorize call was queued
+ * by the landing's SSO submit. Use on landing init to auto-trigger
+ * oidcSecurityService.authorize() after a reload picked up the new authority.
+ */
+function consumePendingAuthorize() {
+    if (typeof sessionStorage === 'undefined')
+        return false;
+    if (sessionStorage.getItem(KEY_PENDING_AUTHORIZE) !== '1')
+        return false;
+    sessionStorage.removeItem(KEY_PENDING_AUTHORIZE);
+    return true;
+}
+/**
+ * Removes all persisted tenant SSO state. Call from logout flows and the
+ * "Use a different organisation" affordance on the landing.
+ *
+ * Also clears angular-auth-oidc-client's sessionStorage cache (well-known
+ * discovery doc, in-flight state) — those entries are keyed by config id,
+ * not by authority URL, so without wiping them a previously-cached
+ * discovery for a different tenant authority survives the switch and
+ * throws an "issuer mismatch" on the next authorize call.
+ */
+function clearTenantSso() {
+    if (typeof sessionStorage === 'undefined')
+        return;
+    sessionStorage.removeItem(KEY_IDENTIFIER);
+    sessionStorage.removeItem(KEY_ISSUER_URI);
+    sessionStorage.removeItem(KEY_DEFAULT_IDP_SCHEME);
+    sessionStorage.removeItem(KEY_DEFAULT_SIGN_IN_POLICY_ID);
+    sessionStorage.removeItem(KEY_DEFAULT_SSO_UI_MODE);
+    sessionStorage.removeItem(KEY_PENDING_AUTHORIZE);
+    clearOidcLibraryCache();
+}
+
+let isRefreshing = false;
+let refreshResult$ = new ReplaySubject(1);
+/**
+ * Auth Interceptor
+ *
+ * Adds the Authorization header with the access token to outgoing requests.
+ * Handles 401 errors by attempting to refresh the token.
+ */
+const authInterceptor = (req, next) => {
+    const authStore = inject(AuthStore);
+    const authService = inject(AuthService);
+    const router = inject(Router);
+    // Skip auth header for login/refresh endpoints
+    if (isAuthEndpoint(req.url)) {
+        return next(req);
+    }
+    const token = authStore.accessToken();
+    if (token) {
+        req = addAuthHeader(req, token);
+    }
+    return next(req).pipe(catchError((error) => {
+        if (error.status === 401 && token) {
+            return handle401Error(req, next, authService, authStore, router);
+        }
+        return throwError(() => error);
+    }));
+};
+/**
+ * Check if the request is to an auth endpoint
+ */
+function isAuthEndpoint(url) {
+    const authEndpoints = ['/auth/login', '/auth/refresh', '/auth/logout'];
+    return authEndpoints.some((endpoint) => url.includes(endpoint));
+}
+/**
+ * Add Authorization header to request
+ */
+function addAuthHeader(req, token) {
+    return req.clone({
+        setHeaders: {
+            Authorization: `Bearer ${token}`,
+        },
+    });
+}
+/**
+ * Handle 401 errors by refreshing the token.
+ *
+ * Uses a ReplaySubject so that:
+ * - On success: all queued requests receive the new token and retry.
+ * - On failure: all queued requests receive the error and stop waiting.
+ * A timeout prevents indefinite hangs if the refresh endpoint is unresponsive.
+ */
+function handle401Error(req, next, authService, authStore, router) {
+    // If already logged out, don't attempt refresh — just fail the request
+    if (!authStore.isAuthenticated()) {
+        return throwError(() => new HttpErrorResponse({ status: 401 }));
+    }
+    if (!isRefreshing) {
+        isRefreshing = true;
+        refreshResult$ = new ReplaySubject(1);
+        return authService.refreshToken().pipe(timeout$1(15000), switchMap$1((response) => {
+            isRefreshing = false;
+            refreshResult$.next(response.accessToken);
+            refreshResult$.complete();
+            return next(addAuthHeader(req, response.accessToken));
+        }), catchError((error) => {
+            isRefreshing = false;
+            refreshResult$.error(error);
+            authStore.logout();
+            router.navigate(['/login'], {
+                queryParams: { returnUrl: router.url },
+            });
+            return throwError(() => error);
+        }));
+    }
+    // Wait for the current refresh to complete (success or failure)
+    return refreshResult$.pipe(take$1(1), switchMap$1((token) => next(addAuthHeader(req, token))), catchError(() => throwError(() => new HttpErrorResponse({ status: 401 }))));
+}
+
+const RETURN_URL_KEY = 'oluso.returnUrl.active';
+let refreshInFlight = null;
+/**
+ * Token attachment fallback + 401 retry with refresh deduplication. On refresh
+ * failure, stashes the current route in sessionStorage under an opaque key so
+ * the post-login callback can restore navigation without leaking the route to
+ * URL/history/server logs.
+ *
+ * Skips the OIDC token endpoint to avoid infinite loops if /connect/token 401s.
+ */
+const authRefreshInterceptor = (req, next) => {
+    const authProvider = inject(AuthProvider);
+    if (req.headers.has('Authorization')) {
+        return next(req).pipe(catchError$1((err) => handle401(err, req, next, authProvider)));
+    }
+    return authProvider.getAccessToken().pipe(take(1), switchMap((token) => {
+        const outReq = token ? addToken(req, token) : req;
+        return next(outReq).pipe(catchError$1((err) => handle401(err, req, next, authProvider)));
+    }));
+};
+function addToken(req, token) {
+    return req.clone({
+        setHeaders: { Authorization: `Bearer ${token}` },
+    });
+}
+function handle401(error, req, next, authProvider) {
+    if (error instanceof HttpErrorResponse &&
+        error.status === 401 &&
+        !error.url?.includes('/connect/token')) {
+        return sharedRefresh(authProvider).pipe(switchMap((result) => {
+            if (result?.isAuthenticated && result?.accessToken) {
+                return next(addToken(req, result.accessToken));
+            }
+            console.warn('Token refresh returned no valid session — redirecting to login');
+            redirectToLogin(authProvider);
+            return throwError(() => error);
+        }), catchError$1((refreshError) => {
+            console.warn('Token refresh failed — redirecting to login', refreshError);
+            redirectToLogin(authProvider);
+            return throwError(() => error);
+        }));
+    }
+    return throwError(() => error);
+}
+function sharedRefresh(authProvider) {
+    if (!refreshInFlight) {
+        refreshInFlight = authProvider.forceRefreshSession().pipe(take(1), finalize(() => { refreshInFlight = null; }), shareReplay({ bufferSize: 1, refCount: false }));
+    }
+    return refreshInFlight;
+}
+function redirectToLogin(authProvider) {
+    rememberReturnUrl();
+    authProvider.authorize();
+}
+/**
+ * Remembers the page the user is on before a sign-in redirect ends their session, so the callback page can
+ * bring them back to it ({@link readAndClearReturnUrl}). The callback, renew and error pages, and the root,
+ * are not remembered.
+ */
+function rememberReturnUrl() {
+    try {
+        const currentUrl = window.location.pathname + window.location.search + window.location.hash;
+        if (!currentUrl.startsWith('/callback') &&
+            !currentUrl.startsWith('/silent-renew') &&
+            !currentUrl.startsWith('/error') &&
+            currentUrl !== '/') {
+            sessionStorage.setItem(RETURN_URL_KEY, currentUrl);
+        }
+    }
+    catch {
+        /* sessionStorage unavailable */
+    }
+}
+/**
+ * Helper for callback pages to restore the pre-login route.
+ */
+function readAndClearReturnUrl() {
+    try {
+        const url = sessionStorage.getItem(RETURN_URL_KEY);
+        sessionStorage.removeItem(RETURN_URL_KEY);
+        return url;
+    }
+    catch {
+        return null;
+    }
+}
+
+/**
+ * Paths that must never carry the X-Tenant-ID header.
+ * OIDC endpoints use the global issuer; sending a tenant header
+ * can change the resolved issuer/discovery document and break
+ * token validation after a tenant switch.
+ */
+const TENANT_HEADER_EXCLUDED_PATHS = [
+    '/connect/',
+    '/.well-known/',
+    '/discovery/',
+    // Action-token links carry their own tenant; a signed-in session's tenant
+    // must not leak into a customer-facing request.
+    '/api/public/',
+];
+/**
+ * Tenant Interceptor
+ *
+ * Adds the X-Tenant-ID header to outgoing API requests when the user
+ * has selected a tenant context.
+ *
+ * This is used in the Admin UI to allow super admins to manage
+ * resources across different tenants. The backend validates
+ * whether the user is authorized to access the specified tenant.
+ *
+ * OIDC protocol endpoints are excluded — they must always use the
+ * global (non-tenant) context so the issuer stays consistent.
+ */
+const tenantInterceptor = (req, next) => {
+    const authStore = inject(AuthStore);
+    // Only a tenant picked in the UI goes out; otherwise the API takes the tenant from the token.
+    const tenantId = authStore.tenantSwitched() ? authStore.currentTenantId() : null;
+    // An explicitly-set header wins. The tenant-switch call has to target the
+    // tenant being switched TO while the store still holds the current one —
+    // setHeaders would otherwise overwrite it and switch you back to yourself.
+    if (tenantId && !req.headers.has('X-Tenant-ID')) {
+        // Don't attach tenant header to OIDC protocol endpoints
+        const urlPath = new URL(req.url, window.location.origin).pathname;
+        const isExcluded = TENANT_HEADER_EXCLUDED_PATHS.some(p => urlPath.includes(p));
+        if (!isExcluded) {
+            req = req.clone({
+                setHeaders: {
+                    'X-Tenant-ID': tenantId,
+                },
+            });
+        }
+    }
+    return next(req);
+};
+/**
+ * Organization Interceptor
+ *
+ * Adds the X-Organization-ID header to outgoing requests when the user
+ * has selected an organization context.
+ *
+ * This is used for multi-tenant applications where users can belong
+ * to multiple organizations.
+ */
+const organizationInterceptor = (req, next) => {
+    const authStore = inject(AuthStore);
+    const organization = authStore.currentOrganization();
+    if (organization) {
+        req = req.clone({
+            setHeaders: {
+                'X-Organization-ID': organization.id,
+            },
+        });
+    }
+    return next(req);
+};
+
+/**
+ * Ngrok Interceptor
+ *
+ * Adds the ngrok-skip-browser-warning header to skip the ngrok interstitial page.
+ * This header is required when making API calls through ngrok tunnels.
+ */
+const ngrokInterceptor = (req, next) => {
+    // Add ngrok header to skip browser warning
+    const modifiedReq = req.clone({
+        setHeaders: {
+            'ngrok-skip-browser-warning': 'true',
+        },
+    });
+    return next(modifiedReq);
+};
+
+/**
+ * Error Interceptor
+ *
+ * Catches HTTP error responses and displays user-friendly toast notifications.
+ * Extracts error messages from backend responses when available.
+ * Skips 401 errors (handled by the auth interceptor).
+ */
+const errorInterceptor = (req, next) => {
+    const toast = inject(ToastService);
+    return next(req).pipe(catchError((error) => {
+        // Skip 401s — the auth interceptor handles token refresh / logout
+        if (error.status === 401) {
+            return throwError(() => error);
+        }
+        // Caller opted out of the global toast — it handles this failure itself
+        // (e.g. an optional conversation thread that may 403/404). Still rethrow.
+        if (req.context.get(SKIP_ERROR_TOAST)) {
+            return throwError(() => error);
+        }
+        const message = extractMessage(error);
+        toast.error(message);
+        return throwError(() => error);
+    }));
+};
+/**
+ * Extract a human-readable message from the error response.
+ * Module controllers return { message: "..." }, the admin API returns
+ * { error: "..." }, and unhandled failures arrive as ProblemDetails.
+ */
+function extractMessage(error) {
+    // Try to get the message from the response body
+    const body = error.error;
+    if (body) {
+        // Backend returns { message: "...", requiredPermission?: "..." }
+        if (typeof body === 'object' && body.message) {
+            if (body.requiredPermission) {
+                return `${body.message} (${body.requiredPermission})`;
+            }
+            return body.message;
+        }
+        // Backend returns { Message: "..." } (PascalCase)
+        if (typeof body === 'object' && body.Message) {
+            return body.Message;
+        }
+        // Admin API validation / business errors: { error: "..." }
+        if (typeof body === 'object' && typeof body.error === 'string' && body.error) {
+            return body.error;
+        }
+        // ProblemDetails: { title, detail }
+        if (typeof body === 'object' && typeof body.detail === 'string' && body.detail) {
+            return body.detail;
+        }
+        if (typeof body === 'object' && typeof body.title === 'string' && body.title) {
+            return body.title;
+        }
+        // ASP.NET validation errors: { errors: { field: ["msg"] } }
+        if (typeof body === 'object' && body.errors) {
+            const firstField = Object.keys(body.errors)[0];
+            if (firstField) {
+                const msgs = body.errors[firstField];
+                if (Array.isArray(msgs) && msgs.length > 0) {
+                    return msgs[0];
+                }
+            }
+        }
+        // Plain string body
+        if (typeof body === 'string' && body.length < 200) {
+            return body;
+        }
+    }
+    // Fallback based on status code
+    switch (error.status) {
+        // No readable response: the connection dropped, or the browser blocked the response (e.g. CORS on a
+        // cross-origin redirect). Not a server outage; those come back as 502/503/504 below.
+        case 0:
+            return 'The request did not complete. It was blocked by the browser or the connection was lost.';
+        case 400:
+            return 'Invalid request. Please check your input.';
+        case 403:
+            return 'You do not have permission to perform this action.';
+        case 404:
+            return 'The requested resource was not found.';
+        case 409:
+            return 'A conflict occurred. The resource may have been modified.';
+        case 422:
+            return 'The request could not be processed. Please check your input.';
+        case 500:
+            return 'An internal server error occurred. Please try again later.';
+        case 502:
+        case 503:
+        case 504:
+            return 'Unable to reach the server right now. Please try again shortly.';
+        default:
+            return `An error occurred (${error.status}). Please try again.`;
+    }
+}
+
+/**
+ * The browser's DPoP key (RFC 9449): an ECDSA P-256 key pair whose private half the page can sign with but
+ * never read, so a token bound to it cannot be used anywhere else.
+ *
+ * The pair is kept in IndexedDB, shared by every tab of the app and surviving reloads, because refresh tokens
+ * are bound to it: a remembered session's next refresh needs the same key. Where IndexedDB is unavailable the
+ * key lives for the page only, and the session ends with it.
+ */
+const DATABASE = 'oluso.dpop';
+const STORE = 'keys';
+const KEY_ID = 'current';
+let current = null;
+/** Whether this page can hold a DPoP key: Web Crypto, which browsers offer only in secure contexts. */
+function dpopSupported() {
+    const secure = typeof globalThis.isSecureContext === 'boolean' ? globalThis.isSecureContext : true;
+    return secure && typeof crypto !== 'undefined' && !!crypto.subtle;
+}
+/** The app's DPoP key, loaded or created once per page. */
+function dpopKey() {
+    current ??= loadOrCreate().catch((error) => {
+        current = null;
+        throw error;
+    });
+    return current;
+}
+/** Forgets the key held by this page, so the next {@link dpopKey} reads storage again (tests). */
+function resetDPoPKeyForTests() {
+    current = null;
+}
+async function loadOrCreate() {
+    const generated = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+    const pair = (await keepFirst(generated)) ?? generated;
+    return { privateKey: pair.privateKey, publicJwk: await publicJwkOf(pair.publicKey) };
+}
+/**
+ * Stores `candidate` unless a pair is already stored, in one transaction so two tabs creating a key at once
+ * agree on a single one. Returns the stored pair, or null when IndexedDB is unavailable.
+ */
+function keepFirst(candidate) {
+    if (typeof indexedDB === 'undefined')
+        return Promise.resolve(null);
+    return new Promise((resolve) => {
+        const open = indexedDB.open(DATABASE, 1);
+        open.onupgradeneeded = () => open.result.createObjectStore(STORE);
+        open.onerror = () => resolve(null);
+        open.onsuccess = () => {
+            const db = open.result;
+            const tx = db.transaction(STORE, 'readwrite');
+            const store = tx.objectStore(STORE);
+            let kept = null;
+            const existing = store.get(KEY_ID);
+            existing.onsuccess = () => {
+                if (existing.result) {
+                    kept = existing.result;
+                }
+                else {
+                    store.put(candidate, KEY_ID);
+                    kept = candidate;
+                }
+            };
+            tx.oncomplete = () => { db.close(); resolve(kept); };
+            tx.onerror = () => { db.close(); resolve(null); };
+        };
+    });
+}
+async function publicJwkOf(publicKey) {
+    const jwk = await crypto.subtle.exportKey('jwk', publicKey);
+    return { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y };
+}
+
+/** A DPoP proof JWT signed by `key` for one request. */
+async function createDPoPProof(key, target) {
+    const header = { typ: 'dpop+jwt', alg: 'ES256', jwk: key.publicJwk };
+    const payload = {
+        jti: crypto.randomUUID(),
+        htm: target.method.toUpperCase(),
+        htu: proofUri(target.url),
+        iat: Math.floor(Date.now() / 1000),
+    };
+    if (target.accessToken)
+        payload['ath'] = await accessTokenHash(target.accessToken);
+    if (target.nonce)
+        payload['nonce'] = target.nonce;
+    const signingInput = `${base64UrlText(JSON.stringify(header))}.${base64UrlText(JSON.stringify(payload))}`;
+    const signature = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, key.privateKey, new TextEncoder().encode(signingInput));
+    return `${signingInput}.${base64UrlBytes(new Uint8Array(signature))}`;
+}
+/** The request URI a proof names: absolute, without query or fragment. */
+function proofUri(url) {
+    const base = typeof location !== 'undefined' ? location.href : 'http://localhost/';
+    const absolute = new URL(url, base);
+    return `${absolute.origin}${absolute.pathname}`;
+}
+/** The <c>ath</c> claim: the base64url SHA-256 of the access token. */
+async function accessTokenHash(accessToken) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(accessToken));
+    return base64UrlBytes(new Uint8Array(digest));
+}
+function base64UrlText(text) {
+    return base64UrlBytes(new TextEncoder().encode(text));
+}
+function base64UrlBytes(bytes) {
+    let binary = '';
+    bytes.forEach((b) => (binary += String.fromCharCode(b)));
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/** Nonces servers have asked proofs to carry (RFC 9449 §8), by origin. */
+const nonces = new Map();
+/**
+ * Sender-constrains the app's tokens with DPoP (RFC 9449).
+ *
+ * - Token requests (any grant) carry a proof, so the server binds the tokens it issues — access and refresh —
+ *   to this browser's key ({@link dpopKey}); a copied token is useless without it.
+ * - A request presenting a DPoP-bound access token (one whose <c>cnf.jkt</c> names a key) is sent under the
+ *   DPoP scheme with a proof for that request and token instead of as a bearer token, which the server refuses.
+ * - When a server asks for a nonce (<c>use_dpop_nonce</c>), the request is retried once with it.
+ *
+ * Register it after the interceptors that attach the access token, so it sees the final request.
+ * Pages without Web Crypto (non-secure contexts) send requests unchanged; their tokens are not bound.
+ */
+const dpopInterceptor = (req, next) => {
+    if (!dpopSupported())
+        return next(req);
+    // A token request presents no access token. The auth library attaches the session's token to every URL under its
+    // secure routes, the token endpoint included; sent there, the server's resource check consumes the proof's jti and
+    // the token endpoint then refuses the same proof as replayed. Client authentication (Basic) is left alone.
+    if (isTokenRequest(req) && /^(Bearer|DPoP)\s/i.test(req.headers.get('Authorization') ?? '')) {
+        req = req.clone({ headers: req.headers.delete('Authorization') });
+    }
+    const presented = boundAccessTokenOf(req);
+    if (!presented && !isTokenRequest(req))
+        return next(req);
+    const send = (nonce) => from(withProof(req, presented, nonce)).pipe(switchMap$1((signed) => next(signed)), tap((event) => { if (event instanceof HttpResponse)
+        rememberNonce(req, event.headers); }));
+    return send(nonces.get(originOf(req.url))).pipe(catchError((error) => {
+        if (!(error instanceof HttpErrorResponse))
+            return throwError(() => error);
+        const nonce = error.headers?.get('DPoP-Nonce');
+        if (nonce)
+            nonces.set(originOf(req.url), nonce);
+        return nonce && asksForNonce(error) ? send(nonce) : throwError(() => error);
+    }));
+};
+async function withProof(req, boundToken, nonce) {
+    const proof = await createDPoPProof(await dpopKey(), { method: req.method, url: req.url, accessToken: boundToken, nonce });
+    let headers = req.headers.set('DPoP', proof);
+    if (boundToken)
+        headers = headers.set('Authorization', `DPoP ${boundToken}`);
+    return req.clone({ headers });
+}
+/** A token endpoint request: a form POST naming a grant. */
+function isTokenRequest(req) {
+    return req.method === 'POST' && typeof req.body === 'string' && new URLSearchParams(req.body).has('grant_type');
+}
+/** The access token a request presents, when it is bound to a DPoP key; else null. */
+function boundAccessTokenOf(req) {
+    const match = /^(?:Bearer|DPoP)\s+(.+)$/i.exec(req.headers.get('Authorization') ?? '');
+    const token = match?.[1]?.trim();
+    return token && isDPoPBound(token) ? token : null;
+}
+let lastChecked = null;
+/** Whether a JWT access token is bound to a DPoP key (has <c>cnf.jkt</c>). */
+function isDPoPBound(token) {
+    if (lastChecked?.token === token)
+        return lastChecked.bound;
+    let bound = false;
+    const part = token.split('.')[1];
+    if (part) {
+        try {
+            const json = atob(part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '='));
+            const jkt = JSON.parse(json)?.cnf?.jkt;
+            bound = typeof jkt === 'string' && jkt.length > 0;
+        }
+        catch {
+            bound = false;
+        }
+    }
+    lastChecked = { token, bound };
+    return bound;
+}
+/** A refusal asking for a DPoP nonce: a 401 challenge from an API or a 400 error from the token endpoint. */
+function asksForNonce(error) {
+    if (error.status === 401)
+        return (error.headers?.get('WWW-Authenticate') ?? '').includes('use_dpop_nonce');
+    return error.status === 400 && error.error?.error === 'use_dpop_nonce';
+}
+function rememberNonce(req, headers) {
+    const nonce = headers.get('DPoP-Nonce');
+    if (nonce)
+        nonces.set(originOf(req.url), nonce);
+}
+function originOf(url) {
+    return new URL(proofUri(url)).origin;
+}
+
+/**
+ * A `fetch` that sends through the app's HttpClient, so its interceptors apply: the signed-in user's access token,
+ * the tenant, DPoP proofs and the refresh-and-retry on an expired token. Give it to the Oluso SDK
+ * (`new OlusoClient({ ..., fetch: httpClientFetch(http) })`) to run journeys the app's backend started for the user.
+ * Answers with an error status resolve like fetch's do, so the SDK reads the server's message.
+ */
+function httpClientFetch(http) {
+    return async (input, init) => {
+        const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+        const method = (init?.method ?? 'GET').toUpperCase();
+        let headers = new HttpHeaders();
+        new Headers(init?.headers).forEach((value, name) => {
+            headers = headers.set(name, value);
+        });
+        try {
+            const response = await firstValueFrom(http.request(method, url, {
+                body: init?.body ?? null,
+                headers,
+                observe: 'response',
+                responseType: 'text',
+                withCredentials: init?.credentials === 'include',
+            }));
+            return toResponse(response);
+        }
+        catch (error) {
+            if (error instanceof HttpErrorResponse && error.status > 0)
+                return toResponse(error);
+            throw error;
+        }
+    };
+}
+function toResponse(response) {
+    const headers = new Headers();
+    response.headers.keys().forEach((name) => {
+        const value = response.headers.get(name);
+        if (value !== null)
+            headers.set(name, value);
+    });
+    const body = response instanceof HttpErrorResponse
+        ? typeof response.error === 'string' ? response.error : JSON.stringify(response.error ?? null)
+        : response.body;
+    const empty = response.status === 204 || response.status === 205 || response.status === 304;
+    return new Response(empty ? null : body, { status: response.status, statusText: response.statusText, headers });
+}
+
+// Models
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { AuthProvider, AuthService, AuthStore, NoOpAuthProvider, PERMISSION_GUARD_TIMEOUT_MS, RememberMeSecurityStorage, RenewAwareAuthProvider, accessTokenHash, allPermissionsGuard, anyPermissionGuard, authGuard, authInterceptor, authRefreshInterceptor, boundAccessTokenOf, checkAuthRenewingSession, clearTenantSso, consumePendingAuthorize, createDPoPProof, dpopInterceptor, dpopKey, dpopSupported, errorInterceptor, guestGuard, httpClientFetch, isDPoPBound, ngrokInterceptor, orgAdminGuard, organizationInterceptor, permissionGuard, proofUri, readAndClearReturnUrl, readTenantSso, refreshRetryDelayMs, refreshTokenOf$1 as refreshTokenOf, rememberReturnUrl, requestTenantSwitch, resetDPoPKeyForTests, resolveTenantFromHostname, resolveTenantSsoAuthority, superAdminGuard, tenantInterceptor, tenantOfToken, tenantSsoAuthorizeParams, tokenRefreshRetryInterceptor, writeTenantSso };
+//# sourceMappingURL=syndew-oluso-auth.mjs.map