ProtectedconfigProtectedisReadonlytypeProvider type identifier Must be implemented by concrete providers
ProtecteduserProtecteduserStatic ReadonlyPROVIDER_Contains the initial path from window.location.pathname before any work was done by auth services
Contains the initial search/query string from window.location.search before any work was done by auth services
ProtectedpreservedlocalStorage keys that survive a logout (e.g. UI theme preference).
Override this getter in a subclass to preserve additional keys specific to your provider or application.
Classify an error into standard error type
Converts provider-specific errors into semantic categories. Eliminates need for consumers to check error.name or error types.
ProtectedclassifyClassify MSAL-specific errors into semantic types
Maps MSAL error classes to AuthErrorType enum. Updated for MSAL 5.x error codes.
ProtectedclearClears MJ client-side caches before logout.
Removes all localStorage entries except those returned by
preservedLocalStorageKeys, and deletes the MJ_Metadata IndexedDB
database so a subsequent user session starts with a clean slate.
ProtectedextractExtract ID token from MSAL's storage
MSAL stores the JWT in AuthenticationResult.idToken This is the key abstraction - consumers never need to know about MSAL's structure!
ProtectedextractExtract complete token info from MSAL
Maps MSAL's AuthenticationResult to StandardAuthToken
ProtectedextractExtract user info from MSAL account
Maps MSAL's AccountInfo structure to StandardUserInfo
Get ID token string (primary token method)
This is the clean abstraction - no provider-specific logic needed!
Replaces the old pattern of: claims?.__raw || claims?.idToken
Get profile picture URL from auth provider
Returns the user's profile picture URL if available from the auth provider. This abstracts away provider-specific logic:
Promise resolving to image URL or null if not available
ProtectedgetGet profile picture URL from Microsoft Graph API
MSAL requires fetching the photo from Microsoft Graph. This is the key advantage of encapsulation - consumers don't need to know about Graph API, they just call getProfilePictureUrl()!
Get required configuration fields
Default implementation requires clientId. Subclasses can override to add provider-specific requirements.
Returns any constraints this provider places on the session, or null for
an unconstrained session. The host shell uses this to confine the UI (e.g.
hide app-switching and lock to a single app for magic-link sessions).
Default: unconstrained. Constrained providers override this.
Get complete token information
Returns full token details including expiration and scopes. Use this when you need more than just the token string.
Get user email as Observable stream
Get user info as Observable stream
Returns standardized user info, hiding provider-specific claim structures. No more need for consumers to merge claims or check provider-specific fields!
Handle OAuth callback
Subclasses implement provider-specific callback handling.
ProtectedhandleHandle session expiry by redirecting to Microsoft login
This method is called by the base class when silent token refresh fails with INTERACTION_REQUIRED error. It redirects to Microsoft login and never returns. After authentication, the app will reload and re-initialize with a fresh token.
Initialize the provider
Subclasses should override to set up provider-specific initialization, handle redirect callbacks, restore sessions, etc.
Check if user is authenticated (Observable stream)
Returns a reactive stream that emits authentication state changes. Consumers can subscribe to react to login/logout events.
Public login method with Observable wrapper for backward compatibility
Consumers can use either:
await this.authBase.login() (Promise)this.authBase.login().subscribe() (Observable)Optionaloptions: Record<string, unknown>ProtectedloginInternal login implementation
Subclasses implement provider-specific login flow. This is called by the public login() method.
Optionaloptions: Record<string, unknown>Logout — clears all MJ client-side caches then delegates to the provider.
Cache clearing happens universally regardless of auth provider so that a
subsequent login as a different user never sees the previous user's data.
Providers that need to clear additional caches should override
logoutInternal() and call super.logoutInternal() if applicable.
ProtectedlogoutProvider-specific logout implementation
Subclasses implement provider-specific logout flow (redirect, SDK logout, etc.).
The base class logout() calls clearClientCaches() before invoking this method,
so providers do NOT need to handle cache clearing themselves.
A callback method that performs custom clean-up, invoked immediately before a directive, pipe, or service instance is destroyed.
Refresh authentication token
Attempts to obtain a fresh authentication token using the provider's refresh mechanism. If silent refresh fails due to session expiry, the provider will handle re-authentication automatically (which may involve redirecting to the auth provider's login page).
Returns StandardAuthToken on success, or throws on complete failure.
IMPORTANT: If the provider requires interactive re-authentication (redirect or popup), this method may never return. The app will reload after authentication completes and re-initialize with a fresh token.
Promise resolving to StandardAuthToken or throws on failure
ProtectedrefreshRefresh token using MSAL's silent token acquisition
MSAL 5.x Best Practices:
IMPORTANT: This method is called when the server has already rejected the current token as expired (JWT_EXPIRED). Using CacheLookupPolicy.Default here can return a cached ID token that is still expired (e.g. when the access token has a longer lifetime than the ID token). forceRefresh: true ensures a network round-trip to Azure AD so both the access token and ID token are genuinely refreshed.
ProtectedupdateUpdate authentication state
Subclasses should call this when authentication state changes (after login, logout, session check, etc.)
ProtectedupdateUpdate user info
Subclasses should call this when user info is retrieved or updated. This automatically updates the email stream as well.
Validate provider configuration
Checks that all required fields are present and non-empty. Subclasses can override to add custom validation logic.
StaticangularFactory function to provide Angular dependencies required by MSAL Stored as a static property for the factory to access without instantiation
MSAL (Microsoft Authentication Library) provider implementation - v3.0.0
Implements the abstract methods from MJAuthBase to hide MSAL-specific details. The key abstraction is that MSAL stores the JWT in AuthenticationResult.idToken, but consumers never need to know this detail.