ProtectedconfigProtectedisReadonlytypeProvider type identifier Must be implemented by concrete providers
ProtecteduserProtecteduserStatic ReadonlyPROVIDER_Contains the initial path from window.location.pathname before any work was done by auth services
Contains the initial search/query string from window.location.search before any work was done by auth services
ProtectedpreservedlocalStorage keys that survive a logout (e.g. UI theme preference).
Override this getter in a subclass to preserve additional keys specific to your provider or application.
Classify an error into standard error type
Converts provider-specific errors into semantic categories. Eliminates need for consumers to check error.name or error types.
ProtectedclassifyClassify provider-specific error into standard error type
Maps provider-specific errors to semantic AuthErrorType values. Examines error objects, error codes, and messages to determine the appropriate category (TOKEN_EXPIRED, INTERACTION_REQUIRED, NETWORK_ERROR, etc.).
The error to classify
StandardAuthError with categorized type and user-friendly message
ProtectedclearClears MJ client-side caches before logout.
Removes all localStorage entries except those returned by
preservedLocalStorageKeys, and deletes the MJ_Metadata IndexedDB
database so a subsequent user session starts with a clean slate.
ProtectedextractExtract ID token from provider-specific storage
This is where providers hide their implementation details.
Promise resolving to token string or null if not authenticated
ProtectedextractExtract complete token info from provider-specific storage
Maps provider-specific token structure to StandardAuthToken.
Promise resolving to StandardAuthToken or null if not authenticated
ProtectedextractExtract user info from provider-specific claims
Maps provider-specific claim structure to StandardUserInfo. This is where providers translate their claims (sub, email, name, etc.) into the standard structure.
Promise resolving to StandardUserInfo or null if not authenticated
Get ID token string (primary token method)
This is the clean abstraction - no provider-specific logic needed!
Replaces the old pattern of: claims?.__raw || claims?.idToken
Get profile picture URL from auth provider
Returns the user's profile picture URL if available from the auth provider. This abstracts away provider-specific logic:
Promise resolving to image URL or null if not available
ProtectedgetGet profile picture URL from auth provider
Retrieves the user's profile picture using provider-specific mechanisms. Some providers include the URL in user claims, others require API calls to fetch the image.
Promise resolving to image URL or null if not available
Get required configuration fields
Default implementation requires clientId. Subclasses can override to add provider-specific requirements.
Magic-link sessions are locked to the single app the invite scoped to
(mj_app_id), so the shell hides app-switching and keeps the user there.
Get complete token information
Returns full token details including expiration and scopes. Use this when you need more than just the token string.
Get user email as Observable stream
Get user info as Observable stream
Returns standardized user info, hiding provider-specific claim structures. No more need for consumers to merge claims or check provider-specific fields!
Handle OAuth callback
Subclasses implement provider-specific callback handling.
ProtectedhandleHandle session expiry when silent refresh fails
Called internally when silent token refresh fails with TOKEN_EXPIRED or INTERACTION_REQUIRED errors. Providers that support refresh tokens can implement this as a no-op. Providers that require interactive re-authentication should initiate the appropriate flow (redirect, popup, etc.).
Note: If this method redirects the page, it may never return. The app will reload after authentication completes and re-initialize with a fresh token.
Promise that resolves if re-auth completed, or never returns if redirected
Initialize the provider
Subclasses should override to set up provider-specific initialization, handle redirect callbacks, restore sessions, etc.
Check if user is authenticated (Observable stream)
Returns a reactive stream that emits authentication state changes. Consumers can subscribe to react to login/logout events.
Public login method with Observable wrapper for backward compatibility
Consumers can use either:
await this.authBase.login() (Promise)this.authBase.login().subscribe() (Observable)Optionaloptions: Record<string, unknown>ProtectedloginInternal login implementation
Subclasses implement provider-specific login flow. This is called by the public login() method.
Logout — clears all MJ client-side caches then delegates to the provider.
Cache clearing happens universally regardless of auth provider so that a
subsequent login as a different user never sees the previous user's data.
Providers that need to clear additional caches should override
logoutInternal() and call super.logoutInternal() if applicable.
ProtectedlogoutProvider-specific logout implementation
Subclasses implement provider-specific logout flow (redirect, SDK logout, etc.).
The base class logout() calls clearClientCaches() before invoking this method,
so providers do NOT need to handle cache clearing themselves.
Refresh authentication token
Attempts to obtain a fresh authentication token using the provider's refresh mechanism. If silent refresh fails due to session expiry, the provider will handle re-authentication automatically (which may involve redirecting to the auth provider's login page).
Returns StandardAuthToken on success, or throws on complete failure.
IMPORTANT: If the provider requires interactive re-authentication (redirect or popup), this method may never return. The app will reload after authentication completes and re-initialize with a fresh token.
Promise resolving to StandardAuthToken or throws on failure
ProtectedrefreshRefresh token using provider-specific mechanism
Implements the provider's token refresh logic using whatever mechanism is appropriate (silent refresh with refresh tokens, iframe-based token acquisition, etc.).
Should return success with token if refresh succeeds, or failure with appropriate error type (TOKEN_EXPIRED, INTERACTION_REQUIRED, etc.) if refresh fails.
Promise resolving to TokenRefreshResult indicating success/failure
ProtectedupdateUpdate authentication state
Subclasses should call this when authentication state changes (after login, logout, session check, etc.)
ProtectedupdateUpdate user info
Subclasses should call this when user info is retrieved or updated. This automatically updates the email stream as well.
Validate provider configuration
Checks that all required fields are present and non-empty. Subclasses can override to add custom validation logic.
StatichasTrue if a magic-link session token is present for this page load — either
arriving in the URL fragment (#token=<jwt>, from the redeem redirect) or
already stashed in sessionStorage from earlier in this tab.
Used at module-config time (AuthServicesModule.forRoot) to auto-select the
magic-link provider even when AUTH_TYPE names a different primary IdP, so a
single Explorer deployment can serve both SSO users and magic-link guests.
Falls back cleanly to the primary IdP when no token is present (e.g. after a
guest's session expires or logs out).
Client-side auth provider for MemberJunction-issued magic-link sessions.
Unlike MSAL/Auth0, there is no interactive login and no SDK: the session token (minted server-side when the user redeemed their invite) arrives in the URL fragment —
#token=<jwt>— when/magic-link/redeemredirects the browser to Explorer. This provider extracts it, stashes it in sessionStorage (per-tab, so it dies with the tab), decodes the claims for display, and hands the token to the GraphQL client viagetIdToken(). The server validates it through the standard JWKS path.Set
AUTH_TYPE: 'magic-link'in the Explorer environment to use this provider. There are no refresh tokens — when the session expires the user must redeem a fresh link.