docs: update changelogs for release

ci: publish release

.changeset/flat-adults-tease.md

@@ -1,5 +0,0 @@
----
-"@openstapps/proxy": patch
----
-
-Bumping proxy version to rebuild image

.changeset/green-hotels-itch.md

@@ -1,8 +0,0 @@
----
-"@openstapps/projectmanagement": patch
-"@openstapps/core-tools": patch
-"@openstapps/easy-ast": patch
-"@openstapps/app": patch
----
-
-Updated node-glob dependency

.changeset/old-parents-accept.md

@@ -1,5 +0,0 @@
----
-"@openstapps/app-cypress": patch
----
-
-removed edge browser

backend/backend/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @openstapps/backend
 
+## 4.0.6
+
+### Patch Changes
+
+- 019f8013: Enable ID cards and assessments using Shibboleth as identity provider
+
+## 4.0.5
+
+### Patch Changes
+
+- Updated dependencies [86004881]
+- Updated dependencies [09ad903a]
+  - @openstapps/core-tools@4.0.5
+  - @openstapps/core@4.0.5
+
 ## 4.0.3
 
 ### Patch Changes

backend/backend/config/default/app/menu.js

@@ -29,19 +29,6 @@ const menus = [
           },
         },
       },
-      {
-        icon: 'local_library',
-        route: '/hebis-search',
-        title: 'library catalog',
-        translations: {
-          de: {
-            title: 'Bibliothekskatalog',
-          },
-          en: {
-            title: 'library catalog',
-          },
-        },
-      },
       {
         icon: 'inventory_2',
         route: '/catalog',
@@ -137,20 +124,6 @@ const menus = [
           },
         },
       },
-      {
-        authProvider: 'paia',
-        icon: 'badge',
-        route: '/library-account',
-        title: 'library account',
-        translations: {
-          de: {
-            title: 'Bibliothekskonto',
-          },
-          en: {
-            title: 'library account',
-          },
-        },
-      },
       {
         icon: 'settings',
         route: '/settings',

backend/backend/config/f-u/backendrc.js

@@ -13,42 +13,24 @@ const config = {
     default: {
       client: {
         clientId: '1cac3f99-33fa-4234-8438-979f07e0cdab',
-        scopes: '',
+        scopes: 'openid profile email offline_access',
-        url: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0',
+        url: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc',
       },
       endpoints: {
-        authorization: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0/authorize',
+        authorization: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/authorize',
-        endSession: 'https://cas.rz.uni-frankfurt.de/cas/logout',
+        endSession: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/end-session',
         mapping: {
-          id: '$.id',
+          id: '$.preferred_username',
-          email: '$.attributes.mailPrimaryAddress',
+          email: '$.mailPrimaryAddress',
-          familyName: '$.attributes.sn',
+          familyName: '$.family_name',
-          givenName: '$.attributes.givenName',
+          givenName: '$.given_name',
-          name: '$.attributes.givenName',
-          role: '$.attributes.eduPersonPrimaryAffiliation',
-          studentId: '$.attributes.employeeNumber',
-        },
-        token: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0/accessToken',
-        userinfo: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0/profile',
-      },
-    },
-    paia: {
-      client: {
-        clientId: '',
-        scopes: '',
-        url: 'https://hds.hebis.de/Shibboleth.sso/UBFFM?target=https://hds.hebis.de/ubffm/paia_login_stub.php',
-      },
-      endpoints: {
-        authorization:
-          'https://hds.hebis.de/Shibboleth.sso/UBFFM?target=https://hds.hebis.de/ubffm/paia_login_stub.php',
-        endSession: 'https://ubffm.hds.hebis.de/Shibboleth.sso/Logout',
-        mapping: {
-          id: '$.email',
           name: '$.name',
-          role: '$.type',
+          role: '$.eduPersonPrimaryAffiliation',
+          studentId: '$.employeeNumber',
         },
-        token: 'https://hds.hebis.de/paia/auth/login',
+        token: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/token',
-        userinfo: 'https://hds.hebis.de/paia/core',
+        userinfo: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/userinfo',
+        revoke: 'https://idp.ub.uni-frankfurt.de/idp/profile/oauth2/revocation',
       },
     },
   },
@@ -58,22 +40,12 @@ const config = {
       extern: {
         hisometry: {
           authProvider: 'default',
-          url: 'https://his-self-service.rz.uni-frankfurt.de',
+          url: 'https://his-self-service.rz.uni-frankfurt.de/v2',
         },
-        daia: {
+        idCards: {
-          url: 'https://daia.hebis.de/DAIA2/UB_Frankfurt',
-        },
-        hebisProxy: {
-          url: 'https://proxy.ub.uni-frankfurt.de/login?qurl=',
-        },
-        paia: {
-          authProvider: 'paia',
-          url: 'https://hds.hebis.de/paia/core',
-        },
-        /** TODO: idCards: {
           authProvider: 'default',
-          url: 'TODO',
+          url: 'https://id-cards.rz.uni-frankfurt.de/v2/id-cards',
-        } */
+        },
       },
     },
     versionHistory,

backend/backend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openstapps/backend",
   "description": "A reference implementation for a StApps backend",
-  "version": "4.0.3",
+  "version": "4.0.6",
   "private": true,
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -53,7 +53,7 @@
     "@types/geojson": "1.0.6",
     "@types/node": "22.15.31",
     "@types/node-cron": "3.0.7",
-    "@types/nodemailer": "6.4.7",
+    "@types/nodemailer": "8.0.2",
     "@types/promise-queue": "2.2.0",
     "@types/uuid": "8.3.4",
     "body-parser": "1.20.3",
@@ -69,7 +69,7 @@
     "nock": "13.3.1",
     "node-cache": "5.1.2",
     "node-cron": "3.0.2",
-    "nodemailer": "6.9.9",
+    "nodemailer": "8.0.11",
     "prom-client": "14.1.1",
     "promise-queue": "2.2.5",
     "uuid": "8.3.2"
@@ -100,7 +100,7 @@
     "supertest": "6.3.3",
     "ts-node": "10.9.2",
     "tsup": "8.5.0",
-    "typescript": "5.4.2"
+    "typescript": "5.9.3"
   },
   "tsup": {
     "entry": [

backend/backend/src/notification/mail-queue.ts

@@ -15,7 +15,7 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 import {Logger, SMTP} from '@openstapps/logger';
-import {MailOptions} from 'nodemailer/lib/sendmail-transport';
+import {SendMailOptions} from 'nodemailer';
 import Queue from 'promise-queue';
 /**
  * A queue that can send mails in serial
@@ -36,7 +36,7 @@ export class MailQueue {
    * the transport gets ready this mails are getting pushed in to
    * the normal queue.
    */
-  dryQueue: MailOptions[];
+  dryQueue: SendMailOptions[];
 
   /**
    * A queue that saves mails, that are being sent in series
@@ -68,7 +68,7 @@ export class MailQueue {
    * Adds a mail into the queue so it gets send when the queue is ready
    * @param mail Information required for sending a mail
    */
-  private async addToQueue(mail: MailOptions) {
+  private async addToQueue(mail: SendMailOptions) {
     return this.queue.add<string>(() => this.transport.sendMail(mail));
   }
 
@@ -99,7 +99,7 @@ export class MailQueue {
    * Push a mail into the queue so it gets send when the queue is ready
    * @param mail Information required for sending a mail
    */
-  public async push(mail: MailOptions) {
+  public async push(mail: SendMailOptions) {
     if (this.transport.isVerified()) {
       await this.addToQueue(mail);
     } else {

backend/backend/test/notification/mail-queue.spec.ts

@@ -19,7 +19,7 @@ import sinon from 'sinon';
 import {MailQueue} from '../../src/notification/mail-queue.js';
 import {expect} from 'chai';
 import Queue from 'promise-queue';
-import {MailOptions} from 'nodemailer/lib/sendmail-transport';
+import {SendMailOptions} from 'nodemailer';
 import {getTransport, TRANSPORT_SEND_RESPONSE} from '../common.js';
 
 describe('MailQueue', async function () {
@@ -54,7 +54,7 @@ describe('MailQueue', async function () {
     const transport = getTransport(false);
     // @ts-expect-error not assignable
     const mailQueue = new MailQueue(transport);
-    const mail: MailOptions = {from: 'Foo', subject: 'Foo Subject'};
+    const mail: SendMailOptions = {from: 'Foo', subject: 'Foo Subject'};
     for (let i = 0; i < numberOfMails; i++) {
       await mailQueue.push(mail);
     }
@@ -70,7 +70,7 @@ describe('MailQueue', async function () {
     const queueAddStub = sandbox.stub(Queue.prototype, 'add');
     // @ts-expect-error not assignable
     const mailQueue = new MailQueue(getTransport(false));
-    const mail: MailOptions = {};
+    const mail: SendMailOptions = {};
     mailQueue.push(mail);
 
     expect(queueAddStub.called).to.be.false;
@@ -81,7 +81,7 @@ describe('MailQueue', async function () {
     const transport = getTransport(false);
     // @ts-expect-error not assignable
     const mailQueue = new MailQueue(transport);
-    const mail: MailOptions = {from: 'Foo', subject: 'Foo Subject'};
+    const mail: SendMailOptions = {from: 'Foo', subject: 'Foo Subject'};
     // fake that transport is verified
     transport.isVerified = () => true;
     mailQueue.push(mail);
@@ -97,7 +97,7 @@ describe('MailQueue', async function () {
     const transport = getTransport(false);
     // @ts-expect-error not assignable
     const mailQueue = new MailQueue(transport);
-    const mail: MailOptions = {from: 'Foo', subject: 'Foo Subject'};
+    const mail: SendMailOptions = {from: 'Foo', subject: 'Foo Subject'};
     // fake that transport is verified
     transport.isVerified = () => true;
     await mailQueue.push(mail);

backend/proxy/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @openstapps/proxy
 
+## 4.0.5
+
+### Patch Changes
+
+- 8ccbfac0: Bumping proxy version to rebuild image
+
 ## 4.0.2
 
 ### Patch Changes

backend/proxy/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openstapps/proxy",
   "description": "NGINX proxy that is dynamically configured by a Node.js script",
-  "version": "4.0.2",
+  "version": "4.0.5",
   "private": true,
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -51,7 +51,7 @@
     "is-cidr": "4.0.2",
     "mustache": "4.2.0",
     "semver": "7.6.0",
-    "typescript": "5.4.2"
+    "typescript": "5.9.3"
   },
   "devDependencies": {
     "@openstapps/api-cli": "workspace:*",

configuration/eslint-config/index.js

@@ -22,7 +22,7 @@ const config = {
         'plugin:unicorn/recommended',
         'prettier',
       ],
-      plugins: ['eslint-plugin-unicorn', 'eslint-plugin-jsdoc'],
+      plugins: ['eslint-plugin-unicorn', 'eslint-plugin-jsdoc', '@stylistic/eslint-plugin'],
       settings: {
         jsdoc: {
           mode: 'typescript',
@@ -76,7 +76,7 @@ const config = {
             ],
           },
         ],
-
+        '@stylistic/lines-between-class-members': ['error', 'always'],
         '@typescript-eslint/explicit-module-boundary-types': 'off',
         '@typescript-eslint/no-unused-vars': [
           'error',
@@ -85,7 +85,6 @@ const config = {
             argsIgnorePattern: '^_',
           },
         ],
-        '@typescript-eslint/lines-between-class-members': ['error', 'always'],
         '@typescript-eslint/no-explicit-any': 'error',
         '@typescript-eslint/no-non-null-assertion': 'off',
       },

configuration/eslint-config/package.json

@@ -19,11 +19,12 @@
     "@openstapps/tsconfig": "workspace:*",
     "@types/node": "22.15.31",
     "eslint": "8.57.0",
-    "typescript": "5.4.2"
+    "typescript": "5.9.3"
   },
   "peerDependencies": {
-    "@typescript-eslint/eslint-plugin": "7.11.0",
+    "@stylistic/eslint-plugin": "5.10.0",
-    "@typescript-eslint/parser": "7.11.0",
+    "@typescript-eslint/eslint-plugin": "8.39.1",
+    "@typescript-eslint/parser": "8.39.1",
     "eslint": "8.57.0",
     "eslint-config-prettier": "9.1.0",
     "eslint-plugin-jsdoc": "48.2.1",

configuration/prettier-config/index.js

@@ -9,7 +9,8 @@ const config = {
   trailingComma: 'all',
   bracketSpacing: false,
   arrowParens: 'avoid',
-  endOfLine: 'lf'
+  endOfLine: 'lf',
+  htmlWhitespaceSensitivity: 'strict'
 }
 
 module.exports = config;

configuration/projectmanagement/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @openstapps/projectmanagement
 
+## 4.0.5
+
+### Patch Changes
+
+- 86004881: Updated node-glob dependency
+
 ## 4.0.2
 
 ### Patch Changes

configuration/projectmanagement/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openstapps/projectmanagement",
   "description": "Main documentation and scripts for maintenance.",
-  "version": "4.0.2",
+  "version": "4.0.5",
   "private": true,
   "type": "module",
   "license": "GPL-3.0-only",
@@ -64,7 +64,7 @@
     "mocha-junit-reporter": "2.2.0",
     "ts-node": "10.9.2",
     "tsup": "8.5.0",
-    "typescript": "5.4.2"
+    "typescript": "5.9.3"
   },
   "tsup": {
     "entry": [

examples/minimal-connector/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @openstapps/minimal-connector
 
+## 4.0.5
+
+### Patch Changes
+
+- Updated dependencies [09ad903a]
+  - @openstapps/core@4.0.5
+  - @openstapps/api@4.0.5
+
 ## 4.0.2
 
 ### Patch Changes

examples/minimal-connector/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openstapps/minimal-connector",
   "description": "This is a minimal connector which serves as an example",
-  "version": "4.0.2",
+  "version": "4.0.5",
   "private": true,
   "type": "module",
   "license": "GPL-3.0-only",
@@ -55,7 +55,7 @@
     "nock": "13.3.1",
     "ts-node": "10.9.2",
     "tsup": "8.5.0",
-    "typescript": "5.4.2"
+    "typescript": "5.9.3"
   },
   "tsup": {
     "entry": [

examples/minimal-plugin/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @openstapps/minimal-plugin
 
+## 4.0.5
+
+### Patch Changes
+
+- Updated dependencies [86004881]
+- Updated dependencies [09ad903a]
+  - @openstapps/core-tools@4.0.5
+  - @openstapps/core@4.0.5
+  - @openstapps/api-plugin@4.0.5
+  - @openstapps/api@4.0.5
+
 ## 4.0.2
 
 ### Patch Changes

examples/minimal-plugin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openstapps/minimal-plugin",
   "description": "Minimal Plugin",
-  "version": "4.0.2",
+  "version": "4.0.5",
   "private": true,
   "type": "module",
   "license": "GPL-3.0-only",
@@ -44,7 +44,7 @@
     "@types/express": "4.17.17",
     "@types/node": "22.15.31",
     "tsup": "8.5.0",
-    "typescript": "5.4.2"
+    "typescript": "5.9.3"
   },
   "tsup": {
     "entry": [

frontend/app/.eslintrc.json

@@ -19,7 +19,7 @@
         "plugin:unicorn/recommended",
         "prettier"
       ],
-      "plugins": ["eslint-plugin-unicorn", "eslint-plugin-jsdoc"],
+      "plugins": ["eslint-plugin-unicorn", "eslint-plugin-jsdoc", "@stylistic/eslint-plugin"],
       "settings": {
         "jsdoc": {
           "mode": "typescript"
@@ -63,9 +63,10 @@
             "argsIgnorePattern": "^_"
           }
         ],
-        "@typescript-eslint/lines-between-class-members": ["error", "always"],
+        "@stylistic/lines-between-class-members": ["error", "always"],
         "@typescript-eslint/no-explicit-any": "error",
-        "@angular-eslint/use-lifecycle-interface": "error"
+        "@angular-eslint/use-lifecycle-interface": "error",
+        "@angular-eslint/prefer-standalone": "off"
       }
     },
     {

frontend/app/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @openstapps/app
 
+## 4.0.5
+
+### Patch Changes
+
+- 09ad903a: Upgrade to Capacitor 8 and Anuglar 20
+- 86004881: Updated node-glob dependency
+- Updated dependencies [09ad903a]
+  - @openstapps/core@4.0.5
+  - @openstapps/api@4.0.5
+
 ## 4.0.3
 
 ### Patch Changes

frontend/app/__mocks__/@capacitor/app.ts

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 StApps
+ * Copyright (C) 2026 StApps
  * This program is free software: you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
  * Software Foundation, version 3.
@@ -13,26 +13,29 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-export interface PAIAAuthorizationResponseJson {
+export interface URLOpenListenerEvent {
-  code: string;
+  url: string;
-  state: string;
-  patron: string;
 }
 
-export class PAIAAuthorizationResponse {
+export interface AppInfo {
-  code: string;
+  name: string;
+  id: string;
+  build: string;
+  version: string;
+}
 
-  state: string;
+export interface PluginListenerHandle {
+  remove: () => Promise<void>;
+}
 
-  patron: string;
+export class AppMock {
-
+  addListener<T>(_eventName: string, _listener: (event: T) => void): Promise<PluginListenerHandle> {
-  constructor(response: PAIAAuthorizationResponseJson) {
+    return Promise.resolve({remove: () => Promise.resolve()});
-    this.code = response.code;
-    this.state = response.state;
-    this.patron = response.patron;
   }
 
-  toJson(): PAIAAuthorizationResponseJson {
+  getInfo(): Promise<AppInfo> {
-    return {code: this.code, state: this.state, patron: this.patron};
+    return Promise.resolve({name: 'StApps', id: 'de.anyschool.app', build: '1', version: '1.2.3'});
   }
 }
+
+export const App = new AppMock();

frontend/app/__mocks__/@capacitor/core.ts

@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * tsconfig.spec.json maps every `@capacitor/*` import to this folder, so this
+ * file replaces `@capacitor/core` in all tests – including the imports made by
+ * real Capacitor plugins (registerPlugin, WebPlugin, CapacitorHttp, …).
+ *
+ * Therefore everything is re-exported from the real package (imported via a
+ * relative path, which bypasses the path mapping) and only `Capacitor` is
+ * replaced by a controllable mock. The local export shadows the one from
+ * `export *`.
+ */
+export * from '../../node_modules/@capacitor/core';
+
+type Platform = 'web' | 'ios' | 'android';
+
+export class CapacitorMock {
+  private platform: Platform = 'web';
+
+  getPlatform(): Platform {
+    return this.platform;
+  }
+
+  isNativePlatform(): boolean {
+    return this.platform !== 'web';
+  }
+
+  isPluginAvailable(_name: string): boolean {
+    return this.isNativePlatform();
+  }
+
+  convertFileSrc(filePath: string): string {
+    return filePath;
+  }
+
+  /**
+   * Test helper: simulate running on the given platform.
+   */
+  setPlatform(platform: Platform): void {
+    this.platform = platform;
+  }
+
+  /**
+   * Test helper: back to the default (web), call this in afterEach.
+   */
+  reset(): void {
+    this.platform = 'web';
+  }
+}
+
+export const Capacitor = new CapacitorMock();

frontend/app/android/.gitignore

@@ -94,3 +94,8 @@ capacitor-cordova-android-plugins
 
 # Copied web assets
 app/src/main/assets/public
+
+# Generated Config files
+app/src/main/assets/capacitor.config.json
+app/src/main/assets/capacitor.plugins.json
+app/src/main/res/xml/config.xml

frontend/app/android/capacitor.settings.gradle

@@ -1,60 +1,60 @@
 // DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN
 include ':capacitor-android'
-project(':capacitor-android').projectDir = new File('../../../node_modules/.pnpm/@capacitor+android@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/android/capacitor')
+project(':capacitor-android').projectDir = new File('../../../node_modules/.pnpm/@capacitor+android@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/android/capacitor')
 
 include ':capacitor-community-in-app-review'
-project(':capacitor-community-in-app-review').projectDir = new File('../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/in-app-review/android')
+project(':capacitor-community-in-app-review').projectDir = new File('../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/in-app-review/android')
 
 include ':capacitor-community-screen-brightness'
-project(':capacitor-community-screen-brightness').projectDir = new File('../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/screen-brightness/android')
+project(':capacitor-community-screen-brightness').projectDir = new File('../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/screen-brightness/android')
 
 include ':capacitor-app'
-project(':capacitor-app').projectDir = new File('../../../node_modules/.pnpm/@capacitor+app@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/app/android')
+project(':capacitor-app').projectDir = new File('../../../node_modules/.pnpm/@capacitor+app@8.1.1_@capacitor+core@8.5.2/node_modules/@capacitor/app/android')
 
 include ':capacitor-browser'
-project(':capacitor-browser').projectDir = new File('../../../node_modules/.pnpm/@capacitor+browser@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/browser/android')
+project(':capacitor-browser').projectDir = new File('../../../node_modules/.pnpm/@capacitor+browser@8.0.4_@capacitor+core@8.5.2/node_modules/@capacitor/browser/android')
 
 include ':capacitor-clipboard'
-project(':capacitor-clipboard').projectDir = new File('../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/clipboard/android')
+project(':capacitor-clipboard').projectDir = new File('../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/clipboard/android')
 
 include ':capacitor-device'
-project(':capacitor-device').projectDir = new File('../../../node_modules/.pnpm/@capacitor+device@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/device/android')
+project(':capacitor-device').projectDir = new File('../../../node_modules/.pnpm/@capacitor+device@8.0.3_@capacitor+core@8.5.2/node_modules/@capacitor/device/android')
 
 include ':capacitor-dialog'
-project(':capacitor-dialog').projectDir = new File('../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/dialog/android')
+project(':capacitor-dialog').projectDir = new File('../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/dialog/android')
 
 include ':capacitor-filesystem'
-project(':capacitor-filesystem').projectDir = new File('../../../node_modules/.pnpm/@capacitor+filesystem@8.1.2_@capacitor+core@8.2.0/node_modules/@capacitor/filesystem/android')
+project(':capacitor-filesystem').projectDir = new File('../../../node_modules/.pnpm/@capacitor+filesystem@8.1.3_@capacitor+core@8.5.2/node_modules/@capacitor/filesystem/android')
 
 include ':capacitor-geolocation'
-project(':capacitor-geolocation').projectDir = new File('../../../node_modules/.pnpm/@capacitor+geolocation@8.1.0_@capacitor+core@8.2.0/node_modules/@capacitor/geolocation/android')
+project(':capacitor-geolocation').projectDir = new File('../../../node_modules/.pnpm/@capacitor+geolocation@8.2.2_@capacitor+core@8.5.2/node_modules/@capacitor/geolocation/android')
 
 include ':capacitor-haptics'
-project(':capacitor-haptics').projectDir = new File('../../../node_modules/.pnpm/@capacitor+haptics@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/haptics/android')
+project(':capacitor-haptics').projectDir = new File('../../../node_modules/.pnpm/@capacitor+haptics@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/haptics/android')
 
 include ':capacitor-keyboard'
-project(':capacitor-keyboard').projectDir = new File('../../../node_modules/.pnpm/@capacitor+keyboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/keyboard/android')
+project(':capacitor-keyboard').projectDir = new File('../../../node_modules/.pnpm/@capacitor+keyboard@8.0.5_@capacitor+core@8.5.2/node_modules/@capacitor/keyboard/android')
 
 include ':capacitor-local-notifications'
-project(':capacitor-local-notifications').projectDir = new File('../../../node_modules/.pnpm/@capacitor+local-notifications@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/local-notifications/android')
+project(':capacitor-local-notifications').projectDir = new File('../../../node_modules/.pnpm/@capacitor+local-notifications@8.3.1_@capacitor+core@8.5.2/node_modules/@capacitor/local-notifications/android')
 
 include ':capacitor-network'
-project(':capacitor-network').projectDir = new File('../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/network/android')
+project(':capacitor-network').projectDir = new File('../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/network/android')
 
 include ':capacitor-preferences'
-project(':capacitor-preferences').projectDir = new File('../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/preferences/android')
+project(':capacitor-preferences').projectDir = new File('../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/preferences/android')
 
 include ':capacitor-screen-orientation'
-project(':capacitor-screen-orientation').projectDir = new File('../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/screen-orientation/android')
+project(':capacitor-screen-orientation').projectDir = new File('../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/screen-orientation/android')
 
 include ':capacitor-share'
-project(':capacitor-share').projectDir = new File('../../../node_modules/.pnpm/@capacitor+share@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/share/android')
+project(':capacitor-share').projectDir = new File('../../../node_modules/.pnpm/@capacitor+share@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/share/android')
 
 include ':capacitor-splash-screen'
-project(':capacitor-splash-screen').projectDir = new File('../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/splash-screen/android')
+project(':capacitor-splash-screen').projectDir = new File('../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/splash-screen/android')
 
 include ':transistorsoft-capacitor-background-fetch'
-project(':transistorsoft-capacitor-background-fetch').projectDir = new File('../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.0.0_@capacitor+core@8.2.0/node_modules/@transistorsoft/capacitor-background-fetch/android')
+project(':transistorsoft-capacitor-background-fetch').projectDir = new File('../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.1.3_@capacitor+core@8.5.2/node_modules/@transistorsoft/capacitor-background-fetch/android')
 
 include ':capacitor-secure-storage-plugin'
-project(':capacitor-secure-storage-plugin').projectDir = new File('../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.12.0_@capacitor+core@8.2.0/node_modules/capacitor-secure-storage-plugin/android')
+project(':capacitor-secure-storage-plugin').projectDir = new File('../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.13.0_@capacitor+core@8.5.2/node_modules/capacitor-secure-storage-plugin/android')

frontend/app/angular.json

@@ -40,6 +40,16 @@
                 "glob": "CHANGELOG.md",
                 "input": ".",
                 "output": "assets"
+              },
+              {
+                "glob": "maplibre-gl-worker.mjs",
+                "input": "node_modules/maplibre-gl/dist",
+                "output": "/"
+              },
+              {
+                "glob": "maplibre-gl-shared.mjs",
+                "input": "node_modules/maplibre-gl/dist",
+                "output": "/"
               }
             ],
             "styles": [
@@ -195,6 +205,30 @@
     },
     "@ionic/angular-toolkit:page": {
       "styleext": "scss"
+    },
+    "@schematics/angular:component": {
+      "type": "component"
+    },
+    "@schematics/angular:directive": {
+      "type": "directive"
+    },
+    "@schematics/angular:service": {
+      "type": "service"
+    },
+    "@schematics/angular:guard": {
+      "typeSeparator": "."
+    },
+    "@schematics/angular:interceptor": {
+      "typeSeparator": "."
+    },
+    "@schematics/angular:module": {
+      "typeSeparator": "."
+    },
+    "@schematics/angular:pipe": {
+      "typeSeparator": "."
+    },
+    "@schematics/angular:resolver": {
+      "typeSeparator": "."
     }
   }
 }

frontend/app/cypress/fixtures/config/default-config.json

@@ -175,16 +175,6 @@
         "hisometry": {
           "authProvider": "default",
           "url": "https://his-self-service.rz.uni-frankfurt.de"
-        },
-        "daia": {
-          "url": "https://daia.hebis.de/DAIA2/UB_Frankfurt"
-        },
-        "hebisProxy": {
-          "url": "https://proxy.ub.uni-frankfurt.de/login?qurl="
-        },
-        "paia": {
-          "authProvider": "paia",
-          "url": "https://hds.hebis.de/paia/core"
         }
       },
       "plugins": {
@@ -193,9 +183,6 @@
         },
         "feedback": {
           "urlPath": "/feedback"
-        },
-        "hebis-plugin": {
-          "urlPath": "/hebissearch"
         }
       }
     },
@@ -229,19 +216,6 @@
               }
             }
           },
-          {
-            "icon": "local_library",
-            "route": "/hebis-search",
-            "title": "library catalog",
-            "translations": {
-              "de": {
-                "title": "Bibliothekskatalog"
-              },
-              "en": {
-                "title": "library catalog"
-              }
-            }
-          },
           {
             "icon": "inventory_2",
             "route": "/catalog",
@@ -324,20 +298,6 @@
               }
             }
           },
-          {
-            "authProvider": "paia",
-            "icon": "badge",
-            "route": "/library-account",
-            "title": "library account",
-            "translations": {
-              "de": {
-                "title": "Bibliothekskonto"
-              },
-              "en": {
-                "title": "library account"
-              }
-            }
-          },
           {
             "icon": "settings",
             "route": "/settings",
@@ -473,24 +433,6 @@
         "token": "https://cas.rz.uni-frankfurt.de/cas/oauth2.0/accessToken",
         "userinfo": "https://cas.rz.uni-frankfurt.de/cas/oauth2.0/profile"
       }
-    },
-    "paia": {
-      "client": {
-        "clientId": "",
-        "scopes": "",
-        "url": "https://hds.hebis.de/Shibboleth.sso/UBFFM?target=https://hds.hebis.de/ubffm/paia_login_stub.php"
-      },
-      "endpoints": {
-        "authorization": "https://hds.hebis.de/Shibboleth.sso/UBFFM?target=https://hds.hebis.de/ubffm/paia_login_stub.php",
-        "endSession": "https://ubffm.hds.hebis.de/Shibboleth.sso/Logout",
-        "mapping": {
-          "id": "$.email",
-          "name": "$.name",
-          "role": "$.type"
-        },
-        "token": "https://hds.hebis.de/paia/auth/login",
-        "userinfo": "https://hds.hebis.de/paia/core"
-      }
     }
   },
   "backend": {

frontend/app/cypress/integration/favorites.spec.ts

@@ -41,8 +41,8 @@ describe('favorites', function () {
           });
         cy.get('stapps-favorite-button').click();
         cy.get('stapps-favorite-button > ion-button > ion-icon')
-          .invoke('attr', 'ng-reflect-fill')
+          .invoke('attr', 'class')
-          .should('eq', 'true');
+          .should('eq', 'selected');
       });
     cy.visit('/favorites');
     cy.get('stapps-data-list-item').within(() => {

frontend/app/ios/.gitignore

@@ -1,5 +1,6 @@
 App/build
 App/Pods
+App/output
 App/App/public
 DerivedData
 xcuserdata
@@ -7,3 +8,5 @@ xcuserdata
 # Cordova plugins for Capacitor
 capacitor-cordova-ios-plugins
 
+# Generated Config files
+App/App/capacitor.config.json

frontend/app/ios/App/App.xcodeproj/project.pbxproj

@@ -14,7 +14,8 @@
 		504EC30F1FED79650016851F /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 504EC30E1FED79650016851F /* Assets.xcassets */; };
 		504EC3121FED79650016851F /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 504EC3101FED79650016851F /* LaunchScreen.storyboard */; };
 		50B271D11FEDC1A000F3C39B /* public in Resources */ = {isa = PBXBuildFile; fileRef = 50B271D01FEDC1A000F3C39B /* public */; };
-		88B0D35EB4B7888A415041EE /* Pods_App.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 7C462D51B10BE605A8502F2C /* Pods_App.framework */; };
+		9582B6852FE996820072D4E8 /* SceneDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9582B6842FE996800072D4E8 /* SceneDelegate.swift */; };
+		A084ECDBA7D38E1E42DFC39D /* Pods_App.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = AF277DCFFFF123FFC6DF26C7 /* Pods_App.framework */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXFileReference section */
@@ -27,10 +28,10 @@
 		504EC3111FED79650016851F /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/LaunchScreen.storyboard; sourceTree = "<group>"; };
 		504EC3131FED79650016851F /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50B271D01FEDC1A000F3C39B /* public */ = {isa = PBXFileReference; lastKnownFileType = folder; path = public; sourceTree = "<group>"; };
-		7C462D51B10BE605A8502F2C /* Pods_App.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_App.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		9582B6842FE996800072D4E8 /* SceneDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SceneDelegate.swift; sourceTree = "<group>"; };
-		E2D249FB277CB255005492AC /* App.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = App.entitlements; sourceTree = "<group>"; };
+		AF277DCFFFF123FFC6DF26C7 /* Pods_App.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_App.framework; sourceTree = BUILT_PRODUCTS_DIR; };
-		EA601541CA9010D807358964 /* Pods-App.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-App.debug.xcconfig"; path = "Target Support Files/Pods-App/Pods-App.debug.xcconfig"; sourceTree = "<group>"; };
+		AF51FD2D460BCFE21FA515B2 /* Pods-App.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-App.release.xcconfig"; path = "Pods/Target Support Files/Pods-App/Pods-App.release.xcconfig"; sourceTree = "<group>"; };
-		EB81CB8CD78E2A93A8154B20 /* Pods-App.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-App.release.xcconfig"; path = "Target Support Files/Pods-App/Pods-App.release.xcconfig"; sourceTree = "<group>"; };
+		FC68EB0AF532CFC21C3344DD /* Pods-App.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-App.debug.xcconfig"; path = "Pods/Target Support Files/Pods-App/Pods-App.debug.xcconfig"; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -38,20 +39,28 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				88B0D35EB4B7888A415041EE /* Pods_App.framework in Frameworks */,
+				A084ECDBA7D38E1E42DFC39D /* Pods_App.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
+		27E2DDA53C4D2A4D1A88CE4A /* Frameworks */ = {
+			isa = PBXGroup;
+			children = (
+				AF277DCFFFF123FFC6DF26C7 /* Pods_App.framework */,
+			);
+			name = Frameworks;
+			sourceTree = "<group>";
+		};
 		504EC2FB1FED79650016851F = {
 			isa = PBXGroup;
 			children = (
 				504EC3061FED79650016851F /* App */,
 				504EC3051FED79650016851F /* Products */,
-				93DA7B5AF35933F9EF51EE34 /* Pods */,
+				7F8756D8B27F46E3366F6CEA /* Pods */,
-				819423158BC1FAAD85B02762 /* Frameworks */,
+				27E2DDA53C4D2A4D1A88CE4A /* Frameworks */,
 			);
 			sourceTree = "<group>";
 		};
@@ -66,7 +75,7 @@
 		504EC3061FED79650016851F /* App */ = {
 			isa = PBXGroup;
 			children = (
-				E2D249FB277CB255005492AC /* App.entitlements */,
+				9582B6842FE996800072D4E8 /* SceneDelegate.swift */,
 				50379B222058CBB4000EE86E /* capacitor.config.json */,
 				504EC3071FED79650016851F /* AppDelegate.swift */,
 				504EC30B1FED79650016851F /* Main.storyboard */,
@@ -79,22 +88,13 @@
 			path = App;
 			sourceTree = "<group>";
 		};
-		819423158BC1FAAD85B02762 /* Frameworks */ = {
+		7F8756D8B27F46E3366F6CEA /* Pods */ = {
 			isa = PBXGroup;
 			children = (
-				7C462D51B10BE605A8502F2C /* Pods_App.framework */,
+				FC68EB0AF532CFC21C3344DD /* Pods-App.debug.xcconfig */,
-			);
+				AF51FD2D460BCFE21FA515B2 /* Pods-App.release.xcconfig */,
-			name = Frameworks;
-			sourceTree = "<group>";
-		};
-		93DA7B5AF35933F9EF51EE34 /* Pods */ = {
-			isa = PBXGroup;
-			children = (
-				EA601541CA9010D807358964 /* Pods-App.debug.xcconfig */,
-				EB81CB8CD78E2A93A8154B20 /* Pods-App.release.xcconfig */,
 			);
 			name = Pods;
-			path = Pods;
 			sourceTree = "<group>";
 		};
 /* End PBXGroup section */
@@ -104,11 +104,11 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 504EC3161FED79650016851F /* Build configuration list for PBXNativeTarget "App" */;
 			buildPhases = (
-				947055B15D65E7FC3ADB1FEB /* [CP] Check Pods Manifest.lock */,
+				6634F4EFEBD30273BCE97C65 /* [CP] Check Pods Manifest.lock */,
 				504EC3001FED79650016851F /* Sources */,
 				504EC3011FED79650016851F /* Frameworks */,
 				504EC3021FED79650016851F /* Resources */,
-				F40DBF7576173B02228B7A71 /* [CP] Embed Pods Frameworks */,
+				9592DBEFFC6D2A0C8D5DEB22 /* [CP] Embed Pods Frameworks */,
 			);
 			buildRules = (
 			);
@@ -125,8 +125,8 @@
 		504EC2FC1FED79650016851F /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				LastSwiftUpdateCheck = 920;
+				LastSwiftUpdateCheck = 0920;
-				LastUpgradeCheck = 920;
+				LastUpgradeCheck = 0920;
 				TargetAttributes = {
 					504EC3031FED79650016851F = {
 						CreatedOnToolsVersion = 9.2;
@@ -144,6 +144,8 @@
 				Base,
 			);
 			mainGroup = 504EC2FB1FED79650016851F;
+			packageReferences = (
+			);
 			productRefGroup = 504EC3051FED79650016851F /* Products */;
 			projectDirPath = "";
 			projectRoot = "";
@@ -170,20 +172,16 @@
 /* End PBXResourcesBuildPhase section */
 
 /* Begin PBXShellScriptBuildPhase section */
-		947055B15D65E7FC3ADB1FEB /* [CP] Check Pods Manifest.lock */ = {
+		6634F4EFEBD30273BCE97C65 /* [CP] Check Pods Manifest.lock */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
-			inputFileListPaths = (
-			);
 			inputPaths = (
 				"${PODS_PODFILE_DIR_PATH}/Podfile.lock",
 				"${PODS_ROOT}/Manifest.lock",
 			);
 			name = "[CP] Check Pods Manifest.lock";
-			outputFileListPaths = (
-			);
 			outputPaths = (
 				"$(DERIVED_FILE_DIR)/Pods-App-checkManifestLockResult.txt",
 			);
@@ -192,7 +190,7 @@
 			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
 			showEnvVarsInLog = 0;
 		};
-		F40DBF7576173B02228B7A71 /* [CP] Embed Pods Frameworks */ = {
+		9592DBEFFC6D2A0C8D5DEB22 /* [CP] Embed Pods Frameworks */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -215,6 +213,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				504EC3081FED79650016851F /* AppDelegate.swift in Sources */,
+				9582B6852FE996820072D4E8 /* SceneDelegate.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -349,7 +348,7 @@
 		};
 		504EC3171FED79650016851F /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = EA601541CA9010D807358964 /* Pods-App.debug.xcconfig */;
+			baseConfigurationReference = FC68EB0AF532CFC21C3344DD /* Pods-App.debug.xcconfig */;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
@@ -371,7 +370,7 @@
 		};
 		504EC3181FED79650016851F /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = EB81CB8CD78E2A93A8154B20 /* Pods-App.release.xcconfig */;
+			baseConfigurationReference = AF51FD2D460BCFE21FA515B2 /* Pods-App.release.xcconfig */;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;

frontend/app/ios/App/App/AppDelegate.swift

@@ -10,7 +10,7 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
     func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
         // Override point for customization after application launch.
         let fetchManager = TSBackgroundFetch.sharedInstance();
-        fetchManager?.didFinishLaunching();
+        fetchManager.didFinishLaunching();
         return true
     }
 
@@ -18,7 +18,7 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
     func application(_ application: UIApplication, performFetchWithCompletionHandler completionHandler: @escaping (UIBackgroundFetchResult) -> Void) {
         print("BackgroundFetchPlugin AppDelegate received fetch event");
         let fetchManager = TSBackgroundFetch.sharedInstance();
-        fetchManager?.perform(completionHandler: completionHandler, applicationState: application.applicationState);
+        fetchManager.perform(completionHandler: completionHandler, applicationState: application.applicationState);
     }
 
     func applicationWillResignActive(_ application: UIApplication) {
@@ -56,4 +56,13 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
         return ApplicationDelegateProxy.shared.application(application, continue: userActivity, restorationHandler: restorationHandler)
     }
 
+    func application(_ application: UIApplication,
+                     configurationForConnecting connectingSceneSession: UISceneSession,
+                     options: UIScene.ConnectionOptions) -> UISceneConfiguration {
+
+        let config = UISceneConfiguration(name: "Default Configuration", sessionRole: connectingSceneSession.role)
+        config.delegateClass = SceneDelegate.self
+        return config
+    }
+
 }

frontend/app/ios/App/App/Assets.xcassets/Contents.json

@@ -1,6 +1,6 @@
 {
-  "info": {
+  "info" : {
-    "version": 1,
+    "version" : 1,
-    "author": "xcode"
+    "author" : "xcode"
   }
-}
+}

frontend/app/ios/App/App/Info.plist

@@ -44,9 +44,29 @@
 	<string>Calendar access is needed to sync your schedule with the device</string>
 	<key>NSLocationWhenInUseUsageDescription</key>
 	<string>Location services are used to enable all map and search features</string>
+	<key>UIApplicationSceneManifest</key>
+	<dict>
+		<key>UIApplicationSupportsMultipleScenes</key>
+		<false/>
+		<key>UISceneConfigurations</key>
+		<dict>
+			<key>UIWindowSceneSessionRoleApplication</key>
+			<array>
+				<dict>
+					<key>UISceneConfigurationName</key>
+					<string>Default Configuration</string>
+					<key>UISceneDelegateClassName</key>
+					<string>$(PRODUCT_MODULE_NAME).SceneDelegate</string>
+					<key>UISceneStoryboardFile</key>
+					<string>Main</string>
+				</dict>
+			</array>
+		</dict>
+	</dict>
 	<key>UIBackgroundModes</key>
 	<array>
 		<string>fetch</string>
+		<string>processing</string>
 	</array>
 	<key>UILaunchStoryboardName</key>
 	<string>LaunchScreen</string>
@@ -61,15 +81,17 @@
 	<key>UISupportedInterfaceOrientations</key>
 	<array>
 		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
 	</array>
 	<key>UISupportedInterfaceOrientations~ipad</key>
 	<array>
-		<string>UIInterfaceOrientationLandscapeLeft</string>
-		<string>UIInterfaceOrientationLandscapeRight</string>
 		<string>UIInterfaceOrientationPortrait</string>
 		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
 	</array>
 	<key>UIViewControllerBasedStatusBarAppearance</key>
-	<false/>
+	<true/>
 </dict>
 </plist>

frontend/app/ios/App/App/SceneDelegate.swift

@@ -0,0 +1,24 @@
+import UIKit
+import Capacitor
+
+class SceneDelegate: UIResponder, UIWindowSceneDelegate {
+    var window: UIWindow?
+
+    func scene(_ scene: UIScene, willConnectTo session: UISceneSession, options connectionOptions: UIScene.ConnectionOptions) {
+        guard let windowScene = scene as? UIWindowScene else { return }
+
+        window = UIWindow(windowScene: windowScene)
+        window?.rootViewController = CAPBridgeViewController()
+        window?.makeKeyAndVisible()
+
+        SceneDelegateProxy.shared.scene(scene, willConnectTo: session, options: connectionOptions)
+    }
+
+    func scene(_ scene: UIScene, openURLContexts URLContexts: Set<UIOpenURLContext>) {
+        SceneDelegateProxy.shared.scene(scene, openURLContexts: URLContexts)
+    }
+
+    func scene(_ scene: UIScene, continue userActivity: NSUserActivity) {
+        SceneDelegateProxy.shared.scene(scene, continue: userActivity)
+    }
+}

frontend/app/ios/App/Podfile

@@ -1,4 +1,4 @@
-require_relative '../../../../node_modules/.pnpm/@capacitor+ios@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/ios/scripts/pods_helpers'
+require_relative '../../../../node_modules/.pnpm/@capacitor+ios@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/ios/scripts/pods_helpers'
 
 platform :ios, '15.0'
 use_frameworks!
@@ -9,27 +9,27 @@ use_frameworks!
 install! 'cocoapods', :disable_input_output_paths => true
 
 def capacitor_pods
-  pod 'Capacitor', :path => '../../../../node_modules/.pnpm/@capacitor+ios@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/ios'
+  pod 'Capacitor', :path => '../../../../node_modules/.pnpm/@capacitor+ios@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/ios'
-  pod 'CapacitorCordova', :path => '../../../../node_modules/.pnpm/@capacitor+ios@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/ios'
+  pod 'CapacitorCordova', :path => '../../../../node_modules/.pnpm/@capacitor+ios@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/ios'
-  pod 'CapacitorCommunityInAppReview', :path => '../../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/in-app-review'
+  pod 'CapacitorCommunityInAppReview', :path => '../../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/in-app-review'
-  pod 'CapacitorCommunityScreenBrightness', :path => '../../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/screen-brightness'
+  pod 'CapacitorCommunityScreenBrightness', :path => '../../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/screen-brightness'
-  pod 'CapacitorApp', :path => '../../../../node_modules/.pnpm/@capacitor+app@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/app'
+  pod 'CapacitorApp', :path => '../../../../node_modules/.pnpm/@capacitor+app@8.1.1_@capacitor+core@8.5.2/node_modules/@capacitor/app'
-  pod 'CapacitorBrowser', :path => '../../../../node_modules/.pnpm/@capacitor+browser@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/browser'
+  pod 'CapacitorBrowser', :path => '../../../../node_modules/.pnpm/@capacitor+browser@8.0.4_@capacitor+core@8.5.2/node_modules/@capacitor/browser'
-  pod 'CapacitorClipboard', :path => '../../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/clipboard'
+  pod 'CapacitorClipboard', :path => '../../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/clipboard'
-  pod 'CapacitorDevice', :path => '../../../../node_modules/.pnpm/@capacitor+device@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/device'
+  pod 'CapacitorDevice', :path => '../../../../node_modules/.pnpm/@capacitor+device@8.0.3_@capacitor+core@8.5.2/node_modules/@capacitor/device'
-  pod 'CapacitorDialog', :path => '../../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/dialog'
+  pod 'CapacitorDialog', :path => '../../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/dialog'
-  pod 'CapacitorFilesystem', :path => '../../../../node_modules/.pnpm/@capacitor+filesystem@8.1.2_@capacitor+core@8.2.0/node_modules/@capacitor/filesystem'
+  pod 'CapacitorFilesystem', :path => '../../../../node_modules/.pnpm/@capacitor+filesystem@8.1.3_@capacitor+core@8.5.2/node_modules/@capacitor/filesystem'
-  pod 'CapacitorGeolocation', :path => '../../../../node_modules/.pnpm/@capacitor+geolocation@8.1.0_@capacitor+core@8.2.0/node_modules/@capacitor/geolocation'
+  pod 'CapacitorGeolocation', :path => '../../../../node_modules/.pnpm/@capacitor+geolocation@8.2.2_@capacitor+core@8.5.2/node_modules/@capacitor/geolocation'
-  pod 'CapacitorHaptics', :path => '../../../../node_modules/.pnpm/@capacitor+haptics@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/haptics'
+  pod 'CapacitorHaptics', :path => '../../../../node_modules/.pnpm/@capacitor+haptics@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/haptics'
-  pod 'CapacitorKeyboard', :path => '../../../../node_modules/.pnpm/@capacitor+keyboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/keyboard'
+  pod 'CapacitorKeyboard', :path => '../../../../node_modules/.pnpm/@capacitor+keyboard@8.0.5_@capacitor+core@8.5.2/node_modules/@capacitor/keyboard'
-  pod 'CapacitorLocalNotifications', :path => '../../../../node_modules/.pnpm/@capacitor+local-notifications@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/local-notifications'
+  pod 'CapacitorLocalNotifications', :path => '../../../../node_modules/.pnpm/@capacitor+local-notifications@8.3.1_@capacitor+core@8.5.2/node_modules/@capacitor/local-notifications'
-  pod 'CapacitorNetwork', :path => '../../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/network'
+  pod 'CapacitorNetwork', :path => '../../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/network'
-  pod 'CapacitorPreferences', :path => '../../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/preferences'
+  pod 'CapacitorPreferences', :path => '../../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/preferences'
-  pod 'CapacitorScreenOrientation', :path => '../../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/screen-orientation'
+  pod 'CapacitorScreenOrientation', :path => '../../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/screen-orientation'
-  pod 'CapacitorShare', :path => '../../../../node_modules/.pnpm/@capacitor+share@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/share'
+  pod 'CapacitorShare', :path => '../../../../node_modules/.pnpm/@capacitor+share@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/share'
-  pod 'CapacitorSplashScreen', :path => '../../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/splash-screen'
+  pod 'CapacitorSplashScreen', :path => '../../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/splash-screen'
-  pod 'TransistorsoftCapacitorBackgroundFetch', :path => '../../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.0.0_@capacitor+core@8.2.0/node_modules/@transistorsoft/capacitor-background-fetch'
+  pod 'TransistorsoftCapacitorBackgroundFetch', :path => '../../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.1.3_@capacitor+core@8.5.2/node_modules/@transistorsoft/capacitor-background-fetch'
-  pod 'CapacitorSecureStoragePlugin', :path => '../../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.12.0_@capacitor+core@8.2.0/node_modules/capacitor-secure-storage-plugin'
+  pod 'CapacitorSecureStoragePlugin', :path => '../../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.13.0_@capacitor+core@8.5.2/node_modules/capacitor-secure-storage-plugin'
   pod 'CordovaPlugins', :path => '../capacitor-cordova-ios-plugins'
 end
 

frontend/app/ios/App/Podfile.lock

@@ -1,9 +1,9 @@
 PODS:
-  - Capacitor (8.2.0):
+  - Capacitor (8.5.2):
     - CapacitorCordova
-  - CapacitorApp (8.0.1):
+  - CapacitorApp (8.1.1):
     - Capacitor
-  - CapacitorBrowser (8.0.2):
+  - CapacitorBrowser (8.0.4):
     - Capacitor
   - CapacitorClipboard (8.0.1):
     - Capacitor
@@ -11,22 +11,22 @@ PODS:
     - Capacitor
   - CapacitorCommunityScreenBrightness (8.0.0):
     - Capacitor
-  - CapacitorCordova (8.2.0)
+  - CapacitorCordova (8.5.2)
-  - CapacitorDevice (8.0.1):
+  - CapacitorDevice (8.0.3):
     - Capacitor
   - CapacitorDialog (8.0.1):
     - Capacitor
-  - CapacitorFilesystem (8.1.2):
+  - CapacitorFilesystem (8.1.3):
     - Capacitor
     - IONFilesystemLib (~> 1.1.1)
-  - CapacitorGeolocation (8.1.0):
+  - CapacitorGeolocation (8.2.2):
     - Capacitor
-    - IONGeolocationLib (= 2.0.0)
+    - IONGeolocationLib (= 2.1.0)
-  - CapacitorHaptics (8.0.1):
+  - CapacitorHaptics (8.0.2):
     - Capacitor
-  - CapacitorKeyboard (8.0.1):
+  - CapacitorKeyboard (8.0.5):
     - Capacitor
-  - CapacitorLocalNotifications (8.0.2):
+  - CapacitorLocalNotifications (8.3.1):
     - Capacitor
   - CapacitorNetwork (8.0.1):
     - Capacitor
@@ -34,46 +34,46 @@ PODS:
     - Capacitor
   - CapacitorScreenOrientation (8.0.1):
     - Capacitor
-  - CapacitorSecureStoragePlugin (0.12.0):
+  - CapacitorSecureStoragePlugin (0.13.0):
     - Capacitor
     - SwiftKeychainWrapper
-  - CapacitorShare (8.0.1):
+  - CapacitorShare (8.0.2):
     - Capacitor
-  - CapacitorSplashScreen (8.0.1):
+  - CapacitorSplashScreen (8.0.2):
     - Capacitor
-  - CordovaPlugins (8.2.0):
+  - CordovaPlugins (8.5.2):
     - CapacitorCordova
-  - IONFilesystemLib (1.1.2)
+  - IONFilesystemLib (1.1.4)
-  - IONGeolocationLib (2.0.0)
+  - IONGeolocationLib (2.1.0)
   - SwiftKeychainWrapper (4.0.1)
-  - TransistorsoftCapacitorBackgroundFetch (8.0.0):
+  - TransistorsoftCapacitorBackgroundFetch (8.1.3):
     - Capacitor
-    - TSBackgroundFetch (~> 4.0)
+    - TSBackgroundFetch (~> 4.1.0)
-  - TSBackgroundFetch (4.0.6)
+  - TSBackgroundFetch (4.1.1)
 
 DEPENDENCIES:
-  - "Capacitor (from `../../../../node_modules/.pnpm/@capacitor+ios@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/ios`)"
+  - "Capacitor (from `../../../../node_modules/.pnpm/@capacitor+ios@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/ios`)"
-  - "CapacitorApp (from `../../../../node_modules/.pnpm/@capacitor+app@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/app`)"
+  - "CapacitorApp (from `../../../../node_modules/.pnpm/@capacitor+app@8.1.1_@capacitor+core@8.5.2/node_modules/@capacitor/app`)"
-  - "CapacitorBrowser (from `../../../../node_modules/.pnpm/@capacitor+browser@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/browser`)"
+  - "CapacitorBrowser (from `../../../../node_modules/.pnpm/@capacitor+browser@8.0.4_@capacitor+core@8.5.2/node_modules/@capacitor/browser`)"
-  - "CapacitorClipboard (from `../../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/clipboard`)"
+  - "CapacitorClipboard (from `../../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/clipboard`)"
-  - "CapacitorCommunityInAppReview (from `../../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/in-app-review`)"
+  - "CapacitorCommunityInAppReview (from `../../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/in-app-review`)"
-  - "CapacitorCommunityScreenBrightness (from `../../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/screen-brightness`)"
+  - "CapacitorCommunityScreenBrightness (from `../../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/screen-brightness`)"
-  - "CapacitorCordova (from `../../../../node_modules/.pnpm/@capacitor+ios@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/ios`)"
+  - "CapacitorCordova (from `../../../../node_modules/.pnpm/@capacitor+ios@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/ios`)"
-  - "CapacitorDevice (from `../../../../node_modules/.pnpm/@capacitor+device@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/device`)"
+  - "CapacitorDevice (from `../../../../node_modules/.pnpm/@capacitor+device@8.0.3_@capacitor+core@8.5.2/node_modules/@capacitor/device`)"
-  - "CapacitorDialog (from `../../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/dialog`)"
+  - "CapacitorDialog (from `../../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/dialog`)"
-  - "CapacitorFilesystem (from `../../../../node_modules/.pnpm/@capacitor+filesystem@8.1.2_@capacitor+core@8.2.0/node_modules/@capacitor/filesystem`)"
+  - "CapacitorFilesystem (from `../../../../node_modules/.pnpm/@capacitor+filesystem@8.1.3_@capacitor+core@8.5.2/node_modules/@capacitor/filesystem`)"
-  - "CapacitorGeolocation (from `../../../../node_modules/.pnpm/@capacitor+geolocation@8.1.0_@capacitor+core@8.2.0/node_modules/@capacitor/geolocation`)"
+  - "CapacitorGeolocation (from `../../../../node_modules/.pnpm/@capacitor+geolocation@8.2.2_@capacitor+core@8.5.2/node_modules/@capacitor/geolocation`)"
-  - "CapacitorHaptics (from `../../../../node_modules/.pnpm/@capacitor+haptics@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/haptics`)"
+  - "CapacitorHaptics (from `../../../../node_modules/.pnpm/@capacitor+haptics@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/haptics`)"
-  - "CapacitorKeyboard (from `../../../../node_modules/.pnpm/@capacitor+keyboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/keyboard`)"
+  - "CapacitorKeyboard (from `../../../../node_modules/.pnpm/@capacitor+keyboard@8.0.5_@capacitor+core@8.5.2/node_modules/@capacitor/keyboard`)"
-  - "CapacitorLocalNotifications (from `../../../../node_modules/.pnpm/@capacitor+local-notifications@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/local-notifications`)"
+  - "CapacitorLocalNotifications (from `../../../../node_modules/.pnpm/@capacitor+local-notifications@8.3.1_@capacitor+core@8.5.2/node_modules/@capacitor/local-notifications`)"
-  - "CapacitorNetwork (from `../../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/network`)"
+  - "CapacitorNetwork (from `../../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/network`)"
-  - "CapacitorPreferences (from `../../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/preferences`)"
+  - "CapacitorPreferences (from `../../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/preferences`)"
-  - "CapacitorScreenOrientation (from `../../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/screen-orientation`)"
+  - "CapacitorScreenOrientation (from `../../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/screen-orientation`)"
-  - "CapacitorSecureStoragePlugin (from `../../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.12.0_@capacitor+core@8.2.0/node_modules/capacitor-secure-storage-plugin`)"
+  - "CapacitorSecureStoragePlugin (from `../../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.13.0_@capacitor+core@8.5.2/node_modules/capacitor-secure-storage-plugin`)"
-  - "CapacitorShare (from `../../../../node_modules/.pnpm/@capacitor+share@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/share`)"
+  - "CapacitorShare (from `../../../../node_modules/.pnpm/@capacitor+share@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/share`)"
-  - "CapacitorSplashScreen (from `../../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/splash-screen`)"
+  - "CapacitorSplashScreen (from `../../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/splash-screen`)"
   - CordovaPlugins (from `../capacitor-cordova-ios-plugins`)
-  - "TransistorsoftCapacitorBackgroundFetch (from `../../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.0.0_@capacitor+core@8.2.0/node_modules/@transistorsoft/capacitor-background-fetch`)"
+  - "TransistorsoftCapacitorBackgroundFetch (from `../../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.1.3_@capacitor+core@8.5.2/node_modules/@transistorsoft/capacitor-background-fetch`)"
 
 SPEC REPOS:
   trunk:
@@ -84,78 +84,78 @@ SPEC REPOS:
 
 EXTERNAL SOURCES:
   Capacitor:
-    :path: "../../../../node_modules/.pnpm/@capacitor+ios@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/ios"
+    :path: "../../../../node_modules/.pnpm/@capacitor+ios@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/ios"
   CapacitorApp:
-    :path: "../../../../node_modules/.pnpm/@capacitor+app@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/app"
+    :path: "../../../../node_modules/.pnpm/@capacitor+app@8.1.1_@capacitor+core@8.5.2/node_modules/@capacitor/app"
   CapacitorBrowser:
-    :path: "../../../../node_modules/.pnpm/@capacitor+browser@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/browser"
+    :path: "../../../../node_modules/.pnpm/@capacitor+browser@8.0.4_@capacitor+core@8.5.2/node_modules/@capacitor/browser"
   CapacitorClipboard:
-    :path: "../../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/clipboard"
+    :path: "../../../../node_modules/.pnpm/@capacitor+clipboard@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/clipboard"
   CapacitorCommunityInAppReview:
-    :path: "../../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/in-app-review"
+    :path: "../../../../node_modules/.pnpm/@capacitor-community+in-app-review@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/in-app-review"
   CapacitorCommunityScreenBrightness:
-    :path: "../../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.2.0/node_modules/@capacitor-community/screen-brightness"
+    :path: "../../../../node_modules/.pnpm/@capacitor-community+screen-brightness@8.0.0_@capacitor+core@8.5.2/node_modules/@capacitor-community/screen-brightness"
   CapacitorCordova:
-    :path: "../../../../node_modules/.pnpm/@capacitor+ios@8.2.0_@capacitor+core@8.2.0/node_modules/@capacitor/ios"
+    :path: "../../../../node_modules/.pnpm/@capacitor+ios@8.5.2_@capacitor+core@8.5.2/node_modules/@capacitor/ios"
   CapacitorDevice:
-    :path: "../../../../node_modules/.pnpm/@capacitor+device@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/device"
+    :path: "../../../../node_modules/.pnpm/@capacitor+device@8.0.3_@capacitor+core@8.5.2/node_modules/@capacitor/device"
   CapacitorDialog:
-    :path: "../../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/dialog"
+    :path: "../../../../node_modules/.pnpm/@capacitor+dialog@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/dialog"
   CapacitorFilesystem:
-    :path: "../../../../node_modules/.pnpm/@capacitor+filesystem@8.1.2_@capacitor+core@8.2.0/node_modules/@capacitor/filesystem"
+    :path: "../../../../node_modules/.pnpm/@capacitor+filesystem@8.1.3_@capacitor+core@8.5.2/node_modules/@capacitor/filesystem"
   CapacitorGeolocation:
-    :path: "../../../../node_modules/.pnpm/@capacitor+geolocation@8.1.0_@capacitor+core@8.2.0/node_modules/@capacitor/geolocation"
+    :path: "../../../../node_modules/.pnpm/@capacitor+geolocation@8.2.2_@capacitor+core@8.5.2/node_modules/@capacitor/geolocation"
   CapacitorHaptics:
-    :path: "../../../../node_modules/.pnpm/@capacitor+haptics@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/haptics"
+    :path: "../../../../node_modules/.pnpm/@capacitor+haptics@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/haptics"
   CapacitorKeyboard:
-    :path: "../../../../node_modules/.pnpm/@capacitor+keyboard@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/keyboard"
+    :path: "../../../../node_modules/.pnpm/@capacitor+keyboard@8.0.5_@capacitor+core@8.5.2/node_modules/@capacitor/keyboard"
   CapacitorLocalNotifications:
-    :path: "../../../../node_modules/.pnpm/@capacitor+local-notifications@8.0.2_@capacitor+core@8.2.0/node_modules/@capacitor/local-notifications"
+    :path: "../../../../node_modules/.pnpm/@capacitor+local-notifications@8.3.1_@capacitor+core@8.5.2/node_modules/@capacitor/local-notifications"
   CapacitorNetwork:
-    :path: "../../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/network"
+    :path: "../../../../node_modules/.pnpm/@capacitor+network@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/network"
   CapacitorPreferences:
-    :path: "../../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/preferences"
+    :path: "../../../../node_modules/.pnpm/@capacitor+preferences@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/preferences"
   CapacitorScreenOrientation:
-    :path: "../../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/screen-orientation"
+    :path: "../../../../node_modules/.pnpm/@capacitor+screen-orientation@8.0.1_@capacitor+core@8.5.2/node_modules/@capacitor/screen-orientation"
   CapacitorSecureStoragePlugin:
-    :path: "../../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.12.0_@capacitor+core@8.2.0/node_modules/capacitor-secure-storage-plugin"
+    :path: "../../../../node_modules/.pnpm/capacitor-secure-storage-plugin@0.13.0_@capacitor+core@8.5.2/node_modules/capacitor-secure-storage-plugin"
   CapacitorShare:
-    :path: "../../../../node_modules/.pnpm/@capacitor+share@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/share"
+    :path: "../../../../node_modules/.pnpm/@capacitor+share@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/share"
   CapacitorSplashScreen:
-    :path: "../../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.1_@capacitor+core@8.2.0/node_modules/@capacitor/splash-screen"
+    :path: "../../../../node_modules/.pnpm/@capacitor+splash-screen@8.0.2_@capacitor+core@8.5.2/node_modules/@capacitor/splash-screen"
   CordovaPlugins:
     :path: "../capacitor-cordova-ios-plugins"
   TransistorsoftCapacitorBackgroundFetch:
-    :path: "../../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.0.0_@capacitor+core@8.2.0/node_modules/@transistorsoft/capacitor-background-fetch"
+    :path: "../../../../node_modules/.pnpm/@transistorsoft+capacitor-background-fetch@8.1.3_@capacitor+core@8.5.2/node_modules/@transistorsoft/capacitor-background-fetch"
 
 SPEC CHECKSUMS:
-  Capacitor: 49a454e1cdbd520bc106a220adca7913536a4933
+  Capacitor: 89067779e14fb7ea56af07b4817f45d1f0c2a269
-  CapacitorApp: 942306cd1acf7774a00e89a3986af3a67c8cad7a
+  CapacitorApp: 305bd13c44f6f9d164e2ee66a4faa956ed8c0e06
-  CapacitorBrowser: 76847841b74c11ccac0a1afae18cf06e3bd59044
+  CapacitorBrowser: 752e0208aa07c7aa63d1f7cde895a3e9519b2656
   CapacitorClipboard: c75fdaa6e622111119f35e7914ecfc67b05efecb
   CapacitorCommunityInAppReview: 4492bdd34aad4d27ed87949376022cc93b294ea1
   CapacitorCommunityScreenBrightness: e4075e1181f7e88259edb8b1e3b9a209e1144d45
-  CapacitorCordova: a9ac88d84a1f5280f33b349fe50fce1902683ac0
+  CapacitorCordova: 5bec5648cbd09a176ce34ce5e7b6cdabb2c8a327
-  CapacitorDevice: ff033fa0c4ec19f5e059a073769a9b2347e69f57
+  CapacitorDevice: 708e742b60a61572cd593e44c809592e8f31da14
   CapacitorDialog: 854c5dac405081cae697c177ca43bcaa95ae67bf
-  CapacitorFilesystem: 2db285a1ac6e475cc27cae2e1bea999000f9e2be
+  CapacitorFilesystem: b2bbd84bb91c177906c9dbc252864cb71ab9957b
-  CapacitorGeolocation: 7132de914f9d853ec4642dc1d36e4e2018a4e8a8
+  CapacitorGeolocation: 327f18983c8f8a55e191fcf7dee80b9294f1ab78
-  CapacitorHaptics: 4df2c625445cef39b67ea635a21802bc92df3b82
+  CapacitorHaptics: 296f771ecd89c7a1bd92a7b6826a7d268e2e70f5
-  CapacitorKeyboard: 867eb4b3c901d9bb5c3d0c93b546185d52484e19
+  CapacitorKeyboard: b6b0744890cdb1d9a96e2cafcc9253fdcc55de3b
-  CapacitorLocalNotifications: 4db83a7f6bdd2f30dcedf5c6f92c415065467a24
+  CapacitorLocalNotifications: e0747a329ddde3074d52dc74a003688af90e42be
   CapacitorNetwork: 8812ce60d11fb63d8f2e4ba51a49b2e59892ebe2
   CapacitorPreferences: cca2021f386efb75947c850334447d9ff22b14f1
   CapacitorScreenOrientation: 6c3c84223ea1dd44aaa7184e2b416dd1192270d0
-  CapacitorSecureStoragePlugin: 50de0808ad398aa401e00f9e58adf88c77cb3c25
+  CapacitorSecureStoragePlugin: d083ff28d9ba5bc74924b9bcf9754ea605016b63
-  CapacitorShare: 0c58305114538568059bfc07111f22dcb9cb2a82
+  CapacitorShare: 2fde721d06a6f83ff5c7578e6a91b190d341ac6a
-  CapacitorSplashScreen: 4b46c72298db552b3c57ce021ef028b6dc7f1fa7
+  CapacitorSplashScreen: 7bf61c2001557ff9e195e601c6b87344480d3c65
-  CordovaPlugins: a59b2cf4431ebffa93e36e7cc3fc0aedfeb058ad
+  CordovaPlugins: 3508a47f9d91d1c38fa7ff41afa75e7226c9407b
-  IONFilesystemLib: 21a63377696b2d8fab5632ecfb7d2ac67bddb68a
+  IONFilesystemLib: e6610c2b260d15e4b9cb9d5e37a87095479b669e
-  IONGeolocationLib: a5e40b54edc2ee9902036eda5aaa41ddf07bb68d
+  IONGeolocationLib: 6a7b6f76063fb1b01cfb14fae7d0f526e3c9b271
   SwiftKeychainWrapper: 807ba1d63c33a7d0613288512399cd1eda1e470c
-  TransistorsoftCapacitorBackgroundFetch: 12dc742682562c9339241d12615f27ef7dbfb88f
+  TransistorsoftCapacitorBackgroundFetch: 3fd1ea4cd2f6e8f512d366261b162c68b362e59a
-  TSBackgroundFetch: 0afbeaae4e1132866e1d4b6e55265af26b5958ae
+  TSBackgroundFetch: 18918b6449a1e3f01eb0f5b44d6d79ce6160a5a5
 
-PODFILE CHECKSUM: 809074712090e90da383be24c4ad182cd7a3dd1f
+PODFILE CHECKSUM: 47c2431c6197a6e8fdf2ace4f969ed028a0e002f
 
 COCOAPODS: 1.16.2

frontend/app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@openstapps/app",
   "description": "The generic app tailored to fulfill needs of German universities, written using Ionic Framework.",
-  "version": "4.0.3",
+  "version": "4.0.5",
   "private": true,
   "license": "GPL-3.0-only",
   "author": "Karl-Philipp Wulfert <krlwlfrt@gmail.com>",
@@ -38,7 +38,7 @@
     "minify-icons": "node scripts/minify-icon-font.mjs",
     "preview": "http-server www/browser --p 8101 -o",
     "push": "git push && git push origin \"v$npm_package_version\"",
-    "resources:ios": "capacitor-assets generate --ios --iconBackgroundColor $(grep -oE \"^@include ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\") --splashBackgroundColor $(grep -oE \"^@include ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\")",
+    "resources:ios": "capacitor-assets generate --ios --iconBackgroundColor $(grep -oE \"^@include color-system\\.ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\") --splashBackgroundColor $(grep -oE \"^@include color-system\\.ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\")",
     "run:android": "ionic capacitor run android --livereload --external",
     "start": "ionic serve",
     "start:external": "ionic serve --external",
@@ -48,109 +48,109 @@
     "test:integration": "sh integration-test.sh"
   },
   "dependencies": {
-    "@angular/animations": "18.2.13",
+    "@angular/animations": "20.3.31",
-    "@angular/cdk": "18.2.13",
+    "@angular/cdk": "20.2.14",
-    "@angular/common": "18.2.13",
+    "@angular/common": "20.3.31",
-    "@angular/core": "18.2.13",
+    "@angular/core": "20.3.31",
-    "@angular/forms": "18.2.13",
+    "@angular/forms": "20.3.31",
-    "@angular/platform-browser": "18.2.13",
+    "@angular/platform-browser": "20.3.31",
-    "@angular/router": "18.2.13",
+    "@angular/router": "20.3.31",
     "@awesome-cordova-plugins/calendar": "8.1.0",
     "@awesome-cordova-plugins/core": "8.1.0",
     "@capacitor-community/in-app-review": "8.0.0",
     "@capacitor-community/screen-brightness": "8.0.0",
-    "@capacitor/app": "8.0.1",
+    "@capacitor/app": "8.1.1",
-    "@capacitor/browser": "8.0.2",
+    "@capacitor/browser": "8.0.4",
     "@capacitor/clipboard": "8.0.1",
-    "@capacitor/core": "8.2.0",
+    "@capacitor/core": "8.5.2",
-    "@capacitor/device": "8.0.1",
+    "@capacitor/device": "8.0.3",
     "@capacitor/dialog": "8.0.1",
-    "@capacitor/filesystem": "8.1.2",
+    "@capacitor/filesystem": "8.1.3",
-    "@capacitor/geolocation": "8.1.0",
+    "@capacitor/geolocation": "8.2.2",
-    "@capacitor/haptics": "8.0.1",
+    "@capacitor/haptics": "8.0.2",
-    "@capacitor/keyboard": "8.0.1",
+    "@capacitor/keyboard": "8.0.5",
-    "@capacitor/local-notifications": "8.0.2",
+    "@capacitor/local-notifications": "8.3.1",
     "@capacitor/network": "8.0.1",
     "@capacitor/preferences": "8.0.1",
     "@capacitor/screen-orientation": "8.0.1",
-    "@capacitor/share": "8.0.1",
+    "@capacitor/share": "8.0.2",
-    "@capacitor/splash-screen": "8.0.1",
+    "@capacitor/splash-screen": "8.0.2",
-    "@ionic/angular": "8.7.16",
+    "@ionic/angular": "8.8.19",
-    "@ionic/angular-server": "8.7.16",
+    "@ionic/angular-server": "8.8.19",
     "@ionic/storage-angular": "4.0.0",
-    "@maplibre/ngx-maplibre-gl": "17.4.1",
+    "@maplibre/ngx-maplibre-gl": "22.1.0",
     "@ngx-translate/core": "15.0.0",
     "@ngx-translate/http-loader": "8.0.0",
-    "@openid/appauth": "1.3.2",
+    "@openid/appauth": "1.4.0",
     "@openstapps/api": "workspace:*",
     "@openstapps/collection-utils": "workspace:*",
     "@openstapps/core": "workspace:*",
-    "@transistorsoft/capacitor-background-fetch": "8.0.0",
+    "@transistorsoft/capacitor-background-fetch": "8.1.3",
-    "@types/dom-view-transitions": "1.0.4",
+    "@types/dom-view-transitions": "1.0.6",
-    "capacitor-secure-storage-plugin": "0.12.0",
+    "capacitor-secure-storage-plugin": "0.13.0",
     "cordova-plugin-calendar": "5.1.6",
     "date-fns": "3.6.0",
     "deepmerge": "4.3.1",
-    "form-data": "4.0.4",
+    "form-data": "4.0.6",
     "geojson": "0.5.0",
-    "ionic-appauth": "2.1.0",
+    "ionicons": "8.1.0",
-    "ionicons": "8.0.13",
     "jsonpath-plus": "10.3.0",
-    "maplibre-gl": "4.0.2",
+    "maplibre-gl": "6.4.1",
     "material-symbols": "0.17.1",
     "moment": "2.30.1",
     "ngx-date-fns": "11.0.0",
     "ngx-logger": "5.0.12",
-    "ngx-markdown": "17.2.1",
+    "ngx-markdown": "18.1.0",
     "ngx-moment": "6.0.2",
     "opening_hours": "3.8.0",
     "pmtiles": "3.0.3",
     "prettier": "3.1.1",
-    "rxjs": "7.8.1",
+    "rxjs": "7.8.2",
     "semver": "7.6.0",
     "swiper": "8.4.5",
     "tslib": "2.6.2",
-    "zone.js": "0.14.10"
+    "zone.js": "0.16.2"
   },
   "devDependencies": {
-    "@angular-devkit/architect": "0.1802.20",
+    "@angular-devkit/architect": "0.2003.37",
-    "@angular-devkit/build-angular": "18.2.20",
+    "@angular-devkit/build-angular": "20.3.37",
-    "@angular-devkit/core": "18.2.20",
+    "@angular-devkit/core": "20.3.37",
-    "@angular-devkit/schematics": "18.2.20",
+    "@angular-devkit/schematics": "20.3.37",
-    "@angular-eslint/builder": "18.4.3",
+    "@angular-eslint/builder": "20.7.0",
-    "@angular-eslint/eslint-plugin": "18.4.3",
+    "@angular-eslint/eslint-plugin": "20.7.0",
-    "@angular-eslint/eslint-plugin-template": "18.4.3",
+    "@angular-eslint/eslint-plugin-template": "20.7.0",
-    "@angular-eslint/schematics": "18.4.1",
+    "@angular-eslint/schematics": "20.7.0",
-    "@angular-eslint/template-parser": "18.4.3",
+    "@angular-eslint/template-parser": "20.7.0",
-    "@angular/cli": "18.2.20",
+    "@angular/cli": "20.3.37",
-    "@angular/compiler": "18.2.13",
+    "@angular/compiler": "20.3.31",
-    "@angular/compiler-cli": "18.2.13",
+    "@angular/compiler-cli": "20.3.31",
-    "@angular/language-server": "18.2.0",
+    "@angular/language-server": "20.3.0",
-    "@angular/language-service": "18.2.13",
+    "@angular/language-service": "20.3.31",
-    "@angular/platform-browser-dynamic": "18.2.13",
+    "@angular/platform-browser-dynamic": "20.3.31",
-    "@capacitor/android": "8.2.0",
+    "@capacitor/android": "8.5.2",
     "@capacitor/assets": "3.0.5",
-    "@capacitor/cli": "8.2.0",
+    "@capacitor/cli": "8.5.2",
-    "@capacitor/ios": "8.2.0",
+    "@capacitor/ios": "8.5.2",
-    "@compodoc/compodoc": "1.1.23",
+    "@compodoc/compodoc": "1.2.1",
     "@cypress/schematic": "4.1.1",
     "@ionic/angular-toolkit": "12.3.0",
     "@ionic/cli": "7.2.1",
     "@openstapps/prettier-config": "workspace:*",
     "@openstapps/tsconfig": "workspace:*",
-    "@types/fontkit": "2.0.7",
+    "@stylistic/eslint-plugin": "5.10.0",
+    "@types/fontkit": "2.0.9",
     "@types/geojson": "1.0.6",
     "@types/glob": "8.1.0",
     "@types/jasmine": "5.1.4",
     "@types/jasminewd2": "2.0.13",
     "@types/jsonpath": "0.2.0",
-    "@types/karma": "6.3.8",
+    "@types/karma": "6.3.9",
     "@types/karma-coverage": "2.0.3",
     "@types/karma-jasmine": "4.0.5",
     "@types/node": "22.15.31",
     "@types/semver": "7.5.8",
-    "@typescript-eslint/eslint-plugin": "7.11.0",
+    "@typescript-eslint/eslint-plugin": "8.39.1",
-    "@typescript-eslint/parser": "7.11.0",
+    "@typescript-eslint/parser": "8.39.1",
     "cordova-res": "0.15.4",
     "cypress": "15.0.0",
     "eslint": "8.57.0",
@@ -158,28 +158,28 @@
     "eslint-plugin-prettier": "5.1.3",
     "eslint-plugin-unicorn": "51.0.1",
     "fast-deep-equal": "3.1.3",
-    "fontkit": "2.0.2",
+    "fontkit": "2.0.4",
     "glob": "10.5.0",
     "http-server": "14.1.1",
     "is-docker": "2.2.1",
     "jasmine-core": "5.1.2",
     "jasmine-spec-reporter": "7.0.0",
     "junit-report-merger": "6.0.3",
-    "karma": "6.4.3",
+    "karma": "6.4.4",
     "karma-chrome-launcher": "3.2.0",
     "karma-coverage": "2.2.1",
     "karma-jasmine": "5.1.0",
     "karma-junit-reporter": "2.0.1",
     "karma-mocha-reporter": "2.2.5",
     "license-checker": "25.0.1",
-    "stylelint": "16.3.1",
+    "stylelint": "17.14.1",
-    "stylelint-config-clean-order": "5.4.1",
+    "stylelint-config-clean-order": "10.0.0",
     "stylelint-config-prettier-scss": "1.0.0",
-    "stylelint-config-recommended-scss": "14.0.0",
+    "stylelint-config-recommended-scss": "17.0.1",
-    "stylelint-config-standard-scss": "13.0.0",
+    "stylelint-config-standard-scss": "17.0.0",
     "surge": "0.23.1",
     "ts-node": "10.9.2",
-    "typescript": "5.4.2"
+    "typescript": "5.9.3"
   },
   "cordova": {
     "plugins": {},

frontend/app/src/app/_helpers/data/sample-configuration.ts

@@ -73,7 +73,6 @@ export const sampleAggregations: SCBackendAggregationConfiguration[] = [
 
 export const sampleAuthConfiguration: {
   default: SCAuthorizationProvider;
-  paia: SCAuthorizationProvider;
 } = {
   default: {
     client: {clientId: '', scopes: '', url: ''},
@@ -84,15 +83,6 @@ export const sampleAuthConfiguration: {
       userinfo: '',
     },
   },
-  paia: {
-    client: {clientId: '', scopes: '', url: ''},
-    endpoints: {
-      authorization: '',
-      mapping: {id: '', name: ''},
-      token: '',
-      userinfo: '',
-    },
-  },
 };
 
 export const sampleDefaultPolygon: Polygon = {

frontend/app/src/app/_helpers/data/sample-things.ts

@@ -13,7 +13,7 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 import {HttpClient} from '@angular/common/http';
-import {Injectable} from '@angular/core';
+import {Injectable, inject} from '@angular/core';
 import {
   SCAcademicEvent,
   SCArticle,
@@ -395,7 +395,9 @@ export class SampleThings {
    */
   http: HttpClient;
 
-  constructor(http: HttpClient) {
+  constructor() {
+    const http = inject(HttpClient);
+
     this.http = http;
   }
 

frontend/app/src/app/_helpers/service-handler.interceptor.ts

@@ -13,7 +13,7 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {Injectable} from '@angular/core';
+import {Injectable, inject} from '@angular/core';
 import {HttpRequest, HttpHandler, HttpEvent, HttpInterceptor, HttpErrorResponse} from '@angular/common/http';
 import {Observable, throwError} from 'rxjs';
 import {NGXLogger} from 'ngx-logger';
@@ -21,7 +21,7 @@ import {catchError} from 'rxjs/operators';
 
 @Injectable()
 export class ServiceHandlerInterceptor implements HttpInterceptor {
-  constructor(private readonly logger: NGXLogger) {}
+  private readonly logger = inject(NGXLogger);
 
   intercept(request: HttpRequest<unknown>, next: HttpHandler): Observable<HttpEvent<unknown>> {
     return next.handle(request).pipe(

frontend/app/src/app/animation/fab-expand.ts

@@ -18,7 +18,11 @@ import {AnimationOptions} from '@ionic/angular/common/providers/nav-controller';
 import {iosDuration, iosEasing, mdDuration, mdEasing} from './easings';
 
 /**
- *
+ * Creates the page transition used when opening a page via a FAB: the FAB grows
+ * towards the screen while the new page fades in on top of it. Going back, the
+ * page fades out and reveals the previous page beneath it.
+ * @param animationController Ionic animation controller used to build the animation
+ * @returns animation builder to pass to `[routerAnimation]`
  */
 export function fabExpand(animationController: AnimationController): AnimationBuilder {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -37,18 +41,11 @@ export function fabExpand(animationController: AnimationController): AnimationBu
 
     const useReducedMotion = viewBounds.width > 500;
     const reducedMotionTransform = `${Math.min(viewBounds.width * 0.3, 200)}px`;
-    const reducedMotionViewBorderRadius = '128px';
     const reducedMotionFabGrow = '2';
-    const reducedMotionViewShrink = '0.9';
 
     const viewCenterX = (viewBounds.width - viewBounds.x) / 2;
     const viewCenterY = (viewBounds.height - viewBounds.y) / 2;
 
-    const viewOnFab = useReducedMotion
-      ? `translate(${reducedMotionTransform}, ${reducedMotionTransform}) scale(${reducedMotionViewShrink})`
-      : `translate(${(fabBounds.x - viewBounds.x) / 2}px, ${(fabBounds.y - viewBounds.y) / 2}px) scale(${
-          fabBounds.width / viewBounds.width
-        }, ${fabBounds.height / viewBounds.height})`;
     const fabOnView = useReducedMotion
       ? `translate(-${reducedMotionTransform}, -${reducedMotionTransform}) scale(${reducedMotionFabGrow})`
       : `translate(${viewCenterX - fabBounds.x}px, ${viewCenterY - fabBounds.y}px) scale(${
@@ -56,8 +53,6 @@ export function fabExpand(animationController: AnimationController): AnimationBu
         }, ${viewBounds.height / fabBounds.height})`;
     const transformNormal = `translate(0px, 0px) scale(1, 1)`;
 
-    const viewBorderRadius = useReducedMotion ? reducedMotionViewBorderRadius : '50%';
-
     const fabViewFade = animationController
       .create()
       .beforeStyles({zIndex: -1})
@@ -69,13 +64,12 @@ export function fabExpand(animationController: AnimationController): AnimationBu
       .fromTo('transform', back ? fabOnView : transformNormal, back ? transformNormal : fabOnView)
       .fromTo('opacity', back ? '0' : '1', back ? '1' : '0')
       .fromTo('borderRadius', back ? '0' : '50%', back ? '50%' : '0')
-      .addElement(fab);
+      .addElement(back ? [] : fab);
     const viewGrow = animationController
       .create()
       .beforeStyles({zIndex: 200, overflow: 'hidden', transformOrigin: 'center'})
-      .fromTo('transform', back ? transformNormal : viewOnFab, back ? viewOnFab : transformNormal)
       .fromTo('opacity', back ? '1' : '0', back ? '0' : '1')
-      .fromTo('borderRadius', back ? '0' : viewBorderRadius, back ? viewBorderRadius : '0')
+      .afterStyles(back ? {display: 'none'} : {})
       .addElement(otherView);
 
     return rootTransition.addAnimation(fabGrow).addAnimation(viewGrow).addAnimation(fabViewFade);

frontend/app/src/app/app-routing.module.ts

@@ -26,6 +26,7 @@ const routes: Routes = [{path: '', redirectTo: '/overview', pathMatch: 'full'}];
     RouterModule.forRoot(routes, {
       preloadingStrategy: PreloadAllModules,
       errorHandler: error => {
+        console.error(error);
         // Handle unknown routes, at the moment this can only be done via window.location
         if (error.message.includes('Cannot match any routes')) {
           window.location.href = '/overview';

frontend/app/src/app/app.component.spec.ts

@@ -72,6 +72,7 @@ describe('AppComponent', () => {
     configProvider.getAnyValue = jasmine.createSpy().and.callFake(function () {
       return sampleAuthConfiguration;
     });
+    inAppReviewProvider = jasmine.createSpyObj('InAppReviewProvider', ['init']);
     ngxLogger = jasmine.createSpyObj('NGXLogger', ['log', 'error', 'warn']);
     storageProvider = jasmine.createSpyObj('StorageProvider', ['init', 'get', 'has', 'put']);
     simpleBrowser = jasmine.createSpyObj('SimpleBrowser', ['open']);
@@ -108,11 +109,5 @@ describe('AppComponent', () => {
   it('should initialize the app', async () => {
     TestBed.createComponent(AppComponent);
     expect(platformSpy.ready).toHaveBeenCalled();
-    // await platformReadySpy;
-
-    // TODO: https://capacitorjs.com/docs/guides/mocking-plugins
-    // expect(splashScreenSpy.hide).toHaveBeenCalled();
   });
-
-  // TODO: add more tests!
 });

frontend/app/src/app/app.component.ts

@@ -12,28 +12,51 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {AfterContentInit, Component, NgZone} from '@angular/core';
+import {AfterContentInit, Component, NgZone, inject} from '@angular/core';
 import {Router} from '@angular/router';
 import {App, URLOpenListenerEvent} from '@capacitor/app';
 import {Platform, ToastController} from '@ionic/angular/standalone';
 import {SettingsProvider} from './modules/settings/settings.provider';
 import {InAppReviewProvider} from './modules/settings/in-app-review/in-app-review.provider';
-import {AuthHelperService} from './modules/auth/auth-helper.service';
+import {AuthActions, AuthProvider} from './modules/auth/auth.provider';
 import {environment} from '../environments/environment';
 import {Capacitor} from '@capacitor/core';
 import {ScheduleSyncService} from './modules/background/schedule/schedule-sync.service';
 import {Keyboard, KeyboardResize} from '@capacitor/keyboard';
 import {AppVersionService} from './modules/about/app-version.service';
 import {SplashScreen} from '@capacitor/splash-screen';
+import {AuthHelperService} from './modules/auth/auth-helper.service';
 
 /**
- * TODO
+ * Root component of the application responsible for global initializations,
+ * deep linking, splash screen management, and global event bindings.
  */
 @Component({
   selector: 'app-root',
   templateUrl: 'app.component.html',
+  standalone: false,
 })
 export class AppComponent implements AfterContentInit {
+  private readonly platform = inject(Platform);
+
+  private readonly settingsProvider = inject(SettingsProvider);
+
+  private readonly inAppReviewProvider = inject(InAppReviewProvider);
+
+  private readonly router = inject(Router);
+
+  private readonly zone = inject(NgZone);
+
+  private readonly authProvider = inject(AuthProvider);
+
+  private readonly authHelper = inject(AuthHelperService);
+
+  private readonly toastController = inject(ToastController);
+
+  private readonly scheduleSyncService = inject(ScheduleSyncService);
+
+  private readonly versionService = inject(AppVersionService);
+
   /**
    * TODO
    */
@@ -53,17 +76,7 @@ export class AppComponent implements AfterContentInit {
    */
   ommitedEventSources = ['ion-input', 'ion-searchbar'];
 
-  constructor(
+  constructor() {
-    private readonly platform: Platform,
-    private readonly settingsProvider: SettingsProvider,
-    private readonly inAppReviewProvider: InAppReviewProvider,
-    private readonly router: Router,
-    private readonly zone: NgZone,
-    private readonly authHelper: AuthHelperService,
-    private readonly toastController: ToastController,
-    private readonly scheduleSyncService: ScheduleSyncService,
-    private readonly versionService: AppVersionService,
-  ) {
     void this.initializeApp();
   }
 
@@ -120,22 +133,21 @@ export class AppComponent implements AfterContentInit {
   }
 
   private async authNotificationsInit() {
-    this.authHelper
+    this.authProvider.events$.subscribe(action => {
-      .getProvider('default')
+      const isWarning = action.action === AuthActions.SessionExpired;
-      .events$.subscribe(action => this.showMessage(this.authHelper.getAuthMessage('default', action)));
+
-    this.authHelper
+      void this.showMessage(this.authHelper.getAuthMessage(action), isWarning ? 'warning' : 'success');
-      .getProvider('paia')
+    });
-      .events$.subscribe(action => this.showMessage(this.authHelper.getAuthMessage('paia', action)));
   }
 
-  private async showMessage(message?: string) {
+  private async showMessage(message: string | undefined, color: 'success' | 'warning' = 'success') {
     if (message === undefined) {
       return;
     }
     const toast = await this.toastController.create({
       message: message,
-      duration: 2000,
+      duration: color === 'warning' ? 4000 : 2000,
-      color: 'success',
+      color,
     });
     await toast.present();
   }

frontend/app/src/app/app.module.ts

@@ -15,7 +15,7 @@
 import {CommonModule, LocationStrategy, PathLocationStrategy, registerLocaleData} from '@angular/common';
 import {HTTP_INTERCEPTORS, HttpClient, provideHttpClient, withInterceptorsFromDi} from '@angular/common/http';
 import localeDe from '@angular/common/locales/de';
-import {APP_INITIALIZER, NgModule} from '@angular/core';
+import {APP_INITIALIZER, NgModule, inject} from '@angular/core';
 import {BrowserModule} from '@angular/platform-browser';
 import {RouteReuseStrategy} from '@angular/router';
 import {IonicRouteStrategy, Platform, provideIonicAngular, IonApp} from '@ionic/angular/standalone';
@@ -33,7 +33,6 @@ import {CatalogModule} from './modules/catalog/catalog.module';
 import {ConfigProvider} from './modules/config/config.provider';
 import {DashboardModule} from './modules/dashboard/dashboard.module';
 import {DataModule} from './modules/data/data.module';
-import {HebisModule} from './modules/hebis/hebis.module';
 import {MapModule} from './modules/map/map.module';
 import {MenuModule} from './modules/menu/menu.module';
 import {NewsModule} from './modules/news/news.module';
@@ -53,14 +52,11 @@ import {FeedbackModule} from './modules/feedback/feedback.module';
 import {DebugDataCollectorService} from './modules/data/debug-data-collector.service';
 import {AuthModule} from './modules/auth/auth.module';
 import {BackgroundModule} from './modules/background/background.module';
-import {LibraryModule} from './modules/library/library.module';
 import {StorageProvider} from './modules/storage/storage.provider';
 import {AssessmentsModule} from './modules/assessments/assessments.module';
 import {ServiceHandlerInterceptor} from './_helpers/service-handler.interceptor';
 import {RoutingStackService} from './util/routing-stack.service';
 import {SCLanguageCode, SCSettingValue} from '@openstapps/core';
-import {DefaultAuthService} from './modules/auth/default-auth.service';
-import {PAIAAuthService} from './modules/auth/paia/paia-auth.service';
 import {NavigationModule} from './modules/menu/navigation/navigation.module';
 import {browserFactory, SimpleBrowser} from './util/browser.factory';
 import {getDateFnsLocale} from './translation/dfns-locale';
@@ -68,8 +64,9 @@ import {setDefaultOptions} from 'date-fns';
 import {DateFnsConfigurationService} from 'ngx-date-fns';
 import {Capacitor} from '@capacitor/core';
 import {SplashScreen} from '@capacitor/splash-screen';
-import maplibregl from 'maplibre-gl';
+import * as maplibregl from 'maplibre-gl';
 import {Protocol} from 'pmtiles';
+import {AuthProvider} from './modules/auth/auth.provider';
 
 registerLocaleData(localeDe);
 
@@ -85,12 +82,12 @@ export function initializerFactory(
   configProvider: ConfigProvider,
   translateService: TranslateService,
   _routingStackService: RoutingStackService,
-  defaultAuthService: DefaultAuthService,
+  authProvider: AuthProvider,
-  paiaAuthService: PAIAAuthService,
   dateFnsConfigurationService: DateFnsConfigurationService,
 ) {
   return async () => {
     try {
+      maplibregl.setWorkerUrl(new URL('maplibre-gl-worker.mjs', document.baseURI).href);
       maplibregl.addProtocol('pmtiles', new Protocol().tile);
       initLogger(logger);
       await storageProvider.init();
@@ -114,8 +111,7 @@ export function initializerFactory(
         setDefaultOptions({locale: dateFnsLocale});
         dateFnsConfigurationService.setLocale(dateFnsLocale);
 
-        await defaultAuthService.init();
+        await authProvider.init();
-        await paiaAuthService.init();
       } catch (error) {
         logger.warn(error);
       }
@@ -154,10 +150,8 @@ export function createTranslateLoader(http: HttpClient) {
     CommonModule,
     DashboardModule,
     DataModule,
-    HebisModule,
     JobModule,
     FavoritesModule,
-    LibraryModule,
     ProfilePageModule,
     FeedbackModule,
     MapModule,
@@ -207,8 +201,7 @@ export function createTranslateLoader(http: HttpClient) {
         ConfigProvider,
         TranslateService,
         RoutingStackService,
-        DefaultAuthService,
+        AuthProvider,
-        PAIAAuthService,
         DateFnsConfigurationService,
       ],
       useFactory: initializerFactory,
@@ -223,5 +216,5 @@ export function createTranslateLoader(http: HttpClient) {
   ],
 })
 export class AppModule {
-  constructor(public debugDataCollectorService: DebugDataCollectorService) {}
+  debugDataCollectorService = inject(DebugDataCollectorService);
 }

frontend/app/src/app/modules/about/about-changelog.component.ts

@@ -21,6 +21,7 @@ import {ConfigProvider} from '../config/config.provider';
   templateUrl: 'about-changelog.html',
   styleUrls: ['about-changelog.scss', './about-page/about-page.scss', 'release-notes-markdown.scss'],
   changeDetection: ChangeDetectionStrategy.OnPush,
+  standalone: false,
 })
 export class AboutChangelogComponent {
   config = inject(ConfigProvider);

frontend/app/src/app/modules/about/about-license-modal.component.ts

@@ -20,6 +20,7 @@ import {License} from './about-licenses.component';
   selector: 'about-license-modal',
   templateUrl: 'about-license-modal.html',
   styleUrls: ['about-license-modal.scss'],
+  standalone: false,
 })
 export class AboutLicenseModalComponent {
   @Input() license: License;

frontend/app/src/app/modules/about/about-licenses.component.ts

@@ -12,7 +12,7 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {Component, OnInit} from '@angular/core';
+import {Component, OnInit, inject} from '@angular/core';
 import {ModalController} from '@ionic/angular/standalone';
 import {AboutLicenseModalComponent} from './about-license-modal.component';
 import licensesFile from 'src/assets/about/licenses.json';
@@ -32,11 +32,12 @@ export interface License {
   selector: 'about-changelog',
   templateUrl: 'about-licenses.html',
   styleUrls: ['about-licenses.scss', './about-page/about-page.scss'],
+  standalone: false,
 })
 export class AboutLicensesComponent implements OnInit {
-  licenses: License[];
+  private modalController = inject(ModalController);
 
-  constructor(private modalController: ModalController) {}
+  licenses: License[];
 
   ngOnInit() {
     this.licenses = this.loadLicenses();

frontend/app/src/app/modules/about/about-page/about-page-content.component.ts

@@ -19,6 +19,7 @@ import {SCAboutPageContent} from '@openstapps/core';
   selector: 'about-page-content',
   templateUrl: 'about-page-content.html',
   styleUrls: ['about-page-content.scss'],
+  standalone: false,
 })
 export class AboutPageContentComponent {
   @Input() content: SCAboutPageContent;

frontend/app/src/app/modules/about/about-page/about-page.component.ts

@@ -12,7 +12,7 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {Component, OnInit} from '@angular/core';
+import {Component, OnInit, inject} from '@angular/core';
 import {ActivatedRoute} from '@angular/router';
 import {SCAboutPage, SCAppConfiguration} from '@openstapps/core';
 import {ConfigProvider} from '../../config/config.provider';
@@ -25,8 +25,13 @@ import {Capacitor} from '@capacitor/core';
   selector: 'about-page',
   templateUrl: 'about-page.html',
   styleUrls: ['about-page.scss'],
+  standalone: false,
 })
 export class AboutPageComponent implements OnInit {
+  private readonly route = inject(ActivatedRoute);
+
+  private readonly configProvider = inject(ConfigProvider);
+
   content: SCAboutPage;
 
   name = config.appName;
@@ -35,11 +40,6 @@ export class AboutPageComponent implements OnInit {
 
   version: string;
 
-  constructor(
-    private readonly route: ActivatedRoute,
-    private readonly configProvider: ConfigProvider,
-  ) {}
-
   async ngOnInit() {
     const route = this.route.snapshot.url.map(it => it.path).join('/');
     this.content =

frontend/app/src/app/modules/about/about-page/about-page.scss

@@ -12,7 +12,7 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-@import '../../../../theme/util/mixins';
+@use '../../../../theme/util/mixins';
 
 ion-text {
   margin-inline: var(--spacing-md);
@@ -64,7 +64,7 @@ ion-text {
   .about-changelog,
   .licenses-content,
   .page-content {
-    @include border-radius-in-parallax(var(--border-radius-default));
+    @include mixins.border-radius-in-parallax(var(--border-radius-default));
 
     display: flex;
     flex-direction: column;
@@ -76,7 +76,7 @@ ion-text {
     background: var(--ion-item-background);
 
     & > * {
-      @include border-radius-in-parallax(var(--border-radius-default));
+      @include mixins.border-radius-in-parallax(var(--border-radius-default));
 
       position: relative;
       overflow: hidden;

frontend/app/src/app/modules/about/about-release-notes.component.ts

@@ -21,6 +21,7 @@ import {ConfigProvider} from '../config/config.provider';
   templateUrl: 'about-release-notes.html',
   styleUrls: ['about-release-notes.scss', './about-page/about-page.scss', 'release-notes-markdown.scss'],
   changeDetection: ChangeDetectionStrategy.OnPush,
+  standalone: false,
 })
 export class AboutReleaseNotesComponent {
   config = inject(ConfigProvider);

frontend/app/src/app/modules/about/about-release-notes.scss

@@ -12,7 +12,7 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-@import '../../../theme/util/mixins';
+@use '../../../theme/util/mixins';
 
 ion-button {
   --color: var(--ion-color-primary-contrast);
@@ -22,7 +22,7 @@ ion-button {
 }
 
 .release-notes {
-  @include border-radius-in-parallax(var(--border-radius-default));
+  @include mixins.border-radius-in-parallax(var(--border-radius-default));
 
   display: block;
   margin: var(--spacing-md);

frontend/app/src/app/modules/about/app-version.service.ts

@@ -1,4 +1,4 @@
-import {Injectable} from '@angular/core';
+import {Injectable, inject} from '@angular/core';
 import {StorageProvider} from '../storage/storage.provider';
 import {ConfigProvider} from '../config/config.provider';
 import {ModalController} from '@ionic/angular/standalone';
@@ -12,11 +12,11 @@ export const RELEASE_NOTES_SHOWN_KEY = 'release_notes_shown';
 
 @Injectable({providedIn: 'root'})
 export class AppVersionService {
-  constructor(
+  private storage = inject(StorageProvider);
-    private storage: StorageProvider,
+
-    private config: ConfigProvider,
+  private config = inject(ConfigProvider);
-    private modalController: ModalController,
+
-  ) {}
+  private modalController = inject(ModalController);
 
   /**
    * Get the latest release notes that have not been presented yet

frontend/app/src/app/modules/about/release-notes-markdown.scss

@@ -1,7 +1,3 @@
-.release-notes {
-  max-width: 16cm;
-}
-
 .release-notes ::ng-deep {
   h1 {
     font-size: 1.5em;
@@ -20,7 +16,7 @@
   }
 
   blockquote {
-    background: var(--ion-item-background);
     border-left: 0.25em solid var(--ion-color-medium);
+    background: var(--ion-item-background);
   }
 }

frontend/app/src/app/modules/about/release-notes.component.ts

@@ -1,4 +1,4 @@
-import {ChangeDetectionStrategy, Component, Input} from '@angular/core';
+import {ChangeDetectionStrategy, Component, Input, inject} from '@angular/core';
 import {SCAppVersionInfo} from '@openstapps/core';
 import {MarkdownModule} from 'ngx-markdown';
 import {ThingTranslateModule} from '../../translation/thing-translate.module';
@@ -17,7 +17,6 @@ import {UtilModule} from '../../util/util.module';
   selector: 'stapps-release-notes',
   templateUrl: 'release-notes.html',
   styleUrls: ['release-notes.scss', 'release-notes-markdown.scss'],
-  standalone: true,
   changeDetection: ChangeDetectionStrategy.OnPush,
   imports: [
     UtilModule,
@@ -32,7 +31,7 @@ import {UtilModule} from '../../util/util.module';
   ],
 })
 export class ReleaseNotesComponent {
-  @Input() versionInfos: SCAppVersionInfo[];
+  readonly modalController = inject(ModalController);
 
-  constructor(readonly modalController: ModalController) {}
+  @Input() versionInfos: SCAppVersionInfo[];
 }

frontend/app/src/app/modules/about/release-notes.scss

@@ -1,11 +1,11 @@
-@import '../../../theme/util/mixins';
+@use '../../../theme/util/mixins';
 
 ion-title {
   padding-block: var(--spacing-md);
 }
 
 .content-card {
-  @include border-radius-in-parallax(var(--border-radius-default));
+  @include mixins.border-radius-in-parallax(var(--border-radius-default));
 
   display: block;
   margin: var(--spacing-md);

frontend/app/src/app/modules/assessments/assessments.provider.ts

@@ -12,12 +12,12 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {Injectable} from '@angular/core';
+import {Injectable, inject} from '@angular/core';
 import {ConfigProvider} from '../config/config.provider';
 import {SCAssessment, SCUuid} from '@openstapps/core';
-import {DefaultAuthService} from '../auth/default-auth.service';
 import {HttpClient} from '@angular/common/http';
 import {uniqBy, keyBy} from '@openstapps/collection-utils';
+import {AuthProvider} from '../auth/auth.provider';
 
 /**
  *
@@ -51,6 +51,12 @@ export function toAssessmentMap(data: SCAssessment[]): Record<SCUuid, SCAssessme
   providedIn: 'root',
 })
 export class AssessmentsProvider {
+  readonly configProvider = inject(ConfigProvider);
+
+  readonly authProvider = inject(AuthProvider);
+
+  readonly http = inject(HttpClient);
+
   assessmentPath = 'assessments';
 
   // usually this wouldn't be necessary, but the assessment service
@@ -64,12 +70,6 @@ export class AssessmentsProvider {
   // 15 minutes
   cacheMaxAge = 15 * 60 * 1000;
 
-  constructor(
-    readonly configProvider: ConfigProvider,
-    readonly defaultAuth: DefaultAuthService,
-    readonly http: HttpClient,
-  ) {}
-
   async getAssessment(uid: SCUuid, accessToken?: string | null, forceFetch = false): Promise<SCAssessment> {
     await this.getAssessments(accessToken, forceFetch);
 
@@ -97,7 +97,7 @@ export class AssessmentsProvider {
     this.cache = this.http
       .get<{data: SCAssessment[]}>(`${url}/${this.assessmentPath}`, {
         headers: {
-          Authorization: `Bearer ${accessToken ?? (await this.defaultAuth.getValidToken()).accessToken}`,
+          Authorization: `Bearer ${accessToken ?? (await this.authProvider.getValidToken()).accessToken}`,
         },
       })
       .toPromise()

frontend/app/src/app/modules/assessments/detail/assessments-detail.component.ts

@@ -26,17 +26,20 @@ import {takeUntilDestroyed} from '@angular/core/rxjs-interop';
   selector: 'assessments-detail',
   templateUrl: 'assessments-detail.html',
   styleUrls: ['assessments-detail.scss'],
+  standalone: false,
 })
 export class AssessmentsDetailComponent implements OnInit {
-  destroy$ = inject(DestroyRef);
+  readonly route = inject(ActivatedRoute);
 
-  constructor(
+  readonly assessmentsProvider = inject(AssessmentsProvider);
-    readonly route: ActivatedRoute,
+
-    readonly assessmentsProvider: AssessmentsProvider,
+  readonly dataRoutingService = inject(DataRoutingService);
-    readonly dataRoutingService: DataRoutingService,
+
-    readonly navController: NavController,
+  readonly navController = inject(NavController);
-    readonly activatedRoute: ActivatedRoute,
+
-  ) {}
+  readonly activatedRoute = inject(ActivatedRoute);
+
+  destroy$ = inject(DestroyRef);
 
   @Input() dataPathAutoRouting = true;
 

frontend/app/src/app/modules/assessments/list/assessments-data-list.component.ts

@@ -21,6 +21,7 @@ import {Observable} from 'rxjs';
   selector: 'assessments-data-list',
   templateUrl: './assessments-data-list.html',
   styleUrls: ['./assessments-data-list.scss'],
+  standalone: false,
 })
 export class AssessmentsDataListComponent {
   /**

frontend/app/src/app/modules/assessments/list/assessments-list-item.component.ts

@@ -20,6 +20,7 @@ import {SCThings} from '@openstapps/core';
   selector: 'assessments-list-item',
   templateUrl: 'assessments-list-item.html',
   styleUrls: ['assessments-list-item.scss'],
+  standalone: false,
 })
 export class AssessmentsListItemComponent {
   /**

frontend/app/src/app/modules/assessments/list/assessments-simple-data-list.component.ts

@@ -23,8 +23,15 @@ import {takeUntilDestroyed} from '@angular/core/rxjs-interop';
   selector: 'assessments-simple-data-list',
   templateUrl: 'assessments-simple-data-list.html',
   styleUrls: ['assessments-simple-data-list.scss'],
+  standalone: false,
 })
 export class AssessmentsSimpleDataListComponent implements OnInit {
+  readonly dataRoutingService = inject(DataRoutingService);
+
+  readonly router = inject(Router);
+
+  readonly activatedRoute = inject(ActivatedRoute);
+
   /**
    * All SCThings to display
    */
@@ -46,12 +53,6 @@ export class AssessmentsSimpleDataListComponent implements OnInit {
 
   destroy$ = inject(DestroyRef);
 
-  constructor(
-    readonly dataRoutingService: DataRoutingService,
-    readonly router: Router,
-    readonly activatedRoute: ActivatedRoute,
-  ) {}
-
   ngOnInit() {
     this.dataRoutingService
       .itemSelectListener()

frontend/app/src/app/modules/assessments/list/assessments-tree-list.component.ts

@@ -20,6 +20,7 @@ import {SCThings} from '@openstapps/core';
   selector: 'assessments-tree-list',
   templateUrl: 'assessments-tree-list.html',
   styleUrls: ['assessments-tree-list.scss'],
+  standalone: false,
 })
 export class AssessmentsTreeListComponent {
   @Input() items?: Promise<SCThings[] | undefined>;

frontend/app/src/app/modules/assessments/page/assessments-page.component.ts

@@ -29,8 +29,21 @@ import {takeUntilDestroyed} from '@angular/core/rxjs-interop';
   templateUrl: 'assessments-page.html',
   styleUrls: ['assessments-page.scss'],
   animations: [materialSharedAxisX],
+  standalone: false,
 })
 export class AssessmentsPageComponent implements OnInit, AfterViewInit {
+  readonly logger = inject(NGXLogger);
+
+  readonly assessmentsProvider = inject(AssessmentsProvider);
+
+  readonly dataProvider = inject(DataProvider);
+
+  readonly activatedRoute = inject(ActivatedRoute);
+
+  readonly dataRoutingService = inject(DataRoutingService);
+
+  readonly router = inject(Router);
+
   assessments: Promise<
     Record<
       string,
@@ -49,15 +62,6 @@ export class AssessmentsPageComponent implements OnInit, AfterViewInit {
 
   destroy$ = inject(DestroyRef);
 
-  constructor(
-    readonly logger: NGXLogger,
-    readonly assessmentsProvider: AssessmentsProvider,
-    readonly dataProvider: DataProvider,
-    readonly activatedRoute: ActivatedRoute,
-    readonly dataRoutingService: DataRoutingService,
-    readonly router: Router,
-  ) {}
-
   ngAfterViewInit() {
     this.segmentView.value = this.sharedAxisChoreographer.currentValue;
   }

frontend/app/src/app/modules/assessments/types/assessment/assessment-base-info.component.ts

@@ -20,6 +20,7 @@ import {SCAssessment} from '@openstapps/core';
   selector: 'assessment-base-info',
   templateUrl: 'assessment-base-info.html',
   styleUrls: ['assessment-base-info.scss'],
+  standalone: false,
 })
 export class AssessmentBaseInfoComponent {
   _item: SCAssessment;

frontend/app/src/app/modules/assessments/types/assessment/assessment-detail.component.ts

@@ -20,6 +20,7 @@ import {SCAssessment} from '@openstapps/core';
   selector: 'assessment-detail',
   templateUrl: 'assessment-detail.html',
   styleUrls: ['assessment-detail.scss'],
+  standalone: false,
 })
 export class AssessmentDetailComponent {
   @Input() item: SCAssessment;

frontend/app/src/app/modules/assessments/types/assessment/assessment-list-item.component.ts

@@ -20,6 +20,7 @@ import {SCAssessment} from '@openstapps/core';
   selector: 'stapps-assessment-list-item',
   templateUrl: './assessment-list-item.html',
   styleUrls: ['./assessment-list-item.scss'],
+  standalone: false,
 })
 export class AssessmentListItemComponent {
   @Input() item: SCAssessment;

frontend/app/src/app/modules/assessments/types/course-of-study/course-of-study-assessment.component.ts

@@ -20,6 +20,7 @@ import {SCAssessment, SCCourseOfStudyWithoutReferences} from '@openstapps/core';
   selector: 'course-of-study-assessment',
   templateUrl: 'course-of-study-assessment.html',
   styleUrls: ['course-of-study-assessment.scss'],
+  standalone: false,
 })
 export class CourseOfStudyAssessmentComponent {
   @Input() courseOfStudy?: SCCourseOfStudyWithoutReferences | null;

frontend/app/src/app/modules/auth/auth-callback/page/auth-callback-page.component.spec.ts

@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import {TestBed} from '@angular/core/testing';
+import {Router} from '@angular/router';
+import {NavController} from '@ionic/angular/standalone';
+import {Subject} from 'rxjs';
+import {AuthActions, AuthProvider, IAuthAction} from '../../auth.provider';
+import {AuthHelperService} from '../../auth-helper.service';
+import {AuthCallbackPageComponent} from './auth-callback-page.component';
+
+/** Lets pending promise callbacks run. */
+async function flushPromises(): Promise<void> {
+  for (let index = 0; index < 10; index++) {
+    await Promise.resolve();
+  }
+}
+
+/** Creates the page like the router does when the IdP redirects back. */
+function openCallbackPage(): AuthCallbackPageComponent {
+  return TestBed.runInInjectionContext(() => new AuthCallbackPageComponent());
+}
+
+describe('AuthCallbackPageComponent', () => {
+  let events: Subject<IAuthAction>;
+  let authProvider: {events$: Subject<IAuthAction>; authorizationCallback: jasmine.Spy};
+  let authHelper: jasmine.SpyObj<Pick<AuthHelperService, 'getOriginPath' | 'deleteOriginPath'>>;
+  let navController: jasmine.SpyObj<Pick<NavController, 'navigateRoot'>>;
+
+  beforeEach(() => {
+    events = new Subject<IAuthAction>();
+    authProvider = {events$: events, authorizationCallback: jasmine.createSpy('authorizationCallback')};
+
+    authHelper = jasmine.createSpyObj('AuthHelperService', ['getOriginPath', 'deleteOriginPath']);
+    authHelper.deleteOriginPath.and.resolveTo();
+
+    navController = jasmine.createSpyObj('NavController', ['navigateRoot']);
+    navController.navigateRoot.and.resolveTo(true);
+
+    TestBed.configureTestingModule({
+      providers: [
+        {provide: AuthProvider, useValue: authProvider},
+        {provide: AuthHelperService, useValue: authHelper},
+        {provide: NavController, useValue: navController},
+        {provide: Router, useValue: {}},
+      ],
+    });
+  });
+
+  it('hands the callback URL to AuthProvider', () => {
+    openCallbackPage();
+
+    expect(authProvider.authorizationCallback).toHaveBeenCalledOnceWith(window.location.href);
+  });
+
+  it('goes back to the page the login was started from', async () => {
+    authHelper.getOriginPath.and.resolveTo('/assessments');
+    openCallbackPage();
+
+    events.next({action: AuthActions.SignInSuccess});
+    await flushPromises();
+
+    expect(navController.navigateRoot).toHaveBeenCalledOnceWith('/assessments');
+    expect(authHelper.deleteOriginPath).toHaveBeenCalled();
+  });
+
+  it('goes to the profile after login when no origin page is known', async () => {
+    openCallbackPage();
+
+    events.next({action: AuthActions.SignInSuccess});
+    await flushPromises();
+
+    expect(navController.navigateRoot).toHaveBeenCalledOnceWith('profile');
+  });
+
+  it('goes to the profile when the login failed', async () => {
+    openCallbackPage();
+
+    events.next({action: AuthActions.SignInFailed, error: new Error('access_denied')});
+    await flushPromises();
+
+    expect(navController.navigateRoot).toHaveBeenCalledOnceWith('profile');
+    expect(authHelper.getOriginPath).not.toHaveBeenCalled();
+  });
+
+  it('ignores other auth events', async () => {
+    openCallbackPage();
+
+    events.next({action: AuthActions.RefreshSuccess});
+    events.next({action: AuthActions.LoadUserInfoSuccess});
+    await flushPromises();
+
+    expect(navController.navigateRoot).not.toHaveBeenCalled();
+  });
+});

frontend/app/src/app/modules/auth/auth-callback/page/auth-callback-page.component.ts

@@ -12,41 +12,53 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {Component} from '@angular/core';
+import {Component, inject} from '@angular/core';
-import {NavController} from '@ionic/angular/standalone';
 import {Router} from '@angular/router';
-import {AuthActions, IAuthAction} from 'ionic-appauth';
-import {AuthHelperService} from '../../auth-helper.service';
 import {takeUntilDestroyed} from '@angular/core/rxjs-interop';
-import {Observable} from 'rxjs';
+import {NavController} from '@ionic/angular/standalone';
-import {IPAIAAuthAction} from '../../paia/paia-auth-action';
+
-import {DefaultAuthService} from '../../default-auth.service';
+import {AuthActions, AuthProvider, IAuthAction} from '../../auth.provider';
+import {AuthHelperService} from '../../auth-helper.service';
 
 @Component({
   templateUrl: 'auth-callback-page.component.html',
   styleUrls: ['auth-callback-page.component.scss'],
+  standalone: false,
 })
 export class AuthCallbackPageComponent {
-  constructor(
+  private navCtrl = inject(NavController);
-    private navCtrl: NavController,
-    private router: Router,
-    private authHelper: AuthHelperService,
-    private auth: DefaultAuthService,
-  ) {
-    const events: Observable<IPAIAAuthAction | IAuthAction> = this.auth.events$;
 
-    events.pipe(takeUntilDestroyed()).subscribe((action: IAuthAction) => this.postCallback(action));
+  private router = inject(Router);
-    this.auth.authorizationCallback(window.location.origin + this.router.url);
+
+  private authHelper = inject(AuthHelperService);
+
+  private authProvider = inject(AuthProvider);
+
+  constructor() {
+    this.authProvider.events$.pipe(takeUntilDestroyed()).subscribe(action => {
+      void this.postCallback(action);
+    });
+
+    this.authProvider.authorizationCallback(window.location.href);
   }
 
-  async postCallback(action: IAuthAction) {
+  private async postCallback(action: IAuthAction): Promise<void> {
-    if (action.action === AuthActions.SignInSuccess) {
+    switch (action.action) {
-      const originPath = await this.authHelper.getOriginPath();
+      case AuthActions.SignInSuccess: {
-      this.navCtrl.navigateRoot(originPath ?? 'profile');
+        const originPath = await this.authHelper.getOriginPath();
-      this.authHelper.deleteOriginPath();
+
-    }
+        await this.authHelper.deleteOriginPath();
-    if (action.action === AuthActions.SignInFailed) {
+
-      this.navCtrl.navigateRoot('profile');
+        await this.navCtrl.navigateRoot(originPath ?? 'profile');
+
+        break;
+      }
+
+      case AuthActions.SignInFailed: {
+        await this.navCtrl.navigateRoot('profile');
+
+        break;
+      }
     }
   }
 }

frontend/app/src/app/modules/auth/auth-guard.service.ts

@@ -13,19 +13,18 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {Injectable} from '@angular/core';
+import {Injectable, inject} from '@angular/core';
 import {CanActivate, NavigationExtras, Router, RouterStateSnapshot} from '@angular/router';
 import {ActivatedProtectedRouteSnapshot} from './protected.routes';
-import {AuthHelperService} from './auth-helper.service';
+import {AuthProvider} from './auth.provider';
 
 @Injectable({
   providedIn: 'root',
 })
 export class AuthGuardService implements CanActivate {
-  constructor(
+  private authProvider = inject(AuthProvider);
-    private authHelper: AuthHelperService,
+
-    private router: Router,
+  private router = inject(Router);
-  ) {}
 
   public async canActivate(route: ActivatedProtectedRouteSnapshot, _state: RouterStateSnapshot) {
     if (route.queryParamMap.get('token')) {
@@ -33,16 +32,16 @@ export class AuthGuardService implements CanActivate {
     }
 
     try {
-      await this.authHelper.getProvider(route.data.authProvider).getValidToken();
+      await this.authProvider.getValidToken();
     } catch {
-      const originNavigation = this.router.getCurrentNavigation();
+      const originNavigation = this.router.currentNavigation();
       let extras: NavigationExtras = {};
       if (originNavigation) {
         const url = originNavigation.extractedUrl.toString();
         extras = {queryParams: {origin_path: url}};
       }
       this.router.navigate(['profile'], extras);
-      await this.authHelper.getProvider(route.data.authProvider).signIn();
+      await this.authProvider.signIn();
 
       return false;
     }

frontend/app/src/app/modules/auth/auth-helper.service.spec.ts

@@ -1,124 +1,288 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
 import {TestBed} from '@angular/core/testing';
-import {AuthHelperService} from './auth-helper.service';
+import {AlertController} from '@ionic/angular/standalone';
+import {TranslateService} from '@ngx-translate/core';
+
+import {SimpleBrowser} from '../../util/browser.factory';
 import {ConfigProvider} from '../config/config.provider';
 import {StorageProvider} from '../storage/storage.provider';
-import {DefaultAuthService} from './default-auth.service';
+import {AuthActions, AuthProvider} from './auth.provider';
-import {Browser} from 'ionic-appauth';
+import {AuthHelperService} from './auth-helper.service';
-import {Requestor, StorageBackend} from '@openid/appauth';
+
-import {TranslateService} from '@ngx-translate/core';
+const AUTH_ORIGIN_PATH = 'stapps.auth.origin_path';
-import {PAIAAuthService} from './paia/paia-auth.service';
+const AUTH_MESSAGE_PREFIX = 'auth.messages.default';
-import {StAppsWebHttpClient} from '../data/stapps-web-http-client.provider';
+const END_SESSION_ENDPOINT = 'https://idp.example.org/logout';
-import {provideHttpClient, withInterceptorsFromDi} from '@angular/common/http';
+
-import {SimpleBrowser} from '../../util/browser.factory';
+const USER_MAPPING = {
-import {LoggerTestingModule} from 'ngx-logger/testing';
+  id: '$.sub',
+  givenName: '$.given_name',
+  familyName: '$.family_name',
+  email: '$.attributes.mail',
+  role: '$.role',
+};
+
+const DEFAULT_AUTH_CONFIG = {default: {endpoints: {mapping: USER_MAPPING}}};
+
+interface TestAlertButton {
+  text: string;
+  role?: string;
+  cssClass?: string;
+  handler?: () => Promise<void> | void;
+}
+
+interface TestAlertOptions {
+  header: string;
+  message: string;
+  buttons: TestAlertButton[];
+}
 
 describe('AuthHelperService', () => {
-  let authHelperService: AuthHelperService;
+  let service: AuthHelperService;
-  const storageProviderSpy = jasmine.createSpyObj('StorageProvider', ['init', 'get', 'has', 'put', 'search']);
-  const translateServiceSpy = jasmine.createSpyObj('TranslateService', ['setDefaultLang', 'use']);
-  const defaultAuthServiceMock = jasmine.createSpyObj('DefaultAuthService', ['init', 'setupConfiguration']);
-  const paiaAuthServiceMock = jasmine.createSpyObj('PAIAAuthService', ['init', 'setupConfiguration']);
-  const authHelperServiceMock = jasmine.createSpyObj('AuthHelperService', ['constructor']);
-  const simpleBrowserMock = jasmine.createSpyObj('SimpleBrowser', ['open']);
-  const configProvider = jasmine.createSpyObj('ConfigProvider', {
-    getAnyValue: {
-      default: {
-        endpoints: {
-          mapping: {
-            id: '$.id',
-            email: '$.attributes.mailPrimaryAddress',
-            givenName: '$.attributes.givenName',
-            familyName: '$.attributes.sn',
-            name: '$.attributes.sn',
-            role: '$.attributes.eduPersonPrimaryAffiliation',
-            studentId: '$.attributes.employeeNumber',
-          },
-        },
-      },
-    },
-  });
 
-  beforeEach(() => {
+  let translateService: jasmine.SpyObj<{instant(key: string): string}>;
+  let configProvider: jasmine.SpyObj<{getAnyValue(key: string): unknown}>;
+  let storageProvider: jasmine.SpyObj<{
+    get<T>(key: string): Promise<T>;
+    put(key: string, value: unknown): Promise<unknown>;
+    delete(key: string): Promise<unknown>;
+  }>;
+  let authProvider: jasmine.SpyObj<Pick<AuthProvider, 'getEndSessionEndpoint'>>;
+  let browser: jasmine.SpyObj<{open(url: string): Promise<void>}>;
+  let alertController: jasmine.SpyObj<{create(options: unknown): Promise<unknown>}>;
+  let alert: jasmine.SpyObj<{present(): Promise<void>}>;
+
+  /**
+   *
+   */
+  function createService(authConfig: unknown = DEFAULT_AUTH_CONFIG) {
+    configProvider.getAnyValue.and.returnValue(authConfig);
+
+    // AuthHelperService uses inject(), so it has to be created inside an injection context.
+    TestBed.resetTestingModule();
     TestBed.configureTestingModule({
-      imports: [LoggerTestingModule],
       providers: [
-        StAppsWebHttpClient,
+        AuthHelperService,
-        {
+        {provide: TranslateService, useValue: translateService},
-          provide: TranslateService,
+        {provide: ConfigProvider, useValue: configProvider},
-          useValue: translateServiceSpy,
+        {provide: StorageProvider, useValue: storageProvider},
-        },
+        {provide: AuthProvider, useValue: authProvider},
-        {
+        {provide: SimpleBrowser, useValue: browser},
-          provide: StorageProvider,
+        {provide: AlertController, useValue: alertController},
-          useValue: storageProviderSpy,
-        },
-        {
-          provider: DefaultAuthService,
-          useValue: defaultAuthServiceMock,
-        },
-        {
-          provider: PAIAAuthService,
-          useValue: paiaAuthServiceMock,
-        },
-        {
-          provide: ConfigProvider,
-          useValue: configProvider,
-        },
-        Browser,
-        StorageBackend,
-        Requestor,
-        {
-          provider: AuthHelperService,
-          useValue: authHelperServiceMock,
-        },
-        {
-          provide: SimpleBrowser,
-          useValue: simpleBrowserMock,
-        },
-        provideHttpClient(withInterceptorsFromDi()),
       ],
     });
-    authHelperService = TestBed.inject(AuthHelperService);
+
+    return TestBed.inject(AuthHelperService);
+  }
+
+  /** Options passed to the most recent AlertController.create() call. */
+  function lastAlertOptions(): TestAlertOptions {
+    return alertController.create.calls.mostRecent().args[0] as TestAlertOptions;
+  }
+
+  /**
+   *
+   */
+  function alertButton(role: string): TestAlertButton {
+    const button = lastAlertOptions().buttons.find(b => b.role === role);
+    if (!button) {
+      throw new Error(`No alert button with role "${role}"`);
+    }
+    return button;
+  }
+
+  beforeEach(() => {
+    translateService = jasmine.createSpyObj('TranslateService', ['instant']);
+    translateService.instant.and.callFake((key: string) => `translated:${key}`);
+
+    configProvider = jasmine.createSpyObj('ConfigProvider', ['getAnyValue']);
+
+    storageProvider = jasmine.createSpyObj('StorageProvider', ['get', 'put', 'delete']);
+    storageProvider.put.and.resolveTo();
+    storageProvider.delete.and.resolveTo();
+
+    authProvider = jasmine.createSpyObj('AuthProvider', ['getEndSessionEndpoint']);
+    authProvider.getEndSessionEndpoint.and.resolveTo(END_SESSION_ENDPOINT);
+
+    browser = jasmine.createSpyObj('SimpleBrowser', ['open']);
+    browser.open.and.resolveTo();
+
+    alert = jasmine.createSpyObj('HTMLIonAlertElement', ['present']);
+    alert.present.and.resolveTo();
+
+    alertController = jasmine.createSpyObj('AlertController', ['create']);
+    alertController.create.and.resolveTo(alert);
+
+    service = createService();
+  });
+
+  describe('userConfigurationMap', () => {
+    it('reads the user mapping from the default auth provider', () => {
+      expect(configProvider.getAnyValue).toHaveBeenCalledWith('auth');
+      expect(service.userConfigurationMap as unknown).toEqual(USER_MAPPING);
+    });
+
+    it('falls back to an empty mapping when no default auth provider is configured', () => {
+      service = createService({});
+
+      expect(service.userConfigurationMap as unknown).toEqual({});
+    });
+  });
+
+  describe('getAuthMessage', () => {
+    it('returns the translated message for SignInSuccess', () => {
+      expect(service.getAuthMessage({action: AuthActions.SignInSuccess})).toBe(
+        `translated:${AUTH_MESSAGE_PREFIX}.logged_in_success`,
+      );
+    });
+
+    it('returns the translated message for SignOutSuccess', () => {
+      expect(service.getAuthMessage({action: AuthActions.SignOutSuccess})).toBe(
+        `translated:${AUTH_MESSAGE_PREFIX}.logged_out_success`,
+      );
+    });
+
+    it('returns the translated message for SessionExpired', () => {
+      expect(service.getAuthMessage({action: AuthActions.SessionExpired})).toBe(
+        `translated:${AUTH_MESSAGE_PREFIX}.session_expired`,
+      );
+    });
+
+    it('returns undefined for all other actions without translating', () => {
+      const messageActions = new Set([
+        AuthActions.SignInSuccess,
+        AuthActions.SignOutSuccess,
+        AuthActions.SessionExpired,
+      ]);
+      const otherActions = Object.values(AuthActions).filter(action => !messageActions.has(action));
+
+      for (const action of otherActions) {
+        expect(service.getAuthMessage({action})).withContext(action).toBeUndefined();
+      }
+      expect(translateService.instant).not.toHaveBeenCalled();
+    });
   });
 
   describe('getUserFromUserInfo', () => {
-    it('should provide user configuration from userInfo', async () => {
+    it('maps user info fields via the configured JSONPath mapping', () => {
-      const userConfiguration = authHelperService.getUserFromUserInfo({
+      const user = service.getUserFromUserInfo({
-        attributes: {
+        sub: 'user-123',
-          eduPersonPrimaryAffiliation: 'student',
+        given_name: 'Erika',
-          employeeNumber: '123456',
+        family_name: 'Mustermann',
-          givenName: 'Erika',
+        attributes: {mail: 'erika@example.org'},
-          mailPrimaryAddress: 'emuster@anyschool.de',
+        role: 'employee',
-          oauthClientId: '123-abc-123',
-          sn: 'Musterfrau',
-          uid: 'emuster',
-        },
-        id: 'emuster',
-        client_id: '123-abc-123',
       });
 
-      expect(userConfiguration).toEqual({
+      expect(user).toEqual(
-        id: 'emuster',
+        jasmine.objectContaining({
-        givenName: 'Erika',
+          id: 'user-123',
-        familyName: 'Musterfrau',
+          givenName: 'Erika',
-        name: 'Erika Musterfrau',
+          familyName: 'Mustermann',
-        email: 'emuster@anyschool.de',
+          email: 'erika@example.org',
+          role: 'employee',
+        }),
+      );
+    });
+
+    it('builds the name from given name and family name', () => {
+      const user = service.getUserFromUserInfo({
+        sub: 'user-123',
+        given_name: 'Erika',
+        family_name: 'Mustermann',
+        role: 'student',
+      });
+
+      expect(user.name).toBe('Erika Mustermann');
+    });
+
+    it('keeps the default name when the family name is missing', () => {
+      const user = service.getUserFromUserInfo({
+        sub: 'user-123',
+        given_name: 'Erika',
+        role: 'student',
+      });
+
+      expect(user.name).toBe('');
+    });
+
+    it('returns the default user when no mapping is configured', () => {
+      service = createService({});
+
+      expect(service.getUserFromUserInfo({sub: 'user-123'})).toEqual({
+        id: '',
+        name: '',
         role: 'student',
-        studentId: '123456',
       });
     });
   });
+
+  describe('origin path', () => {
+    it('stores the origin path', async () => {
+      await service.setOriginPath('/profile');
+
+      expect(storageProvider.put).toHaveBeenCalledOnceWith(AUTH_ORIGIN_PATH, '/profile');
+    });
+
+    it('returns the stored origin path', async () => {
+      storageProvider.get.and.resolveTo('/profile');
+
+      expect(await service.getOriginPath()).toBe('/profile');
+      expect(storageProvider.get).toHaveBeenCalledOnceWith(AUTH_ORIGIN_PATH);
+    });
+
+    it('returns undefined when reading the origin path fails', async () => {
+      storageProvider.get.and.rejectWith(new Error('Value not found'));
+
+      expect(await service.getOriginPath()).toBeUndefined();
+    });
+
+    it('deletes the origin path', async () => {
+      await service.deleteOriginPath();
+
+      expect(storageProvider.delete).toHaveBeenCalledOnceWith(AUTH_ORIGIN_PATH);
+    });
+  });
+
+  describe('endBrowserSession', () => {
+    it('does nothing when the provider has no end-session endpoint', async () => {
+      authProvider.getEndSessionEndpoint.and.resolveTo();
+
+      await service.endBrowserSession();
+
+      expect(alertController.create).not.toHaveBeenCalled();
+      expect(browser.open).not.toHaveBeenCalled();
+    });
+
+    it('presents a translated confirmation alert', async () => {
+      await service.endBrowserSession();
+
+      const options = lastAlertOptions();
+      expect(options.header).toBe(`translated:${AUTH_MESSAGE_PREFIX}.log_out_alert.header`);
+      expect(options.message).toBe(`translated:${AUTH_MESSAGE_PREFIX}.log_out_alert.message`);
+      expect(options.buttons.map(b => b.role)).toEqual(['cancel', 'confirm']);
+      expect(alert.present).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not open the end-session endpoint before confirmation', async () => {
+      await service.endBrowserSession();
+
+      expect(browser.open).not.toHaveBeenCalled();
+    });
+
+    it('opens the end-session endpoint when the user confirms', async () => {
+      await service.endBrowserSession();
+
+      await alertButton('confirm').handler?.();
+
+      expect(browser.open).toHaveBeenCalledOnceWith(END_SESSION_ENDPOINT);
+    });
+
+    it('does not open the end-session endpoint when the user cancels', async () => {
+      await service.endBrowserSession();
+
+      const cancelButton = alertButton('cancel');
+      await cancelButton.handler?.();
+
+      expect(cancelButton.handler).toBeUndefined();
+      expect(browser.open).not.toHaveBeenCalled();
+    });
+  });
 });

frontend/app/src/app/modules/auth/auth-helper.service.ts

@@ -13,41 +13,39 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {Injectable} from '@angular/core';
+import {Injectable, inject} from '@angular/core';
-import {IPAIAAuthAction} from './paia/paia-auth-action';
+import {AlertController} from '@ionic/angular/standalone';
-import {AuthActions, IAuthAction} from 'ionic-appauth';
 import {TranslateService} from '@ngx-translate/core';
+import {SCAuthorizationProvider, SCUserConfiguration, SCUserConfigurationMap} from '@openstapps/core';
 import {JSONPath} from 'jsonpath-plus';
-import {
+
-  SCAuthorizationProvider,
+import {SimpleBrowser} from '../../util/browser.factory';
-  SCAuthorizationProviderType,
-  SCUserConfiguration,
-  SCUserConfigurationMap,
-} from '@openstapps/core';
 import {ConfigProvider} from '../config/config.provider';
 import {StorageProvider} from '../storage/storage.provider';
-import {DefaultAuthService} from './default-auth.service';
+import {AuthActions, AuthProvider, IAuthAction} from './auth.provider';
-import {PAIAAuthService} from './paia/paia-auth.service';
-import {SimpleBrowser} from '../../util/browser.factory';
-import {AlertController} from '@ionic/angular/standalone';
 
 const AUTH_ORIGIN_PATH = 'stapps.auth.origin_path';
+const AUTH_MESSAGE_PREFIX = 'auth.messages.default';
 
 @Injectable({
   providedIn: 'root',
 })
 export class AuthHelperService {
+  private authProvider = inject(AuthProvider);
+
+  private translateService = inject(TranslateService);
+
+  private configProvider = inject(ConfigProvider);
+
+  private storageProvider = inject(StorageProvider);
+
+  private browser = inject(SimpleBrowser);
+
+  private alertController = inject(AlertController);
+
   userConfigurationMap: SCUserConfigurationMap;
 
-  constructor(
+  constructor() {
-    private translateService: TranslateService,
-    private configProvider: ConfigProvider,
-    private storageProvider: StorageProvider,
-    private defaultAuth: DefaultAuthService,
-    private paiaAuth: PAIAAuthService,
-    private browser: SimpleBrowser,
-    private alertController: AlertController,
-  ) {
     this.userConfigurationMap =
       (
         this.configProvider.getAnyValue('auth') as {
@@ -56,98 +54,101 @@ export class AuthHelperService {
       ).default?.endpoints.mapping ?? {};
   }
 
-  public getAuthMessage(provider: SCAuthorizationProviderType, action: IAuthAction | IPAIAAuthAction) {
+  public getAuthMessage(action: IAuthAction): string | undefined {
-    let message: string | undefined;
     switch (action.action) {
       case AuthActions.SignInSuccess: {
-        message = this.translateService.instant(`auth.messages.${provider}.logged_in_success`);
+        return this.translateService.instant(`${AUTH_MESSAGE_PREFIX}.logged_in_success`);
-        break;
       }
+
       case AuthActions.SignOutSuccess: {
-        message = this.translateService.instant(`auth.messages.${provider}.logged_out_success`);
+        return this.translateService.instant(`${AUTH_MESSAGE_PREFIX}.logged_out_success`);
-        break;
+      }
+
+      case AuthActions.SessionExpired: {
+        return this.translateService.instant(`${AUTH_MESSAGE_PREFIX}.session_expired`);
+      }
+
+      default: {
+        return undefined;
       }
     }
-    return message;
   }
 
-  getUserFromUserInfo(userInfo: object) {
+  public getUserFromUserInfo(userInfo: object): SCUserConfiguration {
     const user: SCUserConfiguration = {
       id: '',
       name: '',
       role: 'student',
     };
+
     for (const key in this.userConfigurationMap) {
-      user[key as keyof SCUserConfiguration] = JSONPath({
+      const userKey = key as keyof SCUserConfiguration;
-        path: this.userConfigurationMap[key as keyof SCUserConfiguration] as string,
+
+      user[userKey] = JSONPath({
+        path: this.userConfigurationMap[userKey] as string,
         json: userInfo,
       })[0];
     }
-    if (user.givenName && user.givenName.length > 0 && user.familyName && user.familyName.length > 0) {
+
+    if (user.givenName && user.familyName) {
       user.name = `${user.givenName} ${user.familyName}`;
     }
 
     return user;
   }
 
-  async deleteOriginPath() {
+  public async deleteOriginPath(): Promise<void> {
-    return this.storageProvider.delete(AUTH_ORIGIN_PATH);
+    await this.storageProvider.delete(AUTH_ORIGIN_PATH);
   }
 
-  async setOriginPath(path: string) {
+  public async setOriginPath(path: string): Promise<void> {
-    return this.storageProvider.put<string>(AUTH_ORIGIN_PATH, path);
+    await this.storageProvider.put(AUTH_ORIGIN_PATH, path);
   }
 
-  async getOriginPath() {
+  public async getOriginPath(): Promise<string | undefined> {
-    let originPath: string;
     try {
-      originPath = await this.storageProvider.get<string>(AUTH_ORIGIN_PATH);
+      return await this.storageProvider.get<string>(AUTH_ORIGIN_PATH);
     } catch {
+      return undefined;
+    }
+  }
+
+  public async endBrowserSession(): Promise<void> {
+    const endSessionEndpoint = await this.authProvider.getEndSessionEndpoint();
+
+    if (!endSessionEndpoint) {
       return;
     }
-    return originPath;
-  }
 
-  getProvider<B extends SCAuthorizationProviderType>(
+    const alert = await this.alertController.create({
-    providerType: B,
+      header: this.translateService.instant(`${AUTH_MESSAGE_PREFIX}.log_out_alert.header`),
-  ): B extends 'paia' ? PAIAAuthService : DefaultAuthService;
-  /**
-   * Provides appropriate auth service instance based on type (string) parameter
-   */
-  getProvider(providerType: SCAuthorizationProviderType): DefaultAuthService | PAIAAuthService {
-    return providerType === 'paia'
-      ? (this.paiaAuth as PAIAAuthService)
-      : (this.defaultAuth as DefaultAuthService);
-  }
 
-  /**
+      message: this.translateService.instant(`${AUTH_MESSAGE_PREFIX}.log_out_alert.message`),
-   * Ends browser session by opening endSessionEndpoint URL of the provider
-   * @param providerType Type of the provider (e.g. 'default' or 'paia')
-   */
-  async endBrowserSession(providerType: SCAuthorizationProviderType) {
-    const endSessionEndpoint = (await this.getProvider(providerType).configuration).endSessionEndpoint;
 
-    if (endSessionEndpoint) {
+      buttons: [
-      const alert: HTMLIonAlertElement = await this.alertController.create({
+        {
-        header: this.translateService.instant(`auth.messages.${providerType}.log_out_alert.header`),
+          text: this.translateService.instant('no'),
-        message: this.translateService.instant(`auth.messages.${providerType}.log_out_alert.message`),
+
-        buttons: [
+          role: 'cancel',
-          {
+          cssClass: 'default',
-            text: this.translateService.instant('no'),
+        },
-            cssClass: 'default',
+        {
+          text: this.translateService.instant('yes'),
+
+          role: 'confirm',
+          cssClass: 'preferred',
+
+          handler: async () => {
+            /*
+             * Only now, after explicit confirmation,
+             * open the IdP end-session endpoint.
+             */
+            await this.browser.open(endSessionEndpoint);
           },
-          {
+        },
-            text: this.translateService.instant('yes'),
+      ],
-            role: 'confirm',
+    });
-            cssClass: 'preferred',
-            handler: () => {
-              this.browser.open(new URL(endSessionEndpoint).href);
-            },
-          },
-        ],
-      });
 
-      await alert.present();
+    await alert.present();
-    }
   }
 }

frontend/app/src/app/modules/auth/auth-paths.ts

@@ -12,15 +12,5 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {SCAuthorizationProviderType} from '@openstapps/core';
 
-export const authPaths: {
+export const AUTH_REDIRECT_PATH = 'auth/callback';
-  [key in SCAuthorizationProviderType]: {redirect_path: string};
-} = {
-  default: {
-    redirect_path: 'auth/callback',
-  },
-  paia: {
-    redirect_path: 'auth/paia/callback',
-  },
-};

frontend/app/src/app/modules/auth/auth-routing.module.ts

@@ -15,21 +15,14 @@
 
 import {RouterModule, Routes} from '@angular/router';
 import {NgModule} from '@angular/core';
-import {authPaths} from './auth-paths';
+import {AUTH_REDIRECT_PATH} from './auth-paths';
 import {AuthCallbackPageComponent} from './auth-callback/page/auth-callback-page.component';
-import {DefaultAuthService} from './default-auth.service';
-import {PAIAAuthService} from './paia/paia-auth.service';
 
 const authRoutes: Routes = [
   {
-    path: authPaths.default.redirect_path,
+    path: AUTH_REDIRECT_PATH,
     component: AuthCallbackPageComponent,
   },
-  {
-    path: authPaths.paia.redirect_path,
-    component: AuthCallbackPageComponent,
-    providers: [{provide: DefaultAuthService, useExisting: PAIAAuthService}],
-  },
 ];
 
 /**

frontend/app/src/app/modules/auth/auth.module.ts

@@ -3,15 +3,12 @@ import {CommonModule} from '@angular/common';
 import {Platform} from '@ionic/angular/standalone';
 import {Requestor, StorageBackend} from '@openid/appauth';
 import {storageFactory} from './factories';
-import {Browser} from 'ionic-appauth';
+import {requestorFactory} from './factories/requestor.factory';
-import {CapacitorBrowser} from 'ionic-appauth/lib/capacitor';
-import {httpFactory} from './factories/http.factory';
 import {HttpClient} from '@angular/common/http';
 import {AuthRoutingModule} from './auth-routing.module';
 import {TranslateModule} from '@ngx-translate/core';
 import {AuthCallbackPageComponent} from './auth-callback/page/auth-callback-page.component';
-import {DefaultAuthService} from './default-auth.service';
+import {AuthProvider} from './auth.provider';
-import {PAIAAuthService} from './paia/paia-auth.service';
 
 @NgModule({
   declarations: [AuthCallbackPageComponent],
@@ -24,15 +21,10 @@ import {PAIAAuthService} from './paia/paia-auth.service';
     },
     {
       provide: Requestor,
-      useFactory: httpFactory,
+      useFactory: requestorFactory,
       deps: [Platform, HttpClient],
     },
-    {
+    AuthProvider,
-      provide: Browser,
-      useClass: CapacitorBrowser,
-    },
-    DefaultAuthService,
-    PAIAAuthService,
   ],
 })
 export class AuthModule {}

frontend/app/src/app/modules/auth/auth.provider.methods.spec.ts

@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {Capacitor} from '@capacitor/core';
+import {SCAuthorizationProvider} from '@openstapps/core';
+
+import type {CapacitorMock} from '../../../../__mocks__/@capacitor/core';
+import {getClientConfig, getPlatformScopes} from './auth.provider.methods';
+
+const capacitor = Capacitor as unknown as CapacitorMock;
+
+const authConfig = {
+  default: {
+    client: {
+      clientId: 'client-id',
+      scopes: 'openid profile email offline_access',
+      url: 'https://idp.example.com',
+    },
+    endpoints: {
+      authorization: 'https://idp.example.com/authorize',
+      token: 'https://idp.example.com/token',
+      userinfo: 'https://idp.example.com/userinfo',
+      mapping: {},
+    },
+  } as unknown as SCAuthorizationProvider,
+};
+
+describe('auth.provider.methods', () => {
+  afterEach(() => {
+    capacitor.reset();
+  });
+
+  describe('getClientConfig', () => {
+    it('requests offline_access on iOS', () => {
+      capacitor.setPlatform('ios');
+
+      expect(getClientConfig(authConfig).scopes).toBe('openid profile email offline_access');
+    });
+
+    it('requests offline_access on Android', () => {
+      capacitor.setPlatform('android');
+
+      expect(getClientConfig(authConfig).scopes).toBe('openid profile email offline_access');
+    });
+
+    it('does not request offline_access in the browser', () => {
+      capacitor.setPlatform('web');
+
+      expect(getClientConfig(authConfig).scopes).toBe('openid profile email');
+    });
+  });
+
+  describe('getPlatformScopes', () => {
+    it('leaves scopes without offline_access unchanged in the browser', () => {
+      expect(getPlatformScopes('openid profile')).toBe('openid profile');
+    });
+
+    it('normalizes extra whitespace', () => {
+      expect(getPlatformScopes('  openid   offline_access profile ')).toBe('openid profile');
+    });
+
+    it('still accepts an explicit platform flag', () => {
+      expect(getPlatformScopes('openid offline_access', true)).toBe('openid offline_access');
+    });
+  });
+});

frontend/app/src/app/modules/auth/auth.provider.methods.ts

@@ -13,69 +13,71 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {AuthorizationServiceConfigurationJson} from '@openid/appauth';
-import {IAuthConfig} from 'ionic-appauth';
-import {SCAuthorizationProvider, SCAuthorizationProviderType} from '@openstapps/core';
 import {Capacitor} from '@capacitor/core';
-import {authPaths} from './auth-paths';
+import {SCAuthorizationProvider} from '@openstapps/core';
+import {AuthorizationServiceConfiguration} from '@openid/appauth';
+
 import {environment} from '../../../environments/environment';
+import {AUTH_REDIRECT_PATH} from './auth-paths';
+import type {AuthConfig} from './auth.provider';
+
+export const OFFLINE_ACCESS_SCOPE = 'offline_access';
 
 /**
- * Get configuration of an OAuth2 client
+ * Returns the configuration of the OIDC client.
  */
-export function getClientConfig(
+export function getClientConfig(authConfig: {default: SCAuthorizationProvider}): AuthConfig {
-  providerType: SCAuthorizationProviderType,
+  const provider = authConfig.default;
-  authConfig: {
+
-    default?: SCAuthorizationProvider;
-    paia?: SCAuthorizationProvider;
-  },
-): IAuthConfig {
-  const providerConfig = authConfig[providerType] as SCAuthorizationProvider;
   return {
-    end_session_redirect_url: '',
+    server_host: provider.client.url,
+    client_id: provider.client.clientId,
+    scopes: getPlatformScopes(provider.client.scopes),
+    redirect_url: getRedirectUrl(),
     pkce: true,
-    scopes: providerConfig.client.scopes,
-    server_host: providerConfig.client.url,
-    client_id: providerConfig.client.clientId,
-    redirect_url: getRedirectUrl(authPaths[providerType].redirect_path),
   };
 }
 
 /**
- * Get configuration about endpoints of an OAuth2 server
+ * Returns the scopes to request on the current platform.
+ *
+ * `offline_access` (long-lived refresh tokens) is only requested in the
+ * native apps, where tokens live in the Keychain / Keystore. In the browser,
+ * tokens live in web storage and are reachable by any XSS, so the session is
+ * limited to the access token lifetime instead.
  */
-export function getEndpointsConfig(
+export function getPlatformScopes(scopes: string, isNative: boolean = Capacitor.isNativePlatform()): string {
-  providerType: SCAuthorizationProviderType,
+  const scopeList = scopes.split(/\s+/).filter(scope => scope.length > 0);
-  authConfig: {
+
-    default?: SCAuthorizationProvider;
+  return (isNative ? scopeList : scopeList.filter(scope => scope !== OFFLINE_ACCESS_SCOPE)).join(' ');
-    paia?: SCAuthorizationProvider;
-  },
-): AuthorizationServiceConfigurationJson {
-  const providerConfig = authConfig[providerType] as SCAuthorizationProvider;
-  return {
-    authorization_endpoint: providerConfig.endpoints.authorization,
-    end_session_endpoint: providerConfig.endpoints.endSession,
-    revocation_endpoint: providerConfig.endpoints.revoke ?? '',
-    token_endpoint: providerConfig.endpoints.token,
-    userinfo_endpoint: providerConfig.endpoints.userinfo,
-  };
 }
 
 /**
- * Return a URL of the app, depending on the platform where it is running
+ * Returns the AppAuth OAuth/OIDC service configuration.
  */
-function getRedirectUrl(routePath: string): string {
+export function getServiceConfiguration(authConfig: {
-  let appHost: string;
+  default: SCAuthorizationProvider;
-  let appSchema: string;
+}): AuthorizationServiceConfiguration {
-  if (environment.production) {
+  const endpoints = authConfig.default.endpoints;
-    appSchema = Capacitor.isNativePlatform() ? environment.custom_url_scheme : 'https';
-    appHost = environment.app_host;
-  } else {
-    appSchema = Capacitor.isNativePlatform()
-      ? environment.custom_url_scheme
-      : window.location.protocol.split(':')[0];
 
-    appHost = Capacitor.isNativePlatform() ? environment.app_host : window.location.host;
+  return new AuthorizationServiceConfiguration({
+    authorization_endpoint: endpoints.authorization,
+    token_endpoint: endpoints.token,
+    revocation_endpoint: endpoints.revoke || '',
+  });
+}
+
+/**
+ * Returns the OIDC redirect URL depending on the current platform.
+ */
+function getRedirectUrl(): string {
+  if (Capacitor.isNativePlatform()) {
+    return `${environment.custom_url_scheme}://${environment.app_host}/${AUTH_REDIRECT_PATH}`;
   }
-  return `${appSchema}://${appHost}/${routePath}`;
+
+  if (environment.production) {
+    return `https://${environment.app_host}/${AUTH_REDIRECT_PATH}`;
+  }
+
+  return `${window.location.origin}/${AUTH_REDIRECT_PATH}`;
 }

frontend/app/src/app/modules/auth/auth.provider.spec.ts

@@ -0,0 +1,613 @@
+import {TestBed} from '@angular/core/testing';
+import {Platform} from '@ionic/angular/standalone';
+import {
+  AppAuthError,
+  AuthorizationServiceConfiguration,
+  RevokeTokenRequest,
+  StorageBackend,
+  TokenRequestHandler,
+  TokenResponse,
+} from '@openid/appauth';
+import {BehaviorSubject, firstValueFrom, skip} from 'rxjs';
+
+import {ConfigProvider} from '../config/config.provider';
+import {AuthActions, AuthProvider, IAuthAction, INVALID_GRANT, isInvalidGrant} from './auth.provider';
+
+const TOKEN_RESPONSE_KEY = 'token_response';
+const TOKEN_LIFETIME = 3600;
+/** Shibboleth OP default access token lifetime. */
+const SHORT_TOKEN_LIFETIME = 600;
+const NOW_MS = Date.parse('2026-01-01T12:00:00Z');
+const NOW = NOW_MS / 1000;
+
+// eslint-disable-next-line unicorn/no-null -- StorageBackend.getItem resolves to null for missing keys
+const MISSING_STORAGE_VALUE = null;
+
+/**
+ * Creates a token with a real lifetime instead of spying on isValid().
+ *
+ * remainingSeconds > 0 → still valid for that long
+ * remainingSeconds < 0 → expired that many seconds ago
+ * refreshToken: false  → token without refresh token
+ */
+function makeToken(
+  options: {
+    accessToken?: string;
+    refreshToken?: string | false;
+    remainingSeconds?: number;
+    lifetime?: number;
+  } = {},
+): TokenResponse {
+  const lifetime = options.lifetime ?? TOKEN_LIFETIME;
+  const remaining = options.remainingSeconds ?? lifetime;
+
+  return new TokenResponse({
+    access_token: options.accessToken ?? 'access-token',
+    refresh_token: options.refreshToken === false ? undefined : options.refreshToken ?? 'refresh-token',
+    token_type: 'bearer',
+    expires_in: String(lifetime),
+    issued_at: NOW - (lifetime - remaining),
+  });
+}
+
+/** Lets pending promise callbacks run (the jasmine clock only drives timers). */
+async function flushPromises(): Promise<void> {
+  for (let index = 0; index < 50; index++) {
+    await Promise.resolve();
+  }
+}
+
+/** Typed access to the private members the tests depend on. */
+interface AuthProviderInternals {
+  storage: StorageBackend;
+  tokenHandler: TokenRequestHandler;
+  tokenSubject: BehaviorSubject<TokenResponse | undefined>;
+  authConfigValue: unknown;
+  localConfiguration: AuthorizationServiceConfiguration;
+  notify(action: IAuthAction): void;
+}
+
+describe('AuthProvider', () => {
+  let provider: AuthProvider;
+  let internals: AuthProviderInternals;
+
+  let storageGetItem: jasmine.Spy;
+  let storageSetItem: jasmine.Spy;
+  let storageRemoveItem: jasmine.Spy;
+  let tokenRequest: jasmine.Spy;
+  let revokeRequest: jasmine.Spy;
+
+  /** Seeds storage with the given token and loads it through the public API. */
+  async function givenLoadedToken(token?: TokenResponse): Promise<void> {
+    storageGetItem.and.resolveTo(token ? JSON.stringify(token.toJson()) : MISSING_STORAGE_VALUE);
+    await provider.loadTokenFromStorage();
+  }
+
+  /** Records every auth event emitted after this call (skips the replayed last one). */
+  function recordEvents(): AuthActions[] {
+    const events: AuthActions[] = [];
+    provider.events$.pipe(skip(1)).subscribe(event => events.push(event.action));
+    return events;
+  }
+
+  const isAuthenticated = () => firstValueFrom(provider.isAuthenticated$);
+  const isLoggedIn = () => firstValueFrom(provider.isLoggedIn$);
+
+  beforeEach(() => {
+    jasmine.clock().install();
+    jasmine.clock().mockDate(new Date(NOW_MS));
+
+    // AuthProvider uses inject(), so it has to be created inside an injection context.
+    TestBed.configureTestingModule({
+      providers: [
+        {provide: Platform, useValue: {is: () => false}},
+        {provide: ConfigProvider, useValue: {}},
+      ],
+    });
+
+    provider = TestBed.inject(AuthProvider);
+    internals = provider as unknown as AuthProviderInternals;
+
+    internals.authConfigValue = {
+      server_host: 'https://idp.example.org',
+      client_id: 'test-client',
+      redirect_url: 'https://app.example.org/callback',
+      scopes: 'openid profile',
+      pkce: true,
+    };
+
+    internals.localConfiguration = new AuthorizationServiceConfiguration({
+      authorization_endpoint: 'https://idp.example.org/authorize',
+      token_endpoint: 'https://idp.example.org/token',
+      revocation_endpoint: 'https://idp.example.org/revoke',
+    });
+
+    // Never touch real storage or the network.
+    storageGetItem = spyOn(internals.storage, 'getItem').and.resolveTo(MISSING_STORAGE_VALUE);
+    storageSetItem = spyOn(internals.storage, 'setItem').and.resolveTo();
+    storageRemoveItem = spyOn(internals.storage, 'removeItem').and.resolveTo();
+    tokenRequest = spyOn(internals.tokenHandler, 'performTokenRequest').and.rejectWith(
+      new Error('Unexpected token request'),
+    );
+    revokeRequest = spyOn(internals.tokenHandler, 'performRevokeTokenRequest').and.resolveTo(true);
+  });
+
+  afterEach(() => {
+    jasmine.clock().uninstall();
+  });
+
+  describe('isAuthenticated$', () => {
+    it('should provide false through isAuthenticated$ when there is no token response', async () => {
+      // Start authenticated so the test cannot pass on the initial value alone.
+      await givenLoadedToken(makeToken());
+      expect(await isAuthenticated()).toBeTrue();
+
+      await givenLoadedToken();
+
+      expect(internals.tokenSubject.value).toBeUndefined();
+      expect(await isAuthenticated()).toBeFalse();
+    });
+
+    it('should provide true through isAuthenticated$ when access token is valid', async () => {
+      await givenLoadedToken(makeToken());
+
+      expect(await isAuthenticated()).toBeTrue();
+    });
+
+    it('should provide false through isAuthenticated$ when access token is invalid', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -TOKEN_LIFETIME}));
+
+      expect(await isAuthenticated()).toBeFalse();
+      // Still logged in: a refresh token is available.
+      expect(await isLoggedIn()).toBeTrue();
+    });
+
+    it('should provide true through isAuthenticated$ after an expired token was refreshed', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      expect(await isAuthenticated()).toBeFalse();
+
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+      await provider.getValidToken();
+
+      expect(await isAuthenticated()).toBeTrue();
+    });
+  });
+
+  describe('getValidToken', () => {
+    it('returns the current token without refreshing when it is valid', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'current-access-token'}));
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).not.toHaveBeenCalled();
+      expect(token.accessToken).toBe('current-access-token');
+    });
+
+    it('refreshes the token when the access token is expired', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      tokenRequest.and.resolveTo(
+        makeToken({accessToken: 'new-access-token', refreshToken: 'new-refresh-token'}),
+      );
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(token.accessToken).toBe('new-access-token');
+      expect(token.refreshToken).toBe('new-refresh-token');
+      expect(storageSetItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY, jasmine.any(String));
+    });
+
+    it('refreshes the token when the access token expires within the buffer', async () => {
+      // 30 seconds left, the buffer for a 1 hour token is 60 seconds.
+      await givenLoadedToken(makeToken({remainingSeconds: 30}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(token.accessToken).toBe('new-access-token');
+    });
+
+    it('does not refresh a fresh short-lived (10 minute) token', async () => {
+      await givenLoadedToken(
+        makeToken({accessToken: 'current-access-token', lifetime: SHORT_TOKEN_LIFETIME}),
+      );
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).not.toHaveBeenCalled();
+      expect(token.accessToken).toBe('current-access-token');
+    });
+
+    it('accepts a freshly refreshed short-lived (10 minute) token', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60, lifetime: SHORT_TOKEN_LIFETIME}));
+      tokenRequest.and.resolveTo(
+        makeToken({accessToken: 'new-access-token', lifetime: SHORT_TOKEN_LIFETIME}),
+      );
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(token.accessToken).toBe('new-access-token');
+    });
+
+    it('keeps the previous refresh token when the refresh response contains none', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: 'old-refresh-token'}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token', refreshToken: false}));
+
+      const token = await provider.getValidToken();
+
+      expect(token.accessToken).toBe('new-access-token');
+      expect(token.refreshToken).toBe('old-refresh-token');
+    });
+
+    it('rejects without a request when the token is expired and has no refresh token', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: false}));
+
+      await expectAsync(provider.getValidToken()).toBeRejectedWithError(/No Refresh Token Available/);
+      expect(tokenRequest).not.toHaveBeenCalled();
+    });
+
+    it('sends only one refresh request for parallel callers', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+
+      const tokens = await Promise.all([
+        provider.getValidToken(),
+        provider.getValidToken(),
+        provider.getValidToken(),
+      ]);
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(tokens.map(token => token.accessToken)).toEqual([
+        'new-access-token',
+        'new-access-token',
+        'new-access-token',
+      ]);
+    });
+
+    it('refreshes again after a previous refresh has finished', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'first', remainingSeconds: -60}));
+
+      // The first refresh returns an already expired token, so the call fails ...
+      await expectAsync(provider.getValidToken()).toBeRejected();
+
+      // ... and the next call must start a new request instead of reusing the old one.
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'second'}));
+      expect((await provider.getValidToken()).accessToken).toBe('second');
+      expect(tokenRequest).toHaveBeenCalledTimes(2);
+    });
+
+    describe('without a refresh token (browser)', () => {
+      it('uses the token within the buffer instead of failing early', async () => {
+        await givenLoadedToken(
+          makeToken({accessToken: 'current-access-token', remainingSeconds: 60, refreshToken: false}),
+        );
+
+        const token = await provider.getValidToken();
+
+        expect(token.accessToken).toBe('current-access-token');
+        expect(tokenRequest).not.toHaveBeenCalled();
+      });
+
+      it('logs the user out when the token expires while the app is open', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: 60, refreshToken: false}));
+        expect(await isLoggedIn()).toBeTrue();
+        const events = recordEvents();
+
+        jasmine.clock().tick(2 * 60 * 1000);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWithError(/No Refresh Token Available/);
+        expect(await isLoggedIn()).toBeFalse();
+        expect(internals.tokenSubject.value).toBeUndefined();
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+        expect(events).toContain(AuthActions.SessionExpired);
+        expect(tokenRequest).not.toHaveBeenCalled();
+      });
+
+      it('does not restore an expired token from storage', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: false}));
+
+        expect(await isLoggedIn()).toBeFalse();
+        expect(internals.tokenSubject.value).toBeUndefined();
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+      });
+    });
+
+    describe('when refresh fails with invalid_grant from the native requestor', () => {
+      // CapacitorRequestor rejects non-2xx responses itself and keeps the OAuth body in extras.
+      const refreshError = new AppAuthError('HTTP 400', {error: INVALID_GRANT});
+
+      it('logs the user out', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60}));
+        const events = recordEvents();
+        tokenRequest.and.rejectWith(refreshError);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWith(refreshError);
+
+        expect(await isLoggedIn()).toBeFalse();
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+        expect(events).toEqual([AuthActions.RefreshFailed, AuthActions.SessionExpired]);
+      });
+
+      it('logs the user out only once for parallel callers', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60}));
+        const events = recordEvents();
+        tokenRequest.and.rejectWith(refreshError);
+
+        const results = await Promise.allSettled([provider.getValidToken(), provider.getValidToken()]);
+
+        expect(results.map(result => result.status)).toEqual(['rejected', 'rejected']);
+        expect(tokenRequest).toHaveBeenCalledTimes(1);
+        expect(events.filter(event => event === AuthActions.SessionExpired).length).toBe(1);
+      });
+    });
+
+    describe('when refresh fails with invalid_grant', () => {
+      const refreshError = new AppAuthError(INVALID_GRANT);
+
+      beforeEach(async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: 'invalid-refresh-token'}));
+        expect(await isLoggedIn()).toBeTrue();
+
+        tokenRequest.and.rejectWith(refreshError);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWith(refreshError);
+      });
+
+      it('changes isLoggedIn to false', async () => {
+        expect(await isLoggedIn()).toBeFalse();
+      });
+
+      it('removes the token from storage', () => {
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+      });
+
+      it('clears the current token', () => {
+        expect(internals.tokenSubject.value).toBeUndefined();
+      });
+    });
+
+    describe('when refresh fails with a temporary error', () => {
+      // An AppAuthError that is not invalid_grant, e.g. a network failure.
+      const refreshError = new AppAuthError('Network Error');
+
+      beforeEach(async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60}));
+        tokenRequest.and.rejectWith(refreshError);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWith(refreshError);
+      });
+
+      it('keeps the user logged in', async () => {
+        expect(await isLoggedIn()).toBeTrue();
+      });
+
+      it('does not remove the token from storage', () => {
+        expect(storageRemoveItem).not.toHaveBeenCalled();
+      });
+
+      it('keeps the current token for a later retry', () => {
+        expect(internals.tokenSubject.value?.refreshToken).toBe('refresh-token');
+      });
+    });
+  });
+
+  describe('expiry timer', () => {
+    it('logs the user out when the token expires, without any page asking for a token', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 60, refreshToken: false}));
+      const events = recordEvents();
+
+      jasmine.clock().tick(59 * 1000);
+      await flushPromises();
+      expect(await isLoggedIn()).toBeTrue();
+
+      jasmine.clock().tick(2 * 1000);
+      await flushPromises();
+
+      expect(await isLoggedIn()).toBeFalse();
+      expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+      expect(events).toEqual([AuthActions.SessionExpired]);
+    });
+
+    it('refreshes the token shortly before it expires when a refresh token is available', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 120, lifetime: SHORT_TOKEN_LIFETIME}));
+      tokenRequest.and.resolveTo(
+        makeToken({accessToken: 'new-access-token', lifetime: SHORT_TOKEN_LIFETIME}),
+      );
+
+      // Due 60 seconds before expiry.
+      jasmine.clock().tick(61 * 1000);
+      await flushPromises();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(internals.tokenSubject.value?.accessToken).toBe('new-access-token');
+      expect(await isLoggedIn()).toBeTrue();
+    });
+
+    it('logs the user out when the refresh token is rejected', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 30}));
+      tokenRequest.and.rejectWith(new AppAuthError(INVALID_GRANT));
+
+      jasmine.clock().tick(2 * 1000);
+      await flushPromises();
+
+      expect(await isLoggedIn()).toBeFalse();
+    });
+
+    it('stays logged in and retries later after a temporary error', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 30}));
+      tokenRequest.and.rejectWith(new AppAuthError('Network Error'));
+
+      jasmine.clock().tick(2 * 1000);
+      await flushPromises();
+
+      expect(await isLoggedIn()).toBeTrue();
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+      jasmine.clock().tick(61 * 1000);
+      await flushPromises();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(2);
+      expect(internals.tokenSubject.value?.accessToken).toBe('new-access-token');
+    });
+
+    it('does not fire after logout', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 60, refreshToken: false}));
+      await provider.signOut();
+      const events = recordEvents();
+
+      jasmine.clock().tick(2 * 60 * 1000);
+      await flushPromises();
+
+      expect(events).not.toContain(AuthActions.SessionExpired);
+    });
+  });
+
+  describe('failed sign-in', () => {
+    it('keeps an existing session', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'still-valid'}));
+
+      internals.notify({action: AuthActions.SignInFailed, error: new Error('state mismatch')});
+
+      expect(await isLoggedIn()).toBeTrue();
+      expect(internals.tokenSubject.value?.accessToken).toBe('still-valid');
+      expect(storageRemoveItem).not.toHaveBeenCalled();
+    });
+
+    it('stays logged out without a session', async () => {
+      await givenLoadedToken();
+
+      internals.notify({action: AuthActions.SignInFailed, error: new Error('access_denied')});
+
+      expect(await isLoggedIn()).toBeFalse();
+    });
+  });
+
+  describe('signOut', () => {
+    /** The [token, token_type_hint, client_id] of each revoke request, in order. */
+    const revokedTokens = () =>
+      revokeRequest.calls.allArgs().map(([, request]) => {
+        const json = (request as RevokeTokenRequest).toJson();
+        return [json.token, json.token_type_hint, json.client_id];
+      });
+
+    it('revokes the refresh token, then the access token', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'access', refreshToken: 'refresh'}));
+
+      await provider.signOut();
+
+      expect(revokedTokens()).toEqual([
+        ['refresh', 'refresh_token', 'test-client'],
+        ['access', 'access_token', 'test-client'],
+      ]);
+      expect(await isLoggedIn()).toBeFalse();
+      expect(storageRemoveItem).toHaveBeenCalledWith(TOKEN_RESPONSE_KEY);
+    });
+
+    it('revokes only the access token when there is no refresh token (browser)', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'access', refreshToken: false}));
+
+      await provider.signOut();
+
+      expect(revokedTokens()).toEqual([['access', 'access_token', 'test-client']]);
+    });
+
+    it('logs out locally before the IdP answers', async () => {
+      await givenLoadedToken(makeToken());
+      let loggedInWhileRevoking: boolean | undefined;
+      revokeRequest.and.callFake(async () => {
+        loggedInWhileRevoking = await isLoggedIn();
+        return true;
+      });
+
+      await provider.signOut();
+
+      expect(loggedInWhileRevoking).toBeFalse();
+    });
+
+    it('still logs out and tries the access token when revoking the refresh token fails', async () => {
+      await givenLoadedToken(makeToken());
+      const events = recordEvents();
+      revokeRequest.and.returnValues(
+        Promise.reject(new AppAuthError('Network Error')),
+        Promise.resolve(true),
+      );
+
+      await provider.signOut();
+
+      expect(revokeRequest).toHaveBeenCalledTimes(2);
+      expect(await isLoggedIn()).toBeFalse();
+      expect(events).toEqual([AuthActions.SignOutSuccess, AuthActions.RevokeTokensFailed]);
+    });
+
+    it('does not wait for an IdP that does not answer', async () => {
+      await givenLoadedToken(makeToken());
+      revokeRequest.and.returnValue(new Promise(() => {}));
+      let done = false;
+
+      const signOut = provider.signOut().then(() => (done = true));
+      await flushPromises();
+      expect(done).toBeFalse();
+      expect(await isLoggedIn()).toBeFalse();
+
+      jasmine.clock().tick(5000);
+      await signOut;
+
+      expect(done).toBeTrue();
+    });
+
+    it('revokes nothing when no revocation endpoint is configured', async () => {
+      internals.localConfiguration = new AuthorizationServiceConfiguration({
+        authorization_endpoint: 'https://idp.example.org/authorize',
+        token_endpoint: 'https://idp.example.org/token',
+        revocation_endpoint: '',
+      });
+      await givenLoadedToken(makeToken());
+
+      await provider.signOut();
+
+      expect(revokeRequest).not.toHaveBeenCalled();
+      expect(await isLoggedIn()).toBeFalse();
+    });
+
+    it('revokes nothing when asked not to', async () => {
+      await givenLoadedToken(makeToken());
+
+      await provider.signOut(undefined, false);
+
+      expect(revokeRequest).not.toHaveBeenCalled();
+      expect(await isLoggedIn()).toBeFalse();
+    });
+
+    it('revokes nothing when nobody is logged in', async () => {
+      await givenLoadedToken();
+
+      await provider.signOut();
+
+      expect(revokeRequest).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('isInvalidGrant', () => {
+    it('detects invalid_grant as error message', () => {
+      expect(isInvalidGrant(new AppAuthError(INVALID_GRANT))).toBeTrue();
+    });
+
+    it('detects invalid_grant in the response body', () => {
+      expect(isInvalidGrant(new AppAuthError('HTTP 400', {error: INVALID_GRANT}))).toBeTrue();
+    });
+
+    it('ignores other OAuth errors', () => {
+      expect(isInvalidGrant(new AppAuthError('HTTP 400', {error: 'invalid_request'}))).toBeFalse();
+    });
+
+    it('ignores network and non-AppAuth errors', () => {
+      expect(isInvalidGrant(new AppAuthError('HTTP 503'))).toBeFalse();
+      expect(isInvalidGrant(new Error(INVALID_GRANT))).toBeFalse();
+      expect(isInvalidGrant()).toBeFalse();
+    });
+  });
+});

frontend/app/src/app/modules/auth/auth.service.ts

@@ -1,526 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-// Temporary use of direct file until the version with bug fix is released
-// https://github.com/wi3land/ionic-appauth/blob/3716f4fc6b5491b0b75e049be0a47a5af8c4da6f/src/auth-service.ts
-// Bug: https://github.com/wi3land/ionic-appauth/issues/154
-import {
-  AuthorizationError,
-  AuthorizationNotifier,
-  AuthorizationRequest,
-  AuthorizationRequestHandler,
-  AuthorizationRequestJson,
-  AuthorizationResponse,
-  AuthorizationServiceConfiguration,
-  BaseTokenRequestHandler,
-  DefaultCrypto,
-  GRANT_TYPE_AUTHORIZATION_CODE,
-  GRANT_TYPE_REFRESH_TOKEN,
-  JQueryRequestor,
-  LocalStorageBackend,
-  Requestor,
-  RevokeTokenRequest,
-  RevokeTokenRequestJson,
-  StorageBackend,
-  StringMap,
-  TokenRequest,
-  TokenRequestHandler,
-  TokenRequestJson,
-  TokenResponse,
-} from '@openid/appauth';
-import {
-  ActionHistoryObserver,
-  AuthActionBuilder,
-  AuthActions,
-  AuthObserver,
-  AUTHORIZATION_RESPONSE_KEY,
-  AuthSubject,
-  BaseAuthObserver,
-  Browser,
-  DefaultBrowser,
-  EndSessionHandler,
-  EndSessionRequest,
-  EndSessionRequestJson,
-  IAuthAction,
-  IAuthConfig,
-  IAuthService,
-  IonicAuthorizationRequestHandler,
-  IonicEndSessionHandler,
-  IonicUserInfoHandler,
-  SessionObserver,
-  UserInfoHandler,
-} from 'ionic-appauth';
-import {BehaviorSubject, Observable} from 'rxjs';
-
-const TOKEN_RESPONSE_KEY = 'token_response';
-const AUTH_EXPIRY_BUFFER = 10 * 60 * -1; // 10 mins in seconds
-
-export abstract class AuthService implements IAuthService {
-  private _configuration?: AuthorizationServiceConfiguration;
-
-  private _authConfig?: IAuthConfig;
-
-  private _authSubject: AuthSubject = new AuthSubject();
-
-  private _actionHistory: ActionHistoryObserver = new ActionHistoryObserver();
-
-  private _session: SessionObserver = new SessionObserver();
-
-  private _authSubjectV2 = new BehaviorSubject<IAuthAction>(AuthActionBuilder.Init());
-
-  private _tokenSubject = new BehaviorSubject<TokenResponse | undefined>(undefined);
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private _userSubject = new BehaviorSubject<any>(undefined);
-
-  private _authenticatedSubject = new BehaviorSubject<boolean>(false);
-
-  private _loggedInSubject = new BehaviorSubject<boolean>(false);
-
-  private _initComplete = new BehaviorSubject<boolean>(false);
-
-  protected tokenHandler: TokenRequestHandler;
-
-  protected userInfoHandler: UserInfoHandler;
-
-  protected requestHandler: AuthorizationRequestHandler;
-
-  protected endSessionHandler: EndSessionHandler;
-
-  constructor(
-    protected browser: Browser = new DefaultBrowser(),
-    protected storage: StorageBackend = new LocalStorageBackend(),
-    protected requestor: Requestor = new JQueryRequestor(),
-  ) {
-    this.tokenHandler = new BaseTokenRequestHandler(requestor);
-    this.userInfoHandler = new IonicUserInfoHandler(requestor);
-    this.requestHandler = new IonicAuthorizationRequestHandler(browser, storage);
-    this.endSessionHandler = new IonicEndSessionHandler(browser);
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  get history(): IAuthAction[] {
-    return [...this._actionHistory.history];
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  get session() {
-    return this._session.session;
-  }
-
-  get token$(): Observable<TokenResponse | undefined> {
-    return this._tokenSubject.asObservable();
-  }
-
-  get isAuthenticated$(): Observable<boolean> {
-    return this._authenticatedSubject.asObservable();
-  }
-
-  /**
-   * Similar to isAuthenticated$, but will also return true if the token is expired
-   */
-  get isLoggedIn$(): Observable<boolean> {
-    return this._loggedInSubject.asObservable();
-  }
-
-  get initComplete$(): Observable<boolean> {
-    return this._initComplete.asObservable();
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  get user$(): Observable<any> {
-    return this._userSubject.asObservable();
-  }
-
-  get events$(): Observable<IAuthAction> {
-    return this._authSubjectV2.asObservable();
-  }
-
-  get authConfig(): IAuthConfig {
-    if (!this._authConfig) throw new Error('AuthConfig Not Defined');
-
-    return this._authConfig;
-  }
-
-  set authConfig(value: IAuthConfig) {
-    this._authConfig = value;
-  }
-
-  get configuration(): Promise<AuthorizationServiceConfiguration> {
-    if (!this._configuration) {
-      return AuthorizationServiceConfiguration.fetchFromIssuer(
-        this.authConfig.server_host,
-        this.requestor,
-      ).catch(() => {
-        throw new Error('Unable To Obtain Server Configuration');
-      });
-    }
-
-    if (this._configuration == undefined) {
-      throw new Error('Unable To Obtain Server Configuration');
-    } else {
-      return Promise.resolve(this._configuration);
-    }
-  }
-
-  public async init() {
-    this.setupAuthorizationNotifier();
-    this.loadTokenFromStorage();
-    this.addActionObserver(this._actionHistory);
-    this.addActionObserver(this._session);
-  }
-
-  protected notifyActionListers(action: IAuthAction) {
-    /* eslint-disable unicorn/no-useless-undefined */
-    switch (action.action) {
-      case AuthActions.SignInFailed:
-      case AuthActions.SignOutSuccess:
-      case AuthActions.SignOutFailed: {
-        this._tokenSubject.next(undefined);
-        this._userSubject.next(undefined);
-        this._authenticatedSubject.next(false);
-        this._loggedInSubject.next(false);
-        break;
-      }
-      case AuthActions.LoadTokenFromStorageFailed: {
-        this._tokenSubject.next(undefined);
-        this._userSubject.next(undefined);
-        this._authenticatedSubject.next(false);
-        this._loggedInSubject.next(false);
-        this._initComplete.next(true);
-        break;
-      }
-      case AuthActions.SignInSuccess:
-      case AuthActions.RefreshSuccess: {
-        this._tokenSubject.next(action.tokenResponse);
-        this._authenticatedSubject.next(true);
-        this._loggedInSubject.next(true);
-        break;
-      }
-      case AuthActions.LoadTokenFromStorageSuccess: {
-        this._tokenSubject.next(action.tokenResponse);
-        this._authenticatedSubject.next((action.tokenResponse as TokenResponse).isValid(0));
-        this._loggedInSubject.next(true);
-        this._initComplete.next(true);
-        break;
-      }
-      case AuthActions.RevokeTokensSuccess: {
-        this._tokenSubject.next(undefined);
-        break;
-      }
-      case AuthActions.LoadUserInfoSuccess: {
-        this._userSubject.next(action.user);
-        break;
-      }
-      case AuthActions.LoadUserInfoFailed: {
-        this._userSubject.next(undefined);
-        break;
-      }
-    }
-
-    this._authSubjectV2.next(action);
-    this._authSubject.notify(action);
-  }
-
-  protected setupAuthorizationNotifier() {
-    const notifier = new AuthorizationNotifier();
-    this.requestHandler.setAuthorizationNotifier(notifier);
-    notifier.setAuthorizationListener((request, response, error) =>
-      this.onAuthorizationNotification(request, response, error),
-    );
-  }
-
-  protected onAuthorizationNotification(
-    request: AuthorizationRequest,
-    response: AuthorizationResponse | null,
-    error: AuthorizationError | null,
-  ) {
-    const codeVerifier: string | undefined =
-      request.internal != undefined && this.authConfig.pkce ? request.internal.code_verifier : undefined;
-
-    if (response != undefined) {
-      this.requestAccessToken(response.code, codeVerifier);
-    } else if (error == undefined) {
-      throw new Error('Unknown Error With Authentication');
-    } else {
-      throw new Error(error.errorDescription);
-    }
-  }
-
-  protected async internalAuthorizationCallback(url: string) {
-    this.browser.closeWindow();
-    await this.storage.setItem(AUTHORIZATION_RESPONSE_KEY, url);
-    return this.requestHandler.completeAuthorizationRequestIfPossible();
-  }
-
-  protected async internalEndSessionCallback() {
-    this.browser.closeWindow();
-    this._actionHistory.clear();
-    this.notifyActionListers(AuthActionBuilder.SignOutSuccess());
-  }
-
-  protected async performEndSessionRequest(state?: string): Promise<void> {
-    if (this._tokenSubject.value == undefined) {
-      //if user has no token they should not be logged in in the first place
-      this.endSessionCallback();
-    } else {
-      const requestJson: EndSessionRequestJson = {
-        postLogoutRedirectURI: this.authConfig.end_session_redirect_url,
-        idTokenHint: this._tokenSubject.value.idToken || '',
-        state: state || undefined,
-      };
-
-      const request: EndSessionRequest = new EndSessionRequest(requestJson);
-      const returnedUrl: string | undefined = await this.endSessionHandler.performEndSessionRequest(
-        await this.configuration,
-        request,
-      );
-
-      //callback may come from showWindow or via another method
-      if (returnedUrl != undefined) {
-        this.endSessionCallback();
-      }
-    }
-  }
-
-  protected async performAuthorizationRequest(authExtras?: StringMap, state?: string): Promise<void> {
-    const requestJson: AuthorizationRequestJson = {
-      response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
-      client_id: this.authConfig.client_id,
-      redirect_uri: this.authConfig.redirect_url,
-      scope: this.authConfig.scopes,
-      extras: authExtras,
-      state: state || undefined,
-    };
-
-    const request = new AuthorizationRequest(requestJson, new DefaultCrypto(), this.authConfig.pkce);
-
-    if (this.authConfig.pkce) await request.setupCodeVerifier();
-
-    return this.requestHandler.performAuthorizationRequest(await this.configuration, request);
-  }
-
-  protected async requestAccessToken(code: string, codeVerifier?: string): Promise<void> {
-    const requestJSON: TokenRequestJson = {
-      grant_type: GRANT_TYPE_AUTHORIZATION_CODE,
-      code: code,
-      refresh_token: undefined,
-      redirect_uri: this.authConfig.redirect_url,
-      client_id: this.authConfig.client_id,
-      extras: codeVerifier
-        ? {
-            code_verifier: codeVerifier,
-            client_secret: this.authConfig.client_secret as string,
-          }
-        : {
-            client_secret: this.authConfig.client_secret as string,
-          },
-    };
-
-    const token: TokenResponse = await this.tokenHandler.performTokenRequest(
-      await this.configuration,
-      new TokenRequest(requestJSON),
-    );
-    await this.storage.setItem(TOKEN_RESPONSE_KEY, JSON.stringify(token.toJson()));
-    this.notifyActionListers(AuthActionBuilder.SignInSuccess(token));
-  }
-
-  protected async requestTokenRefresh() {
-    if (!this._tokenSubject.value) {
-      throw new Error('No Token Defined!');
-    }
-
-    const requestJSON: TokenRequestJson = {
-      grant_type: GRANT_TYPE_REFRESH_TOKEN,
-      refresh_token: this._tokenSubject.value?.refreshToken,
-      redirect_uri: this.authConfig.redirect_url,
-      client_id: this.authConfig.client_id,
-    };
-
-    const token: TokenResponse = await this.tokenHandler.performTokenRequest(
-      await this.configuration,
-      new TokenRequest(requestJSON),
-    );
-    if (!token.accessToken) {
-      throw new Error('No Access Token Defined In Refresh Response');
-    }
-    await this.storage.setItem(TOKEN_RESPONSE_KEY, JSON.stringify(token.toJson()));
-    this.notifyActionListers(AuthActionBuilder.RefreshSuccess(token));
-  }
-
-  protected async internalLoadTokenFromStorage() {
-    let token: TokenResponse | undefined;
-    const tokenResponseString: string | null = await this.storage.getItem(TOKEN_RESPONSE_KEY);
-
-    if (tokenResponseString != undefined) {
-      token = new TokenResponse(JSON.parse(tokenResponseString));
-
-      if (token) {
-        return this.notifyActionListers(AuthActionBuilder.LoadTokenFromStorageSuccess(token));
-      }
-    }
-
-    throw new Error('No Token In Storage');
-  }
-
-  protected async requestTokenRevoke() {
-    const revokeRefreshJson: RevokeTokenRequestJson = {
-      token: (this._tokenSubject.value as TokenResponse).refreshToken as string,
-      token_type_hint: 'refresh_token',
-      client_id: this.authConfig.client_id,
-    };
-
-    const revokeAccessJson: RevokeTokenRequestJson = {
-      token: (this._tokenSubject.value as TokenResponse).accessToken,
-      token_type_hint: 'access_token',
-      client_id: this.authConfig.client_id,
-    };
-
-    await this.tokenHandler.performRevokeTokenRequest(
-      await this.configuration,
-      new RevokeTokenRequest(revokeRefreshJson),
-    );
-    await this.tokenHandler.performRevokeTokenRequest(
-      await this.configuration,
-      new RevokeTokenRequest(revokeAccessJson),
-    );
-    await this.storage.removeItem(TOKEN_RESPONSE_KEY);
-    this.notifyActionListers(AuthActionBuilder.RevokeTokensSuccess());
-  }
-
-  protected async internalRequestUserInfo() {
-    if (this._tokenSubject.value) {
-      const userInfo = await this.userInfoHandler.performUserInfoRequest(
-        await this.configuration,
-        this._tokenSubject.value,
-      );
-      this.notifyActionListers(AuthActionBuilder.LoadUserInfoSuccess(userInfo));
-    } else {
-      throw new Error('No Token Available');
-    }
-  }
-
-  public async loadTokenFromStorage() {
-    await this.internalLoadTokenFromStorage().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.LoadTokenFromStorageFailed(error));
-    });
-  }
-
-  public async signIn(authExtras?: StringMap, state?: string) {
-    await this.performAuthorizationRequest(authExtras, state).catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignInFailed(error));
-    });
-  }
-
-  public async signOut(state?: string, revokeTokens?: boolean) {
-    if (revokeTokens) {
-      await this.revokeTokens();
-    }
-
-    await this.storage.removeItem(TOKEN_RESPONSE_KEY);
-
-    if ((await this.configuration).endSessionEndpoint) {
-      await this.performEndSessionRequest(state).catch(error => {
-        this.notifyActionListers(AuthActionBuilder.SignOutFailed(error));
-      });
-    }
-  }
-
-  public async revokeTokens() {
-    await this.requestTokenRevoke().catch(error => {
-      this.storage.removeItem(TOKEN_RESPONSE_KEY);
-      this.notifyActionListers(AuthActionBuilder.RevokeTokensFailed(error));
-    });
-  }
-
-  public async refreshToken() {
-    await this.requestTokenRefresh().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.RefreshFailed(error));
-    });
-  }
-
-  public async loadUserInfo() {
-    await this.internalRequestUserInfo().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.LoadUserInfoFailed(error));
-    });
-  }
-
-  public authorizationCallback(callbackUrl: string): void {
-    this.internalAuthorizationCallback(callbackUrl).catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignInFailed(error));
-    });
-  }
-
-  public endSessionCallback(): void {
-    this.internalEndSessionCallback().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignOutFailed(error));
-    });
-  }
-
-  public async getValidToken(buffer: number = AUTH_EXPIRY_BUFFER): Promise<TokenResponse> {
-    if (this._tokenSubject.value) {
-      if (this._tokenSubject.value.isValid(buffer)) {
-        return this._tokenSubject.value;
-      } else {
-        await this.refreshToken();
-        if (this._tokenSubject.value) {
-          return this._tokenSubject.value;
-        }
-      }
-    }
-
-    throw new Error('Unable To Obtain Valid Token');
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  public addActionListener(function_: (action: IAuthAction) => void): AuthObserver {
-    const observer: AuthObserver = AuthObserver.Create(function_);
-    this.addActionObserver(observer);
-    return observer;
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  public addActionObserver(observer: BaseAuthObserver): void {
-    if (this._actionHistory.lastAction) {
-      observer.update(this._actionHistory.lastAction);
-    }
-
-    this._authSubject.attach(observer);
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  public removeActionObserver(observer: BaseAuthObserver): void {
-    this._authSubject.detach(observer);
-  }
-}

frontend/app/src/app/modules/auth/capacitor-authorization-request-handler.spec.ts

@@ -0,0 +1,328 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import {
+  AuthorizationError,
+  AuthorizationNotifier,
+  AuthorizationRequest,
+  AuthorizationResponse,
+  AuthorizationServiceConfiguration,
+  LocalStorageBackend,
+  StorageBackend,
+} from '@openid/appauth';
+import {CapacitorAuthorizationRequestHandler} from './capacitor-authorization-request-handler';
+
+const PENDING_REQUEST_KEY = 'appauth_capacitor_authorization_request';
+
+/** Redirect URI of the native app (custom URL scheme). */
+const NATIVE_REDIRECT_URI = 'de.example.app://app.example.org/auth/callback';
+
+/** Redirect URI of the web app (callback page). */
+const WEB_REDIRECT_URI = 'https://app.example.org/auth/callback';
+
+const configuration = new AuthorizationServiceConfiguration({
+  authorization_endpoint: 'https://idp.example.org/authorize',
+  token_endpoint: 'https://idp.example.org/token',
+  revocation_endpoint: '',
+});
+
+type AuthorizationListener = jasmine.Spy<
+  (
+    request: AuthorizationRequest,
+    response: AuthorizationResponse | null,
+    error: AuthorizationError | null,
+  ) => void
+>;
+
+/**
+ * In-memory StorageBackend, so the tests can look at what the handler stores
+ * (stands in for the secure storage of the native app).
+ */
+class MemoryStorage extends StorageBackend {
+  readonly items = new Map<string, string>();
+
+  async getItem(name: string): Promise<string | null> {
+    return this.items.get(name) ?? null; // eslint-disable-line unicorn/no-null
+  }
+
+  async removeItem(name: string): Promise<void> {
+    this.items.delete(name);
+  }
+
+  async clear(): Promise<void> {
+    this.items.clear();
+  }
+
+  async setItem(name: string, value: string): Promise<void> {
+    this.items.set(name, value);
+  }
+}
+
+/**
+ * Connects a spy that receives the result of each completed login.
+ */
+function listenForResults(handler: CapacitorAuthorizationRequestHandler): AuthorizationListener {
+  const notifier = new AuthorizationNotifier();
+  const listener: AuthorizationListener = jasmine.createSpy('authorizationListener');
+  notifier.setAuthorizationListener(listener);
+  handler.setAuthorizationNotifier(notifier);
+  return listener;
+}
+
+/**
+ * Starts a login like AuthProvider.signIn() does and returns its state.
+ */
+async function startLogin(
+  handler: CapacitorAuthorizationRequestHandler,
+  redirectUri: string,
+): Promise<string> {
+  const request = new AuthorizationRequest({
+    response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
+    client_id: 'test-client',
+    redirect_uri: redirectUri,
+    scope: 'openid',
+  });
+
+  await handler.performAuthorizationRequest(configuration, request);
+
+  return request.state;
+}
+
+/**
+ * The callback URL as the IdP would send it back.
+ */
+function callbackUrl(redirectUri: string, parameters: Record<string, string>): string {
+  return `${redirectUri}?${new URLSearchParams(parameters).toString()}`;
+}
+
+/**
+ * The AppAuth keys in localStorage (pending logins on the web).
+ */
+function appAuthKeys(): string[] {
+  return Object.keys(localStorage).filter(key => key.includes('appauth'));
+}
+
+describe('CapacitorAuthorizationRequestHandler', () => {
+  describe('in the native app', () => {
+    let storage: MemoryStorage;
+    let handler: CapacitorAuthorizationRequestHandler;
+    let listener: AuthorizationListener;
+    let windowOpen: jasmine.Spy;
+    let browserClose: jasmine.Spy;
+
+    const login = () => startLogin(handler, NATIVE_REDIRECT_URI);
+    const callback = (parameters: Record<string, string>) => callbackUrl(NATIVE_REDIRECT_URI, parameters);
+
+    beforeEach(() => {
+      storage = new MemoryStorage();
+      // Same setup as AuthProvider in the native app: Capacitor browser (the defaults).
+      handler = new CapacitorAuthorizationRequestHandler(storage);
+      listener = listenForResults(handler);
+
+      // In tests, @capacitor/browser uses its web implementation,
+      // which opens the page with window.open() and closes that window again.
+      browserClose = jasmine.createSpy('close');
+      windowOpen = spyOn(window, 'open').and.returnValue({close: browserClose} as unknown as Window);
+    });
+
+    describe('starting the login', () => {
+      it('opens the authorization URL with state and PKCE (S256) in the in-app browser', async () => {
+        const state = await login();
+
+        const url = new URL(windowOpen.calls.mostRecent().args[0] as string);
+        expect(url.origin + url.pathname).toBe('https://idp.example.org/authorize');
+        expect(url.searchParams.get('state')).toBe(state);
+        expect(url.searchParams.get('redirect_uri')).toBe(NATIVE_REDIRECT_URI);
+        expect(url.searchParams.get('code_challenge_method')).toBe('S256');
+        expect(url.searchParams.get('code_challenge')).toBeTruthy();
+      });
+
+      it('stores the pending request including the PKCE code_verifier', async () => {
+        const state = await login();
+
+        const stored = JSON.parse(storage.items.get(PENDING_REQUEST_KEY)!);
+        expect(stored.state).toBe(state);
+        expect(stored.internal.code_verifier).toBeTruthy();
+      });
+
+      it('keeps only one pending login, however often the login is started', async () => {
+        await login();
+        await login();
+        await login();
+
+        expect([...storage.items.keys()]).toEqual([PENDING_REQUEST_KEY]);
+      });
+    });
+
+    describe('completing the login', () => {
+      it('delivers the code together with the matching request', async () => {
+        const state = await login();
+        const verifier = JSON.parse(storage.items.get(PENDING_REQUEST_KEY)!).internal.code_verifier;
+
+        await handler.completeAuthorizationRequestFromUrl(callback({code: 'auth-code', state}));
+
+        expect(listener).toHaveBeenCalledTimes(1);
+        const [request, response, error] = listener.calls.mostRecent().args;
+        expect(response?.code).toBe('auth-code');
+        expect(error).toBeNull();
+        expect(request.internal?.['code_verifier']).toBe(verifier);
+      });
+
+      it('closes the in-app browser when the callback arrives', async () => {
+        const state = await login();
+
+        await handler.completeAuthorizationRequestFromUrl(callback({code: 'auth-code', state}));
+
+        expect(browserClose).toHaveBeenCalled();
+      });
+
+      it('accepts a callback only once', async () => {
+        const state = await login();
+        const url = callback({code: 'auth-code', state});
+
+        await handler.completeAuthorizationRequestFromUrl(url);
+        expect(storage.items.has(PENDING_REQUEST_KEY)).toBeFalse();
+
+        await expectAsync(handler.completeAuthorizationRequestFromUrl(url)).toBeRejectedWithError(
+          /No pending authorization request/,
+        );
+        expect(listener).toHaveBeenCalledTimes(1);
+      });
+
+      it('rejects a callback with a different state and keeps the pending request', async () => {
+        const state = await login();
+
+        await expectAsync(
+          handler.completeAuthorizationRequestFromUrl(
+            callback({code: 'attacker-code', state: 'other-state'}),
+          ),
+        ).toBeRejectedWithError(/state does not match/);
+        expect(listener).not.toHaveBeenCalled();
+
+        // The real callback still works afterwards.
+        await handler.completeAuthorizationRequestFromUrl(callback({code: 'auth-code', state}));
+        expect(listener.calls.mostRecent().args[1]?.code).toBe('auth-code');
+      });
+
+      it('rejects a callback without state', async () => {
+        await login();
+
+        await expectAsync(
+          handler.completeAuthorizationRequestFromUrl(callback({code: 'auth-code'})),
+        ).toBeRejectedWithError(/state does not match/);
+        expect(listener).not.toHaveBeenCalled();
+      });
+
+      it('rejects a callback when no login was started', async () => {
+        await expectAsync(
+          handler.completeAuthorizationRequestFromUrl(callback({code: 'auth-code', state: 'any-state'})),
+        ).toBeRejectedWithError(/No pending authorization request/);
+        expect(listener).not.toHaveBeenCalled();
+      });
+
+      it('delivers an error response from the IdP and ends the pending request', async () => {
+        const state = await login();
+
+        await handler.completeAuthorizationRequestFromUrl(
+          callback({error: 'access_denied', error_description: 'User cancelled', state}),
+        );
+
+        const [, response, error] = listener.calls.mostRecent().args;
+        expect(response).toBeNull();
+        expect(error?.error).toBe('access_denied');
+        expect(error?.errorDescription).toBe('User cancelled');
+        expect(storage.items.has(PENDING_REQUEST_KEY)).toBeFalse();
+      });
+
+      it('rejects a callback with neither code nor error', async () => {
+        const state = await login();
+
+        await expectAsync(
+          handler.completeAuthorizationRequestFromUrl(callback({state})),
+        ).toBeRejectedWithError(/neither an authorization code nor an error/);
+        expect(listener).not.toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe('on the web', () => {
+    let handler: CapacitorAuthorizationRequestHandler;
+    let listener: AuthorizationListener;
+    let openAuthorizationUrl: jasmine.Spy<(url: string) => Promise<void>>;
+
+    const login = () => startLogin(handler, WEB_REDIRECT_URI);
+    const callback = (parameters: Record<string, string>) => callbackUrl(WEB_REDIRECT_URI, parameters);
+
+    beforeEach(() => {
+      for (const key of appAuthKeys()) localStorage.removeItem(key);
+
+      // Same setup as AuthProvider on the web: localStorage, page redirect, nothing to close.
+      // The redirect is a spy, so the test does not actually leave the page.
+      openAuthorizationUrl = jasmine.createSpy('openAuthorizationUrl').and.resolveTo();
+      handler = new CapacitorAuthorizationRequestHandler(
+        new LocalStorageBackend(),
+        openAuthorizationUrl,
+        async () => {},
+      );
+      listener = listenForResults(handler);
+    });
+
+    afterEach(() => {
+      for (const key of appAuthKeys()) localStorage.removeItem(key);
+    });
+
+    it('opens the IdP login through the given function (page redirect)', async () => {
+      const state = await login();
+
+      const url = new URL(openAuthorizationUrl.calls.mostRecent().args[0]);
+      expect(url.searchParams.get('state')).toBe(state);
+      expect(url.searchParams.get('code_challenge_method')).toBe('S256');
+    });
+
+    it('keeps only one pending login, however often the login is started', async () => {
+      await login();
+      await login();
+      await login();
+
+      expect(appAuthKeys()).toEqual([PENDING_REQUEST_KEY]);
+    });
+
+    it('completes the login from the callback page URL and leaves nothing behind', async () => {
+      const state = await login();
+
+      await handler.completeAuthorizationRequestFromUrl(callback({code: 'auth-code', state}));
+
+      expect(listener.calls.mostRecent().args[1]?.code).toBe('auth-code');
+      expect(appAuthKeys()).toEqual([]);
+    });
+
+    it('only accepts the callback of the latest login', async () => {
+      const firstState = await login();
+      const latestState = await login();
+
+      await expectAsync(
+        handler.completeAuthorizationRequestFromUrl(callback({code: 'old', state: firstState})),
+      ).toBeRejectedWithError(/state does not match/);
+
+      await handler.completeAuthorizationRequestFromUrl(callback({code: 'new', state: latestState}));
+      expect(listener.calls.mostRecent().args[1]?.code).toBe('new');
+    });
+
+    it('reports an opened callback without a pending login instead of waiting forever', async () => {
+      await expectAsync(
+        handler.completeAuthorizationRequestFromUrl(callback({code: 'bookmarked', state: 'old'})),
+      ).toBeRejectedWithError(/No pending authorization request/);
+    });
+  });
+});

frontend/app/src/app/modules/auth/capacitor-authorization-request-handler.ts

@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {Browser} from '@capacitor/browser';
+import {
+  AuthorizationError,
+  AuthorizationErrorJson,
+  AuthorizationRequest,
+  AuthorizationRequestHandler,
+  AuthorizationRequestJson,
+  AuthorizationRequestResponse,
+  AuthorizationResponse,
+  AuthorizationResponseJson,
+  AuthorizationServiceConfiguration,
+  BasicQueryStringUtils,
+  DefaultCrypto,
+  StorageBackend,
+  StringMap,
+} from '@openid/appauth';
+
+const AUTHORIZATION_REQUEST_KEY = 'appauth_capacitor_authorization_request';
+
+/**
+ * AppAuth authorization request handler for the native apps and the web.
+ *
+ * AppAuth-JS handles:
+ * - state generation and validation data
+ * - PKCE code_verifier / code_challenge
+ * - authorization URL construction
+ * - AuthorizationNotifier
+ *
+ * This handler adds:
+ * - persist the pending authorization request
+ * - open the authorization URL (native: @capacitor/browser, web: page redirect)
+ * - process the callback URL (native: delivered through appUrlOpen,
+ *   web: the URL of the callback page)
+ *
+ * The pending request is stored under one fixed key, so each new login
+ * replaces a canceled one instead of leaving it behind.
+ */
+export class CapacitorAuthorizationRequestHandler extends AuthorizationRequestHandler {
+  private callbackUrl?: string;
+
+  /**
+   * @param storage Where the pending request is kept until the callback.
+   * @param openAuthorizationUrl Opens the IdP login (default: Capacitor browser).
+   * @param closeBrowser Closes it after the callback (default: Capacitor browser).
+   */
+  constructor(
+    private readonly storage: StorageBackend,
+    private readonly openAuthorizationUrl: (url: string) => Promise<void> = async url => {
+      await Browser.open({url});
+    },
+    private readonly closeBrowser: () => Promise<void> = async () => {
+      await Browser.close();
+    },
+  ) {
+    super(new BasicQueryStringUtils(), new DefaultCrypto());
+  }
+
+  public async performAuthorizationRequest(
+    configuration: AuthorizationServiceConfiguration,
+    request: AuthorizationRequest,
+  ): Promise<void> {
+    /*
+     * Important:
+     *
+     * toJson() calls setupCodeVerifier() internally.
+     * Therefore PKCE is initialized before buildRequestUrl()
+     * constructs the authorization URL.
+     */
+    const requestJson = await request.toJson();
+
+    await this.storage.setItem(AUTHORIZATION_REQUEST_KEY, JSON.stringify(requestJson));
+
+    const url = this.buildRequestUrl(configuration, request);
+
+    await this.openAuthorizationUrl(url);
+  }
+
+  /**
+   * Completes the authorization flow using the URL received from
+   * Capacitor's App.addListener('appUrlOpen', ...).
+   */
+  public async completeAuthorizationRequestFromUrl(callbackUrl: string): Promise<void> {
+    this.callbackUrl = callbackUrl;
+
+    /*
+     * The deep link has returned control to the application.
+     * Close the SFSafariViewController / Custom Tab if it is still open.
+     */
+    try {
+      await this.closeBrowser();
+    } catch {
+      // Browser might already have been closed by the platform.
+    }
+
+    await this.completeAuthorizationRequestIfPossible();
+  }
+
+  protected async completeAuthorizationRequest(): Promise<AuthorizationRequestResponse | null> {
+    if (!this.callbackUrl) {
+      // eslint-disable-next-line unicorn/no-null -- AppAuth's AuthorizationRequestHandler contract
+      return null;
+    }
+
+    const storedRequest = await this.storage.getItem(AUTHORIZATION_REQUEST_KEY);
+
+    if (!storedRequest) {
+      this.callbackUrl = undefined;
+
+      throw new Error('No pending authorization request found.');
+    }
+
+    const requestJson = JSON.parse(storedRequest) as AuthorizationRequestJson;
+
+    /*
+     * The serialized request also contains `internal`, including
+     * AppAuth's PKCE code_verifier.
+     */
+    const request = new AuthorizationRequest(requestJson);
+
+    const parameters = this.parseCallbackUrl(this.callbackUrl);
+
+    const state = parameters['state'];
+
+    /*
+     * Never accept an authorization response for a different request.
+     */
+    if (!state || state !== request.state) {
+      this.callbackUrl = undefined;
+
+      throw new Error('Authorization response state does not match the authorization request.');
+    }
+
+    const error = parameters['error'];
+
+    let response: // eslint-disable-next-line unicorn/no-null -- AppAuth's AuthorizationRequestHandler contract
+    AuthorizationResponse | null = null;
+
+    let authorizationError: // eslint-disable-next-line unicorn/no-null -- AppAuth's AuthorizationRequestHandler contract
+    AuthorizationError | null = null;
+
+    if (error) {
+      const errorJson: AuthorizationErrorJson = {
+        error,
+
+        error_description: parameters['error_description'],
+
+        error_uri: parameters['error_uri'],
+
+        state,
+      };
+
+      authorizationError = new AuthorizationError(errorJson);
+    } else {
+      const code = parameters['code'];
+
+      if (!code) {
+        this.callbackUrl = undefined;
+
+        throw new Error('Authorization callback contains neither an authorization code nor an error.');
+      }
+
+      const responseJson: AuthorizationResponseJson = {
+        code,
+        state,
+      };
+
+      response = new AuthorizationResponse(responseJson);
+    }
+
+    /*
+     * The response has been successfully associated with the
+     * pending request. It can now be consumed exactly once.
+     */
+    await this.storage.removeItem(AUTHORIZATION_REQUEST_KEY);
+
+    this.callbackUrl = undefined;
+
+    return {
+      request,
+      response,
+      error: authorizationError,
+    };
+  }
+
+  private parseCallbackUrl(callbackUrl: string): StringMap {
+    const result: StringMap = {};
+
+    const url = new URL(callbackUrl);
+
+    /*
+     * Authorization Code Flow normally returns code/state in
+     * the query string:
+     *
+     *   openstapps:/callback?code=...&state=...
+     */
+    for (const [key, value] of url.searchParams.entries()) {
+      result[key] = value;
+    }
+
+    /*
+     * Also accept parameters in the fragment as a fallback.
+     */
+    if (url.hash.length > 1) {
+      const hash = url.hash.slice(1);
+
+      const hashParameters = new URLSearchParams(hash);
+
+      for (const [key, value] of hashParameters.entries()) {
+        if (!(key in result)) {
+          result[key] = value;
+        }
+      }
+    }
+
+    return result;
+  }
+}

frontend/app/src/app/modules/auth/capacitor-requestor.ts

@@ -13,61 +13,89 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {Requestor} from '@openid/appauth';
+import {AppAuthError, Requestor} from '@openid/appauth';
-import {CapacitorHttp, HttpHeaders, HttpResponse} from '@capacitor/core';
+import {CapacitorHttp, HttpHeaders, HttpOptions} from '@capacitor/core';
-import {XhrSettings} from 'ionic-appauth/lib/cordova';
 
-// REQUIRES CAPACITOR PLUGIN
+type XhrSettings = Parameters<Requestor['xhr']>[0];
-// @capacitor-community/http
-export class CapacitorRequestor extends Requestor {
-  constructor() {
-    super();
-  }
 
+export class CapacitorRequestor implements Requestor {
   public async xhr<T>(settings: XhrSettings): Promise<T> {
-    if (!settings.method) settings.method = 'GET';
+    if (!settings.url) {
+      throw new AppAuthError('A URL must be provided.');
+    }
 
-    switch (settings.method) {
+    const method = (settings.method ?? 'GET').toUpperCase();
-      case 'GET': {
+    const url = new URL(settings.url);
-        return this.get(settings.url, settings.headers);
+
-      }
+    let data: unknown;
-      case 'POST': {
+
-        return this.post(settings.url, settings.data, settings.headers);
+    if (settings.data) {
-      }
+      if (method === 'POST') {
-      case 'PUT': {
+        data = settings.data;
-        return this.put(settings.url, settings.data, settings.headers);
+      } else {
-      }
+        const searchParameters = new URLSearchParams(settings.data);
-      case 'DELETE': {
+
-        return this.delete(settings.url, settings.headers);
+        for (const [key, value] of searchParameters.entries()) {
+          url.searchParams.append(key, value);
+        }
       }
     }
-  }
 
-  private async get<T>(url: string, headers: HttpHeaders) {
+    const options: HttpOptions = {
-    return CapacitorHttp.get({url, headers}).then((response: HttpResponse) => response.data as T);
+      url: url.toString(),
-  }
+      method,
-
+      headers: this.getHeaders(settings.headers),
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private async post<T>(url: string, data: any, headers: HttpHeaders) {
-    return CapacitorHttp.post({
-      url,
       data,
-      headers,
+    };
-    }).then((response: HttpResponse) => {
+
-      return response.data as T;
+    if (settings.dataType?.toLowerCase() === 'json') {
-    });
+      options.responseType = 'json';
+    }
+
+    const response = await CapacitorHttp.request(options);
+
+    if (response.status < 200 || response.status >= 300) {
+      const body = this.parseBody(response.data);
+
+      /*
+       * Use the OAuth error code (e.g. 'invalid_grant') as message when the
+       * server sent one (RFC 6749, 5.2), so callers can tell a rejected
+       * refresh token apart from temporary failures.
+       */
+      throw new AppAuthError(
+        typeof body?.error === 'string' ? body.error : `HTTP ${response.status}`,
+        body ?? response.data,
+      );
+    }
+
+    return response.data as T;
   }
 
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  private parseBody(data: unknown): Record<string, unknown> | undefined {
-  private async put<T>(url: string, data: any, headers: HttpHeaders) {
+    if (typeof data === 'string') {
-    return CapacitorHttp.put({
+      try {
-      url,
+        data = JSON.parse(data);
-      data,
+      } catch {
-      headers,
+        return undefined;
-    }).then((response: HttpResponse) => response.data as T);
+      }
+    }
+
+    return data !== null && typeof data === 'object' ? (data as Record<string, unknown>) : undefined;
   }
 
-  private async delete<T>(url: string, headers: HttpHeaders) {
+  private getHeaders(headers: XhrSettings['headers']): HttpHeaders {
-    return CapacitorHttp.delete({url, headers}).then((response: HttpResponse) => response.data as T);
+    const result: HttpHeaders = {};
+
+    if (!headers) {
+      return result;
+    }
+
+    for (const [key, value] of Object.entries(headers)) {
+      if (value !== undefined && value !== null) {
+        result[key] = String(value);
+      }
+    }
+
+    return result;
   }
 }

frontend/app/src/app/modules/auth/default-auth.service.spec.ts

@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-import {TestBed} from '@angular/core/testing';
-import {ConfigProvider} from '../config/config.provider';
-import {StorageProvider} from '../storage/storage.provider';
-import {DefaultAuthService} from './default-auth.service';
-import {Browser} from 'ionic-appauth';
-import {nowInSeconds, Requestor, StorageBackend} from '@openid/appauth';
-import {TranslateService} from '@ngx-translate/core';
-import {StAppsWebHttpClient} from '../data/stapps-web-http-client.provider';
-import {provideHttpClient, withInterceptorsFromDi} from '@angular/common/http';
-import {IonicStorage} from 'ionic-appauth/lib';
-import {RouterModule} from '@angular/router';
-import {LoggerTestingModule} from 'ngx-logger/testing';
-
-describe('AuthService', () => {
-  let defaultAuthService: DefaultAuthService;
-  let storageBackendSpy: jasmine.SpyObj<StorageBackend>;
-  const storageProviderSpy = jasmine.createSpyObj('StorageProvider', ['init', 'get', 'has', 'put', 'search']);
-  const translateServiceSpy = jasmine.createSpyObj('TranslateService', ['setDefaultLang', 'use']);
-
-  beforeEach(() => {
-    storageBackendSpy = jasmine.createSpyObj('StorageBackend', ['getItem']);
-
-    TestBed.configureTestingModule({
-      imports: [LoggerTestingModule, RouterModule.forRoot([])],
-      providers: [
-        StAppsWebHttpClient,
-        {
-          provide: TranslateService,
-          useValue: translateServiceSpy,
-        },
-        {
-          provide: StorageProvider,
-          useValue: storageProviderSpy,
-        },
-        IonicStorage,
-        ConfigProvider,
-        Browser,
-        {
-          provide: StorageBackend,
-          useValue: storageBackendSpy,
-        },
-        Requestor,
-        provideHttpClient(withInterceptorsFromDi()),
-      ],
-    });
-    defaultAuthService = TestBed.inject(DefaultAuthService);
-  });
-
-  describe('loadTokenFromStorage', () => {
-    it('should provide false through isAuthenticated$ when there is no token response', async () => {
-      // eslint-disable-next-line unicorn/no-null
-      storageBackendSpy.getItem.and.returnValue(Promise.resolve(null));
-      let loggedInHolder;
-      defaultAuthService.isAuthenticated$.subscribe(loggedIn => {
-        loggedInHolder = loggedIn;
-      });
-      await defaultAuthService.loadTokenFromStorage();
-
-      expect(loggedInHolder).toBeFalse();
-    });
-
-    it('should provide true through isAuthenticated$ when access token is valid', async () => {
-      const validToken = `{"access_token":"AT-XXXX","refresh_token":"RT-XXXX","scope":"","token_type":"bearer","issued_at":${nowInSeconds()},"expires_in":"${
-        8 * 60 * 60
-      }"}`;
-      storageBackendSpy.getItem.and.returnValue(Promise.resolve(validToken));
-      let loggedInHolder;
-      defaultAuthService.isAuthenticated$.subscribe(loggedIn => {
-        loggedInHolder = loggedIn;
-      });
-      await defaultAuthService.loadTokenFromStorage();
-
-      expect(loggedInHolder).toBeTrue();
-    });
-
-    it('should provide false through isAuthenticated$ when access token is invalid', async () => {
-      const invalidToken = `{"access_token":"AT-INVALID-XXXX","refresh_token":"RT-XXXX","scope":"","token_type":"bearer","issued_at":${
-        nowInSeconds() - 9 * 60 * 60
-      },"expires_in":"${8 * 60 * 60}"}`;
-      storageBackendSpy.getItem.and.returnValue(Promise.resolve(invalidToken));
-      let loggedInHolder;
-      defaultAuthService.isAuthenticated$.subscribe(loggedIn => {
-        loggedInHolder = loggedIn;
-      });
-      await defaultAuthService.loadTokenFromStorage();
-
-      expect(loggedInHolder).toBeFalse();
-    });
-  });
-});

frontend/app/src/app/modules/auth/default-auth.service.ts

@@ -1,91 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {
-  AuthorizationRequestHandler,
-  AuthorizationServiceConfiguration,
-  JQueryRequestor,
-  LocalStorageBackend,
-  Requestor,
-  StorageBackend,
-  TokenRequestHandler,
-} from '@openid/appauth';
-import {AuthActionBuilder, Browser, DefaultBrowser, EndSessionHandler, UserInfoHandler} from 'ionic-appauth';
-import {ConfigProvider} from '../config/config.provider';
-import {SCAuthorizationProvider} from '@openstapps/core';
-import {getClientConfig, getEndpointsConfig} from './auth.provider.methods';
-import {Injectable} from '@angular/core';
-import {AuthService} from './auth.service';
-
-const TOKEN_RESPONSE_KEY = 'token_response';
-
-@Injectable({
-  providedIn: 'root',
-})
-export class DefaultAuthService extends AuthService {
-  public localConfiguration: AuthorizationServiceConfiguration;
-
-  protected tokenHandler: TokenRequestHandler;
-
-  protected userInfoHandler: UserInfoHandler;
-
-  protected requestHandler: AuthorizationRequestHandler;
-
-  protected endSessionHandler: EndSessionHandler;
-
-  constructor(
-    protected browser: Browser = new DefaultBrowser(),
-    protected storage: StorageBackend = new LocalStorageBackend(),
-    protected requestor: Requestor = new JQueryRequestor(),
-    private readonly configProvider: ConfigProvider,
-  ) {
-    super(browser, storage, requestor);
-  }
-
-  get configuration(): Promise<AuthorizationServiceConfiguration> {
-    if (!this.localConfiguration) throw new Error('Local Configuration Not Defined');
-
-    return Promise.resolve(this.localConfiguration);
-  }
-
-  public async init() {
-    this.setupConfiguration();
-    this.setupAuthorizationNotifier();
-    await this.loadTokenFromStorage();
-  }
-
-  setupConfiguration() {
-    const authConfig = this.configProvider.getAnyValue('auth') as {
-      default: SCAuthorizationProvider;
-    };
-    this.authConfig = getClientConfig('default', authConfig);
-    this.localConfiguration = new AuthorizationServiceConfiguration(
-      getEndpointsConfig('default', authConfig),
-    );
-  }
-
-  public async signOut() {
-    await this.revokeTokens().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignOutFailed(error));
-    });
-    this.notifyActionListers(AuthActionBuilder.SignOutSuccess());
-  }
-
-  public async revokeTokens() {
-    // Note: only locally
-    await this.storage.removeItem(TOKEN_RESPONSE_KEY);
-    this.notifyActionListers(AuthActionBuilder.RevokeTokensSuccess());
-  }
-}

frontend/app/src/app/modules/auth/factories/requestor.factory.ts

@@ -13,11 +13,10 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {HttpClient} from '@angular/common/http';
 import {Platform} from '@ionic/angular/standalone';
+import {FetchRequestor, Requestor} from '@openid/appauth';
 import {CapacitorRequestor} from '../capacitor-requestor';
-import {NgHttpService} from '../ng-http.service';
 
-export const httpFactory = (platform: Platform, httpClient: HttpClient) => {
+export const requestorFactory = (platform: Platform): Requestor => {
-  return platform.is('capacitor') ? new CapacitorRequestor() : new NgHttpService(httpClient);
+  return platform.is('capacitor') ? new CapacitorRequestor() : new FetchRequestor();
 };

frontend/app/src/app/modules/auth/factories/storage.factory.ts

@@ -14,9 +14,9 @@
  */
 
 import {Platform} from '@ionic/angular/standalone';
-import {IonicStorage} from 'ionic-appauth/lib';
+import {LocalStorageBackend, StorageBackend} from '@openid/appauth';
 import {SafeCapacitorSecureStorage} from '../../storage/capacitor-secure-storage';
 
-export const storageFactory = (platform: Platform) => {
+export const storageFactory = (platform: Platform): StorageBackend => {
-  return platform.is('capacitor') ? new SafeCapacitorSecureStorage() : new IonicStorage();
+  return platform.is('capacitor') ? new SafeCapacitorSecureStorage() : new LocalStorageBackend();
 };

frontend/app/src/app/modules/auth/ng-http.service.ts

@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {Injectable} from '@angular/core';
-import {Requestor} from '@openid/appauth';
-import {HttpClient, HttpHeaders} from '@angular/common/http';
-import {XhrSettings} from 'ionic-appauth/lib/cordova';
-import {firstValueFrom, Observable} from 'rxjs';
-
-@Injectable({
-  providedIn: 'root',
-})
-export class NgHttpService implements Requestor {
-  constructor(private http: HttpClient) {}
-
-  public async xhr<T>(settings: XhrSettings): Promise<T> {
-    if (!settings.method) {
-      settings.method = 'GET';
-    }
-
-    let observable: Observable<T>;
-
-    switch (settings.method) {
-      case 'GET': {
-        observable = this.http.get<T>(settings.url, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-      case 'POST': {
-        observable = this.http.post<T>(settings.url, settings.data, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-      case 'PUT': {
-        observable = this.http.put<T>(settings.url, settings.data, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-      case 'DELETE': {
-        observable = this.http.delete<T>(settings.url, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-    }
-
-    return firstValueFrom(observable);
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private getHeaders(headers: any): HttpHeaders {
-    let httpHeaders: HttpHeaders = new HttpHeaders();
-
-    if (headers !== undefined) {
-      for (const key of Object.keys(headers)) {
-        httpHeaders = httpHeaders.append(key, headers[key]);
-      }
-    }
-
-    return httpHeaders;
-  }
-}

frontend/app/src/app/modules/auth/paia/authorization-request-handler.ts

@@ -1,197 +0,0 @@
-/*
- * Copyright (C) 2022 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {
-  StorageBackend,
-  BasicQueryStringUtils,
-  DefaultCrypto,
-  AuthorizationServiceConfiguration,
-  AuthorizationRequest,
-  StringMap,
-  AuthorizationError,
-  AuthorizationErrorJson,
-  BUILT_IN_PARAMETERS,
-} from '@openid/appauth';
-import {Browser} from 'ionic-appauth';
-import {PAIAAuthorizationNotifier} from './paia-authorization-notifier';
-import {PAIAAuthorizationRequestResponse} from './authorization-request-response';
-import {PAIAAuthorizationResponse, PAIAAuthorizationResponseJson} from './paia-authorization-response';
-
-/** key for authorization request. */
-const authorizationRequestKey = (handle: string) => {
-  return `${handle}_appauth_authorization_request`;
-};
-
-/** key in local storage which represents the current authorization request. */
-const AUTHORIZATION_REQUEST_HANDLE_KEY = 'appauth_current_authorization_request';
-export const AUTHORIZATION_RESPONSE_KEY = 'auth_response';
-
-export class PAIAAuthorizationRequestHandler {
-  notifier: PAIAAuthorizationNotifier;
-
-  constructor(
-    private browser: Browser,
-    private storage: StorageBackend,
-    public utils = new BasicQueryStringUtils(),
-    protected crypto = new Crypto(),
-    private generateRandom = new DefaultCrypto(),
-  ) {}
-
-  public async performAuthorizationRequest(
-    configuration: AuthorizationServiceConfiguration,
-    request: AuthorizationRequest,
-  ): Promise<void> {
-    const handle = this.generateRandom.generateRandom(10);
-    await this.storage.setItem(AUTHORIZATION_REQUEST_HANDLE_KEY, handle);
-    await this.storage.setItem(authorizationRequestKey(handle), JSON.stringify(await request.toJson()));
-    const url = this.buildRequestUrl(configuration, request);
-    const returnedUrl: string | undefined = await this.browser.showWindow(url, request.redirectUri);
-
-    // callback may come from showWindow or via another method
-    if (returnedUrl !== undefined) {
-      await this.storage.setItem(AUTHORIZATION_RESPONSE_KEY, returnedUrl);
-      await this.completeAuthorizationRequestIfPossible();
-    }
-  }
-
-  protected async completeAuthorizationRequest(): Promise<PAIAAuthorizationRequestResponse> {
-    const handle = await this.storage.getItem(AUTHORIZATION_REQUEST_HANDLE_KEY);
-
-    if (!handle) {
-      throw new Error('Handle Not Available');
-    }
-
-    const request: AuthorizationRequest = this.getAuthorizationRequest(
-      await this.storage.getItem(authorizationRequestKey(handle)),
-    );
-    const queryParameters = this.getQueryParams(await this.storage.getItem(AUTHORIZATION_RESPONSE_KEY));
-    void this.removeItemsFromStorage(handle);
-
-    const state: string | undefined = queryParameters['state'];
-    const error: string | undefined = queryParameters['error'];
-
-    if (state !== request.state) {
-      throw new Error('State Does Not Match');
-    }
-
-    return <PAIAAuthorizationRequestResponse>{
-      request: request, // request
-      response: error ? undefined : this.getAuthorizationResponse(queryParameters),
-      error: error ? this.getAuthorizationError(queryParameters) : undefined,
-    };
-  }
-
-  private getAuthorizationRequest(authRequest: string | null): AuthorizationRequest {
-    if (authRequest == undefined) {
-      throw new Error('No Auth Request Available');
-    }
-
-    return new AuthorizationRequest(JSON.parse(authRequest));
-  }
-
-  private getAuthorizationError(queryParameters: StringMap): AuthorizationError {
-    const authorizationErrorJSON: AuthorizationErrorJson = {
-      error: queryParameters['error'],
-      error_description: queryParameters['error_description'],
-      error_uri: undefined,
-      state: queryParameters['state'],
-    };
-    return new AuthorizationError(authorizationErrorJSON);
-  }
-
-  private getAuthorizationResponse(queryParameters: StringMap): PAIAAuthorizationResponse {
-    const authorizationResponseJSON: PAIAAuthorizationResponseJson = {
-      code: queryParameters['code'],
-      patron: queryParameters['patron'],
-      // TODO: currently PAIA is not providing state
-      state: queryParameters['state'] ?? '',
-    };
-    return new PAIAAuthorizationResponse(authorizationResponseJSON);
-  }
-
-  private async removeItemsFromStorage(handle: string): Promise<void> {
-    await this.storage.removeItem(AUTHORIZATION_REQUEST_HANDLE_KEY);
-    await this.storage.removeItem(authorizationRequestKey(handle));
-    await this.storage.removeItem(AUTHORIZATION_RESPONSE_KEY);
-  }
-
-  private getQueryParams(authResponse: string | null): StringMap {
-    if (authResponse == undefined) {
-      return {};
-    } else {
-      const querySide: string = authResponse.split('#')[0];
-      const parts: string[] = querySide.split('?');
-      if (parts.length !== 2) throw new Error('Invalid auth response string');
-      const hash = parts[1];
-      return this.utils.parseQueryString(hash);
-    }
-  }
-
-  setAuthorizationNotifier(notifier: PAIAAuthorizationNotifier): PAIAAuthorizationRequestHandler {
-    this.notifier = notifier;
-    return this;
-  }
-
-  completeAuthorizationRequestIfPossible(): Promise<void> {
-    // call complete authorization if possible to see there might
-    // be a response that needs to be delivered.
-    console.log(`Checking to see if there is an authorization response to be delivered.`);
-    if (!this.notifier) {
-      console.log(`Notifier is not present on AuthorizationRequest handler.
-            No delivery of result will be possible`);
-    }
-    return this.completeAuthorizationRequest().then(result => {
-      if (!result) {
-        console.log(`No result is available yet.`);
-      }
-      if (result && this.notifier) {
-        this.notifier.onAuthorizationComplete(result.request, result.response, result.error);
-      }
-    });
-  }
-
-  /**
-   * A utility method to be able to build the authorization request URL.
-   */
-  protected buildRequestUrl(configuration: AuthorizationServiceConfiguration, request: AuthorizationRequest) {
-    // build the query string
-    // coerce to any type for convenience
-    const requestMap: StringMap = {
-      redirect_uri: request.redirectUri,
-      client_id: request.clientId,
-      response_type: request.responseType,
-      state: request.state,
-      scope: request.scope,
-    };
-
-    // copy over extras
-    if (request.extras) {
-      for (const extra in request.extras) {
-        if (
-          request.extras.hasOwnProperty(extra) && // check before inserting to requestMap
-          !BUILT_IN_PARAMETERS.includes(extra)
-        ) {
-          requestMap[extra] = request.extras[extra];
-        }
-      }
-    }
-
-    const query = this.utils.stringify(requestMap);
-    const baseUrl = configuration.authorizationEndpoint;
-
-    // required encoding (PAIA specific)
-    return `${baseUrl}?${encodeURIComponent(query)}`;
-  }
-}

frontend/app/src/app/modules/auth/paia/authorization-request-response.ts

@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2021 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {AuthorizationError, AuthorizationRequest} from '@openid/appauth';
-import {PAIAAuthorizationResponse} from './paia-authorization-response';
-
-/**
- * Represents a structural type holding both authorization request and response.
- */
-export interface PAIAAuthorizationRequestResponse {
-  request: AuthorizationRequest;
-  response: PAIAAuthorizationResponse | null;
-  error: AuthorizationError | null;
-}

frontend/app/src/app/modules/auth/paia/paia-auth-action.ts

@@ -1,75 +0,0 @@
-/*
- * Copyright (C) 2022 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {PAIATokenResponse} from './paia-token-response';
-import {AuthActionBuilder, IAuthAction} from 'ionic-appauth';
-
-export interface IPAIAAuthAction extends IAuthAction {
-  tokenResponse?: PAIATokenResponse;
-}
-
-export class PAIAAuthActionBuilder extends AuthActionBuilder {
-  public static Init(): IPAIAAuthAction {
-    return AuthActionBuilder.Init() as IPAIAAuthAction;
-  }
-
-  public static SignOutSuccess(): IPAIAAuthAction {
-    return AuthActionBuilder.SignOutSuccess() as IPAIAAuthAction;
-  }
-
-  public static SignOutFailed(error: Error): IPAIAAuthAction {
-    return AuthActionBuilder.SignOutFailed(error) as IPAIAAuthAction;
-  }
-
-  public static RefreshSuccess(tokenResponse: PAIATokenResponse): IPAIAAuthAction {
-    return AuthActionBuilder.RefreshSuccess(tokenResponse) as IPAIAAuthAction;
-  }
-
-  public static RefreshFailed(error: Error): IPAIAAuthAction {
-    return AuthActionBuilder.RefreshFailed(error) as IPAIAAuthAction;
-  }
-
-  public static SignInSuccess(tokenResponse: PAIATokenResponse): IPAIAAuthAction {
-    return AuthActionBuilder.SignInSuccess(tokenResponse) as IPAIAAuthAction;
-  }
-
-  public static SignInFailed(error: Error): IPAIAAuthAction {
-    return AuthActionBuilder.SignInFailed(error) as IPAIAAuthAction;
-  }
-
-  public static LoadTokenFromStorageSuccess(tokenResponse: PAIATokenResponse): IPAIAAuthAction {
-    return AuthActionBuilder.LoadTokenFromStorageSuccess(tokenResponse) as IPAIAAuthAction;
-  }
-
-  public static LoadTokenFromStorageFailed(error: Error): IPAIAAuthAction {
-    return AuthActionBuilder.LoadTokenFromStorageFailed(error) as IPAIAAuthAction;
-  }
-
-  public static RevokeTokensSuccess(): IPAIAAuthAction {
-    return AuthActionBuilder.RevokeTokensSuccess() as IPAIAAuthAction;
-  }
-
-  public static RevokeTokensFailed(error: Error): IPAIAAuthAction {
-    return AuthActionBuilder.RevokeTokensFailed(error) as IPAIAAuthAction;
-  }
-
-  public static LoadUserInfoSuccess(user: Error): IPAIAAuthAction {
-    return AuthActionBuilder.LoadUserInfoSuccess(user) as IPAIAAuthAction;
-  }
-
-  public static LoadUserInfoFailed(error: Error): IPAIAAuthAction {
-    return AuthActionBuilder.LoadUserInfoFailed(error) as IPAIAAuthAction;
-  }
-}

frontend/app/src/app/modules/auth/paia/paia-auth.service.ts

@@ -1,365 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {
-  AuthorizationError,
-  AuthorizationRequest,
-  AuthorizationRequestJson,
-  AuthorizationServiceConfiguration,
-  BasicQueryStringUtils,
-  DefaultCrypto,
-  JQueryRequestor,
-  LocalStorageBackend,
-  Requestor,
-  StorageBackend,
-  StringMap,
-  TokenResponse,
-} from '@openid/appauth';
-import {
-  AuthActions,
-  AUTHORIZATION_RESPONSE_KEY,
-  AuthSubject,
-  Browser,
-  DefaultBrowser,
-  EndSessionHandler,
-  IAuthConfig,
-  IonicEndSessionHandler,
-  IonicUserInfoHandler,
-  UserInfoHandler,
-} from 'ionic-appauth';
-import {BehaviorSubject, Observable} from 'rxjs';
-import {PAIATokenRequestHandler} from './token-request-handler';
-import {PAIAAuthorizationRequestHandler} from './authorization-request-handler';
-import {PAIATokenRequest, PAIATokenRequestJson} from './paia-token-request';
-import {PAIAAuthorizationResponse} from './paia-authorization-response';
-import {PAIAAuthorizationNotifier} from './paia-authorization-notifier';
-import {PAIATokenResponse} from './paia-token-response';
-import {IPAIAAuthAction, PAIAAuthActionBuilder} from './paia-auth-action';
-import {SCAuthorizationProvider} from '@openstapps/core';
-import {ConfigProvider} from '../../config/config.provider';
-import {getClientConfig, getEndpointsConfig} from '../auth.provider.methods';
-import {Injectable} from '@angular/core';
-
-const TOKEN_RESPONSE_KEY = 'paia_token_response';
-const AUTH_EXPIRY_BUFFER = 10 * 60 * -1; // 10 minutes in seconds
-
-export interface IAuthService {
-  signIn(authExtras?: StringMap, state?: string): void;
-  signOut(state?: string, revokeTokens?: boolean): void;
-  loadUserInfo(): void;
-  authorizationCallback(callbackUrl: string): void;
-  loadTokenFromStorage(): void;
-  getValidToken(buffer?: number): Promise<PAIATokenResponse>;
-}
-
-@Injectable({
-  providedIn: 'root',
-})
-export class PAIAAuthService {
-  private _authConfig?: IAuthConfig;
-
-  private _authSubject: AuthSubject = new AuthSubject();
-
-  private _authSubjectV2 = new BehaviorSubject<IPAIAAuthAction>(PAIAAuthActionBuilder.Init());
-
-  private _tokenSubject = new BehaviorSubject<PAIATokenResponse | undefined>(undefined);
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private _userSubject = new BehaviorSubject<any>(undefined);
-
-  private _authenticatedSubject = new BehaviorSubject<boolean>(false);
-
-  private _loggedIn = new BehaviorSubject<boolean>(false);
-
-  private _initComplete = new BehaviorSubject<boolean>(false);
-
-  protected tokenHandler: PAIATokenRequestHandler;
-
-  protected userInfoHandler: UserInfoHandler;
-
-  protected requestHandler: PAIAAuthorizationRequestHandler;
-
-  protected endSessionHandler: EndSessionHandler;
-
-  public localConfiguration: AuthorizationServiceConfiguration;
-
-  constructor(
-    protected browser: Browser = new DefaultBrowser(),
-    protected storage: StorageBackend = new LocalStorageBackend(),
-    protected requestor: Requestor = new JQueryRequestor(),
-    private readonly configProvider: ConfigProvider,
-  ) {
-    this.tokenHandler = new PAIATokenRequestHandler(requestor);
-    this.userInfoHandler = new IonicUserInfoHandler(requestor);
-    this.requestHandler = new PAIAAuthorizationRequestHandler(
-      browser,
-      storage,
-      new BasicQueryStringUtils(),
-      crypto,
-    );
-    this.endSessionHandler = new IonicEndSessionHandler(browser);
-  }
-
-  get token$(): Observable<PAIATokenResponse | undefined> {
-    return this._tokenSubject.asObservable();
-  }
-
-  get isAuthenticated$(): Observable<boolean> {
-    return this._authenticatedSubject.asObservable();
-  }
-
-  /**
-   * Similar to isAuthenticated$, but will also return true if the token is expired
-   */
-  get isLoggedIn$(): Observable<boolean> {
-    return this._loggedIn.asObservable();
-  }
-
-  get initComplete$(): Observable<boolean> {
-    return this._initComplete.asObservable();
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  get user$(): Observable<any> {
-    return this._userSubject.asObservable();
-  }
-
-  get events$(): Observable<IPAIAAuthAction> {
-    return this._authSubjectV2.asObservable();
-  }
-
-  get authConfig(): IAuthConfig {
-    if (!this._authConfig) throw new Error('AuthConfig Not Defined');
-
-    return this._authConfig;
-  }
-
-  set authConfig(value: IAuthConfig) {
-    this._authConfig = value;
-  }
-
-  get configuration(): Promise<AuthorizationServiceConfiguration> {
-    if (!this.localConfiguration) throw new Error('Local Configuration Not Defined');
-
-    return Promise.resolve(this.localConfiguration);
-  }
-
-  public async init() {
-    this.setupConfiguration();
-    this.setupAuthorizationNotifier();
-    await this.loadTokenFromStorage();
-  }
-
-  setupConfiguration() {
-    const authConfig = this.configProvider.getAnyValue('auth') as {
-      paia: SCAuthorizationProvider;
-    };
-    this.authConfig = getClientConfig('paia', authConfig);
-    this.localConfiguration = new AuthorizationServiceConfiguration(getEndpointsConfig('paia', authConfig));
-  }
-
-  protected notifyActionListers(action: IPAIAAuthAction) {
-    /* eslint-disable unicorn/no-useless-undefined */
-    switch (action.action) {
-      case AuthActions.SignInFailed:
-      case AuthActions.SignOutSuccess:
-      case AuthActions.SignOutFailed: {
-        this._tokenSubject.next(undefined);
-        this._userSubject.next(undefined);
-        this._authenticatedSubject.next(false);
-        this._loggedIn.next(false);
-        break;
-      }
-      case AuthActions.LoadTokenFromStorageFailed: {
-        this._tokenSubject.next(undefined);
-        this._userSubject.next(undefined);
-        this._authenticatedSubject.next(false);
-        this._loggedIn.next(false);
-        this._initComplete.next(true);
-        break;
-      }
-      case AuthActions.SignInSuccess: {
-        this._tokenSubject.next(action.tokenResponse);
-        this._authenticatedSubject.next(true);
-        this._loggedIn.next(true);
-        break;
-      }
-      case AuthActions.LoadTokenFromStorageSuccess: {
-        this._tokenSubject.next(action.tokenResponse);
-        this._authenticatedSubject.next((action.tokenResponse as TokenResponse).isValid(0));
-        this._loggedIn.next(true);
-        this._initComplete.next(true);
-        break;
-      }
-      case AuthActions.RevokeTokensSuccess: {
-        this._tokenSubject.next(undefined);
-        break;
-      }
-      case AuthActions.LoadUserInfoSuccess: {
-        this._userSubject.next(action.user);
-        break;
-      }
-      case AuthActions.LoadUserInfoFailed: {
-        this._userSubject.next(undefined);
-        break;
-      }
-    }
-
-    this._authSubjectV2.next(action);
-    this._authSubject.notify(action);
-  }
-
-  protected setupAuthorizationNotifier() {
-    const notifier = new PAIAAuthorizationNotifier();
-    this.requestHandler.setAuthorizationNotifier(notifier);
-    notifier.setAuthorizationListener((request, response, error) =>
-      this.onAuthorizationNotification(request, response, error),
-    );
-  }
-
-  protected onAuthorizationNotification(
-    request: AuthorizationRequest,
-    response: PAIAAuthorizationResponse | null,
-    error: AuthorizationError | null,
-  ) {
-    const codeVerifier: string | undefined =
-      request.internal != undefined && this.authConfig.pkce ? request.internal.code_verifier : undefined;
-
-    if (response != undefined) {
-      this.requestAccessToken(response.code, response.patron, codeVerifier);
-    } else if (error == undefined) {
-      throw new Error('Unknown Error With Authentication');
-    } else {
-      throw new Error(error.errorDescription);
-    }
-  }
-
-  protected async internalAuthorizationCallback(url: string) {
-    this.browser.closeWindow();
-    await this.storage.setItem(AUTHORIZATION_RESPONSE_KEY, url);
-    return this.requestHandler.completeAuthorizationRequestIfPossible();
-  }
-
-  protected async performAuthorizationRequest(authExtras?: StringMap, state?: string): Promise<void> {
-    const requestJson: AuthorizationRequestJson = {
-      response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
-      client_id: this.authConfig.client_id,
-      redirect_uri: this.authConfig.redirect_url,
-      scope: this.authConfig.scopes,
-      extras: authExtras,
-      state: state || undefined,
-    };
-
-    const request = new AuthorizationRequest(requestJson, new DefaultCrypto(), this.authConfig.pkce);
-
-    if (this.authConfig.pkce) await request.setupCodeVerifier();
-
-    return this.requestHandler.performAuthorizationRequest(await this.configuration, request);
-  }
-
-  protected async requestAccessToken(code: string, patron: string, codeVerifier?: string): Promise<void> {
-    const requestJSON: PAIATokenRequestJson = {
-      code: code,
-      patron: patron,
-      extras: codeVerifier
-        ? {
-            code_verifier: codeVerifier,
-          }
-        : {},
-    };
-
-    const token: PAIATokenResponse = await this.tokenHandler.performTokenRequest(
-      await this.configuration,
-      new PAIATokenRequest(requestJSON),
-    );
-    await this.storage.setItem(TOKEN_RESPONSE_KEY, JSON.stringify(token.toJson()));
-    this.notifyActionListers(PAIAAuthActionBuilder.SignInSuccess(token));
-  }
-
-  public async revokeTokens() {
-    // Note: only locally
-    await this.storage.removeItem(TOKEN_RESPONSE_KEY);
-    this.notifyActionListers(PAIAAuthActionBuilder.RevokeTokensSuccess());
-  }
-
-  public async signOut() {
-    await this.revokeTokens().catch(error =>
-      this.notifyActionListers(PAIAAuthActionBuilder.SignOutFailed(error)),
-    );
-    this.notifyActionListers(PAIAAuthActionBuilder.SignOutSuccess());
-  }
-
-  protected async internalLoadTokenFromStorage() {
-    let token: PAIATokenResponse | undefined;
-    const tokenResponseString: string | null = await this.storage.getItem(TOKEN_RESPONSE_KEY);
-
-    if (tokenResponseString != undefined) {
-      token = new PAIATokenResponse(JSON.parse(tokenResponseString));
-
-      if (token) {
-        return this.notifyActionListers(PAIAAuthActionBuilder.LoadTokenFromStorageSuccess(token));
-      }
-    }
-
-    throw new Error('No Token In Storage');
-  }
-
-  protected async internalRequestUserInfo() {
-    if (this._tokenSubject.value) {
-      const userInfo = await this.userInfoHandler.performUserInfoRequest(
-        await this.configuration,
-        this._tokenSubject.value,
-      );
-      this.notifyActionListers(PAIAAuthActionBuilder.LoadUserInfoSuccess(userInfo));
-    } else {
-      throw new Error('No Token Available');
-    }
-  }
-
-  public async loadTokenFromStorage() {
-    await this.internalLoadTokenFromStorage().catch(error => {
-      this.notifyActionListers(PAIAAuthActionBuilder.LoadTokenFromStorageFailed(error));
-    });
-  }
-
-  public async signIn(authExtras?: StringMap, state?: string) {
-    await this.performAuthorizationRequest(authExtras, state).catch(error => {
-      this.notifyActionListers(PAIAAuthActionBuilder.SignInFailed(error));
-    });
-  }
-
-  public async loadUserInfo() {
-    await this.internalRequestUserInfo().catch(error => {
-      this.notifyActionListers(PAIAAuthActionBuilder.LoadUserInfoFailed(error));
-    });
-  }
-
-  public authorizationCallback(callbackUrl: string): void {
-    this.internalAuthorizationCallback(callbackUrl).catch(error => {
-      this.notifyActionListers(PAIAAuthActionBuilder.SignInFailed(error));
-    });
-  }
-
-  public async getValidToken(buffer: number = AUTH_EXPIRY_BUFFER): Promise<PAIATokenResponse> {
-    if (this._tokenSubject.value && this._tokenSubject.value.isValid(buffer)) {
-      return this._tokenSubject.value;
-    }
-
-    const error = new Error('Unable To Obtain Valid Token');
-    this.notifyActionListers(PAIAAuthActionBuilder.SignInFailed(error));
-
-    throw error;
-  }
-}

frontend/app/src/app/modules/auth/paia/paia-authorization-listener.ts

@@ -1,23 +0,0 @@
-/*
- * Copyright (C) 2021 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {AuthorizationError, AuthorizationRequest} from '@openid/appauth';
-import {PAIAAuthorizationResponse} from './paia-authorization-response';
-
-export type PAIAAuthorizationListener = (
-  request: AuthorizationRequest,
-  response: PAIAAuthorizationResponse | null,
-  error: AuthorizationError | null,
-) => void;

frontend/app/src/app/modules/auth/paia/paia-authorization-notifier.ts

@@ -1,40 +0,0 @@
-/*
- * Copyright (C) 2021 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-import {PAIAAuthorizationListener} from './paia-authorization-listener';
-import {AuthorizationError, AuthorizationRequest} from '@openid/appauth';
-import {PAIAAuthorizationResponse} from './paia-authorization-response';
-
-export class PAIAAuthorizationNotifier {
-  // eslint-disable-next-line unicorn/no-null
-  private listener: PAIAAuthorizationListener | null = null;
-
-  setAuthorizationListener(listener: PAIAAuthorizationListener) {
-    this.listener = listener;
-  }
-
-  /**
-   * The authorization complete callback.
-   */
-  onAuthorizationComplete(
-    request: AuthorizationRequest,
-    response: PAIAAuthorizationResponse | null,
-    error: AuthorizationError | null,
-  ): void {
-    if (this.listener) {
-      // complete authorization request
-      this.listener(request, response, error);
-    }
-  }
-}

frontend/app/src/app/modules/auth/paia/paia-token-request.ts

@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2021 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-import {StringMap} from '@openid/appauth';
-
-// TODO: add documentation
-export interface PAIATokenRequestJson {
-  code: string;
-  patron: string;
-  extras?: StringMap;
-}
-
-export class PAIATokenRequest {
-  code: string;
-
-  patron: string;
-
-  extras?: StringMap;
-
-  constructor(request: PAIATokenRequestJson) {
-    this.code = request.code;
-    this.patron = request.patron;
-    this.extras = request.extras;
-  }
-
-  /**
-   * Serializes a TokenRequest to a JavaScript object.
-   */
-  toJson(): PAIATokenRequestJson {
-    return {
-      code: this.code,
-      patron: this.patron,
-      extras: this.extras,
-    };
-  }
-
-  toStringMap(): StringMap {
-    const map: StringMap = {
-      patron: this.patron,
-      code: this.code,
-    };
-
-    // copy over extras
-    if (this.extras) {
-      for (const extra in this.extras) {
-        if (this.extras.hasOwnProperty(extra) && !map.hasOwnProperty(extra)) {
-          // check before inserting to requestMap
-          map[extra] = this.extras[extra];
-        }
-      }
-    }
-    return map;
-  }
-}

frontend/app/src/app/modules/auth/paia/paia-token-response.ts

@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2021 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {TokenResponse, TokenResponseJson} from '@openid/appauth';
-import {nowInSeconds} from '@openid/appauth';
-
-const AUTH_EXPIRY_BUFFER = 10 * 60 * -1; // 10 mins in seconds
-
-export interface PAIATokenResponseJson extends TokenResponseJson {
-  patron: string;
-}
-
-export class PAIATokenResponse extends TokenResponse {
-  patron: string;
-
-  constructor(response: PAIATokenResponseJson) {
-    super(response);
-    this.patron = response.patron;
-  }
-
-  toJson(): PAIATokenResponseJson {
-    return {
-      access_token: this.accessToken,
-      id_token: this.idToken,
-      refresh_token: this.refreshToken,
-      scope: this.scope,
-      token_type: this.tokenType,
-      issued_at: this.issuedAt,
-      expires_in: this.expiresIn?.toString(),
-      patron: this.patron,
-    };
-  }
-
-  isValid(buffer: number = AUTH_EXPIRY_BUFFER): boolean {
-    if (this.expiresIn) {
-      const now = nowInSeconds();
-      return now < this.issuedAt + this.expiresIn + buffer;
-    } else {
-      return true;
-    }
-  }
-}

frontend/app/src/app/modules/auth/paia/paia-user-info-handler.ts

@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2022 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-import {AuthorizationServiceConfiguration, Requestor} from '@openid/appauth';
-import {PAIATokenResponse} from './paia-token-response';
-
-export interface UserInfoHandler {
-  performUserInfoRequest(
-    configuration: AuthorizationServiceConfiguration,
-    token: PAIATokenResponse,
-  ): Promise<unknown>;
-}
-
-export class PAIAUserInfoHandler implements UserInfoHandler {
-  constructor(private requestor: Requestor) {}
-
-  public async performUserInfoRequest(
-    configuration: AuthorizationServiceConfiguration,
-    token: PAIATokenResponse,
-  ): Promise<unknown> {
-    const settings: JQueryAjaxSettings = {
-      url: `${configuration.userInfoEndpoint}/${token.patron}`,
-      method: 'GET',
-      headers: {
-        Authorization: `${token.tokenType == 'bearer' ? 'Bearer' : token.tokenType} ${token.accessToken}`,
-      },
-    };
-
-    return this.requestor.xhr(settings);
-  }
-}

frontend/app/src/app/modules/auth/paia/token-request-handler.ts

@@ -1,81 +0,0 @@
-/*
- * Copyright (C) 2022 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-import {
-  TokenErrorJson,
-  AuthorizationServiceConfiguration,
-  RevokeTokenRequest,
-  Requestor,
-  JQueryRequestor,
-  BasicQueryStringUtils,
-  QueryStringUtils,
-  AppAuthError,
-  TokenError,
-} from '@openid/appauth';
-import {PAIATokenRequest} from './paia-token-request';
-import {PAIATokenResponse, PAIATokenResponseJson} from './paia-token-response';
-
-export class PAIATokenRequestHandler {
-  constructor(
-    public readonly requestor: Requestor = new JQueryRequestor(),
-    public readonly utils: QueryStringUtils = new BasicQueryStringUtils(),
-  ) {}
-
-  private isTokenResponse(
-    response: PAIATokenResponseJson | TokenErrorJson,
-  ): response is PAIATokenResponseJson {
-    return (response as TokenErrorJson).error === undefined;
-  }
-
-  performRevokeTokenRequest(
-    configuration: AuthorizationServiceConfiguration,
-    request: RevokeTokenRequest,
-  ): Promise<boolean> {
-    const revokeTokenResponse = this.requestor.xhr<boolean>({
-      url: configuration.revocationEndpoint,
-      method: 'GET',
-      // headers: {'Content-Type': 'application/x-www-form-urlencoded'},
-      data: this.utils.stringify(request.toStringMap()),
-    });
-
-    return revokeTokenResponse.then(_response => {
-      return true;
-    });
-  }
-
-  performTokenRequest(
-    configuration: AuthorizationServiceConfiguration,
-    request: PAIATokenRequest,
-  ): Promise<PAIATokenResponse> {
-    const tokenResponse = this.requestor.xhr<PAIATokenResponseJson | TokenErrorJson>({
-      url: configuration.tokenEndpoint,
-      method: 'POST',
-      data: {
-        patron: request.patron,
-        grant_type: 'authorization_code',
-        ...request.toStringMap(),
-      },
-      headers: {
-        'Authorization': `Basic ${request.code}`,
-        'Content-Type': 'application/json',
-      },
-    });
-
-    return tokenResponse.then(response => {
-      return this.isTokenResponse(response)
-        ? new PAIATokenResponse(response)
-        : Promise.reject<PAIATokenResponse>(new AppAuthError(response.error, new TokenError(response)));
-    });
-  }
-}