WIP tests cap authoriz request

Closes #254

backend/backend/config/f-u/backendrc.js

@@ -13,23 +13,24 @@ const config = {
     default: {
       client: {
         clientId: '1cac3f99-33fa-4234-8438-979f07e0cdab',
-        scopes: '',
-        url: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0',
+        scopes: 'openid profile email offline_access',
+        url: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc',
       },
       endpoints: {
-        authorization: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0/authorize',
-        endSession: 'https://cas.rz.uni-frankfurt.de/cas/logout',
+        authorization: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/authorize',
+        endSession: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/end-session',
         mapping: {
-          id: '$.id',
-          email: '$.attributes.mailPrimaryAddress',
-          familyName: '$.attributes.sn',
-          givenName: '$.attributes.givenName',
-          name: '$.attributes.givenName',
-          role: '$.attributes.eduPersonPrimaryAffiliation',
-          studentId: '$.attributes.employeeNumber',
+          id: '$.preferred_username',
+          email: '$.mailPrimaryAddress',
+          familyName: '$.family_name',
+          givenName: '$.given_name',
+          name: '$.name',
+          role: '$.eduPersonPrimaryAffiliation',
+          studentId: '$.employeeNumber',
         },
-        token: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0/accessToken',
-        userinfo: 'https://cas.rz.uni-frankfurt.de/cas/oauth2.0/profile',
+        revoke: 'https://idp.ub.uni-frankfurt.de/idp/profile/oauth2/revocation',
+        token: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/token',
+        userinfo: 'https://idp.ub.uni-frankfurt.de/idp/profile/oidc/userinfo',
       },
     },
   },

backend/backend/package.json

@@ -36,7 +36,7 @@
     "format:fix": "prettier --write . --ignore-path ../../.gitignore",
     "lint": "tsc --noEmit && eslint --ext .ts src/",
     "lint:fix": "eslint --fix --ext .ts src/",
-    "start": "cross-env NODE_CONFIG_ENV=elasticsearch ALLOW_NO_TRANSPORT=true node app.js",
+    "start": "cross-env NODE_CONFIG_ENV=elasticsearch ALLOW_NO_TRANSPORT=true NODE_APP_INSTANCE=\"f-u\" node app.js",
     "start:debug": "cross-env STAPPS_LOG_LEVEL=31 NODE_CONFIG_ENV=elasticsearch ALLOW_NO_TRANSPORT=true node app.js",
     "test": "pnpm run test:unit",
     "test:integration": "sh integration-test.sh",

frontend/app/__mocks__/@capacitor/core.ts

@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * tsconfig.spec.json maps every `@capacitor/*` import to this folder, so this
+ * file replaces `@capacitor/core` in all tests – including the imports made by
+ * real Capacitor plugins (registerPlugin, WebPlugin, CapacitorHttp, …).
+ *
+ * Therefore everything is re-exported from the real package (imported via a
+ * relative path, which bypasses the path mapping) and only `Capacitor` is
+ * replaced by a controllable mock. The local export shadows the one from
+ * `export *`.
+ */
+export * from '../../node_modules/@capacitor/core';
+
+type Platform = 'web' | 'ios' | 'android';
+
+export class CapacitorMock {
+  private platform: Platform = 'web';
+
+  getPlatform(): Platform {
+    return this.platform;
+  }
+
+  isNativePlatform(): boolean {
+    return this.platform !== 'web';
+  }
+
+  isPluginAvailable(_name: string): boolean {
+    return this.isNativePlatform();
+  }
+
+  convertFileSrc(filePath: string): string {
+    return filePath;
+  }
+
+  /**
+   * Test helper: simulate running on the given platform.
+   */
+  setPlatform(platform: Platform): void {
+    this.platform = platform;
+  }
+
+  /**
+   * Test helper: back to the default (web), call this in afterEach.
+   */
+  reset(): void {
+    this.platform = 'web';
+  }
+}
+
+export const Capacitor = new CapacitorMock();

frontend/app/capacitor.config.ts

@@ -1,7 +1,7 @@
 import {CapacitorConfig} from '@capacitor/cli';
 
 const config: CapacitorConfig = {
-  appId: 'de.anyschool.app',
+  appId: 'de.unifrankfurt.app',
   appName: 'StApps',
   webDir: 'www/browser',
   cordova: {

frontend/app/ios/App/App/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -1,14 +1,14 @@
 {
-  "images" : [
+  "images": [
     {
-      "filename" : "AppIcon-512@2x.png",
-      "idiom" : "universal",
-      "platform" : "ios",
-      "size" : "1024x1024"
+      "idiom": "universal",
+      "size": "1024x1024",
+      "filename": "AppIcon-512@2x.png",
+      "platform": "ios"
     }
   ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
+  "info": {
+    "author": "xcode",
+    "version": 1
   }
 }

frontend/app/package.json

@@ -38,10 +38,10 @@
     "minify-icons": "node scripts/minify-icon-font.mjs",
     "preview": "http-server www/browser --p 8101 -o",
     "push": "git push && git push origin \"v$npm_package_version\"",
-    "resources:ios": "capacitor-assets generate --ios --iconBackgroundColor $(grep -oE \"^@include ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\") --splashBackgroundColor $(grep -oE \"^@include ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\")",
+    "resources:ios": "capacitor-assets generate --ios --iconBackgroundColor $(grep -oE \"^@include color-system\\.ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\") --splashBackgroundColor $(grep -oE \"^@include color-system\\.ion-color\\(primary, #[a-fA-F0-9]{3,6}\" src/theme/colors.scss | grep -oE \"#[a-fA-F0-9]{3,6}\")",
     "run:android": "ionic capacitor run android --livereload --external",
     "start": "ionic serve",
-    "start:external": "ionic serve --external",
+    "start:external": "ionic serve --external --ssl=true",
     "start:prod": "ionic serve --prod",
     "start:virtual-host": "ionic serve --public-host=mobile.app.uni-frankfurt.de --ssl=true --open=false",
     "test": "ng test --code-coverage",
@@ -81,7 +81,7 @@
     "@maplibre/ngx-maplibre-gl": "22.1.0",
     "@ngx-translate/core": "15.0.0",
     "@ngx-translate/http-loader": "8.0.0",
-    "@openid/appauth": "1.3.2",
+    "@openid/appauth": "1.4.0",
     "@openstapps/api": "workspace:*",
     "@openstapps/collection-utils": "workspace:*",
     "@openstapps/core": "workspace:*",
@@ -93,7 +93,6 @@
     "deepmerge": "4.3.1",
     "form-data": "4.0.6",
     "geojson": "0.5.0",
-    "ionic-appauth": "2.1.0",
     "ionicons": "8.1.0",
     "jsonpath-plus": "10.3.0",
     "maplibre-gl": "6.4.1",

frontend/app/src/app/app.component.ts

@@ -18,13 +18,14 @@ import {App, URLOpenListenerEvent} from '@capacitor/app';
 import {Platform, ToastController} from '@ionic/angular/standalone';
 import {SettingsProvider} from './modules/settings/settings.provider';
 import {InAppReviewProvider} from './modules/settings/in-app-review/in-app-review.provider';
-import {AuthHelperService} from './modules/auth/auth-helper.service';
+import {AuthActions, AuthProvider} from "./modules/auth/auth.provider";
 import {environment} from '../environments/environment';
 import {Capacitor} from '@capacitor/core';
 import {ScheduleSyncService} from './modules/background/schedule/schedule-sync.service';
 import {Keyboard, KeyboardResize} from '@capacitor/keyboard';
 import {AppVersionService} from './modules/about/app-version.service';
 import {SplashScreen} from '@capacitor/splash-screen';
+import {AuthHelperService} from "./modules/auth/auth-helper.service";
 
 /**
  * TODO
@@ -45,6 +46,8 @@ export class AppComponent implements AfterContentInit {
 
   private readonly zone = inject(NgZone);
 
+  private readonly authProvider = inject(AuthProvider);
+
   private readonly authHelper = inject(AuthHelperService);
 
   private readonly toastController = inject(ToastController);
@@ -129,19 +132,21 @@ export class AppComponent implements AfterContentInit {
   }
 
   private async authNotificationsInit() {
-    this.authHelper
-      .getProvider()
-      .events$.subscribe(action => this.showMessage(this.authHelper.getAuthMessage('default', action)));
+    this.authProvider.events$.subscribe(action => {
+      const isWarning = action.action === AuthActions.SessionExpired;
+
+      void this.showMessage(this.authHelper.getAuthMessage(action), isWarning ? 'warning' : 'success');
+    });
   }
 
-  private async showMessage(message?: string) {
+  private async showMessage(message: string | undefined, color: 'success' | 'warning' = 'success') {
     if (message === undefined) {
       return;
     }
     const toast = await this.toastController.create({
       message: message,
-      duration: 2000,
-      color: 'success',
+      duration: color === 'warning' ? 4000 : 2000,
+      color,
     });
     await toast.present();
   }

frontend/app/src/app/app.module.ts

@@ -57,7 +57,6 @@ import {AssessmentsModule} from './modules/assessments/assessments.module';
 import {ServiceHandlerInterceptor} from './_helpers/service-handler.interceptor';
 import {RoutingStackService} from './util/routing-stack.service';
 import {SCLanguageCode, SCSettingValue} from '@openstapps/core';
-import {DefaultAuthService} from './modules/auth/default-auth.service';
 import {NavigationModule} from './modules/menu/navigation/navigation.module';
 import {browserFactory, SimpleBrowser} from './util/browser.factory';
 import {getDateFnsLocale} from './translation/dfns-locale';
@@ -67,6 +66,7 @@ import {Capacitor} from '@capacitor/core';
 import {SplashScreen} from '@capacitor/splash-screen';
 import * as maplibregl from 'maplibre-gl';
 import {Protocol} from 'pmtiles';
+import {AuthProvider} from "./modules/auth/auth.provider";
 
 registerLocaleData(localeDe);
 
@@ -82,7 +82,7 @@ export function initializerFactory(
   configProvider: ConfigProvider,
   translateService: TranslateService,
   _routingStackService: RoutingStackService,
-  defaultAuthService: DefaultAuthService,
+  authProvider: AuthProvider,
   dateFnsConfigurationService: DateFnsConfigurationService,
 ) {
   return async () => {
@@ -111,7 +111,7 @@ export function initializerFactory(
         setDefaultOptions({locale: dateFnsLocale});
         dateFnsConfigurationService.setLocale(dateFnsLocale);
 
-        await defaultAuthService.init();
+        await authProvider.init();
       } catch (error) {
         logger.warn(error);
       }
@@ -201,7 +201,7 @@ export function createTranslateLoader(http: HttpClient) {
         ConfigProvider,
         TranslateService,
         RoutingStackService,
-        DefaultAuthService,
+        AuthProvider,
         DateFnsConfigurationService,
       ],
       useFactory: initializerFactory,

frontend/app/src/app/modules/assessments/assessments.provider.ts

@@ -15,9 +15,9 @@
 import {Injectable, inject} from '@angular/core';
 import {ConfigProvider} from '../config/config.provider';
 import {SCAssessment, SCUuid} from '@openstapps/core';
-import {DefaultAuthService} from '../auth/default-auth.service';
 import {HttpClient} from '@angular/common/http';
 import {uniqBy, keyBy} from '@openstapps/collection-utils';
+import {AuthProvider} from "../auth/auth.provider";
 
 /**
  *
@@ -53,7 +53,7 @@ export function toAssessmentMap(data: SCAssessment[]): Record<SCUuid, SCAssessme
 export class AssessmentsProvider {
   readonly configProvider = inject(ConfigProvider);
 
-  readonly defaultAuth = inject(DefaultAuthService);
+  readonly authProvider = inject(AuthProvider);
 
   readonly http = inject(HttpClient);
 
@@ -97,7 +97,7 @@ export class AssessmentsProvider {
     this.cache = this.http
       .get<{data: SCAssessment[]}>(`${url}/${this.assessmentPath}`, {
         headers: {
-          Authorization: `Bearer ${accessToken ?? (await this.defaultAuth.getValidToken()).accessToken}`,
+          Authorization: `Bearer ${accessToken ?? (await this.authProvider.getValidToken()).accessToken}`,
         },
       })
       .toPromise()

frontend/app/src/app/modules/auth/auth-callback/page/auth-callback-page.component.spec.ts

@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import {TestBed} from '@angular/core/testing';
+import {Router} from '@angular/router';
+import {NavController} from '@ionic/angular/standalone';
+import {Subject} from 'rxjs';
+import {AuthActions, AuthProvider, IAuthAction} from '../../auth.provider';
+import {AuthHelperService} from '../../auth-helper.service';
+import {AuthCallbackPageComponent} from './auth-callback-page.component';
+
+/** Lets pending promise callbacks run. */
+async function flushPromises(): Promise<void> {
+  for (let index = 0; index < 10; index++) {
+    await Promise.resolve();
+  }
+}
+
+/** Creates the page like the router does when the IdP redirects back. */
+function openCallbackPage(): AuthCallbackPageComponent {
+  return TestBed.runInInjectionContext(() => new AuthCallbackPageComponent());
+}
+
+describe('AuthCallbackPageComponent', () => {
+  let events: Subject<IAuthAction>;
+  let authProvider: {events$: Subject<IAuthAction>; authorizationCallback: jasmine.Spy};
+  let authHelper: jasmine.SpyObj<Pick<AuthHelperService, 'getOriginPath' | 'deleteOriginPath'>>;
+  let navController: jasmine.SpyObj<Pick<NavController, 'navigateRoot'>>;
+
+  beforeEach(() => {
+    events = new Subject<IAuthAction>();
+    authProvider = {events$: events, authorizationCallback: jasmine.createSpy('authorizationCallback')};
+
+    authHelper = jasmine.createSpyObj('AuthHelperService', ['getOriginPath', 'deleteOriginPath']);
+    authHelper.deleteOriginPath.and.resolveTo();
+
+    navController = jasmine.createSpyObj('NavController', ['navigateRoot']);
+    navController.navigateRoot.and.resolveTo(true);
+
+    TestBed.configureTestingModule({
+      providers: [
+        {provide: AuthProvider, useValue: authProvider},
+        {provide: AuthHelperService, useValue: authHelper},
+        {provide: NavController, useValue: navController},
+        {provide: Router, useValue: {}},
+      ],
+    });
+  });
+
+  it('hands the callback URL to AuthProvider', () => {
+    openCallbackPage();
+
+    expect(authProvider.authorizationCallback).toHaveBeenCalledOnceWith(window.location.href);
+  });
+
+  it('goes back to the page the login was started from', async () => {
+    authHelper.getOriginPath.and.resolveTo('/assessments');
+    openCallbackPage();
+
+    events.next({action: AuthActions.SignInSuccess});
+    await flushPromises();
+
+    expect(navController.navigateRoot).toHaveBeenCalledOnceWith('/assessments');
+    expect(authHelper.deleteOriginPath).toHaveBeenCalled();
+  });
+
+  it('goes to the profile after login when no origin page is known', async () => {
+    openCallbackPage();
+
+    events.next({action: AuthActions.SignInSuccess});
+    await flushPromises();
+
+    expect(navController.navigateRoot).toHaveBeenCalledOnceWith('profile');
+  });
+
+  it('goes to the profile when the login failed', async () => {
+    openCallbackPage();
+
+    events.next({action: AuthActions.SignInFailed, error: new Error('access_denied')});
+    await flushPromises();
+
+    expect(navController.navigateRoot).toHaveBeenCalledOnceWith('profile');
+    expect(authHelper.getOriginPath).not.toHaveBeenCalled();
+  });
+
+  it('ignores other auth events', async () => {
+    openCallbackPage();
+
+    events.next({action: AuthActions.RefreshSuccess});
+    events.next({action: AuthActions.LoadUserInfoSuccess});
+    await flushPromises();
+
+    expect(navController.navigateRoot).not.toHaveBeenCalled();
+  });
+});

frontend/app/src/app/modules/auth/auth-callback/page/auth-callback-page.component.ts

@@ -13,13 +13,16 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 import {Component, inject} from '@angular/core';
-import {NavController} from '@ionic/angular/standalone';
 import {Router} from '@angular/router';
-import {AuthActions, IAuthAction} from 'ionic-appauth';
-import {AuthHelperService} from '../../auth-helper.service';
 import {takeUntilDestroyed} from '@angular/core/rxjs-interop';
-import {Observable} from 'rxjs';
-import {DefaultAuthService} from '../../default-auth.service';
+import {NavController} from '@ionic/angular/standalone';
+
+import {
+  AuthActions,
+  AuthProvider,
+  IAuthAction,
+} from '../../auth.provider';
+import {AuthHelperService} from '../../auth-helper.service';
 
 @Component({
   templateUrl: 'auth-callback-page.component.html',
@@ -33,23 +36,42 @@ export class AuthCallbackPageComponent {
 
   private authHelper = inject(AuthHelperService);
 
-  private auth = inject(DefaultAuthService);
+  private authProvider = inject(AuthProvider);
 
   constructor() {
-    const events: Observable<IAuthAction> = this.auth.events$;
+    this.authProvider.events$
+      .pipe(takeUntilDestroyed())
+      .subscribe(action => {
+        void this.postCallback(action);
+      });
 
-    events.pipe(takeUntilDestroyed()).subscribe((action: IAuthAction) => this.postCallback(action));
-    this.auth.authorizationCallback(window.location.origin + this.router.url);
+    this.authProvider.authorizationCallback(
+      window.location.href,
+    );
   }
 
-  async postCallback(action: IAuthAction) {
-    if (action.action === AuthActions.SignInSuccess) {
-      const originPath = await this.authHelper.getOriginPath();
-      this.navCtrl.navigateRoot(originPath ?? 'profile');
-      this.authHelper.deleteOriginPath();
-    }
-    if (action.action === AuthActions.SignInFailed) {
-      this.navCtrl.navigateRoot('profile');
+  private async postCallback(
+    action: IAuthAction,
+  ): Promise<void> {
+    switch (action.action) {
+      case AuthActions.SignInSuccess: {
+        const originPath =
+          await this.authHelper.getOriginPath();
+
+        await this.authHelper.deleteOriginPath();
+
+        await this.navCtrl.navigateRoot(
+          originPath ?? 'profile',
+        );
+
+        break;
+      }
+
+      case AuthActions.SignInFailed: {
+        await this.navCtrl.navigateRoot('profile');
+
+        break;
+      }
     }
   }
 }

frontend/app/src/app/modules/auth/auth-guard.service.ts

@@ -16,13 +16,13 @@
 import {Injectable, inject} from '@angular/core';
 import {CanActivate, NavigationExtras, Router, RouterStateSnapshot} from '@angular/router';
 import {ActivatedProtectedRouteSnapshot} from './protected.routes';
-import {AuthHelperService} from './auth-helper.service';
+import {AuthProvider} from "./auth.provider";
 
 @Injectable({
   providedIn: 'root',
 })
 export class AuthGuardService implements CanActivate {
-  private authHelper = inject(AuthHelperService);
+  private authProvider = inject(AuthProvider);
 
   private router = inject(Router);
 
@@ -32,7 +32,7 @@ export class AuthGuardService implements CanActivate {
     }
 
     try {
-      await this.authHelper.getProvider().getValidToken();
+      await this.authProvider.getValidToken();
     } catch {
       const originNavigation = this.router.currentNavigation();
       let extras: NavigationExtras = {};
@@ -41,7 +41,7 @@ export class AuthGuardService implements CanActivate {
         extras = {queryParams: {origin_path: url}};
       }
       this.router.navigate(['profile'], extras);
-      await this.authHelper.getProvider().signIn();
+      await this.authProvider.signIn();
 
       return false;
     }

frontend/app/src/app/modules/auth/auth-helper.service.spec.ts

@@ -1,118 +1,274 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
 import {TestBed} from '@angular/core/testing';
-import {AuthHelperService} from './auth-helper.service';
+import {AlertController} from '@ionic/angular/standalone';
+import {TranslateService} from '@ngx-translate/core';
+
+import {SimpleBrowser} from '../../util/browser.factory';
 import {ConfigProvider} from '../config/config.provider';
 import {StorageProvider} from '../storage/storage.provider';
-import {DefaultAuthService} from './default-auth.service';
-import {Browser} from 'ionic-appauth';
-import {Requestor, StorageBackend} from '@openid/appauth';
-import {TranslateService} from '@ngx-translate/core';
-import {StAppsWebHttpClient} from '../data/stapps-web-http-client.provider';
-import {provideHttpClient, withInterceptorsFromDi} from '@angular/common/http';
-import {SimpleBrowser} from '../../util/browser.factory';
-import {LoggerTestingModule} from 'ngx-logger/testing';
+import {AuthActions, AuthProvider} from './auth.provider';
+import {AuthHelperService} from './auth-helper.service';
+
+const AUTH_ORIGIN_PATH = 'stapps.auth.origin_path';
+const AUTH_MESSAGE_PREFIX = 'auth.messages.default';
+const END_SESSION_ENDPOINT = 'https://idp.example.org/logout';
+
+const USER_MAPPING = {
+  id: '$.sub',
+  givenName: '$.given_name',
+  familyName: '$.family_name',
+  email: '$.attributes.mail',
+  role: '$.role',
+};
+
+interface TestAlertButton {
+  text: string;
+  role?: string;
+  cssClass?: string;
+  handler?: () => Promise<void> | void;
+}
 
 describe('AuthHelperService', () => {
-  let authHelperService: AuthHelperService;
-  const storageProviderSpy = jasmine.createSpyObj('StorageProvider', ['init', 'get', 'has', 'put', 'search']);
-  const translateServiceSpy = jasmine.createSpyObj('TranslateService', ['setDefaultLang', 'use']);
-  const defaultAuthServiceMock = jasmine.createSpyObj('DefaultAuthService', ['init', 'setupConfiguration']);
-  const authHelperServiceMock = jasmine.createSpyObj('AuthHelperService', ['constructor']);
-  const simpleBrowserMock = jasmine.createSpyObj('SimpleBrowser', ['open']);
-  const configProvider = jasmine.createSpyObj('ConfigProvider', {
-    getAnyValue: {
-      default: {
-        endpoints: {
-          mapping: {
-            id: '$.id',
-            email: '$.attributes.mailPrimaryAddress',
-            givenName: '$.attributes.givenName',
-            familyName: '$.attributes.sn',
-            name: '$.attributes.sn',
-            role: '$.attributes.eduPersonPrimaryAffiliation',
-            studentId: '$.attributes.employeeNumber',
-          },
-        },
-      },
-    },
-  });
+  let service: AuthHelperService;
 
-  beforeEach(() => {
+  let translateService: jasmine.SpyObj<{instant(key: string): string}>;
+  let configProvider: jasmine.SpyObj<{getAnyValue(key: string): unknown}>;
+  let storageProvider: jasmine.SpyObj<{
+    get<T>(key: string): Promise<T>;
+    put(key: string, value: unknown): Promise<unknown>;
+    delete(key: string): Promise<unknown>;
+  }>;
+  let authProvider: jasmine.SpyObj<Pick<AuthProvider, 'getEndSessionEndpoint'>>;
+  let browser: jasmine.SpyObj<{open(url: string): Promise<void>}>;
+  let alertController: jasmine.SpyObj<{create(options: unknown): Promise<unknown>}>;
+  let alert: jasmine.SpyObj<{present(): Promise<void>}>;
+
+  function createService(authConfig: unknown = {default: {endpoints: {mapping: USER_MAPPING}}}) {
+    configProvider.getAnyValue.and.returnValue(authConfig);
+
+    // AuthHelperService uses inject(), so it has to be created inside an injection context.
+    TestBed.resetTestingModule();
     TestBed.configureTestingModule({
-      imports: [LoggerTestingModule],
       providers: [
-        StAppsWebHttpClient,
-        {
-          provide: TranslateService,
-          useValue: translateServiceSpy,
-        },
-        {
-          provide: StorageProvider,
-          useValue: storageProviderSpy,
-        },
-        {
-          provider: DefaultAuthService,
-          useValue: defaultAuthServiceMock,
-        },
-        {
-          provide: ConfigProvider,
-          useValue: configProvider,
-        },
-        Browser,
-        StorageBackend,
-        Requestor,
-        {
-          provider: AuthHelperService,
-          useValue: authHelperServiceMock,
-        },
-        {
-          provide: SimpleBrowser,
-          useValue: simpleBrowserMock,
-        },
-        provideHttpClient(withInterceptorsFromDi()),
+        AuthHelperService,
+        {provide: TranslateService, useValue: translateService},
+        {provide: ConfigProvider, useValue: configProvider},
+        {provide: StorageProvider, useValue: storageProvider},
+        {provide: AuthProvider, useValue: authProvider},
+        {provide: SimpleBrowser, useValue: browser},
+        {provide: AlertController, useValue: alertController},
       ],
     });
-    authHelperService = TestBed.inject(AuthHelperService);
+
+    return TestBed.inject(AuthHelperService);
+  }
+
+  /** Options passed to the most recent AlertController.create() call. */
+  function lastAlertOptions(): {header: string; message: string; buttons: TestAlertButton[]} {
+    return alertController.create.calls.mostRecent().args[0] as any;
+  }
+
+  function alertButton(role: string): TestAlertButton {
+    const button = lastAlertOptions().buttons.find(b => b.role === role);
+    if (!button) {
+      throw new Error(`No alert button with role "${role}"`);
+    }
+    return button;
+  }
+
+  beforeEach(() => {
+    translateService = jasmine.createSpyObj('TranslateService', ['instant']);
+    translateService.instant.and.callFake((key: string) => `translated:${key}`);
+
+    configProvider = jasmine.createSpyObj('ConfigProvider', ['getAnyValue']);
+
+    storageProvider = jasmine.createSpyObj('StorageProvider', ['get', 'put', 'delete']);
+    storageProvider.put.and.resolveTo();
+    storageProvider.delete.and.resolveTo();
+
+    authProvider = jasmine.createSpyObj('AuthProvider', ['getEndSessionEndpoint']);
+    authProvider.getEndSessionEndpoint.and.resolveTo(END_SESSION_ENDPOINT);
+
+    browser = jasmine.createSpyObj('SimpleBrowser', ['open']);
+    browser.open.and.resolveTo();
+
+    alert = jasmine.createSpyObj('HTMLIonAlertElement', ['present']);
+    alert.present.and.resolveTo();
+
+    alertController = jasmine.createSpyObj('AlertController', ['create']);
+    alertController.create.and.resolveTo(alert);
+
+    service = createService();
+  });
+
+  describe('userConfigurationMap', () => {
+    it('reads the user mapping from the default auth provider', () => {
+      expect(configProvider.getAnyValue).toHaveBeenCalledWith('auth');
+      expect(service.userConfigurationMap).toEqual(USER_MAPPING as any);
+    });
+
+    it('falls back to an empty mapping when no default auth provider is configured', () => {
+      service = createService({});
+
+      expect(service.userConfigurationMap).toEqual({} as any);
+    });
+  });
+
+  describe('getAuthMessage', () => {
+    it('returns the translated message for SignInSuccess', () => {
+      expect(service.getAuthMessage({action: AuthActions.SignInSuccess})).toBe(
+        `translated:${AUTH_MESSAGE_PREFIX}.logged_in_success`,
+      );
+    });
+
+    it('returns the translated message for SignOutSuccess', () => {
+      expect(service.getAuthMessage({action: AuthActions.SignOutSuccess})).toBe(
+        `translated:${AUTH_MESSAGE_PREFIX}.logged_out_success`,
+      );
+    });
+
+    it('returns the translated message for SessionExpired', () => {
+      expect(service.getAuthMessage({action: AuthActions.SessionExpired})).toBe(
+        `translated:${AUTH_MESSAGE_PREFIX}.session_expired`,
+      );
+    });
+
+    it('returns undefined for all other actions without translating', () => {
+      const messageActions = new Set([
+        AuthActions.SignInSuccess,
+        AuthActions.SignOutSuccess,
+        AuthActions.SessionExpired,
+      ]);
+      const otherActions = Object.values(AuthActions).filter(action => !messageActions.has(action));
+
+      for (const action of otherActions) {
+        expect(service.getAuthMessage({action})).withContext(action).toBeUndefined();
+      }
+      expect(translateService.instant).not.toHaveBeenCalled();
+    });
   });
 
   describe('getUserFromUserInfo', () => {
-    it('should provide user configuration from userInfo', async () => {
-      const userConfiguration = authHelperService.getUserFromUserInfo({
-        attributes: {
-          eduPersonPrimaryAffiliation: 'student',
-          employeeNumber: '123456',
-          givenName: 'Erika',
-          mailPrimaryAddress: 'emuster@anyschool.de',
-          oauthClientId: '123-abc-123',
-          sn: 'Musterfrau',
-          uid: 'emuster',
-        },
-        id: 'emuster',
-        client_id: '123-abc-123',
+    it('maps user info fields via the configured JSONPath mapping', () => {
+      const user = service.getUserFromUserInfo({
+        sub: 'user-123',
+        given_name: 'Erika',
+        family_name: 'Mustermann',
+        attributes: {mail: 'erika@example.org'},
+        role: 'employee',
       });
 
-      expect(userConfiguration).toEqual({
-        id: 'emuster',
-        givenName: 'Erika',
-        familyName: 'Musterfrau',
-        name: 'Erika Musterfrau',
-        email: 'emuster@anyschool.de',
+      expect(user).toEqual(
+        jasmine.objectContaining({
+          id: 'user-123',
+          givenName: 'Erika',
+          familyName: 'Mustermann',
+          email: 'erika@example.org',
+          role: 'employee',
+        }),
+      );
+    });
+
+    it('builds the name from given name and family name', () => {
+      const user = service.getUserFromUserInfo({
+        sub: 'user-123',
+        given_name: 'Erika',
+        family_name: 'Mustermann',
+        role: 'student',
+      });
+
+      expect(user.name).toBe('Erika Mustermann');
+    });
+
+    it('keeps the default name when the family name is missing', () => {
+      const user = service.getUserFromUserInfo({
+        sub: 'user-123',
+        given_name: 'Erika',
+        role: 'student',
+      });
+
+      expect(user.name).toBe('');
+    });
+
+    it('returns the default user when no mapping is configured', () => {
+      service = createService({});
+
+      expect(service.getUserFromUserInfo({sub: 'user-123'})).toEqual({
+        id: '',
+        name: '',
         role: 'student',
-        studentId: '123456',
       });
     });
   });
+
+  describe('origin path', () => {
+    it('stores the origin path', async () => {
+      await service.setOriginPath('/profile');
+
+      expect(storageProvider.put).toHaveBeenCalledOnceWith(AUTH_ORIGIN_PATH, '/profile');
+    });
+
+    it('returns the stored origin path', async () => {
+      storageProvider.get.and.resolveTo('/profile');
+
+      expect(await service.getOriginPath()).toBe('/profile');
+      expect(storageProvider.get).toHaveBeenCalledOnceWith(AUTH_ORIGIN_PATH);
+    });
+
+    it('returns undefined when reading the origin path fails', async () => {
+      storageProvider.get.and.rejectWith(new Error('Value not found'));
+
+      expect(await service.getOriginPath()).toBeUndefined();
+    });
+
+    it('deletes the origin path', async () => {
+      await service.deleteOriginPath();
+
+      expect(storageProvider.delete).toHaveBeenCalledOnceWith(AUTH_ORIGIN_PATH);
+    });
+  });
+
+  describe('endBrowserSession', () => {
+    it('does nothing when the provider has no end-session endpoint', async () => {
+      authProvider.getEndSessionEndpoint.and.resolveTo(undefined);
+
+      await service.endBrowserSession();
+
+      expect(alertController.create).not.toHaveBeenCalled();
+      expect(browser.open).not.toHaveBeenCalled();
+    });
+
+    it('presents a translated confirmation alert', async () => {
+      await service.endBrowserSession();
+
+      const options = lastAlertOptions();
+      expect(options.header).toBe(`translated:${AUTH_MESSAGE_PREFIX}.log_out_alert.header`);
+      expect(options.message).toBe(`translated:${AUTH_MESSAGE_PREFIX}.log_out_alert.message`);
+      expect(options.buttons.map(b => b.role)).toEqual(['cancel', 'confirm']);
+      expect(alert.present).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not open the end-session endpoint before confirmation', async () => {
+      await service.endBrowserSession();
+
+      expect(browser.open).not.toHaveBeenCalled();
+    });
+
+    it('opens the end-session endpoint when the user confirms', async () => {
+      await service.endBrowserSession();
+
+      await alertButton('confirm').handler?.();
+
+      expect(browser.open).toHaveBeenCalledOnceWith(END_SESSION_ENDPOINT);
+    });
+
+    it('does not open the end-session endpoint when the user cancels', async () => {
+      await service.endBrowserSession();
+
+      const cancelButton = alertButton('cancel');
+      await cancelButton.handler?.();
+
+      expect(cancelButton.handler).toBeUndefined();
+      expect(browser.open).not.toHaveBeenCalled();
+    });
+  });
 });

frontend/app/src/app/modules/auth/auth-helper.service.ts

@@ -14,35 +14,38 @@
  */
 
 import {Injectable, inject} from '@angular/core';
-import {AuthActions, IAuthAction} from 'ionic-appauth';
+import {AlertController} from '@ionic/angular/standalone';
 import {TranslateService} from '@ngx-translate/core';
-import {JSONPath} from 'jsonpath-plus';
 import {
   SCAuthorizationProvider,
-  SCAuthorizationProviderType,
   SCUserConfiguration,
   SCUserConfigurationMap,
 } from '@openstapps/core';
+import {JSONPath} from 'jsonpath-plus';
+
+import {SimpleBrowser} from '../../util/browser.factory';
 import {ConfigProvider} from '../config/config.provider';
 import {StorageProvider} from '../storage/storage.provider';
-import {DefaultAuthService} from './default-auth.service';
-import {SimpleBrowser} from '../../util/browser.factory';
-import {AlertController} from '@ionic/angular/standalone';
+import {
+  AuthActions, AuthProvider,
+  IAuthAction,
+} from './auth.provider';
 
 const AUTH_ORIGIN_PATH = 'stapps.auth.origin_path';
+const AUTH_MESSAGE_PREFIX = 'auth.messages.default';
 
 @Injectable({
   providedIn: 'root',
 })
 export class AuthHelperService {
+  private authProvider = inject(AuthProvider);
+
   private translateService = inject(TranslateService);
 
   private configProvider = inject(ConfigProvider);
 
   private storageProvider = inject(StorageProvider);
 
-  private defaultAuth = inject(DefaultAuthService);
-
   private browser = inject(SimpleBrowser);
 
   private alertController = inject(AlertController);
@@ -58,93 +61,144 @@ export class AuthHelperService {
       ).default?.endpoints.mapping ?? {};
   }
 
-  public getAuthMessage(provider: SCAuthorizationProviderType, action: IAuthAction) {
-    let message: string | undefined;
+  public getAuthMessage(
+    action: IAuthAction,
+  ): string | undefined {
     switch (action.action) {
-      case AuthActions.SignInSuccess: {
-        message = this.translateService.instant(`auth.messages.${provider}.logged_in_success`);
-        break;
-      }
-      case AuthActions.SignOutSuccess: {
-        message = this.translateService.instant(`auth.messages.${provider}.logged_out_success`);
-        break;
-      }
+      case AuthActions.SignInSuccess:
+        return this.translateService.instant(
+          `${AUTH_MESSAGE_PREFIX}.logged_in_success`,
+        );
+
+      case AuthActions.SignOutSuccess:
+        return this.translateService.instant(
+          `${AUTH_MESSAGE_PREFIX}.logged_out_success`,
+        );
+
+      case AuthActions.SessionExpired:
+        return this.translateService.instant(
+          `${AUTH_MESSAGE_PREFIX}.session_expired`,
+        );
+
+      default:
+        return undefined;
     }
-    return message;
   }
 
-  getUserFromUserInfo(userInfo: object) {
+  public getUserFromUserInfo(
+    userInfo: object,
+  ): SCUserConfiguration {
     const user: SCUserConfiguration = {
       id: '',
       name: '',
       role: 'student',
     };
+
     for (const key in this.userConfigurationMap) {
-      user[key as keyof SCUserConfiguration] = JSONPath({
-        path: this.userConfigurationMap[key as keyof SCUserConfiguration] as string,
+      const userKey =
+        key as keyof SCUserConfiguration;
+
+      user[userKey] = JSONPath({
+        path:
+          this.userConfigurationMap[
+            userKey
+            ] as string,
         json: userInfo,
       })[0];
     }
-    if (user.givenName && user.givenName.length > 0 && user.familyName && user.familyName.length > 0) {
-      user.name = `${user.givenName} ${user.familyName}`;
+
+    if (
+      user.givenName &&
+      user.familyName
+    ) {
+      user.name =
+        `${user.givenName} ${user.familyName}`;
     }
 
     return user;
   }
 
-  async deleteOriginPath() {
-    return this.storageProvider.delete(AUTH_ORIGIN_PATH);
+  public async deleteOriginPath():
+    Promise<void> {
+    await this.storageProvider.delete(
+      AUTH_ORIGIN_PATH,
+    );
   }
 
-  async setOriginPath(path: string) {
-    return this.storageProvider.put<string>(AUTH_ORIGIN_PATH, path);
+  public async setOriginPath(
+    path: string,
+  ): Promise<void> {
+    await this.storageProvider.put(
+      AUTH_ORIGIN_PATH,
+      path,
+    );
   }
 
-  async getOriginPath() {
-    let originPath: string;
+  public async getOriginPath():
+    Promise<string | undefined> {
     try {
-      originPath = await this.storageProvider.get<string>(AUTH_ORIGIN_PATH);
+      return await this.storageProvider.get<string>(
+        AUTH_ORIGIN_PATH,
+      );
     } catch {
+      return undefined;
+    }
+  }
+
+  public async endBrowserSession():
+    Promise<void> {
+    const endSessionEndpoint =
+      await this.authProvider
+        .getEndSessionEndpoint();
+
+    if (!endSessionEndpoint) {
       return;
     }
-    return originPath;
-  }
 
-  /**
-   * Provides appropriate auth service instance based on type (string) parameter
-   */
-  getProvider(): DefaultAuthService {
-    return this.defaultAuth;
-  }
+    const alert =
+      await this.alertController.create({
+        header:
+          this.translateService.instant(
+            `${AUTH_MESSAGE_PREFIX}.log_out_alert.header`,
+          ),
 
-  /**
-   * Ends browser session by opening endSessionEndpoint URL of the provider
-   * @param providerType Type of the provider (e.g. 'default' or 'paia')
-   */
-  async endBrowserSession(providerType: SCAuthorizationProviderType) {
-    const endSessionEndpoint = (await this.getProvider().configuration).endSessionEndpoint;
+        message:
+          this.translateService.instant(
+            `${AUTH_MESSAGE_PREFIX}.log_out_alert.message`,
+          ),
 
-    if (endSessionEndpoint) {
-      const alert: HTMLIonAlertElement = await this.alertController.create({
-        header: this.translateService.instant(`auth.messages.${providerType}.log_out_alert.header`),
-        message: this.translateService.instant(`auth.messages.${providerType}.log_out_alert.message`),
         buttons: [
           {
-            text: this.translateService.instant('no'),
+            text:
+              this.translateService.instant(
+                'no',
+              ),
+
+            role: 'cancel',
             cssClass: 'default',
           },
           {
-            text: this.translateService.instant('yes'),
+            text:
+              this.translateService.instant(
+                'yes',
+              ),
+
             role: 'confirm',
             cssClass: 'preferred',
-            handler: () => {
-              this.browser.open(new URL(endSessionEndpoint).href);
+
+            handler: async () => {
+              /*
+               * Only now, after explicit confirmation,
+               * open the IdP end-session endpoint.
+               */
+              await this.browser.open(
+                endSessionEndpoint,
+              );
             },
           },
         ],
       });
 
-      await alert.present();
-    }
+    await alert.present();
   }
 }

frontend/app/src/app/modules/auth/auth-paths.ts

@@ -12,15 +12,5 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {SCAuthorizationProviderType} from '@openstapps/core';
 
-export const authPaths: {
-  [key in SCAuthorizationProviderType]: {redirect_path: string};
-} = {
-  default: {
-    redirect_path: 'auth/callback',
-  },
-  paia: {
-    redirect_path: 'auth/paia/callback',
-  },
-};
+export const AUTH_REDIRECT_PATH = 'auth/callback';

frontend/app/src/app/modules/auth/auth-routing.module.ts

@@ -15,12 +15,12 @@
 
 import {RouterModule, Routes} from '@angular/router';
 import {NgModule} from '@angular/core';
-import {authPaths} from './auth-paths';
+import {AUTH_REDIRECT_PATH} from './auth-paths';
 import {AuthCallbackPageComponent} from './auth-callback/page/auth-callback-page.component';
 
 const authRoutes: Routes = [
   {
-    path: authPaths.default.redirect_path,
+    path: AUTH_REDIRECT_PATH,
     component: AuthCallbackPageComponent,
   },
 ];

frontend/app/src/app/modules/auth/auth.module.ts

@@ -3,14 +3,12 @@ import {CommonModule} from '@angular/common';
 import {Platform} from '@ionic/angular/standalone';
 import {Requestor, StorageBackend} from '@openid/appauth';
 import {storageFactory} from './factories';
-import {Browser} from 'ionic-appauth';
-import {CapacitorBrowser} from 'ionic-appauth/lib/capacitor';
-import {httpFactory} from './factories/http.factory';
+import {requestorFactory} from './factories/requestor.factory';
 import {HttpClient} from '@angular/common/http';
 import {AuthRoutingModule} from './auth-routing.module';
 import {TranslateModule} from '@ngx-translate/core';
 import {AuthCallbackPageComponent} from './auth-callback/page/auth-callback-page.component';
-import {DefaultAuthService} from './default-auth.service';
+import {AuthProvider} from "./auth.provider";
 
 @NgModule({
   declarations: [AuthCallbackPageComponent],
@@ -23,14 +21,10 @@ import {DefaultAuthService} from './default-auth.service';
     },
     {
       provide: Requestor,
-      useFactory: httpFactory,
+      useFactory: requestorFactory,
       deps: [Platform, HttpClient],
     },
-    {
-      provide: Browser,
-      useClass: CapacitorBrowser,
-    },
-    DefaultAuthService,
+    AuthProvider,
   ],
 })
 export class AuthModule {}

frontend/app/src/app/modules/auth/auth.provider.methods.spec.ts

@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {Capacitor} from '@capacitor/core';
+import {SCAuthorizationProvider} from '@openstapps/core';
+
+import type {CapacitorMock} from '../../../../__mocks__/@capacitor/core';
+import {getClientConfig, getPlatformScopes} from './auth.provider.methods';
+
+const capacitor = Capacitor as unknown as CapacitorMock;
+
+const authConfig = {
+  default: {
+    client: {
+      clientId: 'client-id',
+      scopes: 'openid profile email offline_access',
+      url: 'https://idp.example.com',
+    },
+    endpoints: {
+      authorization: 'https://idp.example.com/authorize',
+      token: 'https://idp.example.com/token',
+      userinfo: 'https://idp.example.com/userinfo',
+      mapping: {},
+    },
+  } as unknown as SCAuthorizationProvider,
+};
+
+describe('auth.provider.methods', () => {
+  afterEach(() => {
+    capacitor.reset();
+  });
+
+  describe('getClientConfig', () => {
+    it('requests offline_access on iOS', () => {
+      capacitor.setPlatform('ios');
+
+      expect(getClientConfig(authConfig).scopes).toBe('openid profile email offline_access');
+    });
+
+    it('requests offline_access on Android', () => {
+      capacitor.setPlatform('android');
+
+      expect(getClientConfig(authConfig).scopes).toBe('openid profile email offline_access');
+    });
+
+    it('does not request offline_access in the browser', () => {
+      capacitor.setPlatform('web');
+
+      expect(getClientConfig(authConfig).scopes).toBe('openid profile email');
+    });
+  });
+
+  describe('getPlatformScopes', () => {
+    it('leaves scopes without offline_access unchanged in the browser', () => {
+      expect(getPlatformScopes('openid profile')).toBe('openid profile');
+    });
+
+    it('normalizes extra whitespace', () => {
+      expect(getPlatformScopes('  openid   offline_access profile ')).toBe('openid profile');
+    });
+
+    it('still accepts an explicit platform flag', () => {
+      expect(getPlatformScopes('openid offline_access', true)).toBe('openid offline_access');
+    });
+  });
+});

frontend/app/src/app/modules/auth/auth.provider.methods.ts

@@ -13,69 +13,90 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {AuthorizationServiceConfigurationJson} from '@openid/appauth';
-import {IAuthConfig} from 'ionic-appauth';
-import {SCAuthorizationProvider, SCAuthorizationProviderType} from '@openstapps/core';
 import {Capacitor} from '@capacitor/core';
-import {authPaths} from './auth-paths';
+import {SCAuthorizationProvider} from '@openstapps/core';
+import {
+  AuthorizationServiceConfiguration,
+} from '@openid/appauth';
+
 import {environment} from '../../../environments/environment';
+import {AUTH_REDIRECT_PATH} from './auth-paths';
+import type {AuthConfig} from './auth.provider';
+
+export const OFFLINE_ACCESS_SCOPE = 'offline_access';
 
 /**
- * Get configuration of an OAuth2 client
+ * Returns the configuration of the OIDC client.
  */
 export function getClientConfig(
-  providerType: SCAuthorizationProviderType,
   authConfig: {
-    default?: SCAuthorizationProvider;
-    paia?: SCAuthorizationProvider;
+    default: SCAuthorizationProvider;
   },
-): IAuthConfig {
-  const providerConfig = authConfig[providerType] as SCAuthorizationProvider;
+): AuthConfig {
+  const provider =
+    authConfig.default;
+
   return {
-    end_session_redirect_url: '',
+    server_host: provider.client.url,
+    client_id: provider.client.clientId,
+    scopes: getPlatformScopes(provider.client.scopes),
+    redirect_url: getRedirectUrl(),
     pkce: true,
-    scopes: providerConfig.client.scopes,
-    server_host: providerConfig.client.url,
-    client_id: providerConfig.client.clientId,
-    redirect_url: getRedirectUrl(authPaths[providerType].redirect_path),
   };
 }
 
 /**
- * Get configuration about endpoints of an OAuth2 server
+ * Returns the scopes to request on the current platform.
+ *
+ * `offline_access` (long-lived refresh tokens) is only requested in the
+ * native apps, where tokens live in the Keychain / Keystore. In the browser,
+ * tokens live in web storage and are reachable by any XSS, so the session is
+ * limited to the access token lifetime instead.
  */
-export function getEndpointsConfig(
-  providerType: SCAuthorizationProviderType,
+export function getPlatformScopes(
+  scopes: string,
+  isNative: boolean = Capacitor.isNativePlatform(),
+): string {
+  const scopeList = scopes
+    .split(/\s+/)
+    .filter(scope => scope.length > 0);
+
+  return (
+    isNative
+      ? scopeList
+      : scopeList.filter(scope => scope !== OFFLINE_ACCESS_SCOPE)
+  ).join(' ');
+}
+
+/**
+ * Returns the AppAuth OAuth/OIDC service configuration.
+ */
+export function getServiceConfiguration(
   authConfig: {
-    default?: SCAuthorizationProvider;
-    paia?: SCAuthorizationProvider;
+    default: SCAuthorizationProvider;
   },
-): AuthorizationServiceConfigurationJson {
-  const providerConfig = authConfig[providerType] as SCAuthorizationProvider;
-  return {
-    authorization_endpoint: providerConfig.endpoints.authorization,
-    end_session_endpoint: providerConfig.endpoints.endSession,
-    revocation_endpoint: providerConfig.endpoints.revoke ?? '',
-    token_endpoint: providerConfig.endpoints.token,
-    userinfo_endpoint: providerConfig.endpoints.userinfo,
-  };
+): AuthorizationServiceConfiguration {
+  const endpoints =
+    authConfig.default.endpoints;
+
+  return new AuthorizationServiceConfiguration({
+    authorization_endpoint: endpoints.authorization,
+    token_endpoint: endpoints.token,
+    revocation_endpoint: endpoints.revoke || '',
+  });
 }
 
 /**
- * Return a URL of the app, depending on the platform where it is running
+ * Returns the OIDC redirect URL depending on the current platform.
  */
-function getRedirectUrl(routePath: string): string {
-  let appHost: string;
-  let appSchema: string;
-  if (environment.production) {
-    appSchema = Capacitor.isNativePlatform() ? environment.custom_url_scheme : 'https';
-    appHost = environment.app_host;
-  } else {
-    appSchema = Capacitor.isNativePlatform()
-      ? environment.custom_url_scheme
-      : window.location.protocol.split(':')[0];
-
-    appHost = Capacitor.isNativePlatform() ? environment.app_host : window.location.host;
+function getRedirectUrl(): string {
+  if (Capacitor.isNativePlatform()) {
+    return `${environment.custom_url_scheme}://${environment.app_host}/${AUTH_REDIRECT_PATH}`;
   }
-  return `${appSchema}://${appHost}/${routePath}`;
+
+  if (environment.production) {
+    return `https://${environment.app_host}/${AUTH_REDIRECT_PATH}`;
+  }
+
+  return `${window.location.origin}/${AUTH_REDIRECT_PATH}`;
 }

frontend/app/src/app/modules/auth/auth.provider.spec.ts

@@ -0,0 +1,584 @@
+import {
+  AppAuthError,
+  AuthorizationServiceConfiguration,
+  RevokeTokenRequest,
+  StorageBackend,
+  TokenRequestHandler,
+  TokenResponse,
+} from '@openid/appauth';
+import {BehaviorSubject, firstValueFrom, skip} from 'rxjs';
+
+import {AuthActions, AuthProvider, IAuthAction, INVALID_GRANT, isInvalidGrant} from './auth.provider';
+
+const TOKEN_RESPONSE_KEY = 'token_response';
+const TOKEN_LIFETIME = 3600;
+/** Shibboleth OP default access token lifetime. */
+const SHORT_TOKEN_LIFETIME = 600;
+const NOW_MS = Date.parse('2026-01-01T12:00:00Z');
+const NOW = NOW_MS / 1000;
+
+/**
+ * Creates a token with a real lifetime instead of spying on isValid().
+ *
+ * remainingSeconds > 0 → still valid for that long
+ * remainingSeconds < 0 → expired that many seconds ago
+ * refreshToken: null   → token without refresh token
+ */
+function makeToken(
+  opts: {accessToken?: string; refreshToken?: string | null; remainingSeconds?: number; lifetime?: number} = {},
+): TokenResponse {
+  const lifetime = opts.lifetime ?? TOKEN_LIFETIME;
+  const remaining = opts.remainingSeconds ?? lifetime;
+
+  return new TokenResponse({
+    access_token: opts.accessToken ?? 'access-token',
+    refresh_token: opts.refreshToken === null ? undefined : (opts.refreshToken ?? 'refresh-token'),
+    token_type: 'bearer',
+    expires_in: String(lifetime),
+    issued_at: NOW - (lifetime - remaining),
+  });
+}
+
+/** Lets pending promise callbacks run (the jasmine clock only drives timers). */
+async function flushPromises(): Promise<void> {
+  for (let index = 0; index < 50; index++) {
+    await Promise.resolve();
+  }
+}
+
+/** Typed access to the private members the tests depend on. */
+interface AuthProviderInternals {
+  storage: StorageBackend;
+  tokenHandler: TokenRequestHandler;
+  tokenSubject: BehaviorSubject<TokenResponse | undefined>;
+  notify(action: IAuthAction): void;
+}
+
+describe('AuthProvider', () => {
+  let provider: AuthProvider;
+  let internals: AuthProviderInternals;
+
+  let storageGetItem: jasmine.Spy;
+  let storageSetItem: jasmine.Spy;
+  let storageRemoveItem: jasmine.Spy;
+  let tokenRequest: jasmine.Spy;
+  let revokeRequest: jasmine.Spy;
+
+  /** Seeds storage with the given token and loads it through the public API. */
+  async function givenLoadedToken(token: TokenResponse | null): Promise<void> {
+    storageGetItem.and.resolveTo(token ? JSON.stringify(token.toJson()) : null);
+    await provider.loadTokenFromStorage();
+  }
+
+  /** Records every auth event emitted after this call (skips the replayed last one). */
+  function recordEvents(): AuthActions[] {
+    const events: AuthActions[] = [];
+    provider.events$.pipe(skip(1)).subscribe(event => events.push(event.action));
+    return events;
+  }
+
+  const isAuthenticated = () => firstValueFrom(provider.isAuthenticated$);
+  const isLoggedIn = () => firstValueFrom(provider.isLoggedIn$);
+
+  beforeEach(() => {
+    jasmine.clock().install();
+    jasmine.clock().mockDate(new Date(NOW_MS));
+
+    const platform = {is: () => false} as any;
+    const configProvider = {} as any;
+
+    provider = new AuthProvider(platform, configProvider);
+    internals = provider as unknown as AuthProviderInternals;
+
+    (provider as any).authConfigValue = {
+      server_host: 'https://idp.example.org',
+      client_id: 'test-client',
+      redirect_url: 'https://app.example.org/callback',
+      scopes: 'openid profile',
+      pkce: true,
+    };
+
+    (provider as any).localConfiguration = new AuthorizationServiceConfiguration({
+      authorization_endpoint: 'https://idp.example.org/authorize',
+      token_endpoint: 'https://idp.example.org/token',
+      revocation_endpoint: 'https://idp.example.org/revoke',
+    });
+
+    // Never touch real storage or the network.
+    storageGetItem = spyOn(internals.storage, 'getItem').and.resolveTo(null);
+    storageSetItem = spyOn(internals.storage, 'setItem').and.resolveTo();
+    storageRemoveItem = spyOn(internals.storage, 'removeItem').and.resolveTo();
+    tokenRequest = spyOn(internals.tokenHandler, 'performTokenRequest').and.rejectWith(
+      new Error('Unexpected token request'),
+    );
+    revokeRequest = spyOn(internals.tokenHandler, 'performRevokeTokenRequest').and.resolveTo(true);
+  });
+
+  afterEach(() => {
+    jasmine.clock().uninstall();
+  });
+
+  describe('isAuthenticated$', () => {
+    it('should provide false through isAuthenticated$ when there is no token response', async () => {
+      // Start authenticated so the test cannot pass on the initial value alone.
+      await givenLoadedToken(makeToken());
+      expect(await isAuthenticated()).toBeTrue();
+
+      await givenLoadedToken(null);
+
+      expect(internals.tokenSubject.value).toBeUndefined();
+      expect(await isAuthenticated()).toBeFalse();
+    });
+
+    it('should provide true through isAuthenticated$ when access token is valid', async () => {
+      await givenLoadedToken(makeToken());
+
+      expect(await isAuthenticated()).toBeTrue();
+    });
+
+    it('should provide false through isAuthenticated$ when access token is invalid', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -TOKEN_LIFETIME}));
+
+      expect(await isAuthenticated()).toBeFalse();
+      // Still logged in: a refresh token is available.
+      expect(await isLoggedIn()).toBeTrue();
+    });
+
+    it('should provide true through isAuthenticated$ after an expired token was refreshed', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      expect(await isAuthenticated()).toBeFalse();
+
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+      await provider.getValidToken();
+
+      expect(await isAuthenticated()).toBeTrue();
+    });
+  });
+
+  describe('getValidToken', () => {
+    it('returns the current token without refreshing when it is valid', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'current-access-token'}));
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).not.toHaveBeenCalled();
+      expect(token.accessToken).toBe('current-access-token');
+    });
+
+    it('refreshes the token when the access token is expired', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      tokenRequest.and.resolveTo(
+        makeToken({accessToken: 'new-access-token', refreshToken: 'new-refresh-token'}),
+      );
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(token.accessToken).toBe('new-access-token');
+      expect(token.refreshToken).toBe('new-refresh-token');
+      expect(storageSetItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY, jasmine.any(String));
+    });
+
+    it('refreshes the token when the access token expires within the buffer', async () => {
+      // 30 seconds left, the buffer for a 1 hour token is 60 seconds.
+      await givenLoadedToken(makeToken({remainingSeconds: 30}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(token.accessToken).toBe('new-access-token');
+    });
+
+    it('does not refresh a fresh short-lived (10 minute) token', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'current-access-token', lifetime: SHORT_TOKEN_LIFETIME}));
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).not.toHaveBeenCalled();
+      expect(token.accessToken).toBe('current-access-token');
+    });
+
+    it('accepts a freshly refreshed short-lived (10 minute) token', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60, lifetime: SHORT_TOKEN_LIFETIME}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token', lifetime: SHORT_TOKEN_LIFETIME}));
+
+      const token = await provider.getValidToken();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(token.accessToken).toBe('new-access-token');
+    });
+
+    it('keeps the previous refresh token when the refresh response contains none', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: 'old-refresh-token'}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token', refreshToken: null}));
+
+      const token = await provider.getValidToken();
+
+      expect(token.accessToken).toBe('new-access-token');
+      expect(token.refreshToken).toBe('old-refresh-token');
+    });
+
+    it('rejects without a request when the token is expired and has no refresh token', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: null}));
+
+      await expectAsync(provider.getValidToken()).toBeRejectedWithError(/No Refresh Token Available/);
+      expect(tokenRequest).not.toHaveBeenCalled();
+    });
+
+    it('sends only one refresh request for parallel callers', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+
+      const tokens = await Promise.all([
+        provider.getValidToken(),
+        provider.getValidToken(),
+        provider.getValidToken(),
+      ]);
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(tokens.map(token => token.accessToken)).toEqual([
+        'new-access-token',
+        'new-access-token',
+        'new-access-token',
+      ]);
+    });
+
+    it('refreshes again after a previous refresh has finished', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: -60}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'first', remainingSeconds: -60}));
+
+      // The first refresh returns an already expired token, so the call fails ...
+      await expectAsync(provider.getValidToken()).toBeRejected();
+
+      // ... and the next call must start a new request instead of reusing the old one.
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'second'}));
+      expect((await provider.getValidToken()).accessToken).toBe('second');
+      expect(tokenRequest).toHaveBeenCalledTimes(2);
+    });
+
+    describe('without a refresh token (browser)', () => {
+      it('uses the token within the buffer instead of failing early', async () => {
+        await givenLoadedToken(makeToken({accessToken: 'current-access-token', remainingSeconds: 60, refreshToken: null}));
+
+        const token = await provider.getValidToken();
+
+        expect(token.accessToken).toBe('current-access-token');
+        expect(tokenRequest).not.toHaveBeenCalled();
+      });
+
+      it('logs the user out when the token expires while the app is open', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: 60, refreshToken: null}));
+        expect(await isLoggedIn()).toBeTrue();
+        const events = recordEvents();
+
+        jasmine.clock().tick(2 * 60 * 1000);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWithError(/No Refresh Token Available/);
+        expect(await isLoggedIn()).toBeFalse();
+        expect(internals.tokenSubject.value).toBeUndefined();
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+        expect(events).toContain(AuthActions.SessionExpired);
+        expect(tokenRequest).not.toHaveBeenCalled();
+      });
+
+      it('does not restore an expired token from storage', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: null}));
+
+        expect(await isLoggedIn()).toBeFalse();
+        expect(internals.tokenSubject.value).toBeUndefined();
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+      });
+    });
+
+    describe('when refresh fails with invalid_grant from the native requestor', () => {
+      // CapacitorRequestor rejects non-2xx responses itself and keeps the OAuth body in extras.
+      const refreshError = new AppAuthError('HTTP 400', {error: INVALID_GRANT});
+
+      it('logs the user out', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60}));
+        const events = recordEvents();
+        tokenRequest.and.rejectWith(refreshError);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWith(refreshError);
+
+        expect(await isLoggedIn()).toBeFalse();
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+        expect(events).toEqual([AuthActions.RefreshFailed, AuthActions.SessionExpired]);
+      });
+
+      it('logs the user out only once for parallel callers', async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60}));
+        const events = recordEvents();
+        tokenRequest.and.rejectWith(refreshError);
+
+        const results = await Promise.allSettled([provider.getValidToken(), provider.getValidToken()]);
+
+        expect(results.map(result => result.status)).toEqual(['rejected', 'rejected']);
+        expect(tokenRequest).toHaveBeenCalledTimes(1);
+        expect(events.filter(event => event === AuthActions.SessionExpired).length).toBe(1);
+      });
+    });
+
+    describe('when refresh fails with invalid_grant', () => {
+      const refreshError = new AppAuthError(INVALID_GRANT);
+
+      beforeEach(async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60, refreshToken: 'invalid-refresh-token'}));
+        expect(await isLoggedIn()).toBeTrue();
+
+        tokenRequest.and.rejectWith(refreshError);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWith(refreshError);
+      });
+
+      it('changes isLoggedIn to false', async () => {
+        expect(await isLoggedIn()).toBeFalse();
+      });
+
+      it('removes the token from storage', () => {
+        expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+      });
+
+      it('clears the current token', () => {
+        expect(internals.tokenSubject.value).toBeUndefined();
+      });
+    });
+
+    describe('when refresh fails with a temporary error', () => {
+      // An AppAuthError that is not invalid_grant, e.g. a network failure.
+      const refreshError = new AppAuthError('Network Error');
+
+      beforeEach(async () => {
+        await givenLoadedToken(makeToken({remainingSeconds: -60}));
+        tokenRequest.and.rejectWith(refreshError);
+
+        await expectAsync(provider.getValidToken()).toBeRejectedWith(refreshError);
+      });
+
+      it('keeps the user logged in', async () => {
+        expect(await isLoggedIn()).toBeTrue();
+      });
+
+      it('does not remove the token from storage', () => {
+        expect(storageRemoveItem).not.toHaveBeenCalled();
+      });
+
+      it('keeps the current token for a later retry', () => {
+        expect(internals.tokenSubject.value?.refreshToken).toBe('refresh-token');
+      });
+    });
+  });
+
+  describe('expiry timer', () => {
+    it('logs the user out when the token expires, without any page asking for a token', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 60, refreshToken: null}));
+      const events = recordEvents();
+
+      jasmine.clock().tick(59 * 1000);
+      await flushPromises();
+      expect(await isLoggedIn()).toBeTrue();
+
+      jasmine.clock().tick(2 * 1000);
+      await flushPromises();
+
+      expect(await isLoggedIn()).toBeFalse();
+      expect(storageRemoveItem).toHaveBeenCalledOnceWith(TOKEN_RESPONSE_KEY);
+      expect(events).toEqual([AuthActions.SessionExpired]);
+    });
+
+    it('refreshes the token shortly before it expires when a refresh token is available', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 120, lifetime: SHORT_TOKEN_LIFETIME}));
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token', lifetime: SHORT_TOKEN_LIFETIME}));
+
+      // Due 60 seconds before expiry.
+      jasmine.clock().tick(61 * 1000);
+      await flushPromises();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+      expect(internals.tokenSubject.value?.accessToken).toBe('new-access-token');
+      expect(await isLoggedIn()).toBeTrue();
+    });
+
+    it('logs the user out when the refresh token is rejected', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 30}));
+      tokenRequest.and.rejectWith(new AppAuthError(INVALID_GRANT));
+
+      jasmine.clock().tick(2 * 1000);
+      await flushPromises();
+
+      expect(await isLoggedIn()).toBeFalse();
+    });
+
+    it('stays logged in and retries later after a temporary error', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 30}));
+      tokenRequest.and.rejectWith(new AppAuthError('Network Error'));
+
+      jasmine.clock().tick(2 * 1000);
+      await flushPromises();
+
+      expect(await isLoggedIn()).toBeTrue();
+      expect(tokenRequest).toHaveBeenCalledTimes(1);
+
+      tokenRequest.and.resolveTo(makeToken({accessToken: 'new-access-token'}));
+      jasmine.clock().tick(61 * 1000);
+      await flushPromises();
+
+      expect(tokenRequest).toHaveBeenCalledTimes(2);
+      expect(internals.tokenSubject.value?.accessToken).toBe('new-access-token');
+    });
+
+    it('does not fire after logout', async () => {
+      await givenLoadedToken(makeToken({remainingSeconds: 60, refreshToken: null}));
+      await provider.signOut();
+      const events = recordEvents();
+
+      jasmine.clock().tick(2 * 60 * 1000);
+      await flushPromises();
+
+      expect(events).not.toContain(AuthActions.SessionExpired);
+    });
+  });
+
+  describe('failed sign-in', () => {
+    it('keeps an existing session', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'still-valid'}));
+
+      internals.notify({action: AuthActions.SignInFailed, error: new Error('state mismatch')});
+
+      expect(await isLoggedIn()).toBeTrue();
+      expect(internals.tokenSubject.value?.accessToken).toBe('still-valid');
+      expect(storageRemoveItem).not.toHaveBeenCalled();
+    });
+
+    it('stays logged out without a session', async () => {
+      await givenLoadedToken(null);
+
+      internals.notify({action: AuthActions.SignInFailed, error: new Error('access_denied')});
+
+      expect(await isLoggedIn()).toBeFalse();
+    });
+  });
+
+  describe('signOut', () => {
+    /** The [token, token_type_hint, client_id] of each revoke request, in order. */
+    const revokedTokens = () =>
+      revokeRequest.calls.allArgs().map(([, request]) => {
+        const json = (request as RevokeTokenRequest).toJson();
+        return [json.token, json.token_type_hint, json.client_id];
+      });
+
+    it('revokes the refresh token, then the access token', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'access', refreshToken: 'refresh'}));
+
+      await provider.signOut();
+
+      expect(revokedTokens()).toEqual([
+        ['refresh', 'refresh_token', 'test-client'],
+        ['access', 'access_token', 'test-client'],
+      ]);
+      expect(await isLoggedIn()).toBeFalse();
+      expect(storageRemoveItem).toHaveBeenCalledWith(TOKEN_RESPONSE_KEY);
+    });
+
+    it('revokes only the access token when there is no refresh token (browser)', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'access', refreshToken: null}));
+
+      await provider.signOut();
+
+      expect(revokedTokens()).toEqual([['access', 'access_token', 'test-client']]);
+    });
+
+    it('logs out locally before the IdP answers', async () => {
+      await givenLoadedToken(makeToken());
+      let loggedInWhileRevoking: boolean | undefined;
+      revokeRequest.and.callFake(async () => {
+        loggedInWhileRevoking = await isLoggedIn();
+        return true;
+      });
+
+      await provider.signOut();
+
+      expect(loggedInWhileRevoking).toBeFalse();
+    });
+
+    it('still logs out and tries the access token when revoking the refresh token fails', async () => {
+      await givenLoadedToken(makeToken());
+      const events = recordEvents();
+      revokeRequest.and.returnValues(Promise.reject(new AppAuthError('Network Error')), Promise.resolve(true));
+
+      await provider.signOut();
+
+      expect(revokeRequest).toHaveBeenCalledTimes(2);
+      expect(await isLoggedIn()).toBeFalse();
+      expect(events).toEqual([AuthActions.SignOutSuccess, AuthActions.RevokeTokensFailed]);
+    });
+
+    it('does not wait for an IdP that does not answer', async () => {
+      await givenLoadedToken(makeToken());
+      revokeRequest.and.returnValue(new Promise(() => {}));
+      let done = false;
+
+      const signOut = provider.signOut().then(() => (done = true));
+      await flushPromises();
+      expect(done).toBeFalse();
+      expect(await isLoggedIn()).toBeFalse();
+
+      jasmine.clock().tick(5000);
+      await signOut;
+
+      expect(done).toBeTrue();
+    });
+
+    it('revokes nothing when no revocation endpoint is configured', async () => {
+      (provider as any).localConfiguration = new AuthorizationServiceConfiguration({
+        authorization_endpoint: 'https://idp.example.org/authorize',
+        token_endpoint: 'https://idp.example.org/token',
+        revocation_endpoint: '',
+      });
+      await givenLoadedToken(makeToken());
+
+      await provider.signOut();
+
+      expect(revokeRequest).not.toHaveBeenCalled();
+      expect(await isLoggedIn()).toBeFalse();
+    });
+
+    it('revokes nothing when asked not to', async () => {
+      await givenLoadedToken(makeToken());
+
+      await provider.signOut(undefined, false);
+
+      expect(revokeRequest).not.toHaveBeenCalled();
+      expect(await isLoggedIn()).toBeFalse();
+    });
+
+    it('revokes nothing when nobody is logged in', async () => {
+      await givenLoadedToken(null);
+
+      await provider.signOut();
+
+      expect(revokeRequest).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('isInvalidGrant', () => {
+    it('detects invalid_grant as error message', () => {
+      expect(isInvalidGrant(new AppAuthError(INVALID_GRANT))).toBeTrue();
+    });
+
+    it('detects invalid_grant in the response body', () => {
+      expect(isInvalidGrant(new AppAuthError('HTTP 400', {error: INVALID_GRANT}))).toBeTrue();
+    });
+
+    it('ignores other OAuth errors', () => {
+      expect(isInvalidGrant(new AppAuthError('HTTP 400', {error: 'invalid_request'}))).toBeFalse();
+    });
+
+    it('ignores network and non-AppAuth errors', () => {
+      expect(isInvalidGrant(new AppAuthError('HTTP 503'))).toBeFalse();
+      expect(isInvalidGrant(new Error(INVALID_GRANT))).toBeFalse();
+      expect(isInvalidGrant(undefined)).toBeFalse();
+    });
+  });
+});

frontend/app/src/app/modules/auth/auth.service.ts

@@ -1,526 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-// Temporary use of direct file until the version with bug fix is released
-// https://github.com/wi3land/ionic-appauth/blob/3716f4fc6b5491b0b75e049be0a47a5af8c4da6f/src/auth-service.ts
-// Bug: https://github.com/wi3land/ionic-appauth/issues/154
-import {
-  AuthorizationError,
-  AuthorizationNotifier,
-  AuthorizationRequest,
-  AuthorizationRequestHandler,
-  AuthorizationRequestJson,
-  AuthorizationResponse,
-  AuthorizationServiceConfiguration,
-  BaseTokenRequestHandler,
-  DefaultCrypto,
-  GRANT_TYPE_AUTHORIZATION_CODE,
-  GRANT_TYPE_REFRESH_TOKEN,
-  JQueryRequestor,
-  LocalStorageBackend,
-  Requestor,
-  RevokeTokenRequest,
-  RevokeTokenRequestJson,
-  StorageBackend,
-  StringMap,
-  TokenRequest,
-  TokenRequestHandler,
-  TokenRequestJson,
-  TokenResponse,
-} from '@openid/appauth';
-import {
-  ActionHistoryObserver,
-  AuthActionBuilder,
-  AuthActions,
-  AuthObserver,
-  AUTHORIZATION_RESPONSE_KEY,
-  AuthSubject,
-  BaseAuthObserver,
-  Browser,
-  DefaultBrowser,
-  EndSessionHandler,
-  EndSessionRequest,
-  EndSessionRequestJson,
-  IAuthAction,
-  IAuthConfig,
-  IAuthService,
-  IonicAuthorizationRequestHandler,
-  IonicEndSessionHandler,
-  IonicUserInfoHandler,
-  SessionObserver,
-  UserInfoHandler,
-} from 'ionic-appauth';
-import {BehaviorSubject, Observable} from 'rxjs';
-
-const TOKEN_RESPONSE_KEY = 'token_response';
-const AUTH_EXPIRY_BUFFER = 10 * 60 * -1; // 10 mins in seconds
-
-export abstract class AuthService implements IAuthService {
-  private _configuration?: AuthorizationServiceConfiguration;
-
-  private _authConfig?: IAuthConfig;
-
-  private _authSubject: AuthSubject = new AuthSubject();
-
-  private _actionHistory: ActionHistoryObserver = new ActionHistoryObserver();
-
-  private _session: SessionObserver = new SessionObserver();
-
-  private _authSubjectV2 = new BehaviorSubject<IAuthAction>(AuthActionBuilder.Init());
-
-  private _tokenSubject = new BehaviorSubject<TokenResponse | undefined>(undefined);
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private _userSubject = new BehaviorSubject<any>(undefined);
-
-  private _authenticatedSubject = new BehaviorSubject<boolean>(false);
-
-  private _loggedInSubject = new BehaviorSubject<boolean>(false);
-
-  private _initComplete = new BehaviorSubject<boolean>(false);
-
-  protected tokenHandler: TokenRequestHandler;
-
-  protected userInfoHandler: UserInfoHandler;
-
-  protected requestHandler: AuthorizationRequestHandler;
-
-  protected endSessionHandler: EndSessionHandler;
-
-  constructor(
-    protected browser: Browser = new DefaultBrowser(),
-    protected storage: StorageBackend = new LocalStorageBackend(),
-    protected requestor: Requestor = new JQueryRequestor(),
-  ) {
-    this.tokenHandler = new BaseTokenRequestHandler(requestor);
-    this.userInfoHandler = new IonicUserInfoHandler(requestor);
-    this.requestHandler = new IonicAuthorizationRequestHandler(browser, storage);
-    this.endSessionHandler = new IonicEndSessionHandler(browser);
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  get history(): IAuthAction[] {
-    return [...this._actionHistory.history];
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  get session() {
-    return this._session.session;
-  }
-
-  get token$(): Observable<TokenResponse | undefined> {
-    return this._tokenSubject.asObservable();
-  }
-
-  get isAuthenticated$(): Observable<boolean> {
-    return this._authenticatedSubject.asObservable();
-  }
-
-  /**
-   * Similar to isAuthenticated$, but will also return true if the token is expired
-   */
-  get isLoggedIn$(): Observable<boolean> {
-    return this._loggedInSubject.asObservable();
-  }
-
-  get initComplete$(): Observable<boolean> {
-    return this._initComplete.asObservable();
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  get user$(): Observable<any> {
-    return this._userSubject.asObservable();
-  }
-
-  get events$(): Observable<IAuthAction> {
-    return this._authSubjectV2.asObservable();
-  }
-
-  get authConfig(): IAuthConfig {
-    if (!this._authConfig) throw new Error('AuthConfig Not Defined');
-
-    return this._authConfig;
-  }
-
-  set authConfig(value: IAuthConfig) {
-    this._authConfig = value;
-  }
-
-  get configuration(): Promise<AuthorizationServiceConfiguration> {
-    if (!this._configuration) {
-      return AuthorizationServiceConfiguration.fetchFromIssuer(
-        this.authConfig.server_host,
-        this.requestor,
-      ).catch(() => {
-        throw new Error('Unable To Obtain Server Configuration');
-      });
-    }
-
-    if (this._configuration == undefined) {
-      throw new Error('Unable To Obtain Server Configuration');
-    } else {
-      return Promise.resolve(this._configuration);
-    }
-  }
-
-  public async init() {
-    this.setupAuthorizationNotifier();
-    this.loadTokenFromStorage();
-    this.addActionObserver(this._actionHistory);
-    this.addActionObserver(this._session);
-  }
-
-  protected notifyActionListers(action: IAuthAction) {
-    /* eslint-disable unicorn/no-useless-undefined */
-    switch (action.action) {
-      case AuthActions.SignInFailed:
-      case AuthActions.SignOutSuccess:
-      case AuthActions.SignOutFailed: {
-        this._tokenSubject.next(undefined);
-        this._userSubject.next(undefined);
-        this._authenticatedSubject.next(false);
-        this._loggedInSubject.next(false);
-        break;
-      }
-      case AuthActions.LoadTokenFromStorageFailed: {
-        this._tokenSubject.next(undefined);
-        this._userSubject.next(undefined);
-        this._authenticatedSubject.next(false);
-        this._loggedInSubject.next(false);
-        this._initComplete.next(true);
-        break;
-      }
-      case AuthActions.SignInSuccess:
-      case AuthActions.RefreshSuccess: {
-        this._tokenSubject.next(action.tokenResponse);
-        this._authenticatedSubject.next(true);
-        this._loggedInSubject.next(true);
-        break;
-      }
-      case AuthActions.LoadTokenFromStorageSuccess: {
-        this._tokenSubject.next(action.tokenResponse);
-        this._authenticatedSubject.next((action.tokenResponse as TokenResponse).isValid(0));
-        this._loggedInSubject.next(true);
-        this._initComplete.next(true);
-        break;
-      }
-      case AuthActions.RevokeTokensSuccess: {
-        this._tokenSubject.next(undefined);
-        break;
-      }
-      case AuthActions.LoadUserInfoSuccess: {
-        this._userSubject.next(action.user);
-        break;
-      }
-      case AuthActions.LoadUserInfoFailed: {
-        this._userSubject.next(undefined);
-        break;
-      }
-    }
-
-    this._authSubjectV2.next(action);
-    this._authSubject.notify(action);
-  }
-
-  protected setupAuthorizationNotifier() {
-    const notifier = new AuthorizationNotifier();
-    this.requestHandler.setAuthorizationNotifier(notifier);
-    notifier.setAuthorizationListener((request, response, error) =>
-      this.onAuthorizationNotification(request, response, error),
-    );
-  }
-
-  protected onAuthorizationNotification(
-    request: AuthorizationRequest,
-    response: AuthorizationResponse | null,
-    error: AuthorizationError | null,
-  ) {
-    const codeVerifier: string | undefined =
-      request.internal != undefined && this.authConfig.pkce ? request.internal.code_verifier : undefined;
-
-    if (response != undefined) {
-      this.requestAccessToken(response.code, codeVerifier);
-    } else if (error == undefined) {
-      throw new Error('Unknown Error With Authentication');
-    } else {
-      throw new Error(error.errorDescription);
-    }
-  }
-
-  protected async internalAuthorizationCallback(url: string) {
-    this.browser.closeWindow();
-    await this.storage.setItem(AUTHORIZATION_RESPONSE_KEY, url);
-    return this.requestHandler.completeAuthorizationRequestIfPossible();
-  }
-
-  protected async internalEndSessionCallback() {
-    this.browser.closeWindow();
-    this._actionHistory.clear();
-    this.notifyActionListers(AuthActionBuilder.SignOutSuccess());
-  }
-
-  protected async performEndSessionRequest(state?: string): Promise<void> {
-    if (this._tokenSubject.value == undefined) {
-      //if user has no token they should not be logged in in the first place
-      this.endSessionCallback();
-    } else {
-      const requestJson: EndSessionRequestJson = {
-        postLogoutRedirectURI: this.authConfig.end_session_redirect_url,
-        idTokenHint: this._tokenSubject.value.idToken || '',
-        state: state || undefined,
-      };
-
-      const request: EndSessionRequest = new EndSessionRequest(requestJson);
-      const returnedUrl: string | undefined = await this.endSessionHandler.performEndSessionRequest(
-        await this.configuration,
-        request,
-      );
-
-      //callback may come from showWindow or via another method
-      if (returnedUrl != undefined) {
-        this.endSessionCallback();
-      }
-    }
-  }
-
-  protected async performAuthorizationRequest(authExtras?: StringMap, state?: string): Promise<void> {
-    const requestJson: AuthorizationRequestJson = {
-      response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
-      client_id: this.authConfig.client_id,
-      redirect_uri: this.authConfig.redirect_url,
-      scope: this.authConfig.scopes,
-      extras: authExtras,
-      state: state || undefined,
-    };
-
-    const request = new AuthorizationRequest(requestJson, new DefaultCrypto(), this.authConfig.pkce);
-
-    if (this.authConfig.pkce) await request.setupCodeVerifier();
-
-    return this.requestHandler.performAuthorizationRequest(await this.configuration, request);
-  }
-
-  protected async requestAccessToken(code: string, codeVerifier?: string): Promise<void> {
-    const requestJSON: TokenRequestJson = {
-      grant_type: GRANT_TYPE_AUTHORIZATION_CODE,
-      code: code,
-      refresh_token: undefined,
-      redirect_uri: this.authConfig.redirect_url,
-      client_id: this.authConfig.client_id,
-      extras: codeVerifier
-        ? {
-            code_verifier: codeVerifier,
-            client_secret: this.authConfig.client_secret as string,
-          }
-        : {
-            client_secret: this.authConfig.client_secret as string,
-          },
-    };
-
-    const token: TokenResponse = await this.tokenHandler.performTokenRequest(
-      await this.configuration,
-      new TokenRequest(requestJSON),
-    );
-    await this.storage.setItem(TOKEN_RESPONSE_KEY, JSON.stringify(token.toJson()));
-    this.notifyActionListers(AuthActionBuilder.SignInSuccess(token));
-  }
-
-  protected async requestTokenRefresh() {
-    if (!this._tokenSubject.value) {
-      throw new Error('No Token Defined!');
-    }
-
-    const requestJSON: TokenRequestJson = {
-      grant_type: GRANT_TYPE_REFRESH_TOKEN,
-      refresh_token: this._tokenSubject.value?.refreshToken,
-      redirect_uri: this.authConfig.redirect_url,
-      client_id: this.authConfig.client_id,
-    };
-
-    const token: TokenResponse = await this.tokenHandler.performTokenRequest(
-      await this.configuration,
-      new TokenRequest(requestJSON),
-    );
-    if (!token.accessToken) {
-      throw new Error('No Access Token Defined In Refresh Response');
-    }
-    await this.storage.setItem(TOKEN_RESPONSE_KEY, JSON.stringify(token.toJson()));
-    this.notifyActionListers(AuthActionBuilder.RefreshSuccess(token));
-  }
-
-  protected async internalLoadTokenFromStorage() {
-    let token: TokenResponse | undefined;
-    const tokenResponseString: string | null = await this.storage.getItem(TOKEN_RESPONSE_KEY);
-
-    if (tokenResponseString != undefined) {
-      token = new TokenResponse(JSON.parse(tokenResponseString));
-
-      if (token) {
-        return this.notifyActionListers(AuthActionBuilder.LoadTokenFromStorageSuccess(token));
-      }
-    }
-
-    throw new Error('No Token In Storage');
-  }
-
-  protected async requestTokenRevoke() {
-    const revokeRefreshJson: RevokeTokenRequestJson = {
-      token: (this._tokenSubject.value as TokenResponse).refreshToken as string,
-      token_type_hint: 'refresh_token',
-      client_id: this.authConfig.client_id,
-    };
-
-    const revokeAccessJson: RevokeTokenRequestJson = {
-      token: (this._tokenSubject.value as TokenResponse).accessToken,
-      token_type_hint: 'access_token',
-      client_id: this.authConfig.client_id,
-    };
-
-    await this.tokenHandler.performRevokeTokenRequest(
-      await this.configuration,
-      new RevokeTokenRequest(revokeRefreshJson),
-    );
-    await this.tokenHandler.performRevokeTokenRequest(
-      await this.configuration,
-      new RevokeTokenRequest(revokeAccessJson),
-    );
-    await this.storage.removeItem(TOKEN_RESPONSE_KEY);
-    this.notifyActionListers(AuthActionBuilder.RevokeTokensSuccess());
-  }
-
-  protected async internalRequestUserInfo() {
-    if (this._tokenSubject.value) {
-      const userInfo = await this.userInfoHandler.performUserInfoRequest(
-        await this.configuration,
-        this._tokenSubject.value,
-      );
-      this.notifyActionListers(AuthActionBuilder.LoadUserInfoSuccess(userInfo));
-    } else {
-      throw new Error('No Token Available');
-    }
-  }
-
-  public async loadTokenFromStorage() {
-    await this.internalLoadTokenFromStorage().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.LoadTokenFromStorageFailed(error));
-    });
-  }
-
-  public async signIn(authExtras?: StringMap, state?: string) {
-    await this.performAuthorizationRequest(authExtras, state).catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignInFailed(error));
-    });
-  }
-
-  public async signOut(state?: string, revokeTokens?: boolean) {
-    if (revokeTokens) {
-      await this.revokeTokens();
-    }
-
-    await this.storage.removeItem(TOKEN_RESPONSE_KEY);
-
-    if ((await this.configuration).endSessionEndpoint) {
-      await this.performEndSessionRequest(state).catch(error => {
-        this.notifyActionListers(AuthActionBuilder.SignOutFailed(error));
-      });
-    }
-  }
-
-  public async revokeTokens() {
-    await this.requestTokenRevoke().catch(error => {
-      this.storage.removeItem(TOKEN_RESPONSE_KEY);
-      this.notifyActionListers(AuthActionBuilder.RevokeTokensFailed(error));
-    });
-  }
-
-  public async refreshToken() {
-    await this.requestTokenRefresh().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.RefreshFailed(error));
-    });
-  }
-
-  public async loadUserInfo() {
-    await this.internalRequestUserInfo().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.LoadUserInfoFailed(error));
-    });
-  }
-
-  public authorizationCallback(callbackUrl: string): void {
-    this.internalAuthorizationCallback(callbackUrl).catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignInFailed(error));
-    });
-  }
-
-  public endSessionCallback(): void {
-    this.internalEndSessionCallback().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignOutFailed(error));
-    });
-  }
-
-  public async getValidToken(buffer: number = AUTH_EXPIRY_BUFFER): Promise<TokenResponse> {
-    if (this._tokenSubject.value) {
-      if (this._tokenSubject.value.isValid(buffer)) {
-        return this._tokenSubject.value;
-      } else {
-        await this.refreshToken();
-        if (this._tokenSubject.value) {
-          return this._tokenSubject.value;
-        }
-      }
-    }
-
-    throw new Error('Unable To Obtain Valid Token');
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  public addActionListener(function_: (action: IAuthAction) => void): AuthObserver {
-    const observer: AuthObserver = AuthObserver.Create(function_);
-    this.addActionObserver(observer);
-    return observer;
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  public addActionObserver(observer: BaseAuthObserver): void {
-    if (this._actionHistory.lastAction) {
-      observer.update(this._actionHistory.lastAction);
-    }
-
-    this._authSubject.attach(observer);
-  }
-
-  /**
-   * @deprecated independant observers have been replaced by Rxjs
-   * this will be removed in a future release
-   * please use $ suffixed observers in future
-   */
-  public removeActionObserver(observer: BaseAuthObserver): void {
-    this._authSubject.detach(observer);
-  }
-}

frontend/app/src/app/modules/auth/capacitor-authorization-request-handler.spec.ts

@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import {
+  AuthorizationError,
+  AuthorizationNotifier,
+  AuthorizationRequest,
+  AuthorizationResponse,
+  AuthorizationServiceConfiguration,
+  StorageBackend,
+} from '@openid/appauth';
+import {CapacitorAuthorizationRequestHandler} from './capacitor-authorization-request-handler';
+
+const PENDING_REQUEST_KEY = 'appauth_capacitor_authorization_request';
+const REDIRECT_URI = 'de.example.app://app.example.org/auth/callback';
+
+/**
+ * In-memory StorageBackend, so the tests can look at what the handler stores.
+ */
+class MemoryStorage extends StorageBackend {
+  readonly items = new Map<string, string>();
+
+  async getItem(name: string): Promise<string | null> {
+    return this.items.get(name) ?? null; // eslint-disable-line unicorn/no-null
+  }
+
+  async removeItem(name: string): Promise<void> {
+    this.items.delete(name);
+  }
+
+  async clear(): Promise<void> {
+    this.items.clear();
+  }
+
+  async setItem(name: string, value: string): Promise<void> {
+    this.items.set(name, value);
+  }
+}
+
+/**
+ * The callback URL as the IdP would send it back to the app.
+ */
+function callbackUrl(parameters: Record<string, string>): string {
+  return `${REDIRECT_URI}?${new URLSearchParams(parameters).toString()}`;
+}
+
+describe('CapacitorAuthorizationRequestHandler', () => {
+  let storage: MemoryStorage;
+  let handler: CapacitorAuthorizationRequestHandler;
+  let listener: jasmine.Spy<
+    (
+      request: AuthorizationRequest,
+      response: AuthorizationResponse | null,
+      error: AuthorizationError | null,
+    ) => void
+  >;
+  let windowOpen: jasmine.Spy;
+
+  const configuration = new AuthorizationServiceConfiguration({
+    authorization_endpoint: 'https://idp.example.org/authorize',
+    token_endpoint: 'https://idp.example.org/token',
+    revocation_endpoint: '',
+  });
+
+  /**
+   * Starts a login like AuthProvider.signIn() does and returns its state.
+   */
+  async function startLogin(): Promise<string> {
+    const request = new AuthorizationRequest({
+      response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
+      client_id: 'test-client',
+      redirect_uri: REDIRECT_URI,
+      scope: 'openid',
+    });
+
+    await handler.performAuthorizationRequest(configuration, request);
+
+    return request.state;
+  }
+
+  beforeEach(() => {
+    storage = new MemoryStorage();
+    handler = new CapacitorAuthorizationRequestHandler(storage);
+
+    const notifier = new AuthorizationNotifier();
+    listener = jasmine.createSpy('authorizationListener');
+    notifier.setAuthorizationListener(listener);
+    handler.setAuthorizationNotifier(notifier);
+
+    // In tests, @capacitor/browser uses its web implementation, which calls window.open().
+    windowOpen = spyOn(window, 'open').and.returnValue({close: () => {}} as Window);
+  });
+
+  describe('starting the login', () => {
+    it('opens the authorization URL with state and PKCE (S256)', async () => {
+      const state = await startLogin();
+
+      const url = new URL(windowOpen.calls.mostRecent().args[0] as string);
+      expect(url.origin + url.pathname).toBe('https://idp.example.org/authorize');
+      expect(url.searchParams.get('state')).toBe(state);
+      expect(url.searchParams.get('redirect_uri')).toBe(REDIRECT_URI);
+      expect(url.searchParams.get('code_challenge_method')).toBe('S256');
+      expect(url.searchParams.get('code_challenge')).toBeTruthy();
+    });
+
+    it('stores the pending request including the PKCE code_verifier', async () => {
+      const state = await startLogin();
+
+      const stored = JSON.parse(storage.items.get(PENDING_REQUEST_KEY)!);
+      expect(stored.state).toBe(state);
+      expect(stored.internal.code_verifier).toBeTruthy();
+    });
+  });
+
+  describe('completing the login', () => {
+    it('delivers the code together with the matching request', async () => {
+      const state = await startLogin();
+      const verifier = JSON.parse(storage.items.get(PENDING_REQUEST_KEY)!).internal.code_verifier;
+
+      await handler.completeAuthorizationRequestFromUrl(callbackUrl({code: 'auth-code', state}));
+
+      expect(listener).toHaveBeenCalledTimes(1);
+      const [request, response, error] = listener.calls.mostRecent().args;
+      expect(response?.code).toBe('auth-code');
+      expect(error).toBeNull();
+      expect(request.internal?.['code_verifier']).toBe(verifier);
+    });
+
+    it('accepts a callback only once', async () => {
+      const state = await startLogin();
+      const url = callbackUrl({code: 'auth-code', state});
+
+      await handler.completeAuthorizationRequestFromUrl(url);
+      expect(storage.items.has(PENDING_REQUEST_KEY)).toBeFalse();
+
+      await expectAsync(handler.completeAuthorizationRequestFromUrl(url)).toBeRejectedWithError(
+        /No pending authorization request/,
+      );
+      expect(listener).toHaveBeenCalledTimes(1);
+    });
+
+    it('rejects a callback with a different state and keeps the pending request', async () => {
+      const state = await startLogin();
+
+      await expectAsync(
+        handler.completeAuthorizationRequestFromUrl(
+          callbackUrl({code: 'attacker-code', state: 'other-state'}),
+        ),
+      ).toBeRejectedWithError(/state does not match/);
+      expect(listener).not.toHaveBeenCalled();
+
+      // The real callback still works afterwards.
+      await handler.completeAuthorizationRequestFromUrl(callbackUrl({code: 'auth-code', state}));
+      expect(listener.calls.mostRecent().args[1]?.code).toBe('auth-code');
+    });
+
+    it('rejects a callback without state', async () => {
+      await startLogin();
+
+      await expectAsync(
+        handler.completeAuthorizationRequestFromUrl(callbackUrl({code: 'auth-code'})),
+      ).toBeRejectedWithError(/state does not match/);
+      expect(listener).not.toHaveBeenCalled();
+    });
+
+    it('rejects a callback when no login was started', async () => {
+      await expectAsync(
+        handler.completeAuthorizationRequestFromUrl(callbackUrl({code: 'auth-code', state: 'any-state'})),
+      ).toBeRejectedWithError(/No pending authorization request/);
+      expect(listener).not.toHaveBeenCalled();
+    });
+
+    it('delivers an error response from the IdP and ends the pending request', async () => {
+      const state = await startLogin();
+
+      await handler.completeAuthorizationRequestFromUrl(
+        callbackUrl({error: 'access_denied', error_description: 'User cancelled', state}),
+      );
+
+      const [, response, error] = listener.calls.mostRecent().args;
+      expect(response).toBeNull();
+      expect(error?.error).toBe('access_denied');
+      expect(error?.errorDescription).toBe('User cancelled');
+      expect(storage.items.has(PENDING_REQUEST_KEY)).toBeFalse();
+    });
+
+    it('rejects a callback with neither code nor error', async () => {
+      const state = await startLogin();
+
+      await expectAsync(
+        handler.completeAuthorizationRequestFromUrl(callbackUrl({state})),
+      ).toBeRejectedWithError(/neither an authorization code nor an error/);
+      expect(listener).not.toHaveBeenCalled();
+    });
+  });
+});

frontend/app/src/app/modules/auth/capacitor-authorization-request-handler.ts

@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2026 StApps
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {Browser} from '@capacitor/browser';
+import {
+  AuthorizationError,
+  AuthorizationErrorJson,
+  AuthorizationRequest,
+  AuthorizationRequestHandler,
+  AuthorizationRequestJson,
+  AuthorizationRequestResponse,
+  AuthorizationResponse,
+  AuthorizationResponseJson,
+  AuthorizationServiceConfiguration,
+  BasicQueryStringUtils,
+  DefaultCrypto,
+  StorageBackend,
+  StringMap,
+} from '@openid/appauth';
+
+const AUTHORIZATION_REQUEST_KEY =
+  'appauth_capacitor_authorization_request';
+
+/**
+ * AppAuth authorization request handler for native Capacitor applications.
+ *
+ * AppAuth-JS handles:
+ * - state generation and validation data
+ * - PKCE code_verifier / code_challenge
+ * - authorization URL construction
+ * - AuthorizationNotifier
+ *
+ * This handler adds the Capacitor-specific parts:
+ * - persist the pending authorization request
+ * - open the authorization URL using @capacitor/browser
+ * - process the callback URL delivered through appUrlOpen
+ */
+export class CapacitorAuthorizationRequestHandler extends AuthorizationRequestHandler {
+  private callbackUrl?: string;
+
+  constructor(private readonly storage: StorageBackend) {
+    super(
+      new BasicQueryStringUtils(),
+      new DefaultCrypto(),
+    );
+  }
+
+  public async performAuthorizationRequest(
+    configuration: AuthorizationServiceConfiguration,
+    request: AuthorizationRequest,
+  ): Promise<void> {
+    /*
+     * Important:
+     *
+     * toJson() calls setupCodeVerifier() internally.
+     * Therefore PKCE is initialized before buildRequestUrl()
+     * constructs the authorization URL.
+     */
+    const requestJson =
+      await request.toJson();
+
+    await this.storage.setItem(
+      AUTHORIZATION_REQUEST_KEY,
+      JSON.stringify(requestJson),
+    );
+
+    const url =
+      this.buildRequestUrl(
+        configuration,
+        request,
+      );
+
+    await Browser.open({url});
+  }
+
+  /**
+   * Completes the authorization flow using the URL received from
+   * Capacitor's App.addListener('appUrlOpen', ...).
+   */
+  public async completeAuthorizationRequestFromUrl(
+    callbackUrl: string,
+  ): Promise<void> {
+    this.callbackUrl = callbackUrl;
+
+    /*
+     * The deep link has returned control to the application.
+     * Close the SFSafariViewController / Custom Tab if it is still open.
+     */
+    try {
+      await Browser.close();
+    } catch {
+      // Browser might already have been closed by the platform.
+    }
+
+    await this.completeAuthorizationRequestIfPossible();
+  }
+
+  protected async completeAuthorizationRequest():
+    Promise<AuthorizationRequestResponse | null> {
+    if (!this.callbackUrl) {
+      return null;
+    }
+
+    const storedRequest =
+      await this.storage.getItem(
+        AUTHORIZATION_REQUEST_KEY,
+      );
+
+    if (!storedRequest) {
+      this.callbackUrl = undefined;
+
+      throw new Error(
+        'No pending authorization request found.',
+      );
+    }
+
+    const requestJson =
+      JSON.parse(
+        storedRequest,
+      ) as AuthorizationRequestJson;
+
+    /*
+     * The serialized request also contains `internal`, including
+     * AppAuth's PKCE code_verifier.
+     */
+    const request =
+      new AuthorizationRequest(requestJson);
+
+    const parameters =
+      this.parseCallbackUrl(
+        this.callbackUrl,
+      );
+
+    const state =
+      parameters['state'];
+
+    /*
+     * Never accept an authorization response for a different request.
+     */
+    if (!state || state !== request.state) {
+      this.callbackUrl = undefined;
+
+      throw new Error(
+        'Authorization response state does not match the authorization request.',
+      );
+    }
+
+    const error =
+      parameters['error'];
+
+    let response:
+      AuthorizationResponse | null = null;
+
+    let authorizationError:
+      AuthorizationError | null = null;
+
+    if (error) {
+      const errorJson:
+        AuthorizationErrorJson = {
+        error,
+
+        error_description:
+          parameters[
+            'error_description'
+            ],
+
+        error_uri:
+          parameters['error_uri'],
+
+        state,
+      };
+
+      authorizationError =
+        new AuthorizationError(
+          errorJson,
+        );
+    } else {
+      const code =
+        parameters['code'];
+
+      if (!code) {
+        this.callbackUrl = undefined;
+
+        throw new Error(
+          'Authorization callback contains neither an authorization code nor an error.',
+        );
+      }
+
+      const responseJson:
+        AuthorizationResponseJson = {
+        code,
+        state,
+      };
+
+      response =
+        new AuthorizationResponse(
+          responseJson,
+        );
+    }
+
+    /*
+     * The response has been successfully associated with the
+     * pending request. It can now be consumed exactly once.
+     */
+    await this.storage.removeItem(
+      AUTHORIZATION_REQUEST_KEY,
+    );
+
+    this.callbackUrl = undefined;
+
+    return {
+      request,
+      response,
+      error: authorizationError,
+    };
+  }
+
+  private parseCallbackUrl(
+    callbackUrl: string,
+  ): StringMap {
+    const result: StringMap = {};
+
+    const url = new URL(callbackUrl);
+
+    /*
+     * Authorization Code Flow normally returns code/state in
+     * the query string:
+     *
+     *   openstapps:/callback?code=...&state=...
+     */
+    url.searchParams.forEach(
+      (value, key) => {
+        result[key] = value;
+      },
+    );
+
+    /*
+     * Also accept parameters in the fragment as a fallback.
+     */
+    if (url.hash.length > 1) {
+      const hash =
+        url.hash.substring(1);
+
+      const hashParameters =
+        new URLSearchParams(hash);
+
+      hashParameters.forEach(
+        (value, key) => {
+          if (!(key in result)) {
+            result[key] = value;
+          }
+        },
+      );
+    }
+
+    return result;
+  }
+}

frontend/app/src/app/modules/auth/capacitor-requestor.ts

@@ -13,61 +13,96 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 
-import {Requestor} from '@openid/appauth';
-import {CapacitorHttp, HttpHeaders, HttpResponse} from '@capacitor/core';
-import {XhrSettings} from 'ionic-appauth/lib/cordova';
+import {
+  AppAuthError,
+  Requestor,
+} from '@openid/appauth';
+import {
+  CapacitorHttp,
+  HttpHeaders,
+  HttpOptions,
+} from '@capacitor/core';
 
-// REQUIRES CAPACITOR PLUGIN
-// @capacitor-community/http
-export class CapacitorRequestor extends Requestor {
-  constructor() {
-    super();
-  }
+type XhrSettings = Parameters<Requestor['xhr']>[0];
 
+export class CapacitorRequestor implements Requestor {
   public async xhr<T>(settings: XhrSettings): Promise<T> {
-    if (!settings.method) settings.method = 'GET';
+    if (!settings.url) {
+      throw new AppAuthError('A URL must be provided.');
+    }
 
-    switch (settings.method) {
-      case 'GET': {
-        return this.get(settings.url, settings.headers);
-      }
-      case 'POST': {
-        return this.post(settings.url, settings.data, settings.headers);
-      }
-      case 'PUT': {
-        return this.put(settings.url, settings.data, settings.headers);
-      }
-      case 'DELETE': {
-        return this.delete(settings.url, settings.headers);
+    const method = (settings.method ?? 'GET').toUpperCase();
+    const url = new URL(settings.url);
+
+    let data: unknown;
+
+    if (settings.data) {
+      if (method === 'POST') {
+        data = settings.data;
+      } else {
+        const searchParams = new URLSearchParams(settings.data);
+
+        searchParams.forEach((value, key) => {
+          url.searchParams.append(key, value);
+        });
       }
     }
-  }
 
-  private async get<T>(url: string, headers: HttpHeaders) {
-    return CapacitorHttp.get({url, headers}).then((response: HttpResponse) => response.data as T);
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private async post<T>(url: string, data: any, headers: HttpHeaders) {
-    return CapacitorHttp.post({
-      url,
+    const options: HttpOptions = {
+      url: url.toString(),
+      method,
+      headers: this.getHeaders(settings.headers),
       data,
-      headers,
-    }).then((response: HttpResponse) => {
-      return response.data as T;
-    });
+    };
+
+    if (settings.dataType?.toLowerCase() === 'json') {
+      options.responseType = 'json';
+    }
+
+    const response = await CapacitorHttp.request(options);
+
+    if (response.status < 200 || response.status >= 300) {
+      const body = this.parseBody(response.data);
+
+      /*
+       * Use the OAuth error code (e.g. 'invalid_grant') as message when the
+       * server sent one (RFC 6749, 5.2), so callers can tell a rejected
+       * refresh token apart from temporary failures.
+       */
+      throw new AppAuthError(
+        typeof body?.error === 'string' ? body.error : `HTTP ${response.status}`,
+        body ?? response.data,
+      );
+    }
+
+    return response.data as T;
   }
 
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private async put<T>(url: string, data: any, headers: HttpHeaders) {
-    return CapacitorHttp.put({
-      url,
-      data,
-      headers,
-    }).then((response: HttpResponse) => response.data as T);
+  private parseBody(data: unknown): Record<string, unknown> | undefined {
+    if (typeof data === 'string') {
+      try {
+        data = JSON.parse(data);
+      } catch {
+        return undefined;
+      }
+    }
+
+    return data !== null && typeof data === 'object' ? (data as Record<string, unknown>) : undefined;
   }
 
-  private async delete<T>(url: string, headers: HttpHeaders) {
-    return CapacitorHttp.delete({url, headers}).then((response: HttpResponse) => response.data as T);
+  private getHeaders(headers: XhrSettings['headers']): HttpHeaders {
+    const result: HttpHeaders = {};
+
+    if (!headers) {
+      return result;
+    }
+
+    for (const [key, value] of Object.entries(headers)) {
+      if (value !== undefined && value !== null) {
+        result[key] = String(value);
+      }
+    }
+
+    return result;
   }
 }

frontend/app/src/app/modules/auth/default-auth.service.spec.ts

@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-import {TestBed} from '@angular/core/testing';
-import {ConfigProvider} from '../config/config.provider';
-import {StorageProvider} from '../storage/storage.provider';
-import {DefaultAuthService} from './default-auth.service';
-import {Browser} from 'ionic-appauth';
-import {nowInSeconds, Requestor, StorageBackend} from '@openid/appauth';
-import {TranslateService} from '@ngx-translate/core';
-import {StAppsWebHttpClient} from '../data/stapps-web-http-client.provider';
-import {provideHttpClient, withInterceptorsFromDi} from '@angular/common/http';
-import {IonicStorage} from 'ionic-appauth/lib';
-import {RouterModule} from '@angular/router';
-import {LoggerTestingModule} from 'ngx-logger/testing';
-
-describe('AuthService', () => {
-  let defaultAuthService: DefaultAuthService;
-  let storageBackendSpy: jasmine.SpyObj<StorageBackend>;
-  const storageProviderSpy = jasmine.createSpyObj('StorageProvider', ['init', 'get', 'has', 'put', 'search']);
-  const translateServiceSpy = jasmine.createSpyObj('TranslateService', ['setDefaultLang', 'use']);
-
-  beforeEach(() => {
-    storageBackendSpy = jasmine.createSpyObj('StorageBackend', ['getItem']);
-
-    TestBed.configureTestingModule({
-      imports: [LoggerTestingModule, RouterModule.forRoot([])],
-      providers: [
-        StAppsWebHttpClient,
-        {
-          provide: TranslateService,
-          useValue: translateServiceSpy,
-        },
-        {
-          provide: StorageProvider,
-          useValue: storageProviderSpy,
-        },
-        IonicStorage,
-        ConfigProvider,
-        Browser,
-        {
-          provide: StorageBackend,
-          useValue: storageBackendSpy,
-        },
-        Requestor,
-        provideHttpClient(withInterceptorsFromDi()),
-      ],
-    });
-    defaultAuthService = TestBed.inject(DefaultAuthService);
-  });
-
-  describe('loadTokenFromStorage', () => {
-    it('should provide false through isAuthenticated$ when there is no token response', async () => {
-      // eslint-disable-next-line unicorn/no-null
-      storageBackendSpy.getItem.and.returnValue(Promise.resolve(null));
-      let loggedInHolder;
-      defaultAuthService.isAuthenticated$.subscribe(loggedIn => {
-        loggedInHolder = loggedIn;
-      });
-      await defaultAuthService.loadTokenFromStorage();
-
-      expect(loggedInHolder).toBeFalse();
-    });
-
-    it('should provide true through isAuthenticated$ when access token is valid', async () => {
-      const validToken = `{"access_token":"AT-XXXX","refresh_token":"RT-XXXX","scope":"","token_type":"bearer","issued_at":${nowInSeconds()},"expires_in":"${
-        8 * 60 * 60
-      }"}`;
-      storageBackendSpy.getItem.and.returnValue(Promise.resolve(validToken));
-      let loggedInHolder;
-      defaultAuthService.isAuthenticated$.subscribe(loggedIn => {
-        loggedInHolder = loggedIn;
-      });
-      await defaultAuthService.loadTokenFromStorage();
-
-      expect(loggedInHolder).toBeTrue();
-    });
-
-    it('should provide false through isAuthenticated$ when access token is invalid', async () => {
-      const invalidToken = `{"access_token":"AT-INVALID-XXXX","refresh_token":"RT-XXXX","scope":"","token_type":"bearer","issued_at":${
-        nowInSeconds() - 9 * 60 * 60
-      },"expires_in":"${8 * 60 * 60}"}`;
-      storageBackendSpy.getItem.and.returnValue(Promise.resolve(invalidToken));
-      let loggedInHolder;
-      defaultAuthService.isAuthenticated$.subscribe(loggedIn => {
-        loggedInHolder = loggedIn;
-      });
-      await defaultAuthService.loadTokenFromStorage();
-
-      expect(loggedInHolder).toBeFalse();
-    });
-  });
-});

frontend/app/src/app/modules/auth/default-auth.service.ts

@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {
-  AuthorizationRequestHandler,
-  AuthorizationServiceConfiguration,
-  JQueryRequestor,
-  LocalStorageBackend,
-  Requestor,
-  StorageBackend,
-  TokenRequestHandler,
-} from '@openid/appauth';
-import {AuthActionBuilder, Browser, DefaultBrowser, EndSessionHandler, UserInfoHandler} from 'ionic-appauth';
-import {ConfigProvider} from '../config/config.provider';
-import {SCAuthorizationProvider} from '@openstapps/core';
-import {getClientConfig, getEndpointsConfig} from './auth.provider.methods';
-import {Injectable, inject} from '@angular/core';
-import {AuthService} from './auth.service';
-
-const TOKEN_RESPONSE_KEY = 'token_response';
-
-@Injectable({
-  providedIn: 'root',
-})
-export class DefaultAuthService extends AuthService {
-  protected browser: Browser;
-
-  protected storage: StorageBackend;
-
-  protected requestor: Requestor;
-
-  private readonly configProvider = inject(ConfigProvider);
-
-  public localConfiguration: AuthorizationServiceConfiguration;
-
-  protected tokenHandler: TokenRequestHandler;
-
-  protected userInfoHandler: UserInfoHandler;
-
-  protected requestHandler: AuthorizationRequestHandler;
-
-  protected endSessionHandler: EndSessionHandler;
-
-  constructor() {
-    const browser = inject(Browser) ?? new DefaultBrowser();
-    const storage = inject(StorageBackend) ?? new LocalStorageBackend();
-    const requestor = inject(Requestor) ?? new JQueryRequestor();
-
-    super(browser, storage, requestor);
-
-    this.browser = browser;
-    this.storage = storage;
-    this.requestor = requestor;
-  }
-
-  get configuration(): Promise<AuthorizationServiceConfiguration> {
-    if (!this.localConfiguration) throw new Error('Local Configuration Not Defined');
-
-    return Promise.resolve(this.localConfiguration);
-  }
-
-  public async init() {
-    this.setupConfiguration();
-    this.setupAuthorizationNotifier();
-    await this.loadTokenFromStorage();
-  }
-
-  setupConfiguration() {
-    const authConfig = this.configProvider.getAnyValue('auth') as {
-      default: SCAuthorizationProvider;
-    };
-    this.authConfig = getClientConfig('default', authConfig);
-    this.localConfiguration = new AuthorizationServiceConfiguration(
-      getEndpointsConfig('default', authConfig),
-    );
-  }
-
-  public async signOut() {
-    await this.revokeTokens().catch(error => {
-      this.notifyActionListers(AuthActionBuilder.SignOutFailed(error));
-    });
-    this.notifyActionListers(AuthActionBuilder.SignOutSuccess());
-  }
-
-  public async revokeTokens() {
-    // Note: only locally
-    await this.storage.removeItem(TOKEN_RESPONSE_KEY);
-    this.notifyActionListers(AuthActionBuilder.RevokeTokensSuccess());
-  }
-}

frontend/app/src/app/modules/auth/factories/requestor.factory.ts

@@ -14,9 +14,11 @@
  */
 
 import {Platform} from '@ionic/angular/standalone';
+import {FetchRequestor, Requestor} from '@openid/appauth';
 import {CapacitorRequestor} from '../capacitor-requestor';
-import {NgHttpService} from '../ng-http.service';
 
-export const httpFactory = (platform: Platform) => {
-  return platform.is('capacitor') ? new CapacitorRequestor() : new NgHttpService();
+export const requestorFactory = (platform: Platform): Requestor => {
+  return platform.is('capacitor')
+    ? new CapacitorRequestor()
+    : new FetchRequestor();
 };

frontend/app/src/app/modules/auth/factories/storage.factory.ts

@@ -14,9 +14,11 @@
  */
 
 import {Platform} from '@ionic/angular/standalone';
-import {IonicStorage} from 'ionic-appauth/lib';
+import {LocalStorageBackend, StorageBackend} from '@openid/appauth';
 import {SafeCapacitorSecureStorage} from '../../storage/capacitor-secure-storage';
 
-export const storageFactory = (platform: Platform) => {
-  return platform.is('capacitor') ? new SafeCapacitorSecureStorage() : new IonicStorage();
+export const storageFactory = (platform: Platform): StorageBackend => {
+  return platform.is('capacitor')
+    ? new SafeCapacitorSecureStorage()
+    : new LocalStorageBackend();
 };

frontend/app/src/app/modules/auth/ng-http.service.ts

@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2023 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-import {Injectable, inject} from '@angular/core';
-import {Requestor} from '@openid/appauth';
-import {HttpClient, HttpHeaders} from '@angular/common/http';
-import {XhrSettings} from 'ionic-appauth/lib/cordova';
-import {firstValueFrom, Observable} from 'rxjs';
-
-@Injectable({
-  providedIn: 'root',
-})
-export class NgHttpService implements Requestor {
-  private http = inject(HttpClient);
-
-  public async xhr<T>(settings: XhrSettings): Promise<T> {
-    if (!settings.method) {
-      settings.method = 'GET';
-    }
-
-    let observable: Observable<T>;
-
-    switch (settings.method) {
-      case 'GET': {
-        observable = this.http.get<T>(settings.url, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-      case 'POST': {
-        observable = this.http.post<T>(settings.url, settings.data, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-      case 'PUT': {
-        observable = this.http.put<T>(settings.url, settings.data, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-      case 'DELETE': {
-        observable = this.http.delete<T>(settings.url, {
-          headers: this.getHeaders(settings.headers),
-        });
-        break;
-      }
-    }
-
-    return firstValueFrom(observable);
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  private getHeaders(headers: any): HttpHeaders {
-    let httpHeaders: HttpHeaders = new HttpHeaders();
-
-    if (headers !== undefined) {
-      for (const key of Object.keys(headers)) {
-        httpHeaders = httpHeaders.append(key, headers[key]);
-      }
-    }
-
-    return httpHeaders;
-  }
-}

frontend/app/src/app/modules/auth/user-info.model.ts

@@ -1,21 +0,0 @@
-/*
- * Copyright (C) 2022 StApps
- * This program is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program. If not, see <https://www.gnu.org/licenses/>.
- */
-
-export interface IUserInfo {
-  display_name: string;
-  role: string;
-  email: string;
-  user_name: string;
-}

frontend/app/src/app/modules/profile/id-cards.provider.ts

@@ -1,16 +1,19 @@
 import {Injectable, inject} from '@angular/core';
 import {SCIdCard, SCThingOriginType, SCThingType, SCUserConfiguration} from '@openstapps/core';
 import {from, of, Observable} from 'rxjs';
-import {AuthHelperService} from '../auth/auth-helper.service';
 import {mergeMap, concatWith, filter, map, startWith, catchError, tap} from 'rxjs/operators';
 import {ConfigProvider} from '../config/config.provider';
 import {HttpClient} from '@angular/common/http';
 import {EncryptedStorageProvider} from '../storage/encrypted-storage.provider';
+import {AuthProvider} from "../auth/auth.provider";
+import {AuthHelperService} from "../auth/auth-helper.service";
 
 @Injectable({providedIn: 'root'})
 export class IdCardsProvider {
   private authHelper = inject(AuthHelperService);
 
+  private authProvider = inject(AuthProvider);
+
   private config = inject(ConfigProvider);
 
   private httpClient = inject(HttpClient);
@@ -19,7 +22,7 @@ export class IdCardsProvider {
 
   getIdCards(): Observable<SCIdCard[]> {
     const feature = this.config.config.app.features.extern?.['idCards'];
-    const auth = this.authHelper.getProvider();
+    const auth = this.authProvider;
     const storedIdCards = from(
       this.encryptedStorageProvider.get<SCIdCard[]>('id-cards') as Promise<SCIdCard[]>,
     ).pipe(filter(it => it !== undefined));

frontend/app/src/app/modules/profile/id-cards.spec.ts

@@ -2,19 +2,18 @@ import {ConfigProvider} from '../config/config.provider';
 import {IdCardsProvider} from './id-cards.provider';
 import {HttpClient} from '@angular/common/http';
 import {AuthHelperService} from '../auth/auth-helper.service';
+import {AuthProvider} from '../auth/auth.provider';
 import {BehaviorSubject, firstValueFrom, of} from 'rxjs';
 import {EncryptedStorageProvider} from '../storage/encrypted-storage.provider';
 import {TestBed} from '@angular/core/testing';
 import {TranslateService} from '@ngx-translate/core';
-import {StorageBackend, Requestor} from '@openid/appauth';
-import {IonicStorage, Browser} from 'ionic-appauth';
 import {LoggerTestingModule} from 'ngx-logger/testing';
-import {StAppsWebHttpClient} from '../data/stapps-web-http-client.provider';
-import {SimpleBrowser} from '../../util/browser.factory';
 
 class FakeAuth {
   isLoggedIn$ = new BehaviorSubject(false);
 
+  user$ = new BehaviorSubject<unknown>(undefined);
+
   // eslint-disable-next-line @typescript-eslint/no-empty-function
   getValidToken() {}
 }
@@ -25,16 +24,14 @@ describe('IdCards', () => {
   let encryptedStorageProvider: EncryptedStorageProvider;
   let fakeAuth: FakeAuth;
 
-  const authHelperServiceMock = jasmine.createSpyObj('AuthHelperService', ['getProvider']);
+  const authHelperServiceMock = jasmine.createSpyObj('AuthHelperService', ['getUserFromUserInfo']);
   const translateServiceSpy = jasmine.createSpyObj('TranslateService', ['setDefaultLang', 'use']);
-  let storageBackendSpy: jasmine.SpyObj<StorageBackend>;
-  const simpleBrowserMock = jasmine.createSpyObj('SimpleBrowser', ['open']);
 
   beforeEach(() => {
-    storageBackendSpy = jasmine.createSpyObj('StorageBackend', ['getItem']);
+    fakeAuth = new FakeAuth();
     configProviderSpy = jasmine.createSpyObj('ConfigProvider', ['config', 'getAnyValue']);
     configProviderSpy.config = {
-      app: {features: {extern: {idCards: {url: 'http://id-cards.local', authProvider: 'fakeAuth'}}}},
+      app: {features: {extern: {idCards: {url: 'http://id-cards.local', authProvider: 'default'}}}},
     } as never;
     configProviderSpy.getAnyValue = () =>
       ({
@@ -62,7 +59,6 @@ describe('IdCards', () => {
       imports: [LoggerTestingModule],
       providers: [
         IdCardsProvider,
-        StAppsWebHttpClient,
         {
           provide: TranslateService,
           useValue: translateServiceSpy,
@@ -71,40 +67,29 @@ describe('IdCards', () => {
           provide: EncryptedStorageProvider,
           useValue: encryptedStorageProvider,
         },
-        IonicStorage,
         {
           provide: ConfigProvider,
           useValue: configProviderSpy,
         },
-        Browser,
-        {
-          provide: StorageBackend,
-          useValue: storageBackendSpy,
-        },
         {
           provide: AuthHelperService,
           useValue: authHelperServiceMock,
         },
         {
-          provide: SimpleBrowser,
-          useValue: simpleBrowserMock,
+          provide: AuthProvider,
+          useValue: fakeAuth,
         },
         {
           provide: HttpClient,
           useValue: httpClient,
         },
-        Requestor,
       ],
     });
-
-    fakeAuth = new FakeAuth();
-    authHelperServiceMock.getProvider = jasmine.createSpy().and.returnValue(fakeAuth);
   });
 
   it('should emit undefined if not logged in', async () => {
     const provider = TestBed.inject(IdCardsProvider);
     expect(await firstValueFrom(provider.getIdCards())).toEqual([]);
-    expect(authHelperServiceMock.getProvider).toHaveBeenCalledTimes(1);
   });
 
   it('should emit network result when logged in', async () => {
@@ -113,7 +98,6 @@ describe('IdCards', () => {
     fakeAuth.getValidToken = jasmine.createSpy().and.resolveTo({accessToken: 'fake-token'});
     const provider = TestBed.inject(IdCardsProvider);
     expect(await firstValueFrom(provider.getIdCards())).toEqual(['abc' as never]);
-    expect(authHelperServiceMock.getProvider).toHaveBeenCalledTimes(1);
     // eslint-disable-next-line unicorn/no-null
     expect(httpClient.get).toHaveBeenCalledOnceWith('http://id-cards.local', {
       headers: {

frontend/app/src/app/modules/profile/page/profile-page-section.component.ts

@@ -19,6 +19,7 @@ import {AuthHelperService} from '../../auth/auth-helper.service';
 import {mergeMap, of} from 'rxjs';
 import Swiper from 'swiper';
 import {toObservable, toSignal} from '@angular/core/rxjs-interop';
+import {AuthProvider} from "../../auth/auth.provider";
 
 @Component({
   selector: 'stapps-profile-page-section',
@@ -32,10 +33,11 @@ export class ProfilePageSectionComponent {
   minSlideWidth = input(110);
 
   authHelper = inject(AuthHelperService);
+  authProvider = inject(AuthProvider);
 
   loggedIn = toSignal(
     toObservable(this.item).pipe(
-      mergeMap(item => (item.authProvider ? this.authHelper.getProvider().isLoggedIn$ : of(false))),
+      mergeMap(item => (item.authProvider ? this.authProvider.isLoggedIn$ : of(false))),
     ),
   );
 
@@ -66,13 +68,11 @@ export class ProfilePageSectionComponent {
   }
 
   async toggleLogIn() {
-    const providerType = this.item().authProvider;
-    if (!providerType) return;
     if (this.loggedIn()) {
-      await this.authHelper.getProvider().signOut();
-      await this.authHelper.endBrowserSession(providerType);
+      await this.authProvider.signOut();
+      await this.authHelper.endBrowserSession();
     } else {
-      await this.authHelper.getProvider().signIn();
+      await this.authProvider.signIn();
     }
   }
 

frontend/app/src/app/modules/profile/page/profile-page.component.ts

@@ -13,7 +13,7 @@
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
 import {Component, inject} from '@angular/core';
-import {AuthHelperService} from '../../auth/auth-helper.service';
+import {AuthProvider} from '../../auth/auth.provider';
 import {ActivatedRoute} from '@angular/router';
 import {ScheduleProvider} from '../../calendar/schedule.provider';
 import {profilePageSections} from '../../../../config/profile-page-sections';
@@ -25,7 +25,7 @@ import {profilePageSections} from '../../../../config/profile-page-sections';
   standalone: false,
 })
 export class ProfilePageComponent {
-  readonly authHelper = inject(AuthHelperService);
+  readonly authProvider = inject(AuthProvider);
 
   readonly activatedRoute = inject(ActivatedRoute);
 
@@ -33,23 +33,7 @@ export class ProfilePageComponent {
 
   sections = profilePageSections;
 
-  async signIn() {
-    const originPath = this.activatedRoute.snapshot.queryParamMap.get('origin_path');
-    await (originPath ? this.authHelper.setOriginPath(originPath) : this.authHelper.deleteOriginPath());
-    await this.authHelper.getProvider().signIn();
-  }
-
-  async signOut() {
-    await this.authHelper.getProvider().signOut();
-  }
-
-  ionViewWillEnter() {
-    this.authHelper
-      .getProvider()
-      .getValidToken()
-      .then(() => void this.authHelper.getProvider().loadUserInfo())
-      .catch(() => {
-        // noop
-      });
+  ionViewWillEnter(): void {
+    void this.authProvider.loadUserInfo();
   }
 }

frontend/app/src/app/modules/storage/capacitor-secure-storage.ts

@@ -12,19 +12,58 @@
  * You should have received a copy of the GNU General Public License along with
  * this program. If not, see <https://www.gnu.org/licenses/>.
  */
-import {CapacitorSecureStorage} from 'ionic-appauth/lib/capacitor';
 
-/*
- * Removes an item from storage before entering the new one to avoid issues
- * after iOS upgrade (iOS 16)
+import {StorageBackend} from '@openid/appauth';
+import {SecureStoragePlugin} from 'capacitor-secure-storage-plugin';
+
+/**
+ * Secure storage backend for AppAuth on native Capacitor platforms.
+ *
+ * Removes an existing item before writing it again to avoid issues
+ * observed after iOS upgrades.
  */
-export class SafeCapacitorSecureStorage extends CapacitorSecureStorage {
-  async setItem(name: string, value: string): Promise<void> {
-    if (!Storage) throw new Error('Capacitor Storage Is Undefined!');
-
+export class SafeCapacitorSecureStorage implements StorageBackend {
+  public async getItem(name: string): Promise<string | null> {
     try {
-      await super.removeItem(name);
-    } catch {}
-    return super.setItem(name, value);
+      const {value} = await SecureStoragePlugin.get({
+        key: name,
+      });
+
+      return value;
+    } catch {
+      return null;
+    }
+  }
+
+  public async setItem(
+    name: string,
+    value: string,
+  ): Promise<void> {
+    try {
+      await SecureStoragePlugin.remove({
+        key: name,
+      });
+    } catch {
+      // Item does not exist yet.
+    }
+
+    await SecureStoragePlugin.set({
+      key: name,
+      value,
+    });
+  }
+
+  public async removeItem(name: string): Promise<void> {
+    try {
+      await SecureStoragePlugin.remove({
+        key: name,
+      });
+    } catch {
+      // Removing a non-existing item is fine.
+    }
+  }
+
+  public async clear(): Promise<void> {
+    await SecureStoragePlugin.clear();
   }
 }

frontend/app/src/assets/i18n/de.json

@@ -63,6 +63,7 @@
       "default": {
         "logged_in_success": "Erfolgreich eingeloggt.",
         "logged_out_success": "Erfolgreich ausgeloggt.",
+        "session_expired": "Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.",
         "log_out_alert": {
           "header": "Komplett ausloggen",
           "message": "Du wurdest innerhalb der App ausgeloggt. Soll zudem die Browser Session beendet werden? Wähle im Zweifelsfall \"Ja\"."
@@ -372,9 +373,9 @@
     "view": {
       "today": "Heute"
     },
-    "recurring": "Wochen­ansicht",
+    "recurring": "Wochen\u00ADansicht",
     "calendar": "Kalender",
-    "single": "Einzel­termine",
+    "single": "Einzel\u00ADtermine",
     "addEventPage": {
       "TITLE": "Termine Hinzufügen",
       "PLACEHOLDER": "Termine",

frontend/app/src/assets/i18n/en.json

@@ -63,6 +63,7 @@
       "default": {
         "logged_in_success": "Successfully logged in.",
         "logged_out_success": "Successfully logged out.",
+        "session_expired": "Your session has expired. Please log in again.",
         "log_out_alert": {
           "header": "Complete logout",
           "message": "You are now logged out in your app. Do you want to log out from your identity provider as well? If unsure, please choose \"Yes\"."

frontend/app/src/environments/environment.production.ts

@@ -19,9 +19,9 @@
 
 export const environment = {
   backend_url: 'https://mobile.server.uni-frankfurt.de',
-  app_host: 'mobile.app.uni-frankfurt.de',
+  app_host: 'dev.app.uni-frankfurt.de',
   custom_url_scheme: 'de.anyschool.app',
-  backend_version: '4.0.0',
+  backend_version: '999.0.0',
   production: true,
 };
 

frontend/app/src/environments/environment.ts

@@ -18,9 +18,10 @@
 // The list of which env maps to which file can be found in `.angular-cli.json`.
 
 export const environment = {
-  backend_url: 'https://mobile.server.uni-frankfurt.de',
+  // backend_url: 'https://mobile.server.uni-frankfurt.de',
+  backend_url: 'http://localhost:3000',
   app_host: 'mobile.app.uni-frankfurt.de',
-  custom_url_scheme: 'de.anyschool.app',
+  custom_url_scheme: 'de.unifrankfurt.app',
   backend_version: '999.0.0',
   production: false,
 };

pnpm-lock.yaml

@@ -826,8 +826,8 @@ importers:
         specifier: 8.0.0
         version: 8.0.0(@angular/common@20.3.31(@angular/core@20.3.31(@angular/compiler@20.3.31)(rxjs@7.8.2)(zone.js@0.16.2))(rxjs@7.8.2))(@angular/core@20.3.31(@angular/compiler@20.3.31)(rxjs@7.8.2)(zone.js@0.16.2))(@ngx-translate/core@15.0.0(@angular/common@20.3.31(@angular/core@20.3.31(@angular/compiler@20.3.31)(rxjs@7.8.2)(zone.js@0.16.2))(rxjs@7.8.2))(@angular/core@20.3.31(@angular/compiler@20.3.31)(rxjs@7.8.2)(zone.js@0.16.2))(rxjs@7.8.2))(rxjs@7.8.2)
       '@openid/appauth':
-        specifier: 1.3.2
-        version: 1.3.2
+        specifier: 1.4.0
+        version: 1.4.0
       '@openstapps/api':
         specifier: workspace:*
         version: link:../../packages/api
@@ -861,9 +861,6 @@ importers:
       geojson:
         specifier: 0.5.0
         version: 0.5.0
-      ionic-appauth:
-        specifier: 2.1.0
-        version: 2.1.0(rxjs@7.8.2)
       ionicons:
         specifier: 8.1.0
         version: 8.1.0
@@ -2506,40 +2503,11 @@ packages:
       '@awesome-cordova-plugins/core': ^8.0.2
       rxjs: ^5.5.0 || ^6.5.0 || ^7.3.0
 
-  '@awesome-cordova-plugins/core@6.16.0':
-    resolution: {integrity: sha512-ep+nkDY6CyFBfqS/HS03PE+MZWiQoJWb/nLMwfj2ndC14UgZeVO3ecmEFknYjJOBf04emTbs7hbLewFrVkazmg==}
-    peerDependencies:
-      rxjs: ^5.5.0 || ^6.5.0 || ^7.3.0
-
   '@awesome-cordova-plugins/core@8.1.0':
     resolution: {integrity: sha512-7NkUC2FcXSlIuIH2xc1miIdN8/by2uewrIg5JBWauN1KCzCXLhCwZ39C8nBsWxCloAxCvec+MMU5SzJGGWfjTg==}
     peerDependencies:
       rxjs: ^5.5.0 || ^6.5.0 || ^7.3.0
 
-  '@awesome-cordova-plugins/http@6.16.0':
-    resolution: {integrity: sha512-12YBMzyTXgWv9jnuiY1gh7ZKESLHQQNFTtsAvo78uNkEEk4ATPX9nLpWfC8kHzjI5aHNP+15bP85xt5nwntOcA==}
-    peerDependencies:
-      '@awesome-cordova-plugins/core': ^6.0.1
-      rxjs: ^5.5.0 || ^6.5.0 || ^7.3.0
-
-  '@awesome-cordova-plugins/in-app-browser@6.16.0':
-    resolution: {integrity: sha512-5PANbiM2a5oTU4ce+UGZAMFgbuKi1XDXVhSuYrbCbZTiroWcfA4myj6y9s4sawtA8psWeUh+dksApr0ytrslBQ==}
-    peerDependencies:
-      '@awesome-cordova-plugins/core': ^6.0.1
-      rxjs: ^5.5.0 || ^6.5.0 || ^7.3.0
-
-  '@awesome-cordova-plugins/safari-view-controller@6.16.0':
-    resolution: {integrity: sha512-K754S93w4itxiivOpJZjG/CpiAfczsRq6LFZtnuigoeZ6UOCIYAFvxEjmxXUsCHII9LJkmdwdrO0cKf1Ys8SpQ==}
-    peerDependencies:
-      '@awesome-cordova-plugins/core': ^6.0.1
-      rxjs: ^5.5.0 || ^6.5.0 || ^7.3.0
-
-  '@awesome-cordova-plugins/secure-storage@6.16.0':
-    resolution: {integrity: sha512-8urVrC6HxgblmTexeHN+hZZXbuu+Ru9ifpOvPokih/4LJrHaoaB3vrSUAxsZdh/yulqxo0fTtdDtCKpKx58tUA==}
-    peerDependencies:
-      '@awesome-cordova-plugins/core': ^6.0.1
-      rxjs: ^5.5.0 || ^6.5.0 || ^7.3.0
-
   '@babel/code-frame@7.27.1':
     resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==}
     engines: {node: '>=6.9.0'}
@@ -3191,11 +3159,6 @@ packages:
     engines: {node: '>=10.3.0'}
     hasBin: true
 
-  '@capacitor/browser@6.0.6':
-    resolution: {integrity: sha512-VHOPkMR+JqKz2mf5YncnnOWvFdVYFTTLnPW+JRcsP1LobXmA0gtchER35PQ7XXqXU16eeacrehX+XF+rC6wmQw==}
-    peerDependencies:
-      '@capacitor/core': ^6.0.0
-
   '@capacitor/browser@8.0.4':
     resolution: {integrity: sha512-ORZ4u/y+7aMuu6yVuk6SP529fUZyqcbnuHB1q5McpA3o2SYfVoi28iB8rsQjI2ad1qlKJd29ZUuGtspXLBDlWg==}
     peerDependencies:
@@ -3216,9 +3179,6 @@ packages:
     peerDependencies:
       '@capacitor/core': '>=8.0.0'
 
-  '@capacitor/core@6.2.1':
-    resolution: {integrity: sha512-urZwxa7hVE/BnA18oCFAdizXPse6fCKanQyEqpmz6cBJ2vObwMpyJDG5jBeoSsgocS9+Ax+9vb4ducWJn0y2qQ==}
-
   '@capacitor/core@8.5.2':
     resolution: {integrity: sha512-agnQbGdhGw/KZFuLf7H9SY2o+oE7upkr/WPQsYaokXP6f9chaE8iVmbKkfN6SVl4w3pmz7oZ3Ur1hbkmy1hx+w==}
 
@@ -3267,11 +3227,6 @@ packages:
     peerDependencies:
       '@capacitor/core': '>=8.0.0'
 
-  '@capacitor/preferences@6.0.4':
-    resolution: {integrity: sha512-ziauSI1pgdyl+gduvvf8lInvzF3Wdyu/ok+u7NlnhKp8XOj9plJgtnXZWFiR8CiCK5wMvo+gFaNh3zhMyEUwpA==}
-    peerDependencies:
-      '@capacitor/core': ^6.0.0
-
   '@capacitor/preferences@8.0.1':
     resolution: {integrity: sha512-T6no3ebi79XJCk91U3Jp/liJUwgBdvHR+s6vhvPkPxSuch7z3zx5Rv1bdWM6sWruNx+pViuEGqZvbfCdyBvcHQ==}
     peerDependencies:
@@ -4585,8 +4540,8 @@ packages:
     resolution: {integrity: sha512-T8TbSnGsxo6TDBJx/Sgv/BlVJL3tshxZP7Aq5R1mSnM5OcHY2dQaxLMu2+E8u3gN0MLOzdjurqN4ZRVuzQycOQ==}
     engines: {node: '>=8.0'}
 
-  '@openid/appauth@1.3.2':
-    resolution: {integrity: sha512-NoOejniaqzOEbHg3RcBZtTriYqhqpQFgTC4lDNaRbgRCnpz6n8PlxWlCbh2N1K5qKawfxRP29/Wiho3FrXQ3Qw==}
+  '@openid/appauth@1.4.0':
+    resolution: {integrity: sha512-/l6GlJwloaWu1yiojMSrrR1zu7EQ84DK88RxBK2xw6uqfup+gKFEzbDoG2LOVUnBM3L5HMJNYAJfDFelKri3qA==}
 
   '@opentelemetry/api@1.9.0':
     resolution: {integrity: sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==}
@@ -5299,8 +5254,8 @@ packages:
   '@types/jasminewd2@2.0.13':
     resolution: {integrity: sha512-aJ3wj8tXMpBrzQ5ghIaqMisD8C3FIrcO6sDKHqFbuqAsI7yOxj0fA7MrRCPLZHIVUjERIwsMmGn/vB0UQ9u0Hg==}
 
-  '@types/jquery@3.5.34':
-    resolution: {integrity: sha512-3m3939S3erqmTLJANS/uy0B6V7BorKx7RorcGZVjZ62dF5PAGbKEDZK1CuLtKombJkFA2T1jl8LAIIs7IV6gBQ==}
+  '@types/jquery@4.0.1':
+    resolution: {integrity: sha512-9a59A/tycXgYuPABcp6/3spSShn0NT2UOM4EfHvMumjYi4lJWTsK5SZWjhx3yRm9IHGCeWXdV2YfNsrWrft/CA==}
 
   '@types/json-patch@0.0.30':
     resolution: {integrity: sha512-MhCUjojzDhVLnZnxwPwa+rETFRDQ0ffjxYdrqOP6TBO2O0/Z64PV5tNeYApo4bc4y4frbWOrRwv/eEkXlI13Rw==}
@@ -6216,11 +6171,6 @@ packages:
   caniuse-lite@1.0.30001778:
     resolution: {integrity: sha512-PN7uxFL+ExFJO61aVmP1aIEG4i9whQd4eoSCebav62UwDyp5OHh06zN4jqKSMePVgxHifCw1QJxdRkA1Pisekg==}
 
-  capacitor-secure-storage-plugin@0.10.0:
-    resolution: {integrity: sha512-dV4E+HTZAJWC3gef7sBXaAkkb6wvcZHyXjJIHXNb3yz9gRQ/5VMLqCxa0khqpwgWh5oIbo4XFxg3g5tEkfaNMg==}
-    peerDependencies:
-      '@capacitor/core': ^6.0.0
-
   capacitor-secure-storage-plugin@0.13.0:
     resolution: {integrity: sha512-+rLC/9Z0LTaRRt6L6HjBwcDh5gqgI3NPmDSwo4hk41XQOy3EBrRo81VleIqFsowsMA3oMT+E59Bl8/HiWk0nhQ==}
     peerDependencies:
@@ -7820,6 +7770,15 @@ packages:
       debug:
         optional: true
 
+  follow-redirects@1.16.1:
+    resolution: {integrity: sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      debug: '*'
+    peerDependenciesMeta:
+      debug:
+        optional: true
+
   fontkit@2.0.4:
     resolution: {integrity: sha512-syetQadaUEDNdxdugga9CpEYVaQIxOwk7GlwZWWZ19//qW4zE5bknOKeMBDYAASwnpaSHKJITRLMF9m1fp3s6g==}
 
@@ -8441,11 +8400,6 @@ packages:
     resolution: {integrity: sha512-agE4QfB2Lkp9uICn7BAqoscw4SZP9kTE2hxiFI3jBPmXJfdqiahTbUuKGsMoN2GtqL9AxhYioAcVvgsb1HvRbA==}
     engines: {node: '>= 0.10'}
 
-  ionic-appauth@2.1.0:
-    resolution: {integrity: sha512-KSNavekWYe1xD3vn9IOxa48ZM8gVuiUnUuhxKzPLzvLwE4Nr4aEs3XMUyM0HEcoCytiVhuO9ddN3HA+eqhb4Hw==}
-    peerDependencies:
-      rxjs: ^6.5.5 || ^7.4.0
-
   ionicons@8.1.0:
     resolution: {integrity: sha512-XSM2gYWTXxSYTwjmKWAoy4yR7AbAFDjpc5ZIivAiGXskM0fe5CdMPfs6InQRUcrYtVb2WZ/0HQ1/jeh3JW78SA==}
 
@@ -13231,45 +13185,11 @@ snapshots:
       '@types/cordova': 11.0.3
       rxjs: 7.8.2
 
-  '@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2)':
-    dependencies:
-      '@types/cordova': 11.0.3
-      rxjs: 7.8.2
-    optional: true
-
   '@awesome-cordova-plugins/core@8.1.0(rxjs@7.8.2)':
     dependencies:
       '@types/cordova': 11.0.3
       rxjs: 7.8.2
 
-  '@awesome-cordova-plugins/http@6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)':
-    dependencies:
-      '@awesome-cordova-plugins/core': 6.16.0(rxjs@7.8.2)
-      '@types/cordova': 11.0.3
-      rxjs: 7.8.2
-    optional: true
-
-  '@awesome-cordova-plugins/in-app-browser@6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)':
-    dependencies:
-      '@awesome-cordova-plugins/core': 6.16.0(rxjs@7.8.2)
-      '@types/cordova': 11.0.3
-      rxjs: 7.8.2
-    optional: true
-
-  '@awesome-cordova-plugins/safari-view-controller@6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)':
-    dependencies:
-      '@awesome-cordova-plugins/core': 6.16.0(rxjs@7.8.2)
-      '@types/cordova': 11.0.3
-      rxjs: 7.8.2
-    optional: true
-
-  '@awesome-cordova-plugins/secure-storage@6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)':
-    dependencies:
-      '@awesome-cordova-plugins/core': 6.16.0(rxjs@7.8.2)
-      '@types/cordova': 11.0.3
-      rxjs: 7.8.2
-    optional: true
-
   '@babel/code-frame@7.27.1':
     dependencies:
       '@babel/helper-validator-identifier': 7.28.5
@@ -14694,11 +14614,6 @@ snapshots:
       - supports-color
       - typescript
 
-  '@capacitor/browser@6.0.6(@capacitor/core@6.2.1)':
-    dependencies:
-      '@capacitor/core': 6.2.1
-    optional: true
-
   '@capacitor/browser@8.0.4(@capacitor/core@8.5.2)':
     dependencies:
       '@capacitor/core': 8.5.2
@@ -14752,11 +14667,6 @@ snapshots:
     dependencies:
       '@capacitor/core': 8.5.2
 
-  '@capacitor/core@6.2.1':
-    dependencies:
-      tslib: 2.6.2
-    optional: true
-
   '@capacitor/core@8.5.2':
     dependencies:
       tslib: 2.6.2
@@ -14799,11 +14709,6 @@ snapshots:
     dependencies:
       '@capacitor/core': 8.5.2
 
-  '@capacitor/preferences@6.0.4(@capacitor/core@6.2.1)':
-    dependencies:
-      '@capacitor/core': 6.2.1
-    optional: true
-
   '@capacitor/preferences@8.0.1(@capacitor/core@8.5.2)':
     dependencies:
       '@capacitor/core': 8.5.2
@@ -16259,12 +16164,12 @@ snapshots:
 
   '@oozcitak/util@8.3.8': {}
 
-  '@openid/appauth@1.3.2':
+  '@openid/appauth@1.4.0':
     dependencies:
       '@types/base64-js': 1.5.0
-      '@types/jquery': 3.5.34
+      '@types/jquery': 4.0.1
       base64-js: 1.5.1
-      follow-redirects: 1.15.11(debug@4.4.3)
+      follow-redirects: 1.16.1
       form-data: 4.0.6
       opener: 1.5.2
     transitivePeerDependencies:
@@ -16967,9 +16872,7 @@ snapshots:
     dependencies:
       '@types/jasmine': 5.1.4
 
-  '@types/jquery@3.5.34':
-    dependencies:
-      '@types/sizzle': 2.3.10
+  '@types/jquery@4.0.1': {}
 
   '@types/json-patch@0.0.30': {}
 
@@ -18100,11 +18003,6 @@ snapshots:
 
   caniuse-lite@1.0.30001778: {}
 
-  capacitor-secure-storage-plugin@0.10.0(@capacitor/core@6.2.1):
-    dependencies:
-      '@capacitor/core': 6.2.1
-    optional: true
-
   capacitor-secure-storage-plugin@0.13.0(@capacitor/core@8.5.2):
     dependencies:
       '@capacitor/core': 8.5.2
@@ -20072,6 +19970,8 @@ snapshots:
 
   follow-redirects@1.15.9: {}
 
+  follow-redirects@1.16.1: {}
+
   fontkit@2.0.4:
     dependencies:
       '@swc/helpers': 0.5.23
@@ -20786,27 +20686,6 @@ snapshots:
 
   interpret@1.4.0: {}
 
-  ionic-appauth@2.1.0(rxjs@7.8.2):
-    dependencies:
-      '@openid/appauth': 1.3.2
-      '@types/chai-as-promised': 7.1.8
-      rxjs: 7.8.2
-      tslib: 2.6.2
-      uuid: 9.0.1
-    optionalDependencies:
-      '@awesome-cordova-plugins/core': 6.16.0(rxjs@7.8.2)
-      '@awesome-cordova-plugins/http': 6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)
-      '@awesome-cordova-plugins/in-app-browser': 6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)
-      '@awesome-cordova-plugins/safari-view-controller': 6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)
-      '@awesome-cordova-plugins/secure-storage': 6.16.0(@awesome-cordova-plugins/core@6.16.0(rxjs@7.8.2))(rxjs@7.8.2)
-      '@capacitor/browser': 6.0.6(@capacitor/core@6.2.1)
-      '@capacitor/core': 6.2.1
-      '@capacitor/preferences': 6.0.4(@capacitor/core@6.2.1)
-      '@ionic/storage': 4.0.0
-      capacitor-secure-storage-plugin: 0.10.0(@capacitor/core@6.2.1)
-    transitivePeerDependencies:
-      - debug
-
   ionicons@8.1.0:
     dependencies:
       '@stencil/core': 4.43.5
@@ -25178,7 +25057,8 @@ snapshots:
 
   uuid@8.3.2: {}
 
-  uuid@9.0.1: {}
+  uuid@9.0.1:
+    optional: true
 
   uvu@0.5.6:
     dependencies: