From 0c546802fae5899450a56ab4dc116612fca0558e Mon Sep 17 00:00:00 2001
From: Lorenz Hilpert <l.hilpert@paragon-data.de>
Date: Wed, 3 Dec 2025 21:17:15 +0100
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20feat(core-auth):=20add=20AuthServic?=
 =?UTF-8?q?e=20for=20logout=20functionality?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add AuthService wrapping OAuthService logout with proper logging.
Refactor RoleService to use private class fields (#) convention.
---
 libs/core/auth/src/index.ts            | 21 +++++++++++----------
 libs/core/auth/src/lib/auth.service.ts | 14 ++++++++++++++
 libs/core/auth/src/lib/role.service.ts | 12 ++++++------
 3 files changed, 31 insertions(+), 16 deletions(-)
 create mode 100644 libs/core/auth/src/lib/auth.service.ts

diff --git a/libs/core/auth/src/index.ts b/libs/core/auth/src/index.ts
index 5743f94e9..f9af56e4d 100644
--- a/libs/core/auth/src/index.ts
+++ b/libs/core/auth/src/index.ts
@@ -1,10 +1,11 @@
-/**
- * Core Auth Library
- *
- * Provides role-based authorization utilities for the ISA Frontend application.
- */
-
-export { RoleService } from './lib/role.service';
-export { IfRoleDirective } from './lib/if-role.directive';
-export { TokenProvider, TOKEN_PROVIDER, parseJwt } from './lib/token-provider';
-export { Role } from './lib/role';
+/**
+ * Core Auth Library
+ *
+ * Provides role-based authorization utilities for the ISA Frontend application.
+ */
+
+export { AuthService } from './lib/auth.service';
+export { RoleService } from './lib/role.service';
+export { IfRoleDirective } from './lib/if-role.directive';
+export { TokenProvider, TOKEN_PROVIDER, parseJwt } from './lib/token-provider';
+export { Role } from './lib/role';
diff --git a/libs/core/auth/src/lib/auth.service.ts b/libs/core/auth/src/lib/auth.service.ts
new file mode 100644
index 000000000..09e294b9e
--- /dev/null
+++ b/libs/core/auth/src/lib/auth.service.ts
@@ -0,0 +1,14 @@
+import { inject, Injectable } from '@angular/core';
+import { OAuthService } from 'angular-oauth2-oidc';
+import { logger } from '@isa/core/logging';
+
+@Injectable({ providedIn: 'root' })
+export class AuthService {
+  #logger = logger({ service: 'AuthService' });
+  #oAuthService = inject(OAuthService);
+
+  logout(): void {
+    this.#logger.info('User logging out');
+    this.#oAuthService.logOut();
+  }
+}
diff --git a/libs/core/auth/src/lib/role.service.ts b/libs/core/auth/src/lib/role.service.ts
index a9e861e01..de7b4d5f5 100644
--- a/libs/core/auth/src/lib/role.service.ts
+++ b/libs/core/auth/src/lib/role.service.ts
@@ -21,8 +21,8 @@ import { Role } from './role';
   providedIn: 'root',
 })
 export class RoleService {
-  private readonly _log = logger({ service: 'RoleService' });
-  private readonly _tokenProvider = inject(TOKEN_PROVIDER);
+  #logger = logger({ service: 'RoleService' });
+  #tokenProvider = inject(TOKEN_PROVIDER);
 
   /**
    * Check if the authenticated user has specific role(s)
@@ -45,10 +45,10 @@ export class RoleService {
     const roles = coerceArray(role);
 
     try {
-      const userRoles = this._tokenProvider.getClaimByKey('role');
+      const userRoles = this.#tokenProvider.getClaimByKey('role');
 
       if (!userRoles) {
-        this._log.debug('No roles found in token claims');
+        this.#logger.debug('No roles found in token claims');
         return false;
       }
 
@@ -57,14 +57,14 @@ export class RoleService {
 
       const hasAllRoles = roles.every((r) => userRolesArray.includes(r));
 
-      this._log.debug(`Role check: ${roles.join(', ')} => ${hasAllRoles}`, () => ({
+      this.#logger.debug(`Role check: ${roles.join(', ')} => ${hasAllRoles}`, () => ({
         requiredRoles: roles,
         userRoles: userRolesArray,
       }));
 
       return hasAllRoles;
     } catch (error) {
-      this._log.error('Error checking roles', error as Error, () => ({ requiredRoles: roles }));
+      this.#logger.error('Error checking roles', error as Error, () => ({ requiredRoles: roles }));
       return false;
     }
   }