Auth interceptor
Attaches the CSRF token, bearer authorization and impersonation headers to every request built with Angular's HttpClient — the one channel the atomic client itself never sees.
authInterceptorFn serves the Angular HttpClient channel, which @sinequa/atomic's own client does not
see. The library's stores and services no longer use HttpClient — they go through the client, which sets
these headers itself, per client — but @sinequa/agent and @sinequa/assistant build their requests with
HttpClient, as may your own code. Without this interceptor, those requests leave with no CSRF token and the
server answers 401.
Minimal example
import { provideHttpClient, withInterceptors } from "@angular/common/http";
import { authInterceptorFn } from "@sinequa/atomic-angular";
import type { ApplicationConfig } from "@angular/core";
export const appConfig: ApplicationConfig = {
providers: [provideHttpClient(withInterceptors([authInterceptorFn]))],
};How it works
On every request it adds Sinequa-csrf-token (read from the stored session token),
Authorization: Bearer <token> when a bearer token is configured, sinequa-override-user/
sinequa-override-domain when an impersonation is active, and withCredentials: true — aligning the
HttpClient path with the client's own fetch, which uses credentials: "include". It also refreshes the
stored CSRF token from the sinequa-csrf-token response header whenever the server sends a new one.
The bearer token is resolved from authMode: AuthMode.bearer(token) first, then from the legacy bearerToken
configuration key.
Pitfalls
What's next
Principal store
The signed-in user's data, loaded once and shared through a signal store — initials, admin status, and user-override state.
Change Password
A current/new/confirm password form that signs the user back in on success, so the session is never left stale — used both as the /login?mode=changepassword route and embedded in a profile panel.