Which approach is recommended for mocking credential‑protected endpoints when testing Angular Material components?

When writing unit tests for Angular Material components that interact with backend services requiring authentication, the goal is to verify rendering and behavior without sending real requests or exposing production credentials.

The Angular community has not settled on whether to rely solely on HttpClientTestingModule to mock those endpoints or to introduce a dedicated mock service layer that abstracts token handling and response mapping.

Which approach yields tests that are easier to maintain over time? Does adding a mock service layer introduce unnecessary abstraction for simple component tests?