I was performing an XSS challenge on PortSwigger labs here.

This is the solution to their XSS challenge

{{$on.constructor('alert(1)')()}}

However, with no prior experience in AngularJS I am rather lost. I was told that code within double curly braces {{ }} can be execute JavaScript expressions from anywhere in the code, providing the ng-app attribute (also known as an AngularJS directive) is somewhere in the HTML document. I also recognise alert(1) from ordinary JavaScript that creates a popup.

My question is what does the $on.constructor part do?