@acorex-platform/framework-client 0.0.10 → 0.0.15

package/fesm2022/acorex-platform-framework-client-auth.mjs

@@ -1,8 +1,8 @@
 import * as i0 from '@angular/core';
 import { InjectionToken, Injector, Injectable, signal, inject, Input, Directive, provideAppInitializer, Optional, Inject, NgModule, input, output, Component } from '@angular/core';
+import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, from, combineLatest, first } from 'rxjs';
 import { AXPBroadcastEventService, AXP_SESSION_SERVICE } from '@acorex-platform/framework-client/core';
 import { isEmpty } from 'lodash-es';
-import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, from, first } from 'rxjs';
 import { AXPWidgetsCatalog } from '@acorex-platform/framework-shared/core';
 import { AXDataSource } from '@acorex/cdk/common';
 
@@ -244,6 +244,9 @@ class AXPPermissionDefaultLoader {
  */
 const AXP_PERMISSION_CHECKER = new InjectionToken('AXP_PERMISSION_CHECKER');
 
+const AXP_ACCESS_POLICY_CACHE_PORT = new InjectionToken('AXP_ACCESS_POLICY_CACHE_PORT');
+//#endregion
+
 class AXPSessionService {
     constructor() {
         this.eventService = inject(AXPBroadcastEventService);
@@ -255,6 +258,7 @@ class AXPSessionService {
         this.applicationLoader = inject(AXP_APPLICATION_LOADER);
         this.permissionChecker = inject(AXP_PERMISSION_CHECKER, { optional: true });
         this.featureChecker = inject(AXP_FEATURE_CHECKER, { optional: true });
+        this.accessPolicyCache = inject(AXP_ACCESS_POLICY_CACHE_PORT, { optional: true });
         this.status = new BehaviorSubject(AXPSessionStatus.Unauthenticated);
         this.status$ = this.status.asObservable().pipe(shareReplay(1));
         // Add loading state to prevent premature redirects
@@ -294,27 +298,18 @@ class AXPSessionService {
     }
     static { this.SESSION_KEY = 'AXP_SESSION'; }
     get user() {
-        const session = this.getSessionData();
-        if (session?.user && !this.currentUserSubject.value) {
-            this.currentUserSubject.next(session.user);
-        }
+        this.syncContextSubjectsFromStorage();
         return this.currentUserSubject.value;
     }
     get tenant() {
-        const session = this.getSessionData();
-        if (session?.tenant && !this.currentTenantSubject.value) {
-            this.currentTenantSubject.next(session.tenant);
-        }
+        this.syncContextSubjectsFromStorage();
         return this.currentTenantSubject.value;
     }
     get tenants$() {
         return from(this.tenantLoader.getList(this.getContext()));
     }
     get application() {
-        const session = this.getSessionData();
-        if (session?.application && !this.currentApplicationSubject.value) {
-            this.currentApplicationSubject.next(session.application);
-        }
+        this.syncContextSubjectsFromStorage();
         return this.currentApplicationSubject.value;
     }
     get applications$() {
@@ -343,7 +338,7 @@ class AXPSessionService {
                     this.status.next(AXPSessionStatus.Authenticated);
                     await this.loadPermissions();
                     await this.loadFeatures();
-                    await this.signInComplete();
+                    await this.syncSessionAuthorization();
                 }
             }
             else {
@@ -371,22 +366,7 @@ class AXPSessionService {
             if (!result)
                 return;
             if (result?.succeed) {
-                this.permissionsSubject.next([]);
-                this.featuresSubject.next([]);
-                this.currentUserSubject.next(result.data.user);
-                this.setSession({
-                    accessToken: result.data.accessToken,
-                    refreshToken: result.data.refreshToken,
-                    strategy: credentials.strategy,
-                    user: result.data.user,
-                    application: result.data?.application,
-                    tenant: result.data?.tenant,
-                    expiresIn: result.data?.expiresIn,
-                    idToken: result.data?.idToken ?? null,
-                    locked: false,
-                });
-                await this.loadPermissions();
-                await this.loadFeatures();
+                await this.applySignInResult(credentials.strategy, result);
             }
             else {
                 this.status.next(AXPSessionStatus.Unauthenticated);
@@ -403,6 +383,47 @@ class AXPSessionService {
             console.log('Signin process completed');
         }
     }
+    async register(credentials) {
+        this.isLoading.next(true);
+        try {
+            const strategy = this.authStrategyRegistry.get(credentials.strategy);
+            if (!strategy || typeof strategy.register !== 'function') {
+                throw new Error(`Registration is not supported for strategy '${credentials.strategy}'`);
+            }
+            const result = await strategy.register(credentials);
+            if (!result?.succeed) {
+                this.status.next(AXPSessionStatus.Unauthenticated);
+                throw new Error('Registration failed');
+            }
+            await this.applySignInResult(credentials.strategy, result);
+        }
+        catch (error) {
+            console.error('Register error:', error);
+            this.status.next(AXPSessionStatus.Unauthenticated);
+            throw error;
+        }
+        finally {
+            this.isLoading.next(false);
+        }
+    }
+    async applySignInResult(strategy, result) {
+        this.clearSession();
+        this.currentUserSubject.next(result.data.user);
+        this.setSession({
+            accessToken: result.data.accessToken,
+            refreshToken: result.data.refreshToken,
+            strategy,
+            user: result.data.user,
+            tenant: result.data?.tenant ?? null,
+            application: result.data?.application ?? null,
+            expiresIn: result.data?.expiresIn,
+            idToken: result.data?.idToken ?? null,
+            locked: false,
+        });
+        await this.loadPermissions();
+        await this.loadFeatures();
+        await this.syncSessionAuthorization();
+    }
     async updateToken(params) {
         this.isLoading.next(true);
         try {
@@ -416,22 +437,29 @@ class AXPSessionService {
             }
             const result = await strategy.updateToken(params);
             if (result?.succeed) {
+                if (params?.['code']) {
+                    this.clearSession();
+                }
+                else {
+                    this.permissionsSubject.next([]);
+                    this.featuresSubject.next([]);
+                    this.invalidateAccessPolicyCache();
+                }
                 this.currentUserSubject.next(result.data.user);
                 this.setSession({
                     accessToken: result.data.accessToken,
                     refreshToken: result.data.refreshToken,
                     strategy: strategyName,
                     user: result.data.user,
-                    application: result.data?.application,
-                    tenant: result.data?.tenant,
+                    tenant: result.data?.tenant ?? null,
+                    application: result.data?.application ?? null,
                     expiresIn: result.data?.expiresIn,
                     idToken: result.data?.idToken ?? null,
+                    locked: false,
                 });
-                this.status.next(AXPSessionStatus.Authenticated);
-                // If we have both tenant and application, complete the sign-in
-                if (this.application && this.tenant) {
-                    await this.restoreSession();
-                }
+                await this.loadPermissions();
+                await this.loadFeatures();
+                await this.syncSessionAuthorization();
             }
             else {
                 this.status.next(AXPSessionStatus.Unauthenticated);
@@ -538,6 +566,25 @@ class AXPSessionService {
         // Set status to Authorized
         this.status.next(AXPSessionStatus.Authorized);
     }
+    /** Tenant + application must be bound before menu, permissions, and features are fully valid. */
+    hasCompleteSessionContext() {
+        return !!(this.tenant?.id && this.application?.id);
+    }
+    /**
+     * Keeps session status aligned with context: Authenticated after sign-in / tenant pick,
+     * Authorized only once tenant and application are selected and loaders have finished.
+     */
+    async syncSessionAuthorization() {
+        if (!this.user) {
+            this.status.next(AXPSessionStatus.Unauthenticated);
+            return;
+        }
+        if (this.hasCompleteSessionContext()) {
+            await this.signInComplete();
+            return;
+        }
+        this.status.next(AXPSessionStatus.Authenticated);
+    }
     setSession(tokens) {
         const existing = this.getSessionData() ?? {};
         const sessionData = {
@@ -548,11 +595,11 @@ class AXPSessionService {
         if (tokens.user) {
             this.currentUserSubject.next(tokens.user);
         }
-        if (tokens.tenant) {
-            this.currentTenantSubject.next(tokens.tenant);
+        if ('tenant' in tokens) {
+            this.currentTenantSubject.next(tokens.tenant ?? null);
         }
-        if (tokens.application) {
-            this.currentApplicationSubject.next(tokens.application);
+        if ('application' in tokens) {
+            this.currentApplicationSubject.next(tokens.application ?? null);
         }
         localStorage.setItem(AXPSessionService.SESSION_KEY, JSON.stringify(sessionData));
     }
@@ -590,18 +637,33 @@ class AXPSessionService {
         }
     }
     clearSession() {
-        //
+        this.invalidateAccessPolicyCache();
         this.currentUserSubject.next(null);
-        //
         this.currentTenantSubject.next(null);
-        //
         this.currentApplicationSubject.next(null);
-        //
         this.permissionsSubject.next([]);
-        //
         this.featuresSubject.next([]);
-        //
         localStorage.removeItem(AXPSessionService.SESSION_KEY);
+        this.status.next(AXPSessionStatus.Unauthenticated);
+    }
+    /** Keeps in-memory subjects aligned with persisted session (e.g. after user switch). */
+    syncContextSubjectsFromStorage() {
+        const session = this.getSessionData();
+        if (!session) {
+            return;
+        }
+        const sessionUser = session.user ?? null;
+        if (sessionUser?.id !== this.currentUserSubject.value?.id) {
+            this.currentUserSubject.next(sessionUser);
+        }
+        const sessionTenant = session.tenant ?? null;
+        if (sessionTenant?.id !== this.currentTenantSubject.value?.id) {
+            this.currentTenantSubject.next(sessionTenant);
+        }
+        const sessionApplication = session.application ?? null;
+        if (sessionApplication?.id !== this.currentApplicationSubject.value?.id) {
+            this.currentApplicationSubject.next(sessionApplication);
+        }
     }
     authorize(...keys) {
         // Calculate base result
@@ -660,6 +722,9 @@ class AXPSessionService {
             application: this.application,
         });
     }
+    invalidateAccessPolicyCache() {
+        this.accessPolicyCache?.invalidate();
+    }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPSessionService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPSessionService, providedIn: 'root' }); }
 }
@@ -685,8 +750,10 @@ class AXPPermissionDirective {
             this.hasView.set(true);
             return;
         }
-        this.subscription = this.sessionService.isAuthorized$
-            .subscribe((isAuthorized) => {
+        this.subscription = combineLatest([
+            this.sessionService.isAuthorized$,
+            this.sessionService.permissions$,
+        ]).subscribe(([isAuthorized]) => {
             if (isAuthorized && this.sessionService.authorize(...keys)) {
                 if (!this.hasView()) {
                     this.viewContainer.createEmbeddedView(this.templateRef);
@@ -1215,6 +1282,174 @@ class TimeUtil {
 }
 //#endregion
 
+function platformOAuthSessionUpdateParams(params) {
+    const tenant = params['tenant'];
+    const application = params['application'];
+    return {
+        tenant,
+        application,
+        tenantId: params['tenantId'] ?? tenant?.id,
+        applicationId: params['applicationId'] ?? application?.id,
+    };
+}
+function shouldPlatformOAuthBindSession(accessToken, params) {
+    if (!accessToken) {
+        return false;
+    }
+    const { tenant, application, tenantId, applicationId } = platformOAuthSessionUpdateParams(params);
+    return Boolean(tenantId || applicationId || tenant || application);
+}
+async function postPlatformOAuthSessionUpdate(baseUrl, accessToken, params) {
+    const { tenant, application, tenantId, applicationId } = platformOAuthSessionUpdateParams(params);
+    const response = await fetch(`${baseUrl.replace(/\/$/, '')}/v1/auth/session`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${accessToken}`,
+        },
+        credentials: 'include',
+        body: JSON.stringify({
+            tenantId,
+            applicationId,
+            tenant,
+            application,
+        }),
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => '');
+        throw new Error(`Session update failed: ${response.status} ${response.statusText}${detail ? ` — ${detail}` : ''}`);
+    }
+    const result = (await response.json());
+    return toPlatformOAuthSignInResult(result, {
+        user: params['user'] ?? null,
+        tenant: tenant ?? null,
+        application: application ?? null,
+    });
+}
+function toPlatformOAuthSignInResult(result, context) {
+    const tenant = mergeTenant(mapPlatformTenant(result.tenant), context?.tenant ?? null);
+    const application = mergeApplication(mapPlatformApplication(result.application), context?.application ?? null);
+    return {
+        succeed: true,
+        data: {
+            accessToken: result.accessToken,
+            refreshToken: result.refreshToken,
+            idToken: result.id_token ?? null,
+            expiresIn: parsePlatformExpiresIn(result.expiresIn),
+            user: result.user,
+            tenant,
+            application,
+        },
+    };
+}
+function mapPlatformTenant(value) {
+    if (!value?.id) {
+        return null;
+    }
+    return {
+        id: value.id,
+        name: value.name ?? value.id,
+        title: value.title ?? value.name ?? value.id,
+    };
+}
+function mapPlatformApplication(value) {
+    if (!value?.id) {
+        return null;
+    }
+    return {
+        id: value.id,
+        name: value.name ?? value.id,
+        title: value.title ?? value.name ?? value.id,
+    };
+}
+function mergeTenant(mapped, contextTenant) {
+    if (!mapped && !contextTenant) {
+        return null;
+    }
+    if (!mapped) {
+        return contextTenant;
+    }
+    if (!contextTenant) {
+        return mapped;
+    }
+    return {
+        ...contextTenant,
+        ...mapped,
+        title: mapped.title && mapped.title !== mapped.id ? mapped.title : contextTenant.title || mapped.title,
+        name: mapped.name && mapped.name !== mapped.id ? mapped.name : contextTenant.name || mapped.name,
+    };
+}
+function mergeApplication(mapped, contextApplication) {
+    if (!mapped && !contextApplication) {
+        return null;
+    }
+    if (!mapped) {
+        return contextApplication;
+    }
+    if (!contextApplication) {
+        return mapped;
+    }
+    return {
+        ...contextApplication,
+        ...mapped,
+        title: mapped.title && mapped.title !== mapped.id ? mapped.title : contextApplication.title || mapped.title,
+        name: mapped.name && mapped.name !== mapped.id ? mapped.name : contextApplication.name || mapped.name,
+    };
+}
+function parsePlatformExpiresIn(expiresIn) {
+    if (!expiresIn) {
+        return TimeUtil.calculateExpireInDate(0);
+    }
+    const asDate = new Date(expiresIn);
+    if (!Number.isNaN(asDate.getTime())) {
+        return asDate.toISOString();
+    }
+    return TimeUtil.calculateExpireInDate(Number(expiresIn) || 0);
+}
+//#endregion
+
+const AXP_USER_AVATAR_CACHE_PORT = new InjectionToken('AXP_USER_AVATAR_CACHE_PORT');
+
+//#region ---- User profile identity service ----
+/** Keeps session and avatar cache aligned after self-service profile identity updates. */
+class AXPUserProfileIdentityService {
+    constructor() {
+        //#region ---- Services & Dependencies ----
+        this.sessionService = inject(AXPSessionService);
+        this.avatarCachePort = inject(AXP_USER_AVATAR_CACHE_PORT, { optional: true });
+    }
+    //#endregion
+    //#region ---- Public API ----
+    async applySessionPatch(patch) {
+        const session = this.sessionService.getSessionData();
+        const userId = session?.user?.id;
+        if (!session?.user || !userId) {
+            return;
+        }
+        this.sessionService.setSession({
+            ...session,
+            user: {
+                ...session.user,
+                ...patch,
+            },
+        });
+        await this.refreshAvatar(userId);
+    }
+    async refreshAvatar(userId) {
+        const id = userId ?? this.sessionService.user?.id;
+        if (!id) {
+            return;
+        }
+        await this.avatarCachePort?.refreshUserInfo(id);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPUserProfileIdentityService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPUserProfileIdentityService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPUserProfileIdentityService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
 //#region ----   Challenge Data Types   ----
 //#endregion
 
@@ -1379,5 +1614,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDefinitionsDataSourceDefinition, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthDataSourceKeys, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPUnauthenticatedError, AXPUnauthorizedError, AXP_APPLICATION_LOADER, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_TENANT_LOADER, JwtUtil, PkceUtil, TimeUtil, initializeAppState };
+export { AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDefinitionsDataSourceDefinition, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthDataSourceKeys, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, PkceUtil, TimeUtil, initializeAppState, platformOAuthSessionUpdateParams, postPlatformOAuthSessionUpdate, shouldPlatformOAuthBindSession, toPlatformOAuthSignInResult };
 //# sourceMappingURL=acorex-platform-framework-client-auth.mjs.map