@acorex-platform/module-auth-client 0.0.18 → 0.0.20

package/types/acorex-platform-module-auth-client.d.ts

@@ -1,17 +1,14 @@
 import { AXPMultiLanguageString, AXPActionMenuItem } from '@acorex-platform/framework-shared/core';
 import * as i0 from '@angular/core';
 import { InjectionToken } from '@angular/core';
-import * as _acorex_platform_framework_client_core from '@acorex-platform/framework-client/core';
-import { AXPDataSourceDefinitionProvider, AXPDataSourceDefinition } from '@acorex-platform/framework-client/core';
-import * as _acorex_platform_module_auth_client from '@acorex-platform/module-auth-client';
 import { AXMSecurityManagementDeviceSessionsEntityModel } from '@acorex-platform/module-security-management-client/contracts';
 import { AXDataSourceFilterOption } from '@acorex/cdk/common';
-import * as i2 from '@acorex-platform/framework-client/common';
+import * as i2$1 from '@acorex-platform/framework-client/common';
 import { AXPErrorHandler } from '@acorex-platform/framework-client/common';
-import { AuthConfig } from 'angular-oauth2-oidc';
 import * as i1 from '@angular/router';
 import { CanActivateFn } from '@angular/router';
 import * as i1$2 from '@angular/common';
+import * as i2 from '@acorex-platform/framework-client/core';
 import * as i1$1 from '@acorex/core/validation';
 
 declare const PROFILE_PAGE_GROUPS_HOOK = "profile-page.groups";
@@ -22,6 +19,8 @@ type AXPUserProfileGroupsPayload = {
 };
 type AXPUserProfileSectionsPayload = {
     sections: AXPUserProfileSection[];
+    /** When set, hooks should only contribute or enrich this tab group. */
+    groupId?: string;
 };
 type AXPUserProfileHeaderMetaPayload = {
     items: AXPUserProfileHeaderMetaItem[];
@@ -96,6 +95,8 @@ interface AXPUserProfileSectionInsight {
     icon?: string;
     /** Plain line shown when no date is set. */
     text?: string;
+    /** Field label shown as tooltip on the insight badge. */
+    title?: AXPMultiLanguageString;
     /** Date value formatted in the template when valid. */
     date?: Date;
     /** Optional prefix shown before a formatted relative date. */
@@ -113,30 +114,23 @@ interface AXPUserProfileHeaderMetaItem {
 declare function resolveUserProfileSectionContent(section: AXPUserProfileSection): AXPUserProfileSectionContent;
 /** Whether the group renders a full-tab component instead of sections. */
 declare function isUserProfileGroupComponent(group: AXPUserProfileGroup): boolean;
+/** True when section hooks should run for `groupId` (all groups when the payload omits it). */
+declare function isUserProfileSectionsGroupRequested(payload: AXPUserProfileSectionsPayload, groupId: string): boolean;
 /** Visible actions on a section card. */
 declare function visibleUserProfileSectionActions(actions: AXPUserProfileSectionAction[]): AXPUserProfileSectionAction[];
 /** Default card action: explicit `default`, otherwise the first visible action. */
 declare function resolveDefaultUserProfileSectionAction(actions: AXPUserProfileSectionAction[]): AXPUserProfileSectionAction | undefined;
 
-type AXPUserAvatarStorageTarget = {
-    kind: 'person';
-    personId: string;
-    userId: string;
-} | {
-    kind: 'user';
-    userId: string;
-};
 /**
  * Client-side profile photo operations for self-service flows.
- * Bidirectional Person ↔ User sync runs on the server via HCM avatar middleware.
+ * Canonical store is SecurityManagement.User.avatar; Person.image is mirrored
+ * on the server by HCM avatar sync middleware.
  */
 declare class AXPUserAvatarSyncService {
     private readonly entityService;
     private readonly fileStorage;
     private readonly sessionService;
-    private readonly identityService;
     private readonly userAvatarService;
-    resolveStorageTarget(userId: string): Promise<AXPUserAvatarStorageTarget>;
     getCurrentAvatarRef(userId: string): Promise<string | null>;
     getCurrentAvatarBlob(userId: string): Promise<Blob | null>;
     uploadAndSetAvatar(userId: string, file: File): Promise<string>;
@@ -144,22 +138,11 @@ declare class AXPUserAvatarSyncService {
     /** Keeps session, avatar cache, and shell avatars in sync after any avatar change. */
     notifyAvatarChanged(userId: string, avatar: string | null): Promise<void>;
     private refreshClientDisplay;
-    private personData;
     private userData;
-    private findPersonByUserId;
-    private safeRemoveFile;
     static ɵfac: i0.ɵɵFactoryDeclaration<AXPUserAvatarSyncService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<AXPUserAvatarSyncService>;
 }
 
-/**
- * Registers auth module data source definitions.
- */
-declare class AXMAuthDataSourceProvider implements AXPDataSourceDefinitionProvider {
-    private readonly userActivity;
-    items(): Promise<_acorex_platform_framework_client_core.AXPDataSourceDefinition<_acorex_platform_module_auth_client.AXPUserActivityDataSourceItem>[]>;
-}
-
 type AXPUserActivityLevel = 0 | 1 | 2 | 3 | 4;
 interface AXPUserActivityDay {
     date: string;
@@ -175,7 +158,7 @@ interface AXPUserActivityStats {
     avgPerWeek: number;
     total: number;
 }
-/** Single payload row returned by {@link AXMAuthDataSourceKeys.UserActivity}. */
+/** Single payload row returned by Auth:GetUserActivity. */
 interface AXPUserActivityDataSourceItem {
     id: string;
     userId: string;
@@ -207,13 +190,6 @@ declare function extractUserActivityUserId(filter: AXDataSourceFilterOption | un
 declare function extractUserActivityStartDate(filter: AXDataSourceFilterOption | undefined): Date | undefined;
 declare function extractUserActivityEndDate(filter: AXDataSourceFilterOption | undefined): Date | undefined;
 
-/** Contribution-style user activity heatmap derived from device session sign-in dates. */
-declare class AXMUserActivityDataSourceDefinition implements AXPDataSourceDefinitionProvider {
-    private readonly entityService;
-    items(): Promise<AXPDataSourceDefinition<AXPUserActivityDataSourceItem>[]>;
-    private loadUserSessions;
-}
-
 declare class AXMAuthErrorHandler implements AXPErrorHandler {
     private router;
     private layoutService;
@@ -230,26 +206,28 @@ declare enum AXMAuthenticationTypes {
     EmailCode = 4,
     MobileCode = 5
 }
-declare const AXM_AUTH_CONFIG_TOKEN: InjectionToken<AXMAuthConfigs>;
+/** Map persisted credential-type setting values to {@link AXMAuthenticationTypes}. */
+declare function parseAuthCredentialType(value: unknown): AXMAuthenticationTypes;
+/** Optional deploy-time OAuth client overrides (defaults live in platform auth strategies). */
+interface AXMAuthClientConfig {
+    clientId?: string;
+    client_id?: string;
+    redirectUri?: string;
+    scope?: string;
+    issuer?: string;
+}
+/**
+ * Compile-time / environment auth wiring only.
+ * Sign-in page branding, sign-up policy, credential type, and default strategy
+ * come from platform (P) settings — not this token.
+ */
 interface AXMAuthConfigs {
-    type: AXMAuthenticationTypes;
-    authConfig?: AuthConfig;
+    authConfig?: AXMAuthClientConfig;
     baseUrl?: string;
-    end_url?: string;
-    signup?: {
-        enable: boolean;
-        url?: string;
-    };
-    signinPage?: {
-        description: string;
-        slogan: string;
-    };
-    defaultStrategyName?: string;
-    idleTimeout?: number;
 }
+declare const AXM_AUTH_CONFIG_TOKEN: InjectionToken<AXMAuthConfigs>;
 declare const AXMDefaultAuthConfigs: AXMAuthConfigs;
 declare function configAuthModule(config?: Partial<AXMAuthConfigs>): AXMAuthConfigs;
-
 /**
  * Injection token for login page guard.
  * Apps can provide their own custom guard by providing this token.
@@ -257,9 +235,26 @@ declare function configAuthModule(config?: Partial<AXMAuthConfigs>): AXMAuthConf
  */
 declare const AXM_LOGIN_GUARD_TOKEN: InjectionToken<CanActivateFn>;
 
+/**
+ * Reads public platform auth UI settings loaded during app startup.
+ * Slogan and description are multi-language strings.
+ */
+declare class AXMAuthPlatformSettingsService {
+    private readonly settings;
+    slogan(): AXPMultiLanguageString;
+    description(): AXPMultiLanguageString;
+    signupEnabled(): boolean;
+    signupUrl(): string;
+    credentialType(): AXMAuthenticationTypes;
+    defaultStrategyName(): string;
+    private readMls;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AXMAuthPlatformSettingsService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AXMAuthPlatformSettingsService>;
+}
+
 declare class AXPAccountModule {
     static ɵfac: i0.ɵɵFactoryDeclaration<AXPAccountModule, never>;
-    static ɵmod: i0.ɵɵNgModuleDeclaration<AXPAccountModule, never, [typeof i1.RouterModule, typeof _acorex_platform_framework_client_core.AXPComponentSlotModule], never>;
+    static ɵmod: i0.ɵɵNgModuleDeclaration<AXPAccountModule, never, [typeof i1.RouterModule, typeof i2.AXPComponentSlotModule], never>;
     static ɵinj: i0.ɵɵInjectorDeclaration<AXPAccountModule>;
 }
 
@@ -272,13 +267,15 @@ declare class AXMAuthValidationRulesModule {
 declare class AXMAuthModule {
     constructor();
     static ɵfac: i0.ɵɵFactoryDeclaration<AXMAuthModule, never>;
-    static ɵmod: i0.ɵɵNgModuleDeclaration<AXMAuthModule, never, [typeof i1$2.CommonModule, typeof i2.AXPCommonModule, typeof i1.RouterModule, typeof AXPAccountModule, typeof AXMAuthValidationRulesModule], never>;
+    static ɵmod: i0.ɵɵNgModuleDeclaration<AXMAuthModule, never, [typeof i1$2.CommonModule, typeof i2$1.AXPCommonModule, typeof i1.RouterModule, typeof AXPAccountModule, typeof AXMAuthValidationRulesModule], never>;
     static ɵinj: i0.ɵɵInjectorDeclaration<AXMAuthModule>;
 }
 
 /**
- * Guard for login page. Clears incomplete sessions so a prior OAuth attempt
- * does not leak into the next username/password sign-in.
+ * Login page guard.
+ * If the user already has a cookie session but has not finished tenant/app binding,
+ * send them to the chooser — never destroy the session.
+ * If the session is fully bound, send them home (do not show login again).
  */
 declare const canActivateLogin: CanActivateFn;
 
@@ -311,6 +308,7 @@ declare class AXPIdleLockService {
     private overlayRef;
     private overlayOpening;
     private enableTask;
+    private pendingLockScreenOffer;
     private readonly sessionService;
     private readonly settingsService;
     private readonly entityService;
@@ -325,13 +323,22 @@ declare class AXPIdleLockService {
     unlock(): void;
     /** Locks the session overlay when Lock When Idle is enabled. */
     lockScreen(): void;
+    /** Marks that PIN setup succeeded so the caller can offer lock-screen activation. */
+    requestLockScreenOffer(): void;
+    /** Returns whether PIN setup requested a lock-screen offer, then clears the flag. */
+    consumeLockScreenOffer(): boolean;
     refreshPinState(): Promise<void>;
+    /** Refreshes lock-when-idle settings only (no User entity fetch). Used by profile menu hooks. */
+    refreshLockMenuState(): Promise<void>;
     /** Refreshes lock settings and PIN state for menu/commands. */
     refreshLockState(): Promise<void>;
     /** Restores the lock overlay when the persisted session is locked. */
     restoreFromPersistedSession(): Promise<void>;
     /** Re-evaluates idle lock after the user sets or changes their security PIN. */
     notifyPinChanged(): Promise<void>;
+    /** PIN/password entity reads require a fully authorized app context, except when restoring a lock overlay. */
+    private canLoadUserSecurityFields;
+    private ensurePinStateLoaded;
     private scheduleEnable;
     private runEnable;
     /** Idle lock is active when enabled, or when a persisted lock must be restored/unlocked. */
@@ -386,5 +393,5 @@ declare class AXPAuthPasswordChangeTrackingService {
     static ɵprov: i0.ɵɵInjectableDeclaration<AXPAuthPasswordChangeTrackingService>;
 }
 
-export { AUTH_LOGIN_EXTERNAL_PROVIDERS_SLOT, AUTH_USER_ACTIVITY_DEFAULT_WEEKS, AXMAuthDataSourceProvider, AXMAuthErrorHandler, AXMAuthModule, AXMAuthenticationTypes, AXMDefaultAuthConfigs, AXMUserActivityDataSourceDefinition, AXM_AUTH_CONFIG_TOKEN, AXM_LOGIN_GUARD_TOKEN, AXPAuthPasswordChangeTrackingService, AXPIdleLockService, AXPLoginExternalProvidersComponent, AXPLoginHistoryService, AXPUserAvatarSyncService, PROFILE_PAGE_GROUPS_HOOK, PROFILE_PAGE_HEADER_META_HOOK, PROFILE_PAGE_SECTIONS_HOOK, aggregateDailySessionCounts, buildUserActivityDataSourceItem, buildUserActivityWeeks, canActivateLogin, computeUserActivityStats, configAuthModule, countToActivityLevel, extractUserActivityEndDate, extractUserActivityStartDate, extractUserActivityUserId, formatCompactActivityCount, isUserProfileGroupComponent, resolveDefaultUserActivityDateRange, resolveDefaultUserProfileSectionAction, resolveUserProfileSectionContent, visibleUserProfileSectionActions };
-export type { AXMAuthConfigs, AXPLoginHistoryEntry, AXPUserActivityDataSourceItem, AXPUserActivityDay, AXPUserActivityLevel, AXPUserActivityLoadParams, AXPUserActivityStats, AXPUserActivityWeek, AXPUserAvatarStorageTarget, AXPUserProfileGroup, AXPUserProfileGroupComponentContent, AXPUserProfileGroupContent, AXPUserProfileGroupSectionsContent, AXPUserProfileGroupsPayload, AXPUserProfileHeaderMetaItem, AXPUserProfileHeaderMetaPayload, AXPUserProfileSection, AXPUserProfileSectionAction, AXPUserProfileSectionCardContent, AXPUserProfileSectionComponentContent, AXPUserProfileSectionContent, AXPUserProfileSectionInsight, AXPUserProfileSectionLayout, AXPUserProfileSectionsPayload };
+export { AUTH_LOGIN_EXTERNAL_PROVIDERS_SLOT, AUTH_USER_ACTIVITY_DEFAULT_WEEKS, AXMAuthErrorHandler, AXMAuthModule, AXMAuthPlatformSettingsService, AXMAuthenticationTypes, AXMDefaultAuthConfigs, AXM_AUTH_CONFIG_TOKEN, AXM_LOGIN_GUARD_TOKEN, AXPAuthPasswordChangeTrackingService, AXPIdleLockService, AXPLoginExternalProvidersComponent, AXPLoginHistoryService, AXPUserAvatarSyncService, PROFILE_PAGE_GROUPS_HOOK, PROFILE_PAGE_HEADER_META_HOOK, PROFILE_PAGE_SECTIONS_HOOK, aggregateDailySessionCounts, buildUserActivityDataSourceItem, buildUserActivityWeeks, canActivateLogin, computeUserActivityStats, configAuthModule, countToActivityLevel, extractUserActivityEndDate, extractUserActivityStartDate, extractUserActivityUserId, formatCompactActivityCount, isUserProfileGroupComponent, isUserProfileSectionsGroupRequested, parseAuthCredentialType, resolveDefaultUserActivityDateRange, resolveDefaultUserProfileSectionAction, resolveUserProfileSectionContent, visibleUserProfileSectionActions };
+export type { AXMAuthClientConfig, AXMAuthConfigs, AXPLoginHistoryEntry, AXPUserActivityDataSourceItem, AXPUserActivityDay, AXPUserActivityLevel, AXPUserActivityLoadParams, AXPUserActivityStats, AXPUserActivityWeek, AXPUserProfileGroup, AXPUserProfileGroupComponentContent, AXPUserProfileGroupContent, AXPUserProfileGroupSectionsContent, AXPUserProfileGroupsPayload, AXPUserProfileHeaderMetaItem, AXPUserProfileHeaderMetaPayload, AXPUserProfileSection, AXPUserProfileSectionAction, AXPUserProfileSectionCardContent, AXPUserProfileSectionComponentContent, AXPUserProfileSectionContent, AXPUserProfileSectionInsight, AXPUserProfileSectionLayout, AXPUserProfileSectionsPayload };