@anarchitects/auth-angular 0.4.0 → 0.5.1

package/types/anarchitects-auth-angular-ui.d.ts

@@ -1,6 +1,6 @@
+import * as _anarchitects_forms_ts_models from '@anarchitects/forms-ts/models';
 import * as _angular_core from '@angular/core';
 import { SubmissionRequestDTO } from '@anarchitects/forms-ts/dtos';
-import { FormConfig } from '@anarchitects/forms-ts/models';
 
 declare class AnarchitectsAuthUiLoginForm {
     readonly layout: _angular_core.InputSignal<`form:${string}` | `list:${string}` | `detail:${string}` | `app-${string}:${string}` | null>;
@@ -9,7 +9,7 @@ declare class AnarchitectsAuthUiLoginForm {
         credential: string;
         password: string;
     }>;
-    readonly formConfig: _angular_core.WritableSignal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiLoginForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiLoginForm, "anarchitects-auth-ui-login-form", never, { "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -24,7 +24,7 @@ declare class AnarchitectsAuthUiRegisterForm {
         email: string;
         confirmPassword: string;
     }>;
-    readonly formConfig: _angular_core.WritableSignal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiRegisterForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiRegisterForm, "anarchitects-auth-ui-register-form", never, { "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -37,7 +37,7 @@ declare class AnarchitectsAuthUiActivateUserForm {
     readonly submitted: _angular_core.OutputEmitterRef<{
         token: string;
     }>;
-    readonly formConfig: _angular_core.Signal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiActivateUserForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiActivateUserForm, "anarchitects-auth-ui-activate-user-form", never, { "token": { "alias": "token"; "required": false; "isSignal": true; }; "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -49,7 +49,7 @@ declare class AnarchitectsAuthUiForgotPasswordForm {
     readonly submitted: _angular_core.OutputEmitterRef<{
         email: string;
     }>;
-    readonly formConfig: _angular_core.WritableSignal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiForgotPasswordForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiForgotPasswordForm, "anarchitects-auth-ui-forgot-password-form", never, { "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -64,7 +64,7 @@ declare class AnarchitectsAuthUiResetPasswordForm {
         confirmPassword: string;
         token: string;
     }>;
-    readonly formConfig: _angular_core.Signal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiResetPasswordForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiResetPasswordForm, "anarchitects-auth-ui-reset-password-form", never, { "token": { "alias": "token"; "required": false; "isSignal": true; }; "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -77,7 +77,7 @@ declare class AnarchitectsAuthUiVerifyEmailForm {
     readonly submitted: _angular_core.OutputEmitterRef<{
         token: string;
     }>;
-    readonly formConfig: _angular_core.Signal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiVerifyEmailForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiVerifyEmailForm, "anarchitects-auth-ui-verify-email-form", never, { "token": { "alias": "token"; "required": false; "isSignal": true; }; "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -91,7 +91,7 @@ declare class AnarchitectsAuthUiChangePasswordForm {
         currentPassword: string;
         newPassword: string;
     }>;
-    readonly formConfig: _angular_core.WritableSignal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiChangePasswordForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiChangePasswordForm, "anarchitects-auth-ui-change-password-form", never, { "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -104,7 +104,7 @@ declare class AnarchitectsAuthUiUpdateEmailForm {
         password?: string | undefined;
         newEmail: string;
     }>;
-    readonly formConfig: _angular_core.WritableSignal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiUpdateEmailForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiUpdateEmailForm, "anarchitects-auth-ui-update-email-form", never, { "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -117,7 +117,7 @@ declare class AnarchitectsAuthUiLogoutForm {
         accessToken?: string | undefined;
         refreshToken: string;
     }>;
-    readonly formConfig: _angular_core.WritableSignal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiLogoutForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiLogoutForm, "anarchitects-auth-ui-logout-form", never, { "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;
@@ -129,7 +129,7 @@ declare class AnarchitectsAuthUiRefreshTokensForm {
     readonly submitted: _angular_core.OutputEmitterRef<{
         refreshToken: string;
     }>;
-    readonly formConfig: _angular_core.WritableSignal<FormConfig>;
+    readonly formConfig: _angular_core.Signal<_anarchitects_forms_ts_models.FormConfig>;
     onSubmitted(input: SubmissionRequestDTO): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AnarchitectsAuthUiRefreshTokensForm, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AnarchitectsAuthUiRefreshTokensForm, "anarchitects-auth-ui-refresh-tokens-form", never, { "layout": { "alias": "layout"; "required": false; "isSignal": true; }; "layoutOptions": { "alias": "layoutOptions"; "required": false; "isSignal": true; }; }, { "submitted": "submitted"; }, never, ["ng-template[anxTemplate]", "[anxSlot]"], true, never>;

package/types/anarchitects-auth-angular-util.d.ts

@@ -1,17 +1,15 @@
-import * as _casl_ability from '@casl/ability';
-import { MongoAbility } from '@casl/ability';
 import { Action, Subject, PolicyRule } from '@anarchitects/auth-ts/models';
+import { MongoAbility } from '@casl/ability';
 
-type AbilitySubject = Subject | (Record<string, unknown> & {
-    __caslSubjectType__?: Subject;
-});
-type AppAbility = MongoAbility<[
-    Action,
-    AbilitySubject
-], {
-    conditions: Record<string, unknown>;
-}>;
-declare const createAppAbility: (rules: PolicyRule[]) => MongoAbility<_casl_ability.AbilityTuple, Record<string, unknown>>;
+type AbilitySubject = Subject | object;
+type AbilityResource = Record<string, unknown>;
+type AppAbility = MongoAbility<[Action, AbilitySubject]>;
+declare const createAppAbility: (rules: PolicyRule[]) => AppAbility;
+declare const asAppAbilitySubject: <TResource extends AbilityResource>(subjectName: Subject, resource: TResource) => TResource & {
+    __caslSubjectType__: Subject;
+};
+declare const canAccessResource: <TResource extends AbilityResource>(ability: AppAbility | undefined, action: Action, subjectName: Subject, resource: TResource) => boolean;
+declare const canAccessResourceField: <TResource extends AbilityResource>(ability: AppAbility | undefined, action: Action, subjectName: Subject, field: string, resource: TResource) => boolean;
 
-export { createAppAbility };
+export { asAppAbilitySubject, canAccessResource, canAccessResourceField, createAppAbility };
 export type { AppAbility };

package/util/README.md

@@ -5,12 +5,28 @@ Utility layer for Angular auth. Re-exported via `@anarchitects/auth-angular/util
 ## Exports
 
 - `createAppAbility(rules: PolicyRule[])`: wraps `createMongoAbility` and returns the typed `AppAbility` used throughout the auth domain.
+- `canAccessResource(...)`: checks a concrete resource instance against the current ability.
+- `canAccessResourceField(...)`: checks whether a specific field-level action is allowed for a concrete resource.
 - `AppAbility`: CASL ability type configured for `Action`/`Subject` pairs defined in `@anarchitects/auth-ts/models`.
 
+## When To Use These Helpers
+
+Use this layer for concrete resource decisions, not coarse route metadata:
+
+- `createAppAbility(rules)` builds the frontend CASL ability from validated RBAC rules
+- `canAccessResource(...)` answers instance-level questions such as "may this user edit this post?"
+- `canAccessResourceField(...)` answers field-sensitive UI questions such as inline title editing
+
+If you only need coarse route-attempt semantics, use `policyGuard` and `RoutePolicy` instead of calling CASL directly here.
+
 ## Usage
 
 ```ts
-import { createAppAbility } from '@anarchitects/auth-angular/util';
+import {
+  canAccessResource,
+  canAccessResourceField,
+  createAppAbility,
+} from '@anarchitects/auth-angular/util';
 import type { PolicyRule } from '@anarchitects/auth-ts/models';
 
 const rules: PolicyRule[] = [
@@ -23,6 +39,16 @@ const ability = createAppAbility(rules);
 if (ability.can('manage', 'Project')) {
   // guarded feature logic
 }
+
+const post = { id: 'post-1', authorId: 'user-1', title: 'Draft' };
+
+if (canAccessResource(ability, 'update', 'Post', post)) {
+  // show edit button
+}
+
+if (canAccessResourceField(ability, 'update', 'Post', 'title', post)) {
+  // allow inline title editing
+}
 ```
 
-For stateful orchestration examples, see `auth.store` in the state layer where the ability factory is integrated with the auth API responses.
+Use these helpers for frontend instance-level decisions such as edit buttons, row actions, and resolved edit routes. Coarse route gating still belongs to `policyGuard`, and the backend must still enforce the final instance-level decision.