@bravobit/bb-foundation 0.51.7 → 0.52.1

package/auth/lib/auth.interceptor.d.ts

@@ -7,12 +7,14 @@ export declare class AuthInterceptor implements HttpInterceptor {
     private readonly _authHeaderString;
     private readonly _authScheme;
     isRefreshing: boolean;
-    refreshingAccessToken$: BehaviorSubject<string>;
+    refreshingAccessToken$: BehaviorSubject<boolean>;
     intercept(request: HttpRequest<unknown>, next: HttpHandler): import("rxjs").Observable<import("@angular/common/http").HttpEvent<any>>;
+    private modifyRequest;
+    private handleBrowserStorageRequest;
+    private handleHttpOnlyCookieRequest;
     private handle401Error;
     private logoutUser;
-    private getAccessToken;
-    private addAuthorizationHeader;
+    private getAccessTokenFromSession;
     static ɵfac: i0.ɵɵFactoryDeclaration<AuthInterceptor, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<AuthInterceptor>;
 }

package/auth/lib/auth.session.d.ts

@@ -1,4 +1,5 @@
 import { StorageStrategy } from '@bravobit/bb-foundation/storage';
+import { AuthStrategy } from './interfaces/config.interface';
 import { AuthToken } from './interfaces/token.interface';
 export declare class AuthSession {
     private readonly _jwt;
@@ -6,6 +7,7 @@ export declare class AuthSession {
     private readonly _accessTokenStorageKey;
     private readonly _refreshTokenStorageKey;
     private readonly _userStorageKey;
+    private readonly _strategy;
     private _accessTokenString;
     private _refreshTokenString;
     private _accessTokenPayload;
@@ -15,8 +17,13 @@ export declare class AuthSession {
     constructor(options?: {
         id?: string;
         storage?: StorageStrategy;
+        strategy?: AuthStrategy;
     });
     get snapshot(): {
+        user: any;
+        accessToken?: undefined;
+        refreshToken?: undefined;
+    } | {
         user: any;
         accessToken: string;
         refreshToken: string;

package/auth/lib/interfaces/config.interface.d.ts

@@ -1,7 +1,9 @@
 import { ActivatedRouteSnapshot, RouterStateSnapshot, UrlTree } from '@angular/router';
 import { InjectionToken } from '@angular/core';
+export type AuthStrategy = 'httpOnlyCookie' | 'browserStorage';
 export interface AuthConfig {
     applicationId: string;
+    strategy: AuthStrategy;
     http?: {
         scheme?: string;
         header?: string;

package/elements/lib/elements.interfaces.d.ts

@@ -34,5 +34,6 @@ export interface ElementsConfig {
     iconFonts?: ElementsIcon[];
     errors?: ElementsError;
     defaultDisplayUnit?: ElementsDisplayUnit;
+    allowedFileTypes?: string[];
 }
 export type ElementsDisplayUnit = 'rem' | 'px';

package/elements/lib/file-picker/file-picker.component.d.ts

@@ -3,12 +3,13 @@ import { ControlValueAccessor, FormControl } from '@angular/forms';
 import { BehaviorSubject } from 'rxjs';
 import * as i0 from "@angular/core";
 export declare class BbFilePicker implements ControlValueAccessor {
+    private readonly _config?;
     readonly labelId: string;
     fileInput: ElementRef<HTMLInputElement>;
     extraTemplate: TemplateRef<any>;
     label: string | TemplateRef<any> | null;
     hint: string | TemplateRef<any> | null;
-    accept: string | null;
+    accept: string;
     showImages: boolean;
     grouped: boolean;
     required: boolean;
@@ -39,6 +40,7 @@ export declare class BbFilePicker implements ControlValueAccessor {
     };
     saveFile(files: File[]): void;
     private getFilesFromEvent;
+    private getAcceptString;
     static ɵfac: i0.ɵɵFactoryDeclaration<BbFilePicker, never>;
     static ɵcmp: i0.ɵɵComponentDeclaration<BbFilePicker, "bb-file-picker", never, { "label": { "alias": "label"; "required": false; }; "hint": { "alias": "hint"; "required": false; }; "accept": { "alias": "accept"; "required": false; }; "showImages": { "alias": "showImages"; "required": false; }; "grouped": { "alias": "grouped"; "required": false; }; "required": { "alias": "required"; "required": false; }; "disabled": { "alias": "disabled"; "required": false; }; "hideErrors": { "alias": "hideErrors"; "required": false; }; "value": { "alias": "value"; "required": false; }; }, { "valueChange": "valueChange"; }, ["extraTemplate"], never, true, never>;
     static ngAcceptInputType_grouped: unknown;

package/elements/lib/multi-file-control/multi-file-control.component.d.ts

@@ -1,15 +1,15 @@
-import { ChangeDetectorRef, ElementRef, EventEmitter, TemplateRef } from '@angular/core';
+import { ElementRef, EventEmitter, TemplateRef } from '@angular/core';
 import { ControlValueAccessor, FormControl } from '@angular/forms';
-import { Files } from '@bravobit/bb-foundation';
 import * as i0 from "@angular/core";
 export declare class BbMultiFileControl implements ControlValueAccessor {
-    private _files;
-    private _changeDetectorRef;
+    private readonly _files;
+    private readonly _changeDetectorRef;
+    private readonly _config?;
     readonly labelId: string;
     fileInput: ElementRef<HTMLInputElement>;
     label: string | TemplateRef<any> | null;
     hint: string | TemplateRef<any> | null;
-    accept: string | null;
+    accept: string;
     grouped: boolean;
     required: boolean;
     disabled: boolean;
@@ -28,7 +28,6 @@ export declare class BbMultiFileControl implements ControlValueAccessor {
     error: boolean;
     onTouchedCallback: () => void;
     onChangeCallback: (_: File[] | null) => void;
-    constructor(_files: Files, _changeDetectorRef: ChangeDetectorRef);
     get showList(): boolean;
     downloadFile(file: File): void;
     openFileDialog(): void;
@@ -47,6 +46,7 @@ export declare class BbMultiFileControl implements ControlValueAccessor {
     };
     addFiles(files: File[]): void;
     private isFileLike;
+    private getAcceptString;
     static ɵfac: i0.ɵɵFactoryDeclaration<BbMultiFileControl, never>;
     static ɵcmp: i0.ɵɵComponentDeclaration<BbMultiFileControl, "bb-multi-file-control", never, { "label": { "alias": "label"; "required": false; }; "hint": { "alias": "hint"; "required": false; }; "accept": { "alias": "accept"; "required": false; }; "grouped": { "alias": "grouped"; "required": false; }; "required": { "alias": "required"; "required": false; }; "disabled": { "alias": "disabled"; "required": false; }; "hideErrors": { "alias": "hideErrors"; "required": false; }; "items": { "alias": "items"; "required": false; }; }, { "delete": "delete"; }, never, never, true, never>;
     static ngAcceptInputType_grouped: unknown;

package/fesm2022/bravobit-bb-foundation-auth.mjs

@@ -1,6 +1,6 @@
 import * as i0 from '@angular/core';
 import { InjectionToken, inject, Injector, TransferState, makeStateKey, Injectable, Directive, Input, provideAppInitializer, makeEnvironmentProviders, NgModule } from '@angular/core';
-import { HttpContextToken, HttpClient, HttpContext, HttpErrorResponse, HTTP_INTERCEPTORS } from '@angular/common/http';
+import { HttpContextToken, HttpClient, HttpHeaders, HttpContext, HttpErrorResponse, HTTP_INTERCEPTORS } from '@angular/common/http';
 import { shareReplay, tap, map, distinctUntilChanged, catchError, filter, take, switchMap, finalize } from 'rxjs/operators';
 import { firstValueFrom, BehaviorSubject, of, Subscription, first, throwError } from 'rxjs';
 import { Storage, StorageOption } from '@bravobit/bb-foundation/storage';
@@ -138,6 +138,7 @@ class AuthSession {
     _accessTokenStorageKey;
     _refreshTokenStorageKey;
     _userStorageKey;
+    _strategy;
     // Token strings.
     _accessTokenString = null;
     _refreshTokenString = null;
@@ -156,10 +157,14 @@ class AuthSession {
         this._userStorageKey = this.generateKey(applicationId, 'au_usr');
         // Setting up the storage.
         this._storage = options?.storage ?? null;
+        this._strategy = options?.strategy ?? null;
         // Init methods.
         this.restoreFromStorage();
     }
     get snapshot() {
+        if (this._strategy === 'httpOnlyCookie') {
+            return { user: this._user$.getValue() };
+        }
         return {
             user: this._user$.getValue(),
             accessToken: this.accessToken,
@@ -183,9 +188,12 @@ class AuthSession {
         return this._refreshTokenPayload ?? null;
     }
     authenticated() {
-        return this.isTokenValid(this._accessTokenPayload) || this.isTokenValid(this._refreshTokenPayload);
+        return !!this.snapshot?.user;
     }
     setTokens(accessToken, refreshToken, persist = true) {
+        if (this._strategy === 'httpOnlyCookie') {
+            return;
+        }
         this.setAccessToken(accessToken);
         this.setRefreshToken(refreshToken);
         if (persist) {
@@ -206,20 +214,22 @@ class AuthSession {
         if (!this._storage) {
             return;
         }
-        // Set the access token.
-        const accessToken = this._storage.get(this._accessTokenStorageKey);
-        this.setAccessToken(accessToken);
-        // Set the refresh token.
-        const refreshToken = this._storage.get(this._refreshTokenStorageKey);
-        this.setRefreshToken(refreshToken);
+        if (this._strategy === 'browserStorage') {
+            // Set the access token.
+            const accessToken = this._storage.get(this._accessTokenStorageKey);
+            this.setAccessToken(accessToken);
+            // Set the refresh token.
+            const refreshToken = this._storage.get(this._refreshTokenStorageKey);
+            this.setRefreshToken(refreshToken);
+        }
         // Set the user if we have any correct token payloads.
-        if (this._accessTokenPayload || this._refreshTokenPayload) {
+        if ((this._accessTokenPayload || this._refreshTokenPayload) || this._strategy === 'httpOnlyCookie') {
             const user = this._storage.get(this._userStorageKey);
             this._user$.next(user ?? null); // Note: just settings here instead of setUser() because of syncing to the storage.
         }
     }
     persistTokensInStorage() {
-        if (!this._storage) {
+        if (!this._storage || this._strategy === 'httpOnlyCookie') {
             return;
         }
         // Set the access token if completely valid.
@@ -263,15 +273,15 @@ class AuthSession {
         this._refreshTokenString = value ?? null;
         this._refreshTokenPayload = this._jwt.decode(this._refreshTokenString);
     }
-    generateKey = (applicationId, key) => {
+    generateKey(applicationId, key) {
         return [applicationId, key].join('_');
-    };
-    isTokenValid = (token) => {
+    }
+    isTokenValid(token) {
         if (!token) {
             return false;
         }
         return token?.expiresAt?.getTime() > Date.now();
-    };
+    }
 }
 
 class Auth {
@@ -299,7 +309,8 @@ class Auth {
         // Starting the new session.
         this.session = new AuthSession({
             id: this._config?.applicationId,
-            storage: storageStrategy
+            storage: storageStrategy,
+            strategy: this._config?.strategy
         });
         this.user = this.session.user;
     }
@@ -318,15 +329,16 @@ class Auth {
             const user = this._state?.get(this._authStateKey, null) ?? null;
             return this.session.setUser(user);
         }
-        // Try to fetch the user from the server.
-        const user$ = this.me();
-        const user = await firstValueFrom(user$, { defaultValue: null });
-        // Set the state if exists.
-        if (this._state) {
-            this._state?.set(this._authStateKey, user ?? null);
+        if (this._config?.strategy === 'browserStorage') {
+            // Try to fetch the user from the server.
+            const user$ = this.me();
+            const user = await firstValueFrom(user$, { defaultValue: null });
+            // Set the state if exists.
+            if (this._state) {
+                this._state?.set(this._authStateKey, user ?? null);
+            }
+            this.session.setUser(user);
         }
-        // Save the user in the storage and handle auto refreshing.
-        this.session.setUser(user);
         this.handleAutoRefreshing();
     }
     me() {
@@ -365,10 +377,8 @@ class Auth {
     }
     async resendVerifyCode(verifyToken) {
         const url = this.getUrl('auth/resend');
-        const result$ = this._httpClient.post(url, {
-            verify_token: verifyToken
-        });
-        return firstValueFrom(result$);
+        const result$ = this._httpClient.post(url, { verify_token: verifyToken });
+        return await firstValueFrom(result$);
     }
     async register(data, options) {
         // Execute API call.
@@ -388,30 +398,36 @@ class Auth {
         // Note: We do this because else we try to invalidate
         // an "undefined" refresh token.
         const refreshToken = this.session.refreshToken;
-        if (!refreshToken) {
+        if (!refreshToken && this._config?.strategy === 'browserStorage') {
             return this.session.clear();
         }
-        // We do have a refresh token, so try to
-        // invalidate it in the backend.
+        // We do have a refresh token, so try to invalidate it in the backend.
+        // or we are httpOnlyCookie authenticated.
         try {
             const url = this.getUrl('auth/logout');
             const headerName = this._config?.http?.header ?? 'Authorization';
+            const headers = new HttpHeaders({
+                [headerName]: refreshToken
+            });
             const observable$ = this._httpClient.get(url, {
-                headers: { [headerName]: refreshToken }
+                ...(this._config?.strategy === 'browserStorage' ? { headers } : {}),
+                ...(this._config?.strategy === 'httpOnlyCookie' ? { withCredentials: true } : {})
             });
             firstValueFrom(observable$).then(_ => _).catch(_ => _);
         }
         catch {
             // Do nothing because the tokens will be deleted anyways from the session.
         }
-        // Delete the tokens from the session.
-        return this.session.clear();
+        finally {
+            // Delete the tokens from the session.
+            this.session.clear();
+        }
     }
     refresh() {
         // If the refresh token does
         // not exist just return an observable of null.
         const refreshToken = this.session.refreshToken;
-        if (!refreshToken) {
+        if (!refreshToken && this._config?.strategy === 'browserStorage') {
             return of(null);
         }
         // Perform the refresh call.
@@ -419,8 +435,12 @@ class Auth {
         const scheme = this._config?.http?.scheme ?? 'Bearer';
         const url = this.getUrl('auth/refresh');
         const context = new HttpContext().set(USE_AUTHORIZATION, false);
+        const headers = new HttpHeaders({
+            [headerName]: `${scheme} ${refreshToken}`
+        });
         return this._httpClient.get(url, {
-            headers: { [headerName]: `${scheme} ${refreshToken}` },
+            ...(this._config?.strategy === 'browserStorage' ? { headers } : {}),
+            ...(this._config?.strategy === 'httpOnlyCookie' ? { withCredentials: true } : {}),
             context: context
         }).pipe(tap(({ token, refresh_token }) => this.setTokens(token, refresh_token)), map(({ token }) => token));
     }
@@ -461,7 +481,7 @@ class Auth {
     }
     handleAutoRefreshing() {
         const shouldAutoRefresh = this._config?.autoRefresh ?? false;
-        if (!shouldAutoRefresh) {
+        if (!shouldAutoRefresh || this._config?.strategy === 'httpOnlyCookie') {
             return;
         }
         const expiresAt = this.session.refreshTokenPayload?.expiresAt ?? null;
@@ -708,15 +728,14 @@ class AuthInterceptor {
     _authScheme = this._config?.http?.scheme ?? 'Bearer';
     // Data.
     isRefreshing = false;
-    refreshingAccessToken$ = new BehaviorSubject(null);
+    refreshingAccessToken$ = new BehaviorSubject(false);
     intercept(request, next) {
         // 1. Check if the user wants to use the authorization for this request.
         if (!request.context.get(USE_AUTHORIZATION)) {
             return next.handle(request);
         }
         // 2. Compose the new request.
-        const accessToken = this.getAccessToken(request);
-        const newRequest = this.addAuthorizationHeader(request, accessToken);
+        const newRequest = this.modifyRequest(request);
         // 3. Handle all errors.
         return next.handle(newRequest).pipe(catchError(error => {
             // Handle the HTTP401 error.
@@ -727,20 +746,42 @@ class AuthInterceptor {
             return throwError(() => error);
         }));
     }
+    modifyRequest(request) {
+        switch (this._config?.strategy) {
+            case 'browserStorage':
+                return this.handleBrowserStorageRequest(request);
+            case 'httpOnlyCookie':
+                return this.handleHttpOnlyCookieRequest(request);
+            default:
+                throw new Error(`invalid auth strategy "${this._config?.strategy}"`);
+        }
+    }
+    handleBrowserStorageRequest(request) {
+        const accessToken = this.getAccessTokenFromSession(request);
+        if (!accessToken) {
+            return request.clone({ headers: request.headers.delete(this._authHeaderString) });
+        }
+        return request.clone({
+            setHeaders: { [this._authHeaderString]: `${this._authScheme} ${accessToken}` }
+        });
+    }
+    handleHttpOnlyCookieRequest(request) {
+        return request.clone({ withCredentials: true });
+    }
     handle401Error(request, next) {
         // If already refreshing wait for the refresh token to complete.
         if (this.isRefreshing) {
-            return this.refreshingAccessToken$.pipe(filter(accessToken => accessToken !== null), take(1), switchMap(accessToken => next.handle(this.addAuthorizationHeader(request, accessToken))));
+            return this.refreshingAccessToken$.pipe(filter(accessToken => accessToken !== false), take(1), switchMap(() => next.handle(this.modifyRequest(request))));
         }
         // Set the refreshing to true.
         this.isRefreshing = true;
-        this.refreshingAccessToken$.next(null);
+        this.refreshingAccessToken$.next(false);
         return this._auth.refresh().pipe(switchMap(newAccessToken => {
-            if (!newAccessToken) {
+            if (!newAccessToken && this._config?.strategy === 'browserStorage') {
                 return throwError(() => new Error('No refresh token was available.'));
             }
-            this.refreshingAccessToken$.next(newAccessToken);
-            return next.handle(this.addAuthorizationHeader(request, newAccessToken));
+            this.refreshingAccessToken$.next(true);
+            return next.handle(this.modifyRequest(request));
         }), catchError(() => this.logoutUser()), finalize(() => this.isRefreshing = false));
     }
     logoutUser() {
@@ -749,27 +790,14 @@ class AuthInterceptor {
         // Return null as data.
         return of(null);
     }
-    getAccessToken = (request) => {
+    getAccessTokenFromSession(request) {
         // Get the token based on header.
         if (request.headers.has(this._authHeaderString)) {
             return request.headers.get(this._authHeaderString);
         }
         // Return the default access token.
         return this._auth.session.accessToken;
-    };
-    addAuthorizationHeader = (request, accessToken = null) => {
-        // Remove auth header when we do not have
-        // an access token.
-        if (!accessToken) {
-            return request.clone({
-                headers: request.headers.delete(this._authHeaderString)
-            });
-        }
-        // Add the auth header to the request.
-        return request.clone({
-            setHeaders: { [this._authHeaderString]: `${this._authScheme} ${accessToken}` }
-        });
-    };
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.0.6", ngImport: i0, type: AuthInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.0.6", ngImport: i0, type: AuthInterceptor });
 }
@@ -783,6 +811,9 @@ function provideAuthConfig(config) {
         { provide: HTTP_INTERCEPTORS, useClass: AuthInterceptor, multi: true },
         provideAppInitializer(() => inject(Auth).initialize())
     ];
+    if (config?.strategy === 'httpOnlyCookie' && !config?.bootstrap) {
+        throw new Error('the "bootstrap" option must be enabled when using strategy=httpOnlyCookie');
+    }
     if (config?.interceptActing) {
         providers.push({ provide: HTTP_INTERCEPTORS, useClass: ActingInterceptor, multi: true });
     }