@coolms/core-angular 2.0.0-alpha.4 → 2.0.0-alpha.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +46 -0
- package/fesm2022/coolms-core-angular.mjs +2998 -1956
- package/fesm2022/coolms-core-angular.mjs.map +1 -1
- package/package.json +1 -1
- package/types/coolms-core-angular.d.ts +1514 -1350
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,52 @@ currently serves. Earlier alphas are deliberately not reconstructed: entries are
|
|
|
9
9
|
in the same commit as the work they describe, and inventing the ones that
|
|
10
10
|
predate this file would be a worse record than not having them.
|
|
11
11
|
|
|
12
|
+
## 2.0.0-alpha.5 - 2026-10-09
|
|
13
|
+
|
|
14
|
+
### Changed
|
|
15
|
+
|
|
16
|
+
- **The elevation prompt opens only when a person asks for it.** A 403 that
|
|
17
|
+
the server stamps `X-Elevation-Required` no longer opens the prompt by
|
|
18
|
+
itself. `elevationInterceptor` now:
|
|
19
|
+
- leaves a refused read (`GET`, `HEAD`, `OPTIONS`: a page loading, a poll)
|
|
20
|
+
to its caller, which shows its own state;
|
|
21
|
+
- leaves a refused background request alone (see `BACKGROUND_REQUEST`);
|
|
22
|
+
- tells `ELEVATION_NOTICE` when a write a person made is refused, and hands
|
|
23
|
+
the 403 back at once. The application shows the refusal with an Elevate
|
|
24
|
+
button, and only that click opens the prompt (`ElevationService.offerFor`).
|
|
25
|
+
The refused action is not repeated by itself.
|
|
26
|
+
- `ErrorHandlerService.humanize()` says "This needs an elevated session." for
|
|
27
|
+
a stamped refusal, and "You don't have access to this." in place of the
|
|
28
|
+
framework's bare "Access Denied." for any other 403. A sentence the server
|
|
29
|
+
wrote for the refused action is kept.
|
|
30
|
+
- `ConfigService` no longer caches a failed read, so a page that was refused
|
|
31
|
+
reads again after the person elevates.
|
|
32
|
+
- **The console opens for an account the server grants it to.** Once the
|
|
33
|
+
session is settled, the auth guard asks for the admin's endpoint map: a 200
|
|
34
|
+
merges it into the app config, and a 403 signs this sign-in out (on the
|
|
35
|
+
server too) and returns to the sign-in page, which says the account has no
|
|
36
|
+
access to the console. A failure to ask is not an answer: the console opens,
|
|
37
|
+
and each of its requests is still decided by the server.
|
|
38
|
+
- The map is read at `/api/v1/admin/manifest`, and at the older
|
|
39
|
+
`/api/v1/console/manifest` only when the server answers 404 there.
|
|
40
|
+
- An answer is kept only for the sign-in that asked. Nothing is asked while
|
|
41
|
+
nobody is signed in.
|
|
42
|
+
- A module route waits for the map when someone is signed in.
|
|
43
|
+
- The realtime connection opens after this check, and a refused sign-in
|
|
44
|
+
opens none.
|
|
45
|
+
- The sign-in page shows its answer (a wrong password, or the console's
|
|
46
|
+
refusal) as soon as it arrives, without waiting for the person to type.
|
|
47
|
+
|
|
48
|
+
### Added
|
|
49
|
+
|
|
50
|
+
- `BACKGROUND_REQUEST`: an `HttpContextToken` marking a request no person
|
|
51
|
+
made. The realtime connection and subscription tokens and the preferences
|
|
52
|
+
sync carry it.
|
|
53
|
+
- `ELEVATION_NOTICE` and `ElevationNoticePort`: how an application is told
|
|
54
|
+
that a person's write was refused for want of elevation.
|
|
55
|
+
- `isElevationRefusal(err)`: the one test for a stamped 403.
|
|
56
|
+
- `ConsoleAccessService` in the public API.
|
|
57
|
+
|
|
12
58
|
## 2.0.0-alpha.4 - 2026-09-27
|
|
13
59
|
|
|
14
60
|
### Changed
|