@dudousxd/nestjs-media-dashboard 0.9.0 → 0.11.0

package/dist/client/console-session.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Headless client for opening the console from YOUR app.
+ *
+ * The console SPA is served at a literal path and knows nothing about your app's auth, so a plain
+ * browser navigation to it carries no identity. Mode A closes that gap: an XHR from inside your app
+ * — which DOES carry your auth — posts to the console's session endpoint, the `session` hook
+ * decides, and the library answers with its own signed cookie. The navigation that follows rides it.
+ *
+ * No UI here on purpose: you own the button, the page and the copy. This module owns the two things
+ * a host would otherwise have to rediscover — where the session endpoint actually lives, and how to
+ * call it without the failure mode below.
+ */
+/**
+ * Where `POST` mints the console session cookie.
+ *
+ * Note this derives from `apiBasePath`, NOT `basePath`: the auth controller is mounted with the
+ * console's JSON API, which `MediaDashboardModule` mounts separately from the SPA. Deriving it here
+ * rather than at the call site means a host cannot get that split wrong, and cannot be silently
+ * broken by the route moving under a version bump — the break would only show up as a runtime 404.
+ */
+export declare function mediaConsoleSessionUrl(apiBasePath?: string): string;
+/** Where the console SPA itself is served. */
+export declare function mediaConsoleUrl(basePath?: string): string;
+export interface OpenConsoleOptions {
+    /** Where the console SPA is mounted. MUST match `MediaDashboardModule.forRoot({ basePath })`. */
+    basePath?: string;
+    /**
+     * Where the console's JSON API — and with it the session endpoint — is mounted. MUST match
+     * `MediaDashboardModule.forRoot({ apiBasePath })`. Defaults to `${basePath}/api`, the same
+     * defaulting the module itself does, so a host that set neither can pass neither.
+     */
+    apiBasePath?: string;
+    /**
+     * Headers for the mint request — in practice your app's `Authorization` header. A function (sync
+     * or async) is accepted so a token can be read at call time rather than captured at wiring time,
+     * which is what a refreshing token needs.
+     */
+    headers?: HeadersInit | (() => HeadersInit | Promise<HeadersInit>);
+    /** Injected for tests and non-browser callers. Defaults to the global `fetch`. */
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+    /**
+     * Performs the navigation after a successful mint. Defaults to `location.assign`. Override to
+     * route through your own router, or to open in a new tab.
+     */
+    navigate?: (url: string) => void;
+}
+/** Thrown when the session could not be minted. Never thrown after a successful mint. */
+export declare class ConsoleSessionError extends Error {
+    readonly url: string;
+    /** The HTTP status, or `undefined` when the request never produced one (network error). */
+    readonly status?: number | undefined;
+    constructor(message: string, url: string, 
+    /** The HTTP status, or `undefined` when the request never produced one (network error). */
+    status?: number | undefined);
+}
+/**
+ * Mint the console session cookie. Resolves on success; throws {@link ConsoleSessionError} on
+ * refusal. Use this directly when you want to mint without navigating (a pre-flight check, or a
+ * link the user opens later).
+ */
+export declare function mintMediaConsoleSession(options?: OpenConsoleOptions): Promise<void>;
+/**
+ * Mint the session, then navigate to the console. Throws without navigating when the mint is
+ * refused, so a denied user gets a real error instead of landing on the console's
+ * "no session" page — which reads as a bug rather than a permission decision.
+ */
+export declare function openMediaConsole(options?: OpenConsoleOptions): Promise<void>;
+//# sourceMappingURL=console-session.d.ts.map

package/dist/client/console-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-session.d.ts","sourceRoot":"","sources":["../../src/client/console-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,GAAE,MAA8B,GAAG,MAAM,CAE1F;AAED,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,QAAQ,GAAE,MAA0B,GAAG,MAAM,CAE5E;AAED,MAAM,WAAW,kBAAkB;IACjC,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,kFAAkF;IAClF,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,yFAAyF;AACzF,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBAHxB,OAAO,EAAE,MAAM,EACN,GAAG,EAAE,MAAM;IACpB,2FAA2F;IAClF,MAAM,CAAC,EAAE,MAAM,YAAA;CAK3B;AAiBD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkD7F;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF"}

package/dist/client/console-session.js

@@ -0,0 +1,120 @@
+/**
+ * Headless client for opening the console from YOUR app.
+ *
+ * The console SPA is served at a literal path and knows nothing about your app's auth, so a plain
+ * browser navigation to it carries no identity. Mode A closes that gap: an XHR from inside your app
+ * — which DOES carry your auth — posts to the console's session endpoint, the `session` hook
+ * decides, and the library answers with its own signed cookie. The navigation that follows rides it.
+ *
+ * No UI here on purpose: you own the button, the page and the copy. This module owns the two things
+ * a host would otherwise have to rediscover — where the session endpoint actually lives, and how to
+ * call it without the failure mode below.
+ */
+/** The mount default; matches `DurableDashboardModule.forRoot()`'s own `basePath` default. */
+const DEFAULT_BASE_PATH = '/media';
+/** Matches `MediaDashboardModule`'s own `apiBasePath` default of `${basePath}/api`. */
+const DEFAULT_API_BASE_PATH = '/media/api';
+function normalizeBasePath(basePath) {
+    const trimmed = basePath.trim().replace(/\/+$/, '');
+    if (trimmed === '')
+        return '';
+    return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+}
+/**
+ * Where `POST` mints the console session cookie.
+ *
+ * Note this derives from `apiBasePath`, NOT `basePath`: the auth controller is mounted with the
+ * console's JSON API, which `MediaDashboardModule` mounts separately from the SPA. Deriving it here
+ * rather than at the call site means a host cannot get that split wrong, and cannot be silently
+ * broken by the route moving under a version bump — the break would only show up as a runtime 404.
+ */
+export function mediaConsoleSessionUrl(apiBasePath = DEFAULT_API_BASE_PATH) {
+    return `${normalizeBasePath(apiBasePath)}/session`;
+}
+/** Where the console SPA itself is served. */
+export function mediaConsoleUrl(basePath = DEFAULT_BASE_PATH) {
+    return normalizeBasePath(basePath) || '/';
+}
+/** Thrown when the session could not be minted. Never thrown after a successful mint. */
+export class ConsoleSessionError extends Error {
+    url;
+    status;
+    constructor(message, url, 
+    /** The HTTP status, or `undefined` when the request never produced one (network error). */
+    status) {
+        super(message);
+        this.url = url;
+        this.status = status;
+        this.name = 'ConsoleSessionError';
+    }
+}
+/**
+ * Mirror the module's own defaulting: an explicit `apiBasePath` wins, otherwise it hangs off
+ * `basePath`, so a host that only customised the SPA mount still hits the right session endpoint.
+ */
+function resolveApiBasePath(options) {
+    if (options.apiBasePath !== undefined)
+        return options.apiBasePath;
+    if (options.basePath !== undefined)
+        return `${normalizeBasePath(options.basePath)}/api`;
+    return DEFAULT_API_BASE_PATH;
+}
+async function resolveHeaders(headers) {
+    if (headers === undefined)
+        return {};
+    return typeof headers === 'function' ? await headers() : headers;
+}
+/**
+ * Mint the console session cookie. Resolves on success; throws {@link ConsoleSessionError} on
+ * refusal. Use this directly when you want to mint without navigating (a pre-flight check, or a
+ * link the user opens later).
+ */
+export async function mintMediaConsoleSession(options = {}) {
+    const url = mediaConsoleSessionUrl(resolveApiBasePath(options));
+    const doFetch = options.fetch ?? globalThis.fetch;
+    if (typeof doFetch !== 'function') {
+        throw new ConsoleSessionError('No `fetch` available; pass one via `options.fetch`.', url);
+    }
+    let response;
+    try {
+        response = await doFetch(url, {
+            method: 'POST',
+            // The whole point: the response's Set-Cookie must stick, and the cookie must ride the
+            // navigation that follows.
+            credentials: 'include',
+            headers: await resolveHeaders(options.headers),
+            // Load-bearing, and the reason this helper exists rather than three lines at the call site.
+            // `fetch` FOLLOWS redirects by default, so an app whose auth layer rewrites a 401 into a
+            // "go to /signin" redirect makes this request resolve 200 against the sign-in HTML —
+            // `response.ok` reads true, the caller navigates, and the user lands in a console with no
+            // session, which looks exactly like a permissions bug. Handling the redirect explicitly turns
+            // that into a clear error instead of a silent false success.
+            redirect: 'manual',
+            ...(options.signal ? { signal: options.signal } : {}),
+        });
+    }
+    catch (cause) {
+        throw new ConsoleSessionError(`Could not reach the console session endpoint at ${url}: ${String(cause)}`, url);
+    }
+    // `redirect: 'manual'` surfaces differently per runtime: browsers give an opaque response
+    // (`type: 'opaqueredirect'`, status 0), Node/undici gives the real 3xx. Both mean the same thing.
+    const redirected = response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400);
+    if (redirected) {
+        throw new ConsoleSessionError(`The console session endpoint at ${url} answered with a redirect instead of minting a session. Something in front of it — usually an auth middleware or exception filter that rewrites 401s into a sign-in redirect — is intercepting the response. Exempt this path from that rewrite so the real status reaches this caller.`, url, response.status || undefined);
+    }
+    if (!response.ok) {
+        throw new ConsoleSessionError(`The console refused to open (HTTP ${response.status}).`, url, response.status);
+    }
+}
+/**
+ * Mint the session, then navigate to the console. Throws without navigating when the mint is
+ * refused, so a denied user gets a real error instead of landing on the console's
+ * "no session" page — which reads as a bug rather than a permission decision.
+ */
+export async function openMediaConsole(options = {}) {
+    await mintMediaConsoleSession(options);
+    const target = mediaConsoleUrl(options.basePath);
+    const navigate = options.navigate ?? ((url) => globalThis.location?.assign(url));
+    navigate(target);
+}
+//# sourceMappingURL=console-session.js.map

package/dist/client/console-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-session.js","sourceRoot":"","sources":["../../src/client/console-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,uFAAuF;AACvF,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAAsB,qBAAqB;IAChF,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC;AACrD,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,eAAe,CAAC,WAAmB,iBAAiB;IAClE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;AAC5C,CAAC;AA2BD,yFAAyF;AACzF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAGjC;IAEA;IAJX,YACE,OAAe,EACN,GAAW;IACpB,2FAA2F;IAClF,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,QAAG,GAAH,GAAG,CAAQ;QAEX,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAA2B;IACrD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC;IAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxF,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAsC;IAClE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAA8B,EAAE;IAC5E,MAAM,GAAG,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,mBAAmB,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,sFAAsF;YACtF,2BAA2B;YAC3B,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;YAC9C,4FAA4F;YAC5F,yFAAyF;YACzF,qFAAqF;YACrF,0FAA0F;YAC1F,8FAA8F;YAC9F,6DAA6D;YAC7D,QAAQ,EAAE,QAAQ;YAClB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAC3B,mDAAmD,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1E,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,kGAAkG;IAClG,MAAM,UAAU,GACd,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC1F,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,GAAG,yRAAyR,EAC/T,GAAG,EACH,QAAQ,CAAC,MAAM,IAAI,SAAS,CAC7B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,QAAQ,CAAC,MAAM,IAAI,EACxD,GAAG,EACH,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAA8B,EAAE;IACrE,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnB,CAAC"}

package/dist/client/index.d.ts

@@ -1,3 +1,4 @@
+export { ConsoleSessionError, mediaConsoleSessionUrl, mediaConsoleUrl, mintMediaConsoleSession, openMediaConsole, type OpenConsoleOptions, } from './console-session.js';
 export * from './types.js';
 export { apiBase, mediaConsoleClient, type MediaConsoleClient } from './media-console-client.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/client/index.js

@@ -1,3 +1,6 @@
+// Headless console-launcher primitives (path derivation + mint-then-navigate). Re-exported here
+// because `./client` resolves to this file — see the package's `exports` map.
+export { ConsoleSessionError, mediaConsoleSessionUrl, mediaConsoleUrl, mintMediaConsoleSession, openMediaConsole, } from './console-session.js';
 export * from './types.js';
 export { apiBase, mediaConsoleClient } from './media-console-client.js';
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAA2B,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAE9B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAA2B,MAAM,2BAA2B,CAAC"}

package/dist/server/index.cjs

@@ -66,6 +66,9 @@ function resolveConsoleAuth(options) {
   if (modes.length === 0) {
     throw new Error("MediaDashboardModule: auth needs a `login` and/or `session` hook.");
   }
+  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
+    throw new Error("MediaDashboardModule: auth.unauthenticatedPage must be a function.");
+  }
   return {
     secret: options.secret,
     ttlMs: durationToMs(options.ttl),
@@ -78,6 +81,9 @@ function resolveConsoleAuth(options) {
     } : {},
     ...options.revalidate ? {
       revalidate: options.revalidate
+    } : {},
+    ...options.unauthenticatedPage ? {
+      unauthenticatedPage: options.unauthenticatedPage
     } : {}
   };
 }
@@ -224,6 +230,26 @@ function appendSetCookie(response, cookie) {
   ]);
 }
 __name(appendSetCookie, "appendSetCookie");
+function resolveEndableResponse(response) {
+  const isEndable = /* @__PURE__ */ __name((value) => isRawNodeResponse(value) && typeof value.end === "function", "isEndable");
+  if (isEndable(response)) return response;
+  if (isRecord2(response) && isEndable(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveEndableResponse, "resolveEndableResponse");
+function responseAlreadyWritten(response) {
+  return resolveEndableResponse(response)?.headersSent === true;
+}
+__name(responseAlreadyWritten, "responseAlreadyWritten");
+function sendHtml(response, status, html) {
+  const raw = resolveEndableResponse(response);
+  if (!raw) return;
+  raw.statusCode = status;
+  raw.setHeader("content-type", "text/html; charset=utf-8");
+  raw.setHeader("cache-control", "no-store, must-revalidate");
+  raw.end(html);
+}
+__name(sendHtml, "sendHtml");
 
 // src/server/auth/session-cookie.ts
 var import_node_crypto = require("crypto");
@@ -1483,8 +1509,14 @@ var MediaConsoleApiModule = class _MediaConsoleApiModule {
         // none — it's used as-is.
         ...(options.guards ?? []).filter(isGuardClass)
       ],
+      // MEDIA_CONSOLE_AUTH is exported (not just provided) because MediaDashboardUiController —
+      // hosted in MediaDashboardModule, which imports THIS module — reads it to decide whether to
+      // hand an unauthenticated navigation to the host's `unauthenticatedPage`. Exporting keeps the
+      // single `authProvider` instance shared; re-providing the same factory in both modules would
+      // run a `forRootAsync` host's `useAuth` twice.
       exports: [
-        MediaConsoleService
+        MediaConsoleService,
+        MEDIA_CONSOLE_AUTH
       ]
     };
   }
@@ -1529,27 +1561,77 @@ var CONTENT_TYPES = {
   ".woff2": "font/woff2",
   ".ico": "image/x-icon"
 };
-var MediaDashboardUiController = class {
+var MediaDashboardUiController = class _MediaDashboardUiController {
   static {
     __name(this, "MediaDashboardUiController");
   }
   basePath;
   apiBasePath;
+  auth;
   dir = spaDir();
-  constructor(basePath, apiBasePath) {
+  logger = new import_common7.Logger(_MediaDashboardUiController.name);
+  warned = false;
+  constructor(basePath, apiBasePath, auth = null) {
     this.basePath = basePath;
     this.apiBasePath = apiBasePath;
+    this.auth = auth;
   }
   // index.html references hash-named bundles, so it MUST NOT be cached (stale bundle = "stuck
-  // loading after a deploy"). The hashed assets below are immutable.
-  index() {
+  // loading after a deploy"). The hashed assets below are immutable. `sendHtml` sets both headers;
+  // they are no longer `@Header` decorators because this route is now non-passthrough (see below).
+  //
+  // Non-passthrough `@Res()` so a host's `auth.unauthenticatedPage` can OWN the response and serve
+  // its own page in place of the SPA. Without a hook this behaves exactly as before: the shell is
+  // served to everyone, and the SPA's own auth screen renders once its API calls come back 401.
+  async index(req, res) {
+    if (await this.serveUnauthenticatedPage(req, res)) return;
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
       throw new import_common7.NotFoundException("Console SPA is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__MEDIA_BASE__='${this.basePath}';window.__MEDIA_API__='${this.apiBasePath}';</script>`;
-    return html.includes("</head>") ? html.replace("</head>", `${inject}</head>`) : inject + html;
+    sendHtml(res, 200, html.includes("</head>") ? html.replace("</head>", `${inject}</head>`) : inject + html);
+  }
+  /**
+  * Hand the response to the host's `unauthenticatedPage` when this navigation has no valid session.
+  * Returns `true` when the host wrote a page (the caller must not also serve the SPA).
+  *
+  * Mode-A-only, deliberately: with `login` configured the SPA's own login form is the way in, so
+  * replacing the shell would lock a Mode B host out of its own console.
+  */
+  async serveUnauthenticatedPage(req, res) {
+    const auth = this.auth;
+    const hook = auth?.unauthenticatedPage;
+    if (!auth || !hook) return false;
+    if (auth.modes.includes("login")) return false;
+    if (this.hasValidSession(auth, req)) return false;
+    try {
+      await hook({
+        request: req,
+        response: res,
+        basePath: this.basePath
+      });
+      if (responseAlreadyWritten(res)) return true;
+      this.warnOnce("auth.unauthenticatedPage returned without writing a response; serving the console SPA instead. The hook must write AND end the response it is given.");
+    } catch (error) {
+      this.warnOnce(`auth.unauthenticatedPage threw; serving the console SPA instead. ${String(error)}`);
+      if (responseAlreadyWritten(res)) return true;
+    }
+    return false;
+  }
+  hasValidSession(auth, req) {
+    const cookieValue = parseCookieHeader(readCookieHeader(req))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return false;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    }) !== null;
+  }
+  /** Once per process, not once per request: a broken hook fires on every unauthenticated visit. */
+  warnOnce(message) {
+    if (this.warned) return;
+    this.warned = true;
+    this.logger.warn(message);
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
@@ -1567,11 +1649,14 @@ var MediaDashboardUiController = class {
 };
 _ts_decorate7([
   (0, import_common7.Get)(),
-  (0, import_common7.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common7.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_param6(0, (0, import_common7.Req)()),
+  _ts_param6(1, (0, import_common7.Res)()),
   _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", String)
+  _ts_metadata6("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata6("design:returntype", Promise)
 ], MediaDashboardUiController.prototype, "index", null);
 _ts_decorate7([
   (0, import_common7.Get)("assets/:file"),
@@ -1587,10 +1672,13 @@ MediaDashboardUiController = _ts_decorate7([
   (0, import_common7.Controller)(),
   _ts_param6(0, (0, import_common7.Inject)(MEDIA_DASHBOARD_BASE_PATH)),
   _ts_param6(1, (0, import_common7.Inject)(MEDIA_DASHBOARD_API_PATH)),
+  _ts_param6(2, (0, import_common7.Optional)()),
+  _ts_param6(2, (0, import_common7.Inject)(MEDIA_CONSOLE_AUTH)),
   _ts_metadata6("design:type", Function),
   _ts_metadata6("design:paramtypes", [
     String,
-    String
+    String,
+    Object
   ])
 ], MediaDashboardUiController);