@flusys/ng-auth 0.1.0-beta.3 → 1.0.0-rc

package/types/flusys-ng-auth.d.ts

@@ -1,13 +1,14 @@
-import { IMessageResponse, ApiResourceService, ISingleResponse, IUserProvider, IListResponse, IUserBasicInfo, ICompanyApiProvider, ICompanyBasicInfo, IUserPermissionProvider } from '@flusys/ng-shared';
+import { IMessageResponse, ApiResourceService, ISingleResponse, IUserProvider, IListResponse, IUserBasicInfo, ICompanyApiProvider, ICompanyBasicInfo, IUserPermissionProvider, IAuthStateProvider, IProfileRoleInfo, IProfileActionInfo, UploadFileFn } from '@flusys/ng-shared';
 import * as rxjs from 'rxjs';
 import { Observable } from 'rxjs';
 import * as _angular_core from '@angular/core';
-import { Signal, Provider, OnInit } from '@angular/core';
+import { Signal, Provider } from '@angular/core';
 import { HttpClient, HttpRequest, HttpHandlerFn, HttpEvent } from '@angular/common/http';
 import { CanActivateFn, Routes } from '@angular/router';
-import { ILayoutAuthState, ICompanyInfo as ICompanyInfo$1, IBranchInfo as IBranchInfo$1, IUserInfo as IUserInfo$1, ILayoutAuthApi } from '@flusys/ng-layout';
+import { ILayoutAuthApi, ICompanyInfo as ICompanyInfo$1, IBranchInfo as IBranchInfo$1, ILayoutAuthState, IUserInfo as IUserInfo$1 } from '@flusys/ng-layout';
 import * as _angular_forms_signals from '@angular/forms/signals';
 import * as _flusys_ng_auth from '@flusys/ng-auth';
+import * as _flusys_ng_core from '@flusys/ng-core';
 
 /**
  * Login Request Interface
@@ -62,6 +63,7 @@ interface IUserInfo {
     id: string;
     email: string;
     name?: string;
+    phone?: string | null;
     profilePictureId?: string | null;
     companyId?: string;
     branchId?: string;
@@ -134,12 +136,13 @@ interface IMeResponse {
  * Returned on successful registration
  */
 interface IRegistrationResponse {
-    accessToken: string;
-    refreshToken: string;
+    accessToken?: string;
+    refreshToken?: string;
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
     companyFeatureEnabled?: boolean;
+    requiresEmailVerification?: boolean;
 }
 /**
  * Company Selection Response Interface
@@ -160,9 +163,21 @@ interface IRefreshTokenResponse {
     refreshToken?: string;
 }
 /**
- * Auth Response Type - Can be login success or company selection required
+ * Login Response when email verification required
+ */
+interface ILoginRequiresEmailVerification {
+    requiresEmailVerification: true;
+    email: string;
+    message: string;
+}
+/**
+ * Auth Response Type - Can be login success, company selection, or email verification required
  */
-type AuthResponse = ILoginResponse | ICompanySelectionResponse;
+type AuthResponse = ILoginResponse | ICompanySelectionResponse | ILoginRequiresEmailVerification;
+/**
+ * Type guard to check if response requires email verification
+ */
+declare function isEmailVerificationRequired(response: AuthResponse): response is ILoginRequiresEmailVerification;
 /**
  * Type guard to check if response requires company selection
  */
@@ -445,6 +460,16 @@ declare class AuthApiService {
      * Reset password with token
      */
     resetPassword(token: string, newPassword: string): Observable<IMessageResponse>;
+    /**
+     * Resend verification email (unauthenticated)
+     */
+    resendVerification(email: string): Observable<IMessageResponse>;
+    /**
+     * Verify email with token
+     * Returns IMessageResponse for existing user verification
+     * Returns IRegistrationResponse for pending registration completion
+     */
+    verifyEmail(token: string): Observable<IMessageResponse | IRegistrationResponse>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthApiService>;
 }
@@ -494,29 +519,58 @@ declare class AuthInitService {
 declare class AuthStateService {
     private readonly appConfig;
     private readonly router;
-    readonly user: _angular_core.WritableSignal<IUserInfo | null>;
-    readonly accessToken: _angular_core.WritableSignal<string>;
-    readonly company: _angular_core.WritableSignal<ICompanyInfo | null>;
-    readonly branch: _angular_core.WritableSignal<IBranchInfo | null>;
-    readonly selectionSessionId: _angular_core.WritableSignal<string | null>;
-    readonly availableCompanies: _angular_core.WritableSignal<ICompanyWithBranches[]>;
-    readonly selectionExpiresAt: _angular_core.WritableSignal<Date | null>;
+    private readonly _user;
+    private readonly _accessToken;
+    private readonly _tokenExpiresAt;
+    private readonly _company;
+    private readonly _branch;
+    readonly user: _angular_core.Signal<IUserInfo | null>;
+    readonly accessToken: _angular_core.Signal<string>;
+    readonly tokenExpiresAt: _angular_core.Signal<number | null>;
+    readonly company: _angular_core.Signal<ICompanyInfo | null>;
+    readonly branch: _angular_core.Signal<IBranchInfo | null>;
+    private readonly _selectionSessionId;
+    private readonly _availableCompanies;
+    private readonly _selectionExpiresAt;
+    readonly selectionSessionId: _angular_core.Signal<string | null>;
+    readonly availableCompanies: _angular_core.Signal<ICompanyWithBranches[]>;
+    readonly selectionExpiresAt: _angular_core.Signal<Date | null>;
     readonly isAuthenticated: _angular_core.Signal<boolean>;
     readonly requiresCompanySelection: _angular_core.Signal<boolean>;
     readonly userName: _angular_core.Signal<string>;
     readonly companyName: _angular_core.Signal<string>;
     readonly branchName: _angular_core.Signal<string>;
+    /**
+     * Check if token is expired or will expire soon (within 30 seconds).
+     * Used to proactively refresh token before requests fail.
+     */
+    readonly isTokenExpired: _angular_core.Signal<boolean>;
+    /**
+     * Check if we need to refresh on app load (token expired but refresh cookie may exist)
+     */
+    readonly needsRefreshOnLoad: _angular_core.Signal<boolean>;
     readonly tenantId: _angular_core.Signal<string | null>;
     constructor();
     setLoginState(response: ILoginResponse): void;
     setSelectionState(response: ICompanySelectionResponse): void;
     clearSelectionState(): void;
     resetState(): void;
+    setUser(user: IUserInfo | null): void;
+    setAccessToken(token: string): void;
+    setCompany(company: ICompanyInfo | null): void;
+    setBranch(branch: IBranchInfo | null): void;
     navigateToLogin(returnUrl?: string): void;
     navigateAfterLogin(returnUrl?: string): void;
+    /** Validates a return URL to prevent open redirect attacks */
+    private isValidReturnUrl;
     getStoredCompanyId(): string | null;
     getStoredBranchId(): string | null;
     private loadFromStorage;
+    /**
+     * Decode JWT expiry without verification (client-side only).
+     * Returns expiry timestamp in milliseconds.
+     */
+    private decodeTokenExpiry;
     private store;
     private get;
     private remove;
@@ -602,12 +656,18 @@ declare class CompanyApiService extends ApiResourceService<ICreateCompanyRequest
  * Manages token refresh state in a request-safe manner for SSR environments.
  * Replaces module-level state that would be shared across requests in SSR.
  *
+ * NOTE: Uses BehaviorSubject intentionally for RxJS interoperability.
+ * The HTTP interceptor needs to queue concurrent requests and have them
+ * wait for the new token via Observable subscription. This is a valid
+ * pattern that signals cannot replicate directly (no multi-subscriber
+ * async coordination). Signal is used for the boolean flag only.
+ *
  * @example
  * ```typescript
  * const refreshState = inject(TokenRefreshStateService);
  *
  * if (refreshState.isRefreshing()) {
- *   // Queue request
+ *   // Queue request via refreshTokenSubject$
  * } else {
  *   refreshState.startRefresh();
  *   // Perform refresh
@@ -688,11 +748,11 @@ declare class UserApiService extends ApiResourceService<ICreateUserRequest | IUp
  * Handles user-company and user-branch permission assignments.
  * Uses batch operations for efficient permission management.
  *
- * Backend Endpoints:
+ * Backend Endpoints (POST-only RPC):
  * - POST /administration/permissions/user-company/assign - Batch assign/revoke company permissions
- * - GET /administration/permissions/user-company?userId=xxx - Get user's companies
+ * - POST /administration/permissions/get-user-company - Get user's companies
  * - POST /administration/permissions/user-branch/assign - Batch assign/revoke branch permissions
- * - GET /administration/permissions/user-branch?userId=xxx - Get user's branches
+ * - POST /administration/permissions/get-user-branch - Get user's branches
  */
 declare class UserPermissionApiService {
     private readonly appConfig;
@@ -848,34 +908,28 @@ declare const guestGuard: CanActivateFn;
 declare const companyFeatureGuard: CanActivateFn;
 
 /**
- * Auth Interceptor
- * Adds Authorization header and tenant header to HTTP requests.
- *
- * - Adds Bearer token for authenticated requests (including /auth/me)
- * - Adds tenant header for multi-tenant mode
- * - Adds withCredentials for auth endpoints (cookies)
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * provideHttpClient(
- *   withFetch(),
- *   withInterceptors([authInterceptor, tokenRefreshInterceptor])
- * )
- * ```
+ * Auth Interceptor - Adds auth headers and cookie credentials to requests
  */
 declare function authInterceptor(req: HttpRequest<unknown>, next: HttpHandlerFn): Observable<HttpEvent<unknown>>;
 
 /**
  * Token Refresh Interceptor
- * Handles 401 errors by refreshing the access token.
+ * Handles token refresh both proactively and reactively.
+ *
+ * PROACTIVE REFRESH:
+ * - Checks token expiry BEFORE making requests
+ * - Refreshes token if expired or expiring soon (within 30 seconds)
+ * - Prevents unnecessary 401 failures
  *
- * - Intercepts 401 Unauthorized responses
- * - Calls refresh token endpoint
- * - Retries failed request with new token
+ * REACTIVE REFRESH:
+ * - Still handles 401 errors as fallback
  * - Queues concurrent requests during refresh
  * - Redirects to login on refresh failure
- * - SSR-safe: Uses injectable service instead of module-level state
+ *
+ * SECURITY:
+ * - Token kept in memory only (not localStorage)
+ * - Uses HTTP-only refresh token cookie
+ * - SSR-safe: Uses injectable service
  *
  * @example
  * ```typescript
@@ -901,6 +955,11 @@ declare const AUTH_ROUTES: Routes;
  * Uses tabbed interface - all under /administration with child routes
  */
 declare const ADMINISTRATION_ROUTES: Routes;
+/**
+ * Profile Routes Configuration
+ * Protected route for user profile management
+ */
+declare const PROFILE_ROUTES: Routes;
 
 /**
  * Auth Layout State Adapter
@@ -992,6 +1051,7 @@ declare class AuthUserProviderAdapter implements IUserProvider {
         search?: string;
         companyId?: string;
         branchId?: string;
+        isActive?: boolean;
         [key: string]: any;
     }): Observable<IListResponse<IUserBasicInfo>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthUserProviderAdapter, never>;
@@ -1040,6 +1100,39 @@ declare class AuthUserPermissionProviderAdapter implements IUserPermissionProvid
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthUserPermissionProviderAdapter>;
 }
 
+/**
+ * Auth State Provider Adapter
+ *
+ * Implements IAuthStateProvider interface from ng-shared using auth services from ng-auth.
+ * This allows feature packages (form-builder, etc.) to check auth state without
+ * depending on ng-auth directly.
+ *
+ * @example
+ * // In app.config.ts
+ * providers: [
+ *   { provide: AUTH_STATE_PROVIDER, useClass: AuthStateProviderAdapter }
+ * ]
+ *
+ * // In form-builder component
+ * private readonly authStateProvider = inject(AUTH_STATE_PROVIDER);
+ * const isLoggedIn = this.authStateProvider.isAuthenticated();
+ */
+declare class AuthStateProviderAdapter implements IAuthStateProvider {
+    private readonly authState;
+    private readonly authInit;
+    /**
+     * Signal indicating if user is currently authenticated
+     */
+    get isAuthenticated(): Signal<boolean>;
+    /**
+     * Initialize auth state (restore session from cookies/storage)
+     * Returns Observable<void> that completes when initialization is done
+     */
+    initialize(): Observable<void>;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthStateProviderAdapter, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthStateProviderAdapter>;
+}
+
 /**
  * Provides auth layout integration for ng-layout.
  * Call this in your app.config.ts to integrate ng-auth with ng-layout.
@@ -1100,6 +1193,10 @@ declare const AUTH_ENDPOINTS: {
     readonly REGISTER: "/auth/register";
     readonly SELECT: "/auth/select";
     readonly SWITCH_COMPANY: "/auth/switch-company";
+    readonly VERIFY_EMAIL: "/auth/verify-email";
+    readonly FORGOT_PASSWORD: "/auth/forgot-password";
+    readonly RESET_PASSWORD: "/auth/reset-password";
+    readonly RESEND_VERIFICATION: "/auth/resend-verification";
 };
 /**
  * Check if a URL is an auth-related endpoint
@@ -1153,13 +1250,15 @@ interface IBranchFormModel {
  * Handles creating and editing branches.
  * Defaults to current company context.
  */
-declare class BranchFormComponent implements OnInit {
+declare class BranchFormComponent {
     private readonly router;
     private readonly route;
     private readonly messageService;
     private readonly branchService;
     private readonly companyService;
     private readonly authState;
+    private readonly routeParams;
+    private readonly queryParams;
     /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     /** Existing branch data when editing */
@@ -1174,7 +1273,7 @@ declare class BranchFormComponent implements OnInit {
     readonly branchForm: _angular_forms_signals.FieldTree<IBranchFormModel, string | number>;
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     loadBranch(id: string): Promise<void>;
     generateSlug(): void;
     onSubmit(): Promise<void>;
@@ -1188,7 +1287,13 @@ declare class BranchFormComponent implements OnInit {
  * Displays a list of branches for a company with CRUD operations.
  * Defaults to current company context.
  */
-declare class BranchListComponent implements OnInit {
+declare class BranchListComponent {
+    readonly BRANCH_PERMISSIONS: {
+        readonly CREATE: "branch.create";
+        readonly READ: "branch.read";
+        readonly UPDATE: "branch.update";
+        readonly DELETE: "branch.delete";
+    };
     private readonly router;
     private readonly route;
     private readonly messageService;
@@ -1196,8 +1301,10 @@ declare class BranchListComponent implements OnInit {
     private readonly branchService;
     private readonly companyService;
     private readonly authState;
-    /** Selected company ID */
-    selectedCompanyId: string | null;
+    private readonly queryParamMap;
+    private initialized;
+    /** Selected company ID (signal for zoneless change detection) */
+    readonly selectedCompanyId: _angular_core.WritableSignal<string | null>;
     /** Companies list for dropdown */
     readonly companies: _angular_core.Signal<_flusys_ng_auth.ICompany[]>;
     /** Branches from service */
@@ -1206,7 +1313,7 @@ declare class BranchListComponent implements OnInit {
     readonly isLoading: _angular_core.Signal<boolean>;
     /** Total count from service */
     readonly total: _angular_core.Signal<number>;
-    ngOnInit(): void;
+    constructor();
     loadBranches(): void;
     onCompanyChange(): void;
     onLazyLoad(event: {
@@ -1234,11 +1341,12 @@ interface ICompanyFormModel$1 {
  * Company Form Component
  * Handles creating and editing companies.
  */
-declare class CompanyFormComponent implements OnInit {
+declare class CompanyFormComponent {
     private readonly router;
     private readonly route;
     private readonly messageService;
     private readonly companyService;
+    private readonly routeParams;
     /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     /** Existing company data when editing */
@@ -1251,7 +1359,7 @@ declare class CompanyFormComponent implements OnInit {
     readonly companyForm: _angular_forms_signals.FieldTree<ICompanyFormModel$1, string | number>;
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     loadCompany(id: string): Promise<void>;
     generateSlug(): void;
     onSubmit(): Promise<void>;
@@ -1265,7 +1373,19 @@ declare class CompanyFormComponent implements OnInit {
  * Displays a list of companies with CRUD operations.
  * Only visible when company feature is enabled.
  */
-declare class CompanyListComponent implements OnInit {
+declare class CompanyListComponent {
+    readonly COMPANY_PERMISSIONS: {
+        readonly CREATE: "company.create";
+        readonly READ: "company.read";
+        readonly UPDATE: "company.update";
+        readonly DELETE: "company.delete";
+    };
+    readonly BRANCH_PERMISSIONS: {
+        readonly CREATE: "branch.create";
+        readonly READ: "branch.read";
+        readonly UPDATE: "branch.update";
+        readonly DELETE: "branch.delete";
+    };
     private readonly router;
     private readonly messageService;
     private readonly confirmationService;
@@ -1276,7 +1396,6 @@ declare class CompanyListComponent implements OnInit {
     readonly isLoading: _angular_core.Signal<boolean>;
     /** Total count from service */
     readonly total: _angular_core.Signal<number>;
-    ngOnInit(): void;
     loadCompanies(): void;
     onLazyLoad(event: {
         first?: number | null;
@@ -1290,6 +1409,25 @@ declare class CompanyListComponent implements OnInit {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<CompanyListComponent, "lib-company-list", never, {}, {}, never, never, true, never>;
 }
 
+interface IForgotPasswordFormModel {
+    email: string;
+}
+declare class ForgotPasswordPageComponent {
+    private readonly destroyRef;
+    private readonly messageService;
+    private readonly authApi;
+    readonly isLoading: _angular_core.WritableSignal<boolean>;
+    readonly emailSent: _angular_core.WritableSignal<boolean>;
+    readonly submittedEmail: _angular_core.WritableSignal<string>;
+    readonly formModel: _angular_core.WritableSignal<IForgotPasswordFormModel>;
+    readonly forgotForm: _angular_forms_signals.FieldTree<IForgotPasswordFormModel, string | number>;
+    readonly isFormValid: _angular_core.Signal<boolean>;
+    onSubmit(): void;
+    resetForm(): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ForgotPasswordPageComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ForgotPasswordPageComponent, "lib-forgot-password-page", never, {}, {}, never, never, true, never>;
+}
+
 /** Login form model interface */
 interface ILoginFormModel {
     email: string;
@@ -1302,25 +1440,23 @@ interface ISelectionFormModel {
     branchId: string;
     rememberSelection: boolean;
 }
-type LoginStep = 'credentials' | 'company-selection';
+type LoginStep = 'credentials' | 'company-selection' | 'email-verification';
 /**
  * Login Page Component
  * Multi-step authentication flow:
  * - Step 1: Email/Password credentials
  * - Step 2: Company/Branch selection (when company feature enabled and user has multiple)
  */
-declare class LoginPageComponent implements OnInit {
+declare class LoginPageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
     private readonly authApi;
     private readonly authState;
-    /** Return URL after successful login */
     readonly returnUrl: _angular_core.InputSignal<string>;
-    /** Current step in login flow */
     readonly currentStep: _angular_core.WritableSignal<LoginStep>;
-    /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
+    readonly unverifiedEmail: _angular_core.WritableSignal<string>;
     /** Login form model */
     readonly loginFormModel: _angular_core.WritableSignal<ILoginFormModel>;
     /** Login form with validation schema */
@@ -1343,18 +1479,105 @@ declare class LoginPageComponent implements OnInit {
     readonly userName: _angular_core.WritableSignal<string>;
     /** Branches for selected company */
     readonly branches: _angular_core.Signal<IBranchSelectionInfo[]>;
-    ngOnInit(): void;
+    constructor();
+    /**
+     * Restores pending company selection state from auth service.
+     * Called when user refreshes page during Step 2 of login flow.
+     */
+    private restorePendingSelectionState;
     onSubmit(): void;
     /** Handle company selection change */
     onCompanyChange(): void;
     onSelectCompany(): void;
     goBackToCredentials(): void;
+    onResendVerification(): void;
     private autoSelectIfSingle;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<LoginPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<LoginPageComponent, "lib-login-page", never, { "returnUrl": { "alias": "returnUrl"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
 }
 
-/** User registration form model */
+/** Profile form model */
+interface IProfileFormModel {
+    name: string;
+    phone: string;
+}
+/** Password form model */
+interface IPasswordFormModel {
+    currentPassword: string;
+    newPassword: string;
+    confirmPassword: string;
+}
+/**
+ * Profile Page Component
+ *
+ * Allows users to view and update their profile information.
+ * Features:
+ * - Update name, phone, profile picture (if storage enabled)
+ * - View company/branch info (read-only, if company feature enabled)
+ * - View roles/actions (read-only, if IAM enabled via optional injection)
+ *
+ * Package Independence:
+ * - Uses PROFILE_UPLOAD_PROVIDER (optional) for storage functionality
+ * - Uses PROFILE_PERMISSION_PROVIDER (optional) for IAM functionality
+ * - No direct imports from ng-storage or ng-iam
+ */
+declare class ProfilePageComponent {
+    private readonly destroyRef;
+    private readonly appConfig;
+    private readonly messageService;
+    private readonly authState;
+    private readonly userService;
+    private readonly authApiService;
+    private readonly fileUrlService;
+    private readonly uploadProvider;
+    private readonly permissionProvider;
+    readonly isLoading: _angular_core.WritableSignal<boolean>;
+    readonly isLoadingPermissions: _angular_core.WritableSignal<boolean>;
+    private readonly _profilePictureUrl;
+    readonly profilePictureUrl: _angular_core.Signal<string | null>;
+    private readonly _userRoles;
+    readonly userRoles: _angular_core.Signal<IProfileRoleInfo[]>;
+    private readonly _userActions;
+    readonly userActions: _angular_core.Signal<IProfileActionInfo[]>;
+    readonly userEmail: _angular_core.Signal<string>;
+    readonly userName: _angular_core.Signal<string>;
+    readonly userInitials: _angular_core.Signal<string>;
+    readonly companyName: _angular_core.Signal<string>;
+    readonly branchName: _angular_core.Signal<string>;
+    readonly showUploadSection: _angular_core.Signal<boolean>;
+    readonly showCompanySection: _angular_core.Signal<boolean>;
+    readonly showPermissionsSection: _angular_core.Signal<boolean>;
+    readonly permissionMode: _angular_core.Signal<_flusys_ng_core.PermissionMode>;
+    readonly showRoles: _angular_core.Signal<boolean>;
+    readonly showActions: _angular_core.Signal<boolean>;
+    readonly showBottomRow: _angular_core.Signal<boolean>;
+    readonly formModel: _angular_core.WritableSignal<IProfileFormModel>;
+    readonly formTree: _angular_forms_signals.FieldTree<IProfileFormModel, string | number>;
+    readonly isFormValid: _angular_core.Signal<boolean>;
+    readonly passwordModel: _angular_core.WritableSignal<IPasswordFormModel>;
+    readonly isPasswordLoading: _angular_core.WritableSignal<boolean>;
+    readonly isPasswordFormValid: _angular_core.Signal<boolean>;
+    readonly passwordsMatch: _angular_core.Signal<boolean>;
+    readonly uploadFileFn: UploadFileFn;
+    /** Map upload result to IUploadedFile format */
+    private mapUploadResultToUploadedFile;
+    constructor();
+    private loadUserData;
+    private loadPermissions;
+    onProfilePictureUploaded(file: {
+        id?: string;
+        name: string;
+        key: string;
+        size: number;
+        contentType: string;
+    }): void;
+    onSubmit(): void;
+    updatePasswordField(field: keyof IPasswordFormModel, value: string): void;
+    onChangePassword(): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ProfilePageComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ProfilePageComponent, "lib-profile-page", never, {}, {}, never, never, true, never>;
+}
+
 interface IUserFormModel$1 {
     name: string;
     email: string;
@@ -1362,7 +1585,6 @@ interface IUserFormModel$1 {
     confirmPassword: string;
     phone: string;
 }
-/** Company form model */
 interface ICompanyFormModel {
     createNewCompany: boolean;
     companySlug: string;
@@ -1371,43 +1593,57 @@ interface ICompanyFormModel {
     newCompanyPhone: string;
     newCompanyAddress: string;
 }
-/**
- * Registration Page Component
- * Handles user registration with optional company creation
- * Adapts UI based on company feature configuration
- */
-declare class RegisterPageComponent implements OnInit {
+declare class RegisterPageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
     private readonly authApi;
     private readonly authState;
     private readonly route;
-    /** Return URL after successful registration */
+    private readonly router;
+    private readonly queryParamMap;
+    private companySlugInitialized;
     readonly returnUrl: _angular_core.InputSignal<string>;
-    /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Whether company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** User form model */
     readonly userFormModel: _angular_core.WritableSignal<IUserFormModel$1>;
-    /** User form with validation schema */
     readonly userForm: _angular_forms_signals.FieldTree<IUserFormModel$1, string | number>;
-    /** Company form model */
     readonly companyFormModel: _angular_core.WritableSignal<ICompanyFormModel>;
-    /** Company form with conditional validation schema */
     readonly companyForm: _angular_forms_signals.FieldTree<ICompanyFormModel, string | number>;
-    ngOnInit(): void;
-    /** Check if passwords match */
     readonly passwordsMatch: _angular_core.Signal<boolean>;
-    /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
+    constructor();
     onCreateCompanyToggle(): void;
     onSubmit(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<RegisterPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<RegisterPageComponent, "lib-register-page", never, { "returnUrl": { "alias": "returnUrl"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
 }
 
+interface IResetPasswordFormModel {
+    newPassword: string;
+    confirmPassword: string;
+}
+type PageState$1 = 'form' | 'success' | 'invalid-token';
+declare class ResetPasswordPageComponent {
+    private readonly destroyRef;
+    private readonly route;
+    private readonly messageService;
+    private readonly authApi;
+    private readonly queryParams;
+    private tokenInitialized;
+    private token;
+    readonly isLoading: _angular_core.WritableSignal<boolean>;
+    readonly pageState: _angular_core.WritableSignal<PageState$1>;
+    readonly formModel: _angular_core.WritableSignal<IResetPasswordFormModel>;
+    readonly resetForm: _angular_forms_signals.FieldTree<IResetPasswordFormModel, string | number>;
+    readonly passwordMismatch: _angular_core.Signal<boolean>;
+    readonly canSubmit: _angular_core.Signal<boolean>;
+    constructor();
+    onSubmit(): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<ResetPasswordPageComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<ResetPasswordPageComponent, "lib-reset-password-page", never, {}, {}, never, never, true, never>;
+}
+
 /** User form model interface */
 interface IUserFormModel {
     name: string;
@@ -1422,7 +1658,7 @@ interface IUserFormModel {
  * Handles creating and editing users.
  * When company feature is enabled, automatically assigns new users to current company/branch.
  */
-declare class UserFormComponent implements OnInit {
+declare class UserFormComponent {
     private readonly destroyRef;
     private readonly router;
     private readonly route;
@@ -1431,6 +1667,8 @@ declare class UserFormComponent implements OnInit {
     private readonly userService;
     private readonly permissionService;
     private readonly authState;
+    private readonly routeParams;
+    private userLoadTriggered;
     /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     /** Existing user data when editing */
@@ -1449,7 +1687,7 @@ declare class UserFormComponent implements OnInit {
     readonly formTree: _angular_forms_signals.FieldTree<IUserFormModel, string | number>;
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     loadUser(id: string): void;
     onSubmit(): void;
     /**
@@ -1465,7 +1703,13 @@ declare class UserFormComponent implements OnInit {
  * User List Component
  * Displays a list of users with CRUD operations.
  */
-declare class UserListComponent implements OnInit {
+declare class UserListComponent {
+    readonly USER_PERMISSIONS: {
+        readonly CREATE: "user.create";
+        readonly READ: "user.read";
+        readonly UPDATE: "user.update";
+        readonly DELETE: "user.delete";
+    };
     private readonly router;
     private readonly appConfig;
     private readonly messageService;
@@ -1484,7 +1728,6 @@ declare class UserListComponent implements OnInit {
     readonly showBranchDialog: _angular_core.WritableSignal<boolean>;
     /** Selected user for permission management */
     readonly selectedUser: _angular_core.WritableSignal<IUser | null>;
-    ngOnInit(): void;
     loadUsers(): void;
     onLazyLoad(event: {
         first?: number | null;
@@ -1499,6 +1742,36 @@ declare class UserListComponent implements OnInit {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserListComponent, "lib-user-list", never, {}, {}, never, never, true, never>;
 }
 
+interface IResendFormModel {
+    email: string;
+}
+type PageState = 'verifying' | 'success' | 'invalid-token' | 'resend';
+declare class VerifyEmailPageComponent {
+    private readonly platformId;
+    private readonly transferState;
+    private readonly destroyRef;
+    private readonly route;
+    private readonly messageService;
+    private readonly authApi;
+    private readonly queryParams;
+    private verificationTriggered;
+    readonly isLoading: _angular_core.WritableSignal<boolean>;
+    readonly pageState: _angular_core.WritableSignal<PageState>;
+    readonly resendSuccess: _angular_core.WritableSignal<boolean>;
+    readonly submittedEmail: _angular_core.WritableSignal<string>;
+    readonly resendFormModel: _angular_core.WritableSignal<IResendFormModel>;
+    readonly resendForm: _angular_forms_signals.FieldTree<IResendFormModel, string | number>;
+    readonly isResendFormValid: _angular_core.Signal<boolean>;
+    constructor();
+    private verifyEmail;
+    private handleVerificationResult;
+    showResendForm(): void;
+    onResend(): void;
+    private handleResendComplete;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<VerifyEmailPageComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<VerifyEmailPageComponent, "lib-verify-email-page", never, {}, {}, never, never, true, never>;
+}
+
 /**
  * User Branch Permission Dialog
  *
@@ -1594,5 +1867,5 @@ interface CompanyWithAssignment extends ICompany {
     isAssigned: boolean;
 }
 
-export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, LoginPageComponent, RegisterPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isAuthEndpoint, isCompanySelectionResponse, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
-export type { AuthResponse, IAssignUserBranchRequest, IAssignUserCompanyRequest, IBatchOperationResponse, IBranch, IBranchInfo, IBranchSelectionInfo, IChangePasswordRequest, ICompany, ICompanyInfo, ICompanySelectionResponse, ICompanyWithBranches, ICreateBranchRequest, ICreateCompanyRequest, ICreateUserRequest, ILoginRequest, ILoginResponse, IMeResponse, IPermissionItem, IRefreshTokenResponse, IRegistrationRequest, IRegistrationResponse, ISelectRequest, ISwitchCompanyRequest, IUpdateBranchRequest, IUpdateCompanyRequest, IUpdateUserRequest, IUser, IUserBranchPermission, IUserBranchesResponse, IUserCompaniesResponse, IUserCompanyPermission, IUserInfo };
+export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateProviderAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isAuthEndpoint, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
+export type { AuthResponse, IAssignUserBranchRequest, IAssignUserCompanyRequest, IBatchOperationResponse, IBranch, IBranchInfo, IBranchSelectionInfo, IChangePasswordRequest, ICompany, ICompanyInfo, ICompanySelectionResponse, ICompanyWithBranches, ICreateBranchRequest, ICreateCompanyRequest, ICreateUserRequest, ILoginRequest, ILoginRequiresEmailVerification, ILoginResponse, IMeResponse, IPermissionItem, IRefreshTokenResponse, IRegistrationRequest, IRegistrationResponse, ISelectRequest, ISwitchCompanyRequest, IUpdateBranchRequest, IUpdateCompanyRequest, IUpdateUserRequest, IUser, IUserBranchPermission, IUserBranchesResponse, IUserCompaniesResponse, IUserCompanyPermission, IUserInfo };