@flusys/ng-auth 1.0.0-rc → 1.0.0

package/fesm2022/flusys-ng-auth.mjs

@@ -1,12 +1,12 @@
 import * as i1 from '@angular/common/http';
 import { HttpClient } from '@angular/common/http';
 import * as i0 from '@angular/core';
-import { inject, Injectable, signal, computed, effect, PLATFORM_ID, ChangeDetectionStrategy, Component, DestroyRef, input, output, makeStateKey, TransferState } from '@angular/core';
+import { inject, Injectable, signal, computed, effect, PLATFORM_ID, ChangeDetectionStrategy, Component, untracked, DestroyRef, input, output, makeStateKey, TransferState } from '@angular/core';
 import { APP_CONFIG, getServiceUrl, isCompanyFeatureEnabled, isFeatureEnabled, getPermissionMode } from '@flusys/ng-core';
 import * as i2$1 from '@angular/router';
 import { Router, RouterOutlet, RouterLink, RouterLinkActive, ActivatedRoute } from '@angular/router';
 import { of, timeout, switchMap, map, tap, catchError, shareReplay, finalize, BehaviorSubject, throwError, filter, take, firstValueFrom } from 'rxjs';
-import { ApiResourceService, CookieService, USER_PROVIDER, COMPANY_API_PROVIDER, USER_PERMISSION_PROVIDER, AUTH_STATE_PROVIDER, AngularModule, PrimeModule, BRANCH_PERMISSIONS, HasPermissionDirective, COMPANY_PERMISSIONS, FileUrlService, PROFILE_UPLOAD_PROVIDER, PROFILE_PERMISSION_PROVIDER, FileUploaderComponent, USER_PERMISSIONS } from '@flusys/ng-shared';
+import { PlatformService, ApiResourceService, CookieService, permissionGuard, USER_PERMISSIONS, COMPANY_PERMISSIONS, BRANCH_PERMISSIONS, USER_PROVIDER, COMPANY_API_PROVIDER, USER_PERMISSION_PROVIDER, AUTH_STATE_PROVIDER, PermissionValidatorService, AngularModule, PrimeModule, HasPermissionDirective, FileUrlService, PROFILE_UPLOAD_PROVIDER, PROFILE_PERMISSION_PROVIDER, FileUploaderComponent } from '@flusys/ng-shared';
 import { map as map$1, catchError as catchError$1, tap as tap$1 } from 'rxjs/operators';
 import { isPlatformBrowser, CommonModule } from '@angular/common';
 import { MessageService, ConfirmationService } from 'primeng/api';
@@ -31,42 +31,16 @@ import * as i5$2 from 'primeng/progressspinner';
 import { ProgressSpinnerModule } from 'primeng/progressspinner';
 import * as i3$2 from 'primeng/checkbox';
 
-// AUTH INTERFACES - Matching NestJS Auth Package DTOs
-/**
- * Type guard to check if response requires email verification
- */
 function isEmailVerificationRequired(response) {
     return 'requiresEmailVerification' in response && response.requiresEmailVerification === true;
 }
-/**
- * Type guard to check if response requires company selection
- */
 function isCompanySelectionResponse(response) {
     return 'requiresSelection' in response && response.requiresSelection === true;
 }
-/**
- * Type guard to check if response is a successful login
- */
 function isLoginResponse(response) {
     return 'accessToken' in response && !('requiresSelection' in response) && !('requiresEmailVerification' in response);
 }
 
-// =============================================================================
-// BRANCH INTERFACES - Matching NestJS Auth Package DTOs
-// =============================================================================
-
-// =============================================================================
-// COMPANY INTERFACES - Matching NestJS Auth Package DTOs
-// =============================================================================
-
-// =============================================================================
-// USER PERMISSION INTERFACES - Matching NestJS Auth Package DTOs
-// =============================================================================
-
-// =============================================================================
-// USER INTERFACES - Matching NestJS Auth Package DTOs
-// =============================================================================
-
 /**
  * Auth API Service
  * Handles all authentication-related API calls matching NestJS auth endpoints
@@ -196,6 +170,7 @@ class AuthStateService {
     // DI Injection
     appConfig = inject(APP_CONFIG);
     router = inject(Router);
+    platform = inject(PlatformService);
     // Core State (private writable, public readonly)
     _user = signal(null, ...(ngDevMode ? [{ debugName: "_user" }] : []));
     _accessToken = signal('', ...(ngDevMode ? [{ debugName: "_accessToken" }] : [])); // Memory-only, not persisted
@@ -213,7 +188,6 @@ class AuthStateService {
     _selectionExpiresAt = signal(null, ...(ngDevMode ? [{ debugName: "_selectionExpiresAt" }] : []));
     selectionSessionId = this._selectionSessionId.asReadonly();
     availableCompanies = this._availableCompanies.asReadonly();
-    selectionExpiresAt = this._selectionExpiresAt.asReadonly();
     // Computed States
     isAuthenticated = computed(() => !!this._accessToken() && !!this._user(), ...(ngDevMode ? [{ debugName: "isAuthenticated" }] : []));
     requiresCompanySelection = computed(() => !!this._selectionSessionId() && this._availableCompanies().length > 0, ...(ngDevMode ? [{ debugName: "requiresCompanySelection" }] : []));
@@ -231,15 +205,6 @@ class AuthStateService {
         // Consider expired 30 seconds before actual expiry
         return Date.now() >= expiresAt - 30000;
     }, ...(ngDevMode ? [{ debugName: "isTokenExpired" }] : []));
-    /**
-     * Check if we need to refresh on app load (token expired but refresh cookie may exist)
-     */
-    needsRefreshOnLoad = computed(() => {
-        const expiresAt = this._tokenExpiresAt();
-        const hasToken = !!this._accessToken();
-        // Need refresh if: we have stored expiry (was logged in) but no current token
-        return expiresAt !== null && !hasToken;
-    }, ...(ngDevMode ? [{ debugName: "needsRefreshOnLoad" }] : []));
     // Config-derived states
     tenantId = computed(() => this.appConfig.multiTenant.tenantId ?? null, ...(ngDevMode ? [{ debugName: "tenantId" }] : []));
     constructor() {
@@ -342,7 +307,7 @@ class AuthStateService {
     }
     // Storage helpers
     loadFromStorage() {
-        if (typeof window === 'undefined')
+        if (this.platform.isServer)
             return;
         // Load token expiry (NOT the token - it's memory-only for security)
         const expiryStr = this.get(STORAGE.TOKEN_EXPIRY);
@@ -372,14 +337,14 @@ class AuthStateService {
         }
     }
     store(key, value) {
-        if (typeof window !== 'undefined')
+        if (!this.platform.isServer)
             localStorage.setItem(key, value);
     }
     get(key) {
-        return typeof window !== 'undefined' ? localStorage.getItem(key) : null;
+        return !this.platform.isServer ? localStorage.getItem(key) : null;
     }
     remove(key) {
-        if (typeof window !== 'undefined')
+        if (!this.platform.isServer)
             localStorage.removeItem(key);
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthStateService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
@@ -503,63 +468,18 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
 /**
  * Branch API Service
  * Signal-based service for branch CRUD operations
- * Branches default to current company context
- *
- * @example
- * ```typescript
- * branchService = inject(BranchApiService);
- *
- * // Set current company context
- * branchService.setCurrentCompanyId('company-uuid');
- *
- * // Access data via signals
- * branches = this.branchService.data;
- * isLoading = this.branchService.isLoading;
- *
- * // Fetch branches (will filter by current company)
- * this.branchService.fetchList('search');
- *
- * // Create branch (companyId will be auto-set if not provided)
- * await this.branchService.insertBranch({ name: 'New Branch', slug: 'new-branch' });
- * ```
  */
 class BranchApiService extends ApiResourceService {
-    /** Current company context for branch operations */
-    currentCompanyId = signal(null, ...(ngDevMode ? [{ debugName: "currentCompanyId" }] : []));
-    /** Branches filtered by current company */
-    companyBranches = computed(() => {
-        const companyId = this.currentCompanyId();
-        if (!companyId)
-            return this.data();
-        return this.data().filter((branch) => branch.companyId === companyId);
-    }, ...(ngDevMode ? [{ debugName: "companyBranches" }] : []));
+    _currentCompanyId = signal(null, ...(ngDevMode ? [{ debugName: "_currentCompanyId" }] : []));
     constructor(http) {
         super('administration/branch', http);
     }
-    /**
-     * Set the current company context for branch operations
-     */
     setCurrentCompanyId(companyId) {
-        this.currentCompanyId.set(companyId);
-    }
-    /**
-     * Insert a new branch, auto-setting companyId if not provided
-     */
-    async insertBranch(data) {
-        const companyId = data.companyId ?? this.currentCompanyId();
-        if (!companyId) {
-            throw new Error('Company ID is required. Set currentCompanyId or provide companyId in data.');
-        }
-        return this.insertAsync({ ...data, companyId });
+        this._currentCompanyId.set(companyId);
     }
-    /**
-     * Fetch branches for a specific company
-     */
     fetchByCompany(companyId, search = '') {
         this.setCurrentCompanyId(companyId);
-        this.fetchList(search, {
-            filter: { companyId },
-        });
+        this.fetchList(search, { filter: { companyId } });
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: BranchApiService, deps: [{ token: i1.HttpClient }], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: BranchApiService, providedIn: 'root' });
@@ -572,21 +492,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
 /**
  * Company API Service
  * Signal-based service for company CRUD operations
- *
- * @example
- * ```typescript
- * companyService = inject(CompanyApiService);
- *
- * // Access data via signals
- * companies = this.companyService.data;
- * isLoading = this.companyService.isLoading;
- *
- * // Fetch companies
- * this.companyService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create company
- * await this.companyService.insertAsync({ name: 'New Company', slug: 'new-company' });
- * ```
  */
 class CompanyApiService extends ApiResourceService {
     constructor(http) {
@@ -602,52 +507,22 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
 
 /**
  * Token Refresh State Service
- *
- * Manages token refresh state in a request-safe manner for SSR environments.
- * Replaces module-level state that would be shared across requests in SSR.
- *
- * NOTE: Uses BehaviorSubject intentionally for RxJS interoperability.
- * The HTTP interceptor needs to queue concurrent requests and have them
- * wait for the new token via Observable subscription. This is a valid
- * pattern that signals cannot replicate directly (no multi-subscriber
- * async coordination). Signal is used for the boolean flag only.
- *
- * @example
- * ```typescript
- * const refreshState = inject(TokenRefreshStateService);
- *
- * if (refreshState.isRefreshing()) {
- *   // Queue request via refreshTokenSubject$
- * } else {
- *   refreshState.startRefresh();
- *   // Perform refresh
- * }
- * ```
+ * Manages token refresh state for SSR-safe request queuing.
+ * Uses BehaviorSubject for RxJS interop (multi-subscriber async coordination).
  */
 class TokenRefreshStateService {
-    /** Flag to track if token refresh is in progress */
     _isRefreshing = signal(false, ...(ngDevMode ? [{ debugName: "_isRefreshing" }] : []));
     isRefreshing = this._isRefreshing.asReadonly();
-    /** Subject to queue requests while refreshing */
     _refreshTokenSubject = new BehaviorSubject(null);
     refreshTokenSubject$ = this._refreshTokenSubject.asObservable();
-    /**
-     * Mark refresh as started
-     */
     startRefresh() {
         this._isRefreshing.set(true);
         this._refreshTokenSubject.next(null);
     }
-    /**
-     * Mark refresh as completed and broadcast new token
-     */
     completeRefresh(newToken) {
         this._isRefreshing.set(false);
         this._refreshTokenSubject.next(newToken);
     }
-    /**
-     * Mark refresh as failed
-     */
     failRefresh() {
         this._isRefreshing.set(false);
     }
@@ -662,51 +537,11 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
 /**
  * User API Service
  * Signal-based service for user CRUD operations
- *
- * @example
- * ```typescript
- * userService = inject(UserApiService);
- *
- * // Access data via signals
- * users = this.userService.data;
- * isLoading = this.userService.isLoading;
- *
- * // Fetch users
- * this.userService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create user
- * await this.userService.insertAsync({
- *   name: 'John Doe',
- *   email: 'john@example.com',
- *   password: 'password123'
- * });
- * ```
  */
 class UserApiService extends ApiResourceService {
     constructor(http) {
         super('administration/users', http);
     }
-    /**
-     * Verify user's email
-     */
-    verifyEmail(userId) {
-        return this.http.post(`${this.baseUrl}/${userId}/verify-email`, {});
-    }
-    /**
-     * Verify user's phone
-     */
-    verifyPhone(userId) {
-        return this.http.post(`${this.baseUrl}/${userId}/verify-phone`, {});
-    }
-    /**
-     * Update user status (active/inactive)
-     */
-    updateStatus(userId, isActive) {
-        return this.http.post(`${this.baseUrl}/${userId}/status`, { isActive });
-    }
-    /**
-     * Update current user's profile
-     */
     updateProfile(data) {
         return this.http.post(`${this.baseUrl}/profile`, data);
     }
@@ -720,314 +555,121 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
 
 /**
  * User Permission API Service
- *
  * Handles user-company and user-branch permission assignments.
- * Uses batch operations for efficient permission management.
- *
- * Backend Endpoints (POST-only RPC):
- * - POST /administration/permissions/user-company/assign - Batch assign/revoke company permissions
- * - POST /administration/permissions/get-user-company - Get user's companies
- * - POST /administration/permissions/user-branch/assign - Batch assign/revoke branch permissions
- * - POST /administration/permissions/get-user-branch - Get user's branches
  */
 class UserPermissionApiService {
     appConfig = inject(APP_CONFIG);
     http = inject(HttpClient);
-    baseUrl;
-    constructor() {
-        this.baseUrl = this.appConfig.apiBaseUrl + '/administration/permissions';
-    }
-    // ============================================
-    // Company Permission Endpoints
-    // ============================================
-    /**
-     * Batch assign/revoke user-company permissions
-     *
-     * @example
-     * // Add company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: true },
-     *     { targetId: 'company-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: false }
-     *   ]
-     * });
-     */
+    baseUrl = this.appConfig.apiBaseUrl + '/administration/permissions';
+    // Company Permissions
     assignUserCompanies(data) {
         return this.http.post(`${this.baseUrl}/user-company/assign`, data);
     }
-    /**
-     * Assign single company to user (convenience method)
-     */
     assignUserToCompany(userId, companyId) {
-        return this.assignUserCompanies({
-            userId,
-            items: [{ targetId: companyId, isAdd: true }],
-        });
+        return this.assignUserCompanies({ userId, items: [{ targetId: companyId, isAdd: true }] });
     }
-    /**
-     * Revoke single company from user (convenience method)
-     */
     revokeUserFromCompany(userId, companyId) {
-        return this.assignUserCompanies({
-            userId,
-            items: [{ targetId: companyId, isAdd: false }],
-        });
+        return this.assignUserCompanies({ userId, items: [{ targetId: companyId, isAdd: false }] });
     }
-    /**
-     * Get user's company permissions
-     *
-     * @param userId - User ID to get companies for
-     * @returns Observable with user's company permissions
-     */
     getUserCompanies(userId) {
         return this.http.post(`${this.baseUrl}/get-user-company`, { userId });
     }
-    // ============================================
-    // Branch Permission Endpoints
-    // ============================================
-    /**
-     * Batch assign/revoke user-branch permissions
-     *
-     * @example
-     * // Add branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: true },
-     *     { targetId: 'branch-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: false }
-     *   ]
-     * });
-     */
+    // Branch Permissions
     assignUserBranches(data) {
         return this.http.post(`${this.baseUrl}/user-branch/assign`, data);
     }
-    /**
-     * Assign single branch to user (convenience method)
-     */
     assignUserToBranch(userId, branchId) {
-        return this.assignUserBranches({
-            userId,
-            items: [{ targetId: branchId, isAdd: true }],
-        });
+        return this.assignUserBranches({ userId, items: [{ targetId: branchId, isAdd: true }] });
     }
-    /**
-     * Revoke single branch from user (convenience method)
-     */
     revokeUserFromBranch(userId, branchId) {
-        return this.assignUserBranches({
+        return this.assignUserBranches({ userId, items: [{ targetId: branchId, isAdd: false }] });
+    }
+    getUserBranches(userId, companyId) {
+        return this.http.post(`${this.baseUrl}/get-user-branch`, {
             userId,
-            items: [{ targetId: branchId, isAdd: false }],
+            ...(companyId && { companyId }),
         });
     }
-    /**
-     * Get user's branch permissions
-     *
-     * @param userId - User ID to get branches for
-     * @returns Observable with user's branch permissions
-     */
-    getUserBranches(userId) {
-        return this.http.post(`${this.baseUrl}/get-user-branch`, { userId });
-    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: UserPermissionApiService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: UserPermissionApiService, providedIn: 'root' });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: UserPermissionApiService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
-        }], ctorParameters: () => [] });
+        }] });
 
 /**
  * Authentication API Endpoints
  *
  * Centralized endpoint definitions to prevent inconsistencies across interceptors
  * and services. All auth-related endpoints should be referenced from here.
- *
- * @example
- * ```typescript
- * if (isAuthEndpoint(req.url)) {
- *   // Skip interceptor logic
- * }
- * ```
  */
 const AUTH_ENDPOINTS = {
     LOGIN: '/auth/login',
     LOGOUT: '/auth/logout',
     REFRESH: '/auth/refresh',
     REGISTER: '/auth/register',
+    ME: '/auth/me',
     SELECT: '/auth/select',
     SWITCH_COMPANY: '/auth/switch-company',
+    CHANGE_PASSWORD: '/auth/change-password',
     VERIFY_EMAIL: '/auth/verify-email',
     FORGOT_PASSWORD: '/auth/forgot-password',
     RESET_PASSWORD: '/auth/reset-password',
     RESEND_VERIFICATION: '/auth/resend-verification',
 };
-/**
- * Check if a URL is an auth-related endpoint
- */
-function isAuthEndpoint(url) {
-    return Object.values(AUTH_ENDPOINTS).some((endpoint) => url.includes(endpoint));
-}
-/**
- * Check if a URL is a specific auth endpoint
- */
+/** Check if a URL matches a specific endpoint */
 function isEndpoint(url, endpoint) {
     return url.includes(endpoint);
 }
 
-/**
- * Validates a return URL to prevent open redirect attacks.
- * Only allows relative URLs that start with '/' and don't contain protocol.
- */
 function isValidReturnUrl(url) {
     if (typeof url !== 'string' || !url)
         return false;
-    // Must start with '/' and not contain protocol indicators
     return url.startsWith('/') && !url.includes('://') && !url.startsWith('//');
 }
-/**
- * Auth Guard
- * Protects routes that require authentication.
- *
- * Session restoration is handled by guestGuard. This guard assumes
- * the session has already been restored if user accessed login page first.
- *
- * Handles company feature:
- * - If company feature enabled and no company selected, redirects to login
- *   (login page handles company selection as step 2)
- * - If not authenticated, redirects to login
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'dashboard',
- *   loadComponent: () => import('./dashboard.component'),
- *   canActivate: [authGuard]
- * }
- * ```
- */
+/** Protects routes requiring authentication */
 const authGuard = (route, state) => {
     const authState = inject(AuthStateService);
     const router = inject(Router);
     const appConfig = inject(APP_CONFIG);
-    // Check if user is authenticated
     if (!authState.isAuthenticated()) {
-        // Store return URL for redirect after login
-        return router.createUrlTree([AUTH_ENDPOINTS.LOGIN], {
-            queryParams: { returnUrl: state.url },
-        });
+        return router.createUrlTree([AUTH_ENDPOINTS.LOGIN], { queryParams: { returnUrl: state.url } });
     }
-    // Check if company feature is enabled and company selection is required
     if (appConfig.enableCompanyFeature) {
-        // If user needs to select company or no company selected, redirect to login
-        // Login page handles company selection as step 2
         if (authState.requiresCompanySelection() || !authState.company()) {
-            return router.createUrlTree([AUTH_ENDPOINTS.LOGIN], {
-                queryParams: { returnUrl: state.url },
-            });
+            return router.createUrlTree([AUTH_ENDPOINTS.LOGIN], { queryParams: { returnUrl: state.url } });
         }
     }
     return true;
 };
-/**
- * Guest Guard
- * Protects auth routes (login, register) from authenticated users.
- * Redirects authenticated users to home page.
- *
- * CRITICAL: Unlike old implementation, this guard RESTORES the session first
- * before checking authentication. This handles the case when users directly
- * navigate to /auth/login via browser URL while having valid refresh token.
- *
- * Flow:
- * 1. Restore session (if needed) via AuthInitService.initialize()
- * 2. Check if user is authenticated
- * 3. If authenticated -> redirect to dashboard
- * 4. If not authenticated -> allow access to login page
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'auth/login',
- *   loadComponent: () => import('./login.component'),
- *   canActivate: [guestGuard]
- * }
- * ```
- */
+/** Protects auth routes from authenticated users, restores session first */
 const guestGuard = (route) => {
     const authState = inject(AuthStateService);
     const authInit = inject(AuthInitService);
     const router = inject(Router);
     const appConfig = inject(APP_CONFIG);
-    // Helper to check and redirect authenticated users
     const checkAndRedirect = () => {
-        // Allow access if user needs company selection (login page handles this)
-        if (authState.requiresCompanySelection()) {
+        if (authState.requiresCompanySelection())
             return true;
-        }
-        // If authenticated, check if company selection is needed
         if (authState.isAuthenticated()) {
-            // If company feature enabled but no company, allow access to login for selection
-            if (appConfig.enableCompanyFeature && !authState.company()) {
+            if (appConfig.enableCompanyFeature && !authState.company())
                 return true;
-            }
-            // Redirect to home or returnUrl (with open redirect protection)
             const returnUrl = route.queryParams['returnUrl'];
-            const safeUrl = isValidReturnUrl(returnUrl) ? returnUrl : '/';
-            return router.createUrlTree([safeUrl]);
+            return router.createUrlTree([isValidReturnUrl(returnUrl) ? returnUrl : '/']);
         }
         return true;
     };
-    // If session already restored, just check authentication
-    if (authInit.initialized()) {
+    if (authInit.initialized())
         return checkAndRedirect();
-    }
-    // Otherwise, restore session first
     return authInit.initialize().pipe(map$1(() => checkAndRedirect()), catchError$1(() => of(true)));
 };
-/**
- * Company Feature Guard
- * Protects routes that require company feature to be enabled.
- * Redirects to home if company feature is disabled.
- *
- * Use this guard on company/branch management routes.
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'administration/company',
- *   loadComponent: () => import('./company-list.component'),
- *   canActivate: [authGuard, companyFeatureGuard]
- * }
- * ```
- */
+/** Protects routes requiring company feature to be enabled */
 const companyFeatureGuard = () => {
     const router = inject(Router);
     const appConfig = inject(APP_CONFIG);
-    // If company feature not enabled, redirect to home
-    if (!appConfig.enableCompanyFeature) {
+    if (!appConfig.enableCompanyFeature)
         return router.createUrlTree(['/']);
-    }
     return true;
 };
 
@@ -1073,34 +715,7 @@ function authInterceptor(req, next) {
     return next(req);
 }
 
-/**
- * Token Refresh Interceptor
- * Handles token refresh both proactively and reactively.
- *
- * PROACTIVE REFRESH:
- * - Checks token expiry BEFORE making requests
- * - Refreshes token if expired or expiring soon (within 30 seconds)
- * - Prevents unnecessary 401 failures
- *
- * REACTIVE REFRESH:
- * - Still handles 401 errors as fallback
- * - Queues concurrent requests during refresh
- * - Redirects to login on refresh failure
- *
- * SECURITY:
- * - Token kept in memory only (not localStorage)
- * - Uses HTTP-only refresh token cookie
- * - SSR-safe: Uses injectable service
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * provideHttpClient(
- *   withFetch(),
- *   withInterceptors([authInterceptor, tokenRefreshInterceptor])
- * )
- * ```
- */
+/** Token Refresh Interceptor - Proactive and reactive token refresh with request queuing */
 function tokenRefreshInterceptor(req, next) {
     const authState = inject(AuthStateService);
     const authApi = inject(AuthApiService);
@@ -1132,48 +747,25 @@ function tokenRefreshInterceptor(req, next) {
         return handleTokenRefresh(req, next, authState, authApi, messageService, isBrowser, refreshState);
     }));
 }
-/**
- * Handle token refresh - either proactively or after 401
- */
 function handleTokenRefresh(req, next, authState, authApi, messageService, isBrowser, refreshState) {
-    // If already refreshing, queue this request
     if (refreshState.isRefreshing()) {
-        return refreshState.refreshTokenSubject$.pipe(filter((token) => token !== null), take(1), switchMap((token) => {
-            return next(req.clone({
-                setHeaders: { Authorization: `Bearer ${token}` },
-            }));
-        }));
+        return refreshState.refreshTokenSubject$.pipe(filter((token) => token !== null), take(1), switchMap((token) => next(req.clone({ setHeaders: { Authorization: `Bearer ${token}` } }))));
     }
-    // Start refresh process
     refreshState.startRefresh();
     return authApi.refresh().pipe(switchMap((response) => {
         const newToken = response.accessToken;
-        // Update auth state (memory-only token + decoded expiry)
         authState.setAccessToken(newToken);
-        // Complete refresh and notify queued requests
         refreshState.completeRefresh(newToken);
-        // Continue with original request using new token
-        return next(req.clone({
-            setHeaders: { Authorization: `Bearer ${newToken}` },
-        }));
+        return next(req.clone({ setHeaders: { Authorization: `Bearer ${newToken}` } }));
     }), catchError((refreshError) => {
         refreshState.failRefresh();
         return handleRefreshFailure(authState, messageService, isBrowser, refreshError);
     }));
 }
-/**
- * Handle refresh token failure - logout and redirect
- */
 function handleRefreshFailure(authState, messageService, isBrowser, error) {
-    // Show message
     if (isBrowser) {
-        messageService.add({
-            severity: 'error',
-            summary: 'Session Expired',
-            detail: 'Please log in again.',
-        });
+        messageService.add({ severity: 'error', summary: 'Session Expired', detail: 'Please log in again.' });
     }
-    // Reset auth state and redirect
     authState.resetState();
     authState.navigateToLogin();
     return throwError(() => error);
@@ -1229,13 +821,13 @@ const AUTH_ROUTES = [
 const ADMINISTRATION_ROUTES = [
     {
         path: '',
-        // canActivate: [authGuard, permissionGuard('admin-check')],
         canActivate: [authGuard],
         loadComponent: () => Promise.resolve().then(function () { return administrationPage_component; }).then((m) => m.AdministrationPageComponent),
         children: [
-            // Users tab (always available)
+            // Users tab
             {
                 path: 'users',
+                canActivate: [permissionGuard(USER_PERMISSIONS.READ)],
                 children: [
                     {
                         path: '',
@@ -1254,7 +846,7 @@ const ADMINISTRATION_ROUTES = [
             // Company tab (requires company feature)
             {
                 path: 'company',
-                canActivate: [companyFeatureGuard],
+                canActivate: [companyFeatureGuard, permissionGuard(COMPANY_PERMISSIONS.READ)],
                 children: [
                     {
                         path: '',
@@ -1273,7 +865,7 @@ const ADMINISTRATION_ROUTES = [
             // Branch tab (requires company feature)
             {
                 path: 'branch',
-                canActivate: [companyFeatureGuard],
+                canActivate: [companyFeatureGuard, permissionGuard(BRANCH_PERMISSIONS.READ)],
                 children: [
                     {
                         path: '',
@@ -1311,16 +903,21 @@ const PROFILE_ROUTES = [
 ];
 
 /**
- * Auth Layout State Adapter
- * Bridges AuthStateService signals to ILayoutAuthState interface.
- * Provides ready-to-use integration between ng-auth, ng-layout, and ng-shared provider tokens.
+ * Auth Layout Provider Adapters
+ *
+ * Implements provider interfaces from ng-layout using ng-auth services.
+ * Bridges auth state and API to layout components.
+ *
+ * @example
+ * // In app.config.ts
+ * import { provideAuthLayoutIntegration } from '@flusys/ng-auth';
+ * providers: [...provideAuthLayoutIntegration()]
  */
+// =============================================================================
+// Layout State Adapter
+// =============================================================================
 class AuthLayoutStateAdapter {
     authState = inject(AuthStateService);
-    /**
-     * Maps company info to company info for layout.
-     * Falls back to app name from config when no company is selected.
-     */
     currentCompanyInfo = computed(() => {
         const company = this.authState.company();
         if (company) {
@@ -1333,10 +930,6 @@ class AuthLayoutStateAdapter {
         }
         return null;
     }, ...(ngDevMode ? [{ debugName: "currentCompanyInfo" }] : []));
-    /**
-     * Maps branch info to branch info for layout.
-     * Returns null when no branch is selected.
-     */
     currentBranchInfo = computed(() => {
         const branch = this.authState.branch();
         if (branch) {
@@ -1349,10 +942,6 @@ class AuthLayoutStateAdapter {
         }
         return null;
     }, ...(ngDevMode ? [{ debugName: "currentBranchInfo" }] : []));
-    /**
-     * Maps user info from auth state to layout user info.
-     * Profile picture URL is managed separately by AuthLayoutSyncService via FileUrlService.
-     */
     loginUserData = computed(() => {
         const user = this.authState.user();
         if (user) {
@@ -1371,30 +960,19 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
-/**
- * Auth Layout API Adapter
- * Bridges AuthApiService to ILayoutAuthApi interface.
- * Handles logout and navigation for layout components.
- */
+// =============================================================================
+// Layout API Adapter
+// =============================================================================
 class AuthLayoutApiAdapter {
     authApi = inject(AuthApiService);
     authState = inject(AuthStateService);
     permissionApi = inject(UserPermissionApiService);
     router = inject(Router);
-    /**
-     * Logout the current user.
-     * Calls backend logout endpoint and resets local auth state.
-     * Auth state reset handles clearing all localStorage including company/branch.
-     */
     logOut() {
         return this.authApi.logout().pipe(tap$1(() => {
-            this.authState.resetState(); // Clears all auth state including localStorage
+            this.authState.resetState();
         }));
     }
-    /**
-     * Navigate to login page.
-     * Optionally preserves current URL as return URL.
-     */
     navigateLogin(withUrl) {
         if (withUrl) {
             const currentUrl = this.router.url;
@@ -1404,54 +982,33 @@ class AuthLayoutApiAdapter {
             this.authState.navigateToLogin();
         }
     }
-    /**
-     * Switch to a different company and branch.
-     * Calls backend switch endpoint, then triggers full page reload to
-     * refresh permissions, reset component state, and re-filter all data.
-     */
     switchCompany(companyId, branchId) {
         return this.authApi.switchCompany({ companyId, branchId }).pipe(tap$1(() => {
-            // Reload page to refresh permissions and all component state
-            // This ensures all data is filtered by new company/branch context
             window.location.reload();
         }));
     }
-    /**
-     * Get list of companies the logged-in user has permissions for.
-     * Uses permission API to filter by user's actual company-level permissions.
-     */
     getUserCompanies() {
         const userId = this.authState.user()?.id;
         if (!userId) {
             return of([]);
         }
-        return this.permissionApi.getUserCompanies(userId).pipe(map$1((response) => {
-            return (response.data || []).map((permission) => ({
-                id: permission.companyId,
-                name: permission.companyName,
-                slug: permission.companySlug ?? '',
-                imageId: '',
-            }));
-        }));
+        return this.permissionApi.getUserCompanies(userId).pipe(map$1((response) => (response.data || []).map((permission) => ({
+            id: permission.companyId,
+            name: permission.companyName,
+            slug: permission.companySlug ?? '',
+            imageId: '',
+        }))));
     }
-    /**
-     * Get branches for a specific company that the logged-in user has access to.
-     * Fetches all user branches and filters by companyId.
-     */
     getCompanyBranches(companyId) {
         const userId = this.authState.user()?.id;
         if (!userId) {
             return of([]);
         }
-        return this.permissionApi.getUserBranches(userId).pipe(map$1((response) => {
-            return (response.data || [])
-                .filter((permission) => permission.companyId === companyId)
-                .map((permission) => ({
-                id: permission.branchId,
-                name: permission.branchName,
-                slug: permission.branchSlug ?? '',
-            }));
-        }));
+        return this.permissionApi.getUserBranches(userId, companyId).pipe(map$1((response) => (response.data || []).map((permission) => ({
+            id: permission.branchId,
+            name: permission.branchName,
+            slug: permission.branchSlug ?? '',
+        }))));
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthLayoutApiAdapter, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthLayoutApiAdapter, providedIn: 'root' });
@@ -1462,25 +1019,23 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
         }] });
 
 /**
- * Auth User Provider Adapter
+ * Auth Shared Provider Adapters
  *
- * Implements IUserProvider interface from ng-shared using UserApiService from ng-auth.
- * This allows IAM and other packages to access user data without depending on ng-auth directly.
+ * Implements provider interfaces from ng-shared using ng-auth services.
+ * Allows IAM, Storage, and Form-Builder packages to access auth data
+ * without depending on ng-auth directly.
  *
  * @example
  * // In app.config.ts
- * providers: [
- *   { provide: USER_PROVIDER, useClass: AuthUserProviderAdapter }
- * ]
- *
- * // In IAM component
- * private readonly userProvider = inject(USER_PROVIDER);
- * this.userProvider.getUsers({ page: 0, pageSize: 50 }).subscribe(...);
+ * import { provideAuthProviders } from '@flusys/ng-auth';
+ * providers: [...provideAuthProviders()]
  */
+// =============================================================================
+// User Provider Adapter
+// =============================================================================
 class AuthUserProviderAdapter {
     userApi = inject(UserApiService);
     getUsers(filter) {
-        // Convert filter to API format
         const apiFilter = {
             pagination: {
                 currentPage: filter?.page ?? 0,
@@ -1510,19 +1065,9 @@ class AuthUserProviderAdapter {
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthUserProviderAdapter, decorators: [{
             type: Injectable
         }] });
-
-/**
- * Auth Company API Provider Adapter
- *
- * Implements ICompanyApiProvider interface from ng-shared using CompanyApiService.
- * Allows IAM package to access company data without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: COMPANY_API_PROVIDER, useClass: AuthCompanyApiProviderAdapter }
- * ]
- */
+// =============================================================================
+// Company API Provider Adapter
+// =============================================================================
 class AuthCompanyApiProviderAdapter {
     companyApi = inject(CompanyApiService);
     getCompanies(filter) {
@@ -1550,23 +1095,13 @@ class AuthCompanyApiProviderAdapter {
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthCompanyApiProviderAdapter, decorators: [{
             type: Injectable
         }] });
-
-/**
- * Auth User Permission Provider Adapter
- *
- * Implements IUserPermissionProvider interface from ng-shared using UserPermissionApiService.
- * Allows IAM package to query user permissions without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: USER_PERMISSION_PROVIDER, useClass: AuthUserPermissionProviderAdapter }
- * ]
- */
+// =============================================================================
+// User Permission Provider Adapter
+// =============================================================================
 class AuthUserPermissionProviderAdapter {
     userPermissionApi = inject(UserPermissionApiService);
-    getUserBranchPermissions(userId) {
-        return this.userPermissionApi.getUserBranches(userId);
+    getUserBranchPermissions(userId, companyId) {
+        return this.userPermissionApi.getUserBranches(userId, companyId);
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthUserPermissionProviderAdapter, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthUserPermissionProviderAdapter });
@@ -1574,37 +1109,15 @@ class AuthUserPermissionProviderAdapter {
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AuthUserPermissionProviderAdapter, decorators: [{
             type: Injectable
         }] });
-
-/**
- * Auth State Provider Adapter
- *
- * Implements IAuthStateProvider interface from ng-shared using auth services from ng-auth.
- * This allows feature packages (form-builder, etc.) to check auth state without
- * depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: AUTH_STATE_PROVIDER, useClass: AuthStateProviderAdapter }
- * ]
- *
- * // In form-builder component
- * private readonly authStateProvider = inject(AUTH_STATE_PROVIDER);
- * const isLoggedIn = this.authStateProvider.isAuthenticated();
- */
+// =============================================================================
+// Auth State Provider Adapter
+// =============================================================================
 class AuthStateProviderAdapter {
     authState = inject(AuthStateService);
     authInit = inject(AuthInitService);
-    /**
-     * Signal indicating if user is currently authenticated
-     */
     get isAuthenticated() {
         return this.authState.isAuthenticated;
     }
-    /**
-     * Initialize auth state (restore session from cookies/storage)
-     * Returns Observable<void> that completes when initialization is done
-     */
     initialize() {
         return this.authInit.initialize().pipe(map(() => undefined));
     }
@@ -1615,23 +1128,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Injectable
         }] });
 
-/**
- * Provides auth layout integration for ng-layout.
- * Call this in your app.config.ts to integrate ng-auth with ng-layout.
- *
- * Also registers LAYOUT_AUTH_STATE since AuthLayoutStateAdapter
- * implements both ILayoutAuthState and ICompanyContextProvider.
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     ...provideAuthLayoutIntegration(),
- *   ],
- * };
- * ```
- */
+/** Provides auth integration for ng-layout */
 function provideAuthLayoutIntegration() {
     return [
         { provide: LAYOUT_AUTH_STATE, useClass: AuthLayoutStateAdapter },
@@ -1639,34 +1136,12 @@ function provideAuthLayoutIntegration() {
     ];
 }
 
-/**
- * Provide Auth Provider Adapters
- *
- * Registers auth implementations for provider interfaces from ng-shared.
- * This allows IAM and Storage packages to use auth services without direct dependencies.
- *
- * @example
- * // In app.config.ts
- * import { provideAuthProviders } from '@flusys/ng-auth';
- *
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     provideAuthProviders(),
- *     // ... other providers
- *   ]
- * };
- *
- * @returns Array of Angular providers
- */
+/** Provides auth implementations for ng-shared provider interfaces */
 function provideAuthProviders() {
     return [
-        // User data provider (for IAM user selection)
         { provide: USER_PROVIDER, useClass: AuthUserProviderAdapter },
-        // Company API provider (for IAM company selection)
         { provide: COMPANY_API_PROVIDER, useClass: AuthCompanyApiProviderAdapter },
-        // User permission provider (for IAM permission assignment)
         { provide: USER_PERMISSION_PROVIDER, useClass: AuthUserPermissionProviderAdapter },
-        // Auth state provider (for form-builder and other packages)
         { provide: AUTH_STATE_PROVIDER, useClass: AuthStateProviderAdapter },
     ];
 }
@@ -1680,6 +1155,7 @@ function provideAuthProviders() {
  */
 class AdministrationPageComponent {
     appConfig = inject(APP_CONFIG);
+    permissionValidator = inject(PermissionValidatorService);
     /** All available tabs */
     allTabs = [
         {
@@ -1687,12 +1163,14 @@ class AdministrationPageComponent {
             label: 'Users',
             icon: 'pi pi-users',
             route: 'users',
+            permission: USER_PERMISSIONS.READ,
         },
         {
             id: 'companies',
             label: 'Companies',
             icon: 'pi pi-building',
             route: 'company',
+            permission: COMPANY_PERMISSIONS.READ,
             requiresCompanyFeature: true,
         },
         {
@@ -1700,20 +1178,26 @@ class AdministrationPageComponent {
             label: 'Branches',
             icon: 'pi pi-sitemap',
             route: 'branch',
+            permission: BRANCH_PERMISSIONS.READ,
             requiresCompanyFeature: true,
         },
     ];
     /** Check if company feature is enabled */
     companyFeatureEnabled = computed(() => isCompanyFeatureEnabled(this.appConfig), ...(ngDevMode ? [{ debugName: "companyFeatureEnabled" }] : []));
-    /** Visible tabs based on config */
+    /** Visible tabs based on config and permissions */
     visibleTabs = computed(() => {
-        return this.allTabs.filter((tab) => !tab.requiresCompanyFeature || this.companyFeatureEnabled());
+        return this.allTabs.filter((tab) => {
+            const hasCompanyFeature = !tab.requiresCompanyFeature || this.companyFeatureEnabled();
+            const hasPermission = this.permissionValidator.hasPermission(tab.permission);
+            return hasCompanyFeature && hasPermission;
+        });
     }, ...(ngDevMode ? [{ debugName: "visibleTabs" }] : []));
-    /** Dynamic subtitle based on visible features */
+    /** Dynamic subtitle based on visible tabs */
     subtitle = computed(() => {
-        return this.companyFeatureEnabled()
-            ? 'Manage users, companies, and branches'
-            : 'Manage users';
+        const tabs = this.visibleTabs();
+        if (tabs.length === 0)
+            return 'No permissions available';
+        return `Manage ${tabs.map((t) => t.label.toLowerCase()).join(', ')}`;
     }, ...(ngDevMode ? [{ debugName: "subtitle" }] : []));
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AdministrationPageComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
     static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.1.3", type: AdministrationPageComponent, isStandalone: true, selector: "lib-administration-page", ngImport: i0, template: `
@@ -1743,7 +1227,7 @@ class AdministrationPageComponent {
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: AdministrationPageComponent, decorators: [{
             type: Component,
-            args: [{ selector: 'lib-administration-page', standalone: true, changeDetection: ChangeDetectionStrategy.OnPush, imports: [CommonModule, RouterOutlet, RouterLink, RouterLinkActive], template: `
+            args: [{ selector: 'lib-administration-page', changeDetection: ChangeDetectionStrategy.OnPush, imports: [CommonModule, RouterOutlet, RouterLink, RouterLinkActive], template: `
     <div class="p-4">
       <div class="mb-4">
         <h1 class="text-2xl font-bold m-0">Administration</h1>
@@ -1855,25 +1339,27 @@ class BranchFormComponent {
             const response = await this.branchService.findByIdAsync(id);
             if (response.success && response.data) {
                 this.existingBranch.set(response.data);
-                this.formModel.set({
-                    companyId: response.data.companyId,
-                    name: response.data.name,
-                    slug: response.data.slug,
-                    email: response.data.email || '',
-                    phone: response.data.phone || '',
-                    address: response.data.address || '',
-                    isActive: response.data.isActive,
-                });
+                this.formModel.set(this.toFormModel(response.data));
             }
         }
         catch {
-            // Error toast handled by global interceptor
             this.router.navigate(['/administration/branch']);
         }
         finally {
             this.isLoading.set(false);
         }
     }
+    toFormModel(branch) {
+        return {
+            companyId: branch.companyId,
+            name: branch.name,
+            slug: branch.slug,
+            email: branch.email || '',
+            phone: branch.phone || '',
+            address: branch.address || '',
+            isActive: branch.isActive,
+        };
+    }
     generateSlug() {
         const model = this.formModel();
         if (!model.slug && model.name) {
@@ -1895,63 +1381,66 @@ class BranchFormComponent {
         }
         this.isLoading.set(true);
         try {
-            const model = this.formModel();
             if (this.isEditMode() && this.existingBranch()) {
-                // Update existing branch
-                const updateData = {
-                    id: this.existingBranch().id,
-                    name: model.name,
-                    slug: model.slug,
-                    email: model.email || undefined,
-                    phone: model.phone || undefined,
-                    address: model.address || undefined,
-                    isActive: model.isActive,
-                };
-                await this.branchService.updateAsync(updateData);
-                this.messageService.add({
-                    severity: 'success',
-                    summary: 'Success',
-                    detail: 'Branch updated successfully.',
-                });
+                await this.updateBranch();
             }
             else {
-                // Create new branch
-                const createData = {
-                    companyId: model.companyId,
-                    name: model.name,
-                    slug: model.slug,
-                    email: model.email || undefined,
-                    phone: model.phone || undefined,
-                    address: model.address || undefined,
-                    isActive: model.isActive,
-                };
-                await this.branchService.insertAsync(createData);
-                this.messageService.add({
-                    severity: 'success',
-                    summary: 'Success',
-                    detail: 'Branch created successfully.',
-                });
+                await this.createBranch();
             }
-            // Navigate back to branch list with company filter
-            const companyId = this.existingBranch()?.companyId || model.companyId;
-            this.router.navigate(['/administration/branch'], {
-                queryParams: { companyId },
-            });
+            this.navigateToList();
         }
         catch {
-            // Error toast handled by global interceptor
+            // Error handled by global interceptor
         }
         finally {
             this.isLoading.set(false);
         }
     }
-    onCancel() {
-        const model = this.formModel();
-        const companyId = this.existingBranch()?.companyId || model.companyId;
+    async updateBranch() {
+        const model = this.formModel();
+        const updateData = {
+            id: this.existingBranch().id,
+            name: model.name,
+            slug: model.slug,
+            ...this.buildOptionalFields(model),
+        };
+        await this.branchService.updateAsync(updateData);
+        this.onSaveSuccess('Branch updated successfully.');
+    }
+    async createBranch() {
+        const model = this.formModel();
+        const createData = {
+            companyId: model.companyId,
+            name: model.name,
+            slug: model.slug,
+            ...this.buildOptionalFields(model),
+        };
+        await this.branchService.insertAsync(createData);
+        this.onSaveSuccess('Branch created successfully.');
+    }
+    buildOptionalFields(model) {
+        return {
+            email: model.email || undefined,
+            phone: model.phone || undefined,
+            address: model.address || undefined,
+            isActive: model.isActive,
+        };
+    }
+    onSaveSuccess(message) {
+        this.messageService.add({ severity: 'success', summary: 'Success', detail: message });
+    }
+    getTargetCompanyId() {
+        return this.existingBranch()?.companyId || this.formModel().companyId || null;
+    }
+    navigateToList() {
+        const companyId = this.getTargetCompanyId();
         this.router.navigate(['/administration/branch'], {
             queryParams: companyId ? { companyId } : {},
         });
     }
+    onCancel() {
+        this.navigateToList();
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: BranchFormComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
     static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.1.3", type: BranchFormComponent, isStandalone: true, selector: "lib-branch-form", ngImport: i0, template: `
     <p-card>
@@ -2070,7 +1559,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-branch-form',
-                    standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     imports: [AngularModule, PrimeModule, FormField],
                     template: `
@@ -2226,15 +1714,18 @@ class BranchListComponent {
             if (this.initialized)
                 return;
             this.initialized = true;
-            // Load companies for dropdown
-            this.companyService.fetchList('', {
-                pagination: { currentPage: 0, pageSize: 100 },
+            // Use untracked to avoid nested effect error when initializing resources
+            untracked(() => {
+                // Load companies for dropdown
+                this.companyService.fetchList('', {
+                    pagination: { currentPage: 0, pageSize: 100 },
+                });
+                // Check for company ID from query params or use current company
+                // p-table's onLazyLoad will handle the initial data fetch
+                const queryCompanyId = params?.get('companyId') || null;
+                const currentCompanyId = this.authState.company()?.id;
+                this.selectedCompanyId.set(queryCompanyId || currentCompanyId || null);
             });
-            // Check for company ID from query params or use current company
-            // p-table's onLazyLoad will handle the initial data fetch
-            const queryCompanyId = params?.get('companyId') || null;
-            const currentCompanyId = this.authState.company()?.id;
-            this.selectedCompanyId.set(queryCompanyId || currentCompanyId || null);
         });
     }
     loadBranches() {
@@ -2396,7 +1887,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-branch-list',
-                    standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     imports: [AngularModule, PrimeModule, TagModule, HasPermissionDirective],
                     template: `
@@ -2603,44 +2093,22 @@ class CompanyFormComponent {
         }
         this.isLoading.set(true);
         try {
-            const model = this.formModel();
-            if (this.isEditMode() && this.existingCompany()) {
-                // Update existing company
+            const isEdit = this.isEditMode() && this.existingCompany();
+            if (isEdit) {
                 const updateData = {
                     id: this.existingCompany().id,
-                    name: model.name,
-                    slug: model.slug,
-                    email: model.email || undefined,
-                    phone: model.phone || undefined,
-                    website: model.website || undefined,
-                    address: model.address || undefined,
-                    isActive: model.isActive,
+                    ...this.buildCompanyData(),
                 };
                 await this.companyService.updateAsync(updateData);
-                this.messageService.add({
-                    severity: 'success',
-                    summary: 'Success',
-                    detail: 'Company updated successfully.',
-                });
             }
             else {
-                // Create new company
-                const createData = {
-                    name: model.name,
-                    slug: model.slug,
-                    email: model.email || undefined,
-                    phone: model.phone || undefined,
-                    website: model.website || undefined,
-                    address: model.address || undefined,
-                    isActive: model.isActive,
-                };
-                await this.companyService.insertAsync(createData);
-                this.messageService.add({
-                    severity: 'success',
-                    summary: 'Success',
-                    detail: 'Company created successfully.',
-                });
+                await this.companyService.insertAsync(this.buildCompanyData());
             }
+            this.messageService.add({
+                severity: 'success',
+                summary: 'Success',
+                detail: `Company ${isEdit ? 'updated' : 'created'} successfully.`,
+            });
             this.router.navigate(['/administration/company']);
         }
         catch {
@@ -2653,6 +2121,19 @@ class CompanyFormComponent {
     onCancel() {
         this.router.navigate(['/administration/company']);
     }
+    /** Build company data from form model */
+    buildCompanyData() {
+        const model = this.formModel();
+        return {
+            name: model.name,
+            slug: model.slug,
+            email: model.email || undefined,
+            phone: model.phone || undefined,
+            website: model.website || undefined,
+            address: model.address || undefined,
+            isActive: model.isActive,
+        };
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.3", ngImport: i0, type: CompanyFormComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
     static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.1.3", type: CompanyFormComponent, isStandalone: true, selector: "lib-company-form", ngImport: i0, template: `
     <p-card>
@@ -2766,7 +2247,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-company-form',
-                    standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     imports: [AngularModule, PrimeModule, FormField],
                     template: `
@@ -2903,11 +2383,6 @@ class CompanyListComponent {
     isLoading = this.companyService.isLoading;
     /** Total count from service */
     total = this.companyService.total;
-    loadCompanies() {
-        this.companyService.fetchList('', {
-            pagination: { currentPage: 0, pageSize: 10 },
-        });
-    }
     onLazyLoad(event) {
         const first = event.first ?? 0;
         const rows = event.rows ?? 10;
@@ -3044,7 +2519,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-company-list',
-                    standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     imports: [AngularModule, PrimeModule, TagModule, HasPermissionDirective],
                     template: `
@@ -3168,21 +2642,15 @@ class ForgotPasswordPageComponent {
         }
         this.isLoading.set(true);
         const email = this.formModel().email;
+        // Always show success (security: don't reveal if email exists)
         this.authApi
             .forgotPassword(email)
-            .pipe(takeUntilDestroyed(this.destroyRef))
-            .subscribe({
-            next: () => {
-                this.isLoading.set(false);
-                this.submittedEmail.set(email);
-                this.emailSent.set(true);
-            },
-            error: () => {
-                this.isLoading.set(false);
-                this.submittedEmail.set(email);
-                this.emailSent.set(true);
-            },
-        });
+            .pipe(takeUntilDestroyed(this.destroyRef), tap({ next: () => this.showEmailSent(email), error: () => this.showEmailSent(email) }), finalize(() => this.isLoading.set(false)))
+            .subscribe();
+    }
+    showEmailSent(email) {
+        this.submittedEmail.set(email);
+        this.emailSent.set(true);
     }
     resetForm() {
         this.emailSent.set(false);
@@ -3273,7 +2741,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-forgot-password-page',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, FormField, AppFloatingConfigurator],
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     template: `
@@ -3362,12 +2829,6 @@ var forgotPasswordPage_component = /*#__PURE__*/Object.freeze({
     ForgotPasswordPageComponent: ForgotPasswordPageComponent
 });
 
-/**
- * Login Page Component
- * Multi-step authentication flow:
- * - Step 1: Email/Password credentials
- * - Step 2: Company/Branch selection (when company feature enabled and user has multiple)
- */
 class LoginPageComponent {
     destroyRef = inject(DestroyRef);
     appConfig = inject(APP_CONFIG);
@@ -3378,52 +2839,32 @@ class LoginPageComponent {
     currentStep = signal('credentials', ...(ngDevMode ? [{ debugName: "currentStep" }] : []));
     isLoading = signal(false, ...(ngDevMode ? [{ debugName: "isLoading" }] : []));
     unverifiedEmail = signal('', ...(ngDevMode ? [{ debugName: "unverifiedEmail" }] : []));
-    // ============================================
-    // Login Form (Signal Forms)
-    // ============================================
-    /** Login form model */
     loginFormModel = signal({
         email: '',
         password: '',
         rememberMe: true,
     }, ...(ngDevMode ? [{ debugName: "loginFormModel" }] : []));
-    /** Login form with validation schema */
     loginForm = form(this.loginFormModel, (f) => {
         required(f.email, { message: 'Email is required' });
         email(f.email, { message: 'Please enter a valid email address' });
         required(f.password, { message: 'Password is required' });
-        minLength(f.password, 6, { message: 'Password must be at least 6 characters' });
+        minLength(f.password, 8, { message: 'Password must be at least 8 characters' });
     });
-    /** Check if login form is valid */
     isLoginFormValid = computed(() => this.loginForm().valid(), ...(ngDevMode ? [{ debugName: "isLoginFormValid" }] : []));
-    // ============================================
-    // Selection Form (Signal Forms)
-    // ============================================
-    /** Selection form model */
     selectionFormModel = signal({
         companyId: '',
         branchId: '',
         rememberSelection: true,
     }, ...(ngDevMode ? [{ debugName: "selectionFormModel" }] : []));
-    /** Selection form with validation schema */
     selectionForm = form(this.selectionFormModel, (f) => {
         required(f.companyId, { message: 'Please select a company' });
         required(f.branchId, { message: 'Please select a branch' });
     });
-    /** Check if selection form is valid */
     isSelectionFormValid = computed(() => this.selectionForm().valid(), ...(ngDevMode ? [{ debugName: "isSelectionFormValid" }] : []));
-    /** Whether company feature is enabled */
     companyFeatureEnabled = computed(() => isCompanyFeatureEnabled(this.appConfig), ...(ngDevMode ? [{ debugName: "companyFeatureEnabled" }] : []));
-    // ============================================
-    // Company Selection State (Step 2)
-    // ============================================
-    /** Session ID for company selection */
     sessionId = null;
-    /** Available companies */
     companies = signal([], ...(ngDevMode ? [{ debugName: "companies" }] : []));
-    /** User's name */
     userName = signal('', ...(ngDevMode ? [{ debugName: "userName" }] : []));
-    /** Branches for selected company */
     branches = computed(() => {
         const companyId = this.selectionFormModel().companyId;
         if (!companyId)
@@ -3432,17 +2873,12 @@ class LoginPageComponent {
         return company?.branches ?? [];
     }, ...(ngDevMode ? [{ debugName: "branches" }] : []));
     constructor() {
-        // Effect to restore pending company selection state (e.g., on page refresh during Step 2)
         effect(() => {
             if (this.authState.requiresCompanySelection()) {
                 this.restorePendingSelectionState();
             }
         });
     }
-    /**
-     * Restores pending company selection state from auth service.
-     * Called when user refreshes page during Step 2 of login flow.
-     */
     restorePendingSelectionState() {
         const availableCompanies = this.authState.availableCompanies();
         const sessionId = this.authState.selectionSessionId();
@@ -3455,9 +2891,6 @@ class LoginPageComponent {
             this.autoSelectIfSingle();
         }
     }
-    // ============================================
-    // Step 1: Login
-    // ============================================
     onSubmit() {
         if (!this.isLoginFormValid()) {
             this.messageService.add({
@@ -3502,23 +2935,22 @@ class LoginPageComponent {
                     this.authState.navigateAfterLogin(this.returnUrl());
                 }
             },
-            error: () => {
+            error: (error) => {
                 this.isLoading.set(false);
-                // Error toast handled by global interceptor
+                const message = error?.error?.message || 'Login failed. Please try again.';
+                this.messageService.add({
+                    severity: 'error',
+                    summary: 'Login Failed',
+                    detail: message,
+                });
             },
         });
     }
-    // ============================================
-    // Step 2: Company Selection
-    // ============================================
-    /** Handle company selection change */
     onCompanyChange() {
-        // Reset branch when company changes
         this.selectionFormModel.update((model) => ({
             ...model,
             branchId: '',
         }));
-        // Auto-select if only one branch
         const branches = this.branches();
         if (branches.length === 1) {
             this.selectionFormModel.update((model) => ({
@@ -3558,7 +2990,6 @@ class LoginPageComponent {
             .subscribe({
             next: (response) => {
                 this.isLoading.set(false);
-                // Response is unwrapped - LoginResponse directly
                 this.authState.setLoginState(response);
                 this.messageService.add({
                     severity: 'success',
@@ -3569,7 +3000,6 @@ class LoginPageComponent {
             },
             error: () => {
                 this.isLoading.set(false);
-                // Error toast handled by global interceptor
             },
         });
     }
@@ -3604,15 +3034,10 @@ class LoginPageComponent {
             },
             error: () => {
                 this.isLoading.set(false);
-                // Error toast handled by global interceptor
             },
         });
     }
-    // ============================================
-    // Helpers
-    // ============================================
     autoSelectIfSingle() {
-        // Auto-select if only one company
         if (this.companies().length === 1) {
             this.selectionFormModel.update((model) => ({
                 ...model,
@@ -3620,7 +3045,6 @@ class LoginPageComponent {
             }));
             this.onCompanyChange();
         }
-        // Try to restore from storage
         const storedCompanyId = this.authState.getStoredCompanyId();
         const storedBranchId = this.authState.getStoredBranchId();
         if (storedCompanyId) {
@@ -3845,7 +3269,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-login-page',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, FormField, AppFloatingConfigurator],
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     template: `
@@ -4125,6 +3548,10 @@ class ProfilePageComponent {
     // Show bottom row only if at least one section is visible
     showBottomRow = computed(() => this.showCompanySection() || this.showPermissionsSection(), ...(ngDevMode ? [{ debugName: "showBottomRow" }] : []));
     // Form
+    originalFormModel = signal({
+        name: '',
+        phone: '',
+    }, ...(ngDevMode ? [{ debugName: "originalFormModel" }] : []));
     formModel = signal({
         name: '',
         phone: '',
@@ -4136,6 +3563,11 @@ class ProfilePageComponent {
         const model = this.formModel();
         return model.name.trim().length > 0;
     }, ...(ngDevMode ? [{ debugName: "isFormValid" }] : []));
+    isFormDirty = computed(() => {
+        const current = this.formModel();
+        const original = this.originalFormModel();
+        return current.name !== original.name || current.phone !== original.phone;
+    }, ...(ngDevMode ? [{ debugName: "isFormDirty" }] : []));
     // Password form
     passwordModel = signal({
         currentPassword: '',
@@ -4196,10 +3628,12 @@ class ProfilePageComponent {
     loadUserData() {
         const user = this.authState.user();
         if (user) {
-            this.formModel.set({
+            const initialValues = {
                 name: user.name ?? '',
                 phone: user.phone ?? '',
-            });
+            };
+            this.originalFormModel.set(initialValues);
+            this.formModel.set(initialValues);
             // Load profile picture URL (only if storage is enabled)
             if (user.profilePictureId && isFeatureEnabled(this.appConfig, 'storage')) {
                 this.fileUrlService
@@ -4316,7 +3750,7 @@ class ProfilePageComponent {
         };
         this.userService
             .updateProfile(updateData)
-            .pipe(takeUntilDestroyed(this.destroyRef))
+            .pipe(takeUntilDestroyed(this.destroyRef), finalize(() => this.isLoading.set(false)))
             .subscribe({
             next: (response) => {
                 if (response.success && response.data) {
@@ -4326,17 +3760,20 @@ class ProfilePageComponent {
                         name: response.data.name,
                         phone: response.data.phone ?? null,
                     });
+                    // Update original form model to reset dirty state
+                    this.originalFormModel.set({
+                        name: response.data.name,
+                        phone: response.data.phone ?? '',
+                    });
                     this.messageService.add({
                         severity: 'success',
                         summary: 'Success',
                         detail: 'Profile updated successfully',
                     });
                 }
-                this.isLoading.set(false);
             },
             error: () => {
                 // Error toast handled by global interceptor
-                this.isLoading.set(false);
             },
         });
     }
@@ -4353,7 +3790,7 @@ class ProfilePageComponent {
             currentPassword: model.currentPassword,
             newPassword: model.newPassword,
         })
-            .pipe(takeUntilDestroyed(this.destroyRef))
+            .pipe(takeUntilDestroyed(this.destroyRef), finalize(() => this.isPasswordLoading.set(false)))
             .subscribe({
             next: () => {
                 this.messageService.add({
@@ -4367,11 +3804,9 @@ class ProfilePageComponent {
                     newPassword: '',
                     confirmPassword: '',
                 });
-                this.isPasswordLoading.set(false);
             },
             error: () => {
                 // Error toast handled by global interceptor
-                this.isPasswordLoading.set(false);
             },
         });
     }
@@ -4463,7 +3898,7 @@ class ProfilePageComponent {
                 icon="pi pi-check"
                 type="submit"
                 [loading]="isLoading()"
-                [disabled]="!isFormValid() || isLoading()" />
+                [disabled]="!isFormValid() || !isFormDirty() || isLoading()" />
             </div>
           </form>
         </div>
@@ -4633,7 +4068,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-profile-page',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, FormField, FileUploaderComponent],
                     template: `
     <!-- Page Header -->
@@ -4722,7 +4156,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
                 icon="pi pi-check"
                 type="submit"
                 [loading]="isLoading()"
-                [disabled]="!isFormValid() || isLoading()" />
+                [disabled]="!isFormValid() || !isFormDirty() || isLoading()" />
             </div>
           </form>
         </div>
@@ -4922,7 +4356,9 @@ class RegisterPageComponent {
         required(f.email, { message: 'Email is required' });
         email(f.email, { message: 'Please enter a valid email address' });
         required(f.password, { message: 'Password is required' });
-        minLength(f.password, 6, { message: 'Password must be at least 6 characters' });
+        minLength(f.password, 8, {
+            message: 'Password must be at least 8 characters',
+        });
         required(f.confirmPassword, { message: 'Please confirm your password' });
     });
     companyFormModel = signal({
@@ -4942,7 +4378,7 @@ class RegisterPageComponent {
         const userModel = this.userFormModel();
         const userValid = userModel.name.trim().length >= 2 &&
             userModel.email.includes('@') &&
-            userModel.password.length >= 6 &&
+            userModel.password.length >= 8 &&
             userModel.confirmPassword.length > 0 &&
             this.passwordsMatch();
         if (!isCompanyFeatureEnabled(this.appConfig))
@@ -5040,7 +4476,6 @@ class RegisterPageComponent {
                         user: response.user,
                         company: response.company,
                         branch: response.branch,
-                        companyFeatureEnabled: response.companyFeatureEnabled,
                     });
                     this.messageService.add({
                         severity: 'success',
@@ -5052,7 +4487,6 @@ class RegisterPageComponent {
             },
             error: () => {
                 this.isLoading.set(false);
-                // Error toast handled by global interceptor
             },
         });
     }
@@ -5068,7 +4502,8 @@ class RegisterPageComponent {
         >
           <div
             class="py-8 px-4 sm:py-10 sm:px-8 md:py-12 md:px-12 w-full sm:w-[650px] max-w-[95vw] sm:max-w-[90vw]"
-            style="border-radius: var(--p-content-border-radius); background: var(--p-content-background)">
+            style="border-radius: var(--p-content-border-radius); background: var(--p-content-background)"
+          >
             <div class="text-center mb-6">
               <div class="text-3xl font-medium mb-4 text-color">
                 Create Account
@@ -5134,7 +4569,7 @@ class RegisterPageComponent {
                     id="password"
                     type="password"
                     [formField]="userForm.password"
-                    placeholder="Min. 6 characters"
+                    placeholder="Min. 8 characters"
                     class="w-full"
                     autocomplete="new-password"
                   />
@@ -5154,110 +4589,115 @@ class RegisterPageComponent {
                     autocomplete="new-password"
                   />
                   @if (!passwordsMatch() && userFormModel().confirmPassword) {
-                  <small class="text-danger block mt-2"
-                    >Passwords do not match</small
-                  >
+                    <small class="text-danger block mt-2"
+                      >Passwords do not match</small
+                    >
                   }
                 </div>
               </div>
 
               @if (companyFeatureEnabled()) {
-              <div class="border-t border-surface pt-6 mt-6">
-                <div class="text-center mb-6">
-                  <div class="text-2xl font-medium mb-2 text-color">
-                    Company Details
-                  </div>
-                  <span class="text-muted-color font-medium"
-                    >Join existing or create new company</span
-                  >
-                </div>
-
-                <div class="mb-4">
-                  <label class="p-checkbox-native" (click)="onCreateCompanyToggle()">
-                    <input
-                      type="checkbox"
-                      [formField]="companyForm.createNewCompany"
-                    />
-                    <span>Create new company</span>
-                  </label>
-                </div>
-
-                @if (!companyFormModel().createNewCompany) {
-                <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
-                  <div>
-                    <label for="companySlug" class="block font-medium mb-2"
-                      >Company Code</label
-                    >
-                    <input
-                      pInputText
-                      id="companySlug"
-                      [formField]="companyForm.companySlug"
-                      placeholder="Company code/slug"
-                      class="w-full"
-                    />
-                    <small class="text-muted-color"
-                      >Enter company code to join</small
+                <div class="border-t border-surface pt-6 mt-6">
+                  <div class="text-center mb-6">
+                    <div class="text-2xl font-medium mb-2 text-color">
+                      Company Details
+                    </div>
+                    <span class="text-muted-color font-medium"
+                      >Join existing or create new company</span
                     >
                   </div>
 
-                  <div>
-                    <label for="branchSlug" class="block font-medium mb-2"
-                      >Branch Code</label
+                  <div class="mb-4">
+                    <label
+                      class="p-checkbox-native"
+                      (click)="onCreateCompanyToggle()"
                     >
-                    <input
-                      pInputText
-                      id="branchSlug"
-                      [formField]="companyForm.branchSlug"
-                      placeholder="Branch code (optional)"
-                      class="w-full"
-                    />
+                      <input
+                        type="checkbox"
+                        [formField]="companyForm.createNewCompany"
+                      />
+                      <span>Create new company</span>
+                    </label>
                   </div>
-                </div>
-                } @else {
-                <div class="mb-4">
-                  <label for="newCompanyName" class="block font-medium mb-2"
-                    >Company Name *</label
-                  >
-                  <input
-                    pInputText
-                    id="newCompanyName"
-                    [formField]="companyForm.newCompanyName"
-                    placeholder="Your company name"
-                    class="w-full"
-                  />
-                </div>
 
-                <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
-                  <div>
-                    <label for="newCompanyPhone" class="block font-medium mb-2"
-                      >Company Phone</label
-                    >
-                    <input
-                      pInputText
-                      id="newCompanyPhone"
-                      [formField]="companyForm.newCompanyPhone"
-                      placeholder="Company phone"
-                      class="w-full"
-                    />
-                  </div>
+                  @if (!companyFormModel().createNewCompany) {
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
+                      <div>
+                        <label for="companySlug" class="block font-medium mb-2"
+                          >Company Code</label
+                        >
+                        <input
+                          pInputText
+                          id="companySlug"
+                          [formField]="companyForm.companySlug"
+                          placeholder="Company code/slug"
+                          class="w-full"
+                        />
+                        <small class="text-muted-color"
+                          >Enter company code to join</small
+                        >
+                      </div>
+
+                      <div>
+                        <label for="branchSlug" class="block font-medium mb-2"
+                          >Branch Code</label
+                        >
+                        <input
+                          pInputText
+                          id="branchSlug"
+                          [formField]="companyForm.branchSlug"
+                          placeholder="Branch code (optional)"
+                          class="w-full"
+                        />
+                      </div>
+                    </div>
+                  } @else {
+                    <div class="mb-4">
+                      <label for="newCompanyName" class="block font-medium mb-2"
+                        >Company Name *</label
+                      >
+                      <input
+                        pInputText
+                        id="newCompanyName"
+                        [formField]="companyForm.newCompanyName"
+                        placeholder="Your company name"
+                        class="w-full"
+                      />
+                    </div>
 
-                  <div>
-                    <label
-                      for="newCompanyAddress"
-                      class="block font-medium mb-2"
-                      >Address</label
-                    >
-                    <input
-                      pInputText
-                      id="newCompanyAddress"
-                      [formField]="companyForm.newCompanyAddress"
-                      placeholder="Company address"
-                      class="w-full"
-                    />
-                  </div>
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
+                      <div>
+                        <label
+                          for="newCompanyPhone"
+                          class="block font-medium mb-2"
+                          >Company Phone</label
+                        >
+                        <input
+                          pInputText
+                          id="newCompanyPhone"
+                          [formField]="companyForm.newCompanyPhone"
+                          placeholder="Company phone"
+                          class="w-full"
+                        />
+                      </div>
+
+                      <div>
+                        <label
+                          for="newCompanyAddress"
+                          class="block font-medium mb-2"
+                          >Address</label
+                        >
+                        <input
+                          pInputText
+                          id="newCompanyAddress"
+                          [formField]="companyForm.newCompanyAddress"
+                          placeholder="Company address"
+                          class="w-full"
+                        />
+                      </div>
+                    </div>
+                  }
                 </div>
-                }
-              </div>
               }
 
               <p-button
@@ -5288,7 +4728,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-register-page',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, FormField, AppFloatingConfigurator],
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     template: `
@@ -5302,7 +4741,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
         >
           <div
             class="py-8 px-4 sm:py-10 sm:px-8 md:py-12 md:px-12 w-full sm:w-[650px] max-w-[95vw] sm:max-w-[90vw]"
-            style="border-radius: var(--p-content-border-radius); background: var(--p-content-background)">
+            style="border-radius: var(--p-content-border-radius); background: var(--p-content-background)"
+          >
             <div class="text-center mb-6">
               <div class="text-3xl font-medium mb-4 text-color">
                 Create Account
@@ -5368,7 +4808,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
                     id="password"
                     type="password"
                     [formField]="userForm.password"
-                    placeholder="Min. 6 characters"
+                    placeholder="Min. 8 characters"
                     class="w-full"
                     autocomplete="new-password"
                   />
@@ -5388,110 +4828,115 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
                     autocomplete="new-password"
                   />
                   @if (!passwordsMatch() && userFormModel().confirmPassword) {
-                  <small class="text-danger block mt-2"
-                    >Passwords do not match</small
-                  >
+                    <small class="text-danger block mt-2"
+                      >Passwords do not match</small
+                    >
                   }
                 </div>
               </div>
 
               @if (companyFeatureEnabled()) {
-              <div class="border-t border-surface pt-6 mt-6">
-                <div class="text-center mb-6">
-                  <div class="text-2xl font-medium mb-2 text-color">
-                    Company Details
-                  </div>
-                  <span class="text-muted-color font-medium"
-                    >Join existing or create new company</span
-                  >
-                </div>
-
-                <div class="mb-4">
-                  <label class="p-checkbox-native" (click)="onCreateCompanyToggle()">
-                    <input
-                      type="checkbox"
-                      [formField]="companyForm.createNewCompany"
-                    />
-                    <span>Create new company</span>
-                  </label>
-                </div>
-
-                @if (!companyFormModel().createNewCompany) {
-                <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
-                  <div>
-                    <label for="companySlug" class="block font-medium mb-2"
-                      >Company Code</label
-                    >
-                    <input
-                      pInputText
-                      id="companySlug"
-                      [formField]="companyForm.companySlug"
-                      placeholder="Company code/slug"
-                      class="w-full"
-                    />
-                    <small class="text-muted-color"
-                      >Enter company code to join</small
+                <div class="border-t border-surface pt-6 mt-6">
+                  <div class="text-center mb-6">
+                    <div class="text-2xl font-medium mb-2 text-color">
+                      Company Details
+                    </div>
+                    <span class="text-muted-color font-medium"
+                      >Join existing or create new company</span
                     >
                   </div>
 
-                  <div>
-                    <label for="branchSlug" class="block font-medium mb-2"
-                      >Branch Code</label
+                  <div class="mb-4">
+                    <label
+                      class="p-checkbox-native"
+                      (click)="onCreateCompanyToggle()"
                     >
-                    <input
-                      pInputText
-                      id="branchSlug"
-                      [formField]="companyForm.branchSlug"
-                      placeholder="Branch code (optional)"
-                      class="w-full"
-                    />
+                      <input
+                        type="checkbox"
+                        [formField]="companyForm.createNewCompany"
+                      />
+                      <span>Create new company</span>
+                    </label>
                   </div>
-                </div>
-                } @else {
-                <div class="mb-4">
-                  <label for="newCompanyName" class="block font-medium mb-2"
-                    >Company Name *</label
-                  >
-                  <input
-                    pInputText
-                    id="newCompanyName"
-                    [formField]="companyForm.newCompanyName"
-                    placeholder="Your company name"
-                    class="w-full"
-                  />
-                </div>
 
-                <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
-                  <div>
-                    <label for="newCompanyPhone" class="block font-medium mb-2"
-                      >Company Phone</label
-                    >
-                    <input
-                      pInputText
-                      id="newCompanyPhone"
-                      [formField]="companyForm.newCompanyPhone"
-                      placeholder="Company phone"
-                      class="w-full"
-                    />
-                  </div>
+                  @if (!companyFormModel().createNewCompany) {
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
+                      <div>
+                        <label for="companySlug" class="block font-medium mb-2"
+                          >Company Code</label
+                        >
+                        <input
+                          pInputText
+                          id="companySlug"
+                          [formField]="companyForm.companySlug"
+                          placeholder="Company code/slug"
+                          class="w-full"
+                        />
+                        <small class="text-muted-color"
+                          >Enter company code to join</small
+                        >
+                      </div>
+
+                      <div>
+                        <label for="branchSlug" class="block font-medium mb-2"
+                          >Branch Code</label
+                        >
+                        <input
+                          pInputText
+                          id="branchSlug"
+                          [formField]="companyForm.branchSlug"
+                          placeholder="Branch code (optional)"
+                          class="w-full"
+                        />
+                      </div>
+                    </div>
+                  } @else {
+                    <div class="mb-4">
+                      <label for="newCompanyName" class="block font-medium mb-2"
+                        >Company Name *</label
+                      >
+                      <input
+                        pInputText
+                        id="newCompanyName"
+                        [formField]="companyForm.newCompanyName"
+                        placeholder="Your company name"
+                        class="w-full"
+                      />
+                    </div>
 
-                  <div>
-                    <label
-                      for="newCompanyAddress"
-                      class="block font-medium mb-2"
-                      >Address</label
-                    >
-                    <input
-                      pInputText
-                      id="newCompanyAddress"
-                      [formField]="companyForm.newCompanyAddress"
-                      placeholder="Company address"
-                      class="w-full"
-                    />
-                  </div>
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4 mb-4">
+                      <div>
+                        <label
+                          for="newCompanyPhone"
+                          class="block font-medium mb-2"
+                          >Company Phone</label
+                        >
+                        <input
+                          pInputText
+                          id="newCompanyPhone"
+                          [formField]="companyForm.newCompanyPhone"
+                          placeholder="Company phone"
+                          class="w-full"
+                        />
+                      </div>
+
+                      <div>
+                        <label
+                          for="newCompanyAddress"
+                          class="block font-medium mb-2"
+                          >Address</label
+                        >
+                        <input
+                          pInputText
+                          id="newCompanyAddress"
+                          [formField]="companyForm.newCompanyAddress"
+                          placeholder="Company address"
+                          class="w-full"
+                        />
+                      </div>
+                    </div>
+                  }
                 </div>
-                }
-              </div>
               }
 
               <p-button
@@ -5538,7 +4983,7 @@ class ResetPasswordPageComponent {
     formModel = signal({ newPassword: '', confirmPassword: '' }, ...(ngDevMode ? [{ debugName: "formModel" }] : []));
     resetForm = form(this.formModel, (f) => {
         required(f.newPassword, { message: 'New password is required' });
-        minLength(f.newPassword, 6, { message: 'Password must be at least 6 characters' });
+        minLength(f.newPassword, 8, { message: 'Password must be at least 8 characters' });
         required(f.confirmPassword, { message: 'Please confirm your password' });
     });
     passwordMismatch = computed(() => {
@@ -5571,10 +5016,9 @@ class ResetPasswordPageComponent {
         const newPassword = this.formModel().newPassword;
         this.authApi
             .resetPassword(this.token, newPassword)
-            .pipe(takeUntilDestroyed(this.destroyRef))
+            .pipe(takeUntilDestroyed(this.destroyRef), finalize(() => this.isLoading.set(false)))
             .subscribe({
             next: () => {
-                this.isLoading.set(false);
                 this.messageService.add({
                     severity: 'success',
                     summary: 'Success',
@@ -5583,7 +5027,6 @@ class ResetPasswordPageComponent {
                 this.pageState.set('success');
             },
             error: (error) => {
-                this.isLoading.set(false);
                 const message = error.error?.message || '';
                 // Show invalid-token state for expired/invalid token errors
                 if (message.toLowerCase().includes('expired') || message.toLowerCase().includes('invalid')) {
@@ -5711,7 +5154,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-reset-password-page',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, FormField, AppFloatingConfigurator],
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     template: `
@@ -5888,8 +5330,7 @@ class UserFormComponent {
         // Basic validation
         const nameValid = model.name.trim().length > 0;
         const emailValid = model.email.includes('@');
-        // Password validation - required only for new users
-        const passwordValid = isEdit ? true : model.password.length >= 6;
+        const passwordValid = isEdit ? true : model.password.length >= 8;
         return nameValid && emailValid && passwordValid;
     }, ...(ngDevMode ? [{ debugName: "isFormValid" }] : []));
     constructor() {
@@ -5907,29 +5348,27 @@ class UserFormComponent {
     loadUser(id) {
         this.isLoading.set(true);
         this.userService.findById(id)
-            .pipe(takeUntilDestroyed(this.destroyRef))
+            .pipe(takeUntilDestroyed(this.destroyRef), finalize(() => this.isLoading.set(false)))
             .subscribe({
             next: (response) => {
                 if (response.success && response.data) {
                     this.existingUser.set(response.data);
-                    this.formModel.set({
-                        name: response.data.name,
-                        email: response.data.email,
-                        password: '',
-                        phone: response.data.phone || '',
-                        isActive: response.data.isActive,
-                        emailVerified: response.data.emailVerified,
-                    });
+                    this.formModel.set(this.toFormModel(response.data));
                 }
-                this.isLoading.set(false);
-            },
-            error: () => {
-                // Error toast handled by global interceptor
-                this.router.navigate(['/administration/users']);
-                this.isLoading.set(false);
             },
+            error: () => this.router.navigate(['/administration/users']),
         });
     }
+    toFormModel(user) {
+        return {
+            name: user.name,
+            email: user.email,
+            password: '',
+            phone: user.phone || '',
+            isActive: user.isActive,
+            emailVerified: user.emailVerified,
+        };
+    }
     onSubmit() {
         if (!this.isFormValid()) {
             this.messageService.add({
@@ -5940,72 +5379,56 @@ class UserFormComponent {
             return;
         }
         this.isLoading.set(true);
-        const model = this.formModel();
         if (this.isEditMode() && this.existingUser()) {
-            // Update existing user
-            const updateData = {
-                id: this.existingUser().id,
-                name: model.name,
-                email: model.email,
-                phone: model.phone || undefined,
-                isActive: model.isActive,
-                emailVerified: model.emailVerified,
-            };
-            // Only include password if provided
-            if (model.password) {
-                updateData.password = model.password;
-            }
-            this.userService.update(updateData)
-                .pipe(takeUntilDestroyed(this.destroyRef))
-                .subscribe({
-                next: () => {
-                    this.messageService.add({
-                        severity: 'success',
-                        summary: 'Success',
-                        detail: 'User updated successfully.',
-                    });
-                    this.router.navigate(['/administration/users']);
-                    this.isLoading.set(false);
-                },
-                error: () => {
-                    // Error toast handled by global interceptor
-                    this.isLoading.set(false);
-                },
-            });
+            this.updateUser();
         }
         else {
-            // Create new user
-            const createData = {
-                name: model.name,
-                email: model.email,
-                password: model.password,
-                phone: model.phone || undefined,
-                isActive: model.isActive,
-                emailVerified: model.emailVerified,
-            };
-            this.userService.insert(createData)
-                .pipe(takeUntilDestroyed(this.destroyRef))
-                .subscribe({
-                next: (createResponse) => {
-                    // Auto-assign to company/branch if company feature enabled
-                    if (isCompanyFeatureEnabled(this.appConfig) && createResponse.success && createResponse.data) {
-                        const userId = createResponse.data.id;
-                        this.assignUserToCompanyAndBranch(userId);
-                    }
-                    this.messageService.add({
-                        severity: 'success',
-                        summary: 'Success',
-                        detail: 'User created successfully.',
-                    });
-                    this.router.navigate(['/administration/users']);
-                    this.isLoading.set(false);
-                },
-                error: () => {
-                    // Error toast handled by global interceptor
-                    this.isLoading.set(false);
-                },
-            });
+            this.createUser();
+        }
+    }
+    updateUser() {
+        const model = this.formModel();
+        const updateData = {
+            id: this.existingUser().id,
+            name: model.name,
+            email: model.email,
+            phone: model.phone || undefined,
+            isActive: model.isActive,
+            emailVerified: model.emailVerified,
+        };
+        if (model.password) {
+            updateData.password = model.password;
         }
+        this.userService.update(updateData)
+            .pipe(takeUntilDestroyed(this.destroyRef), finalize(() => this.isLoading.set(false)))
+            .subscribe({
+            next: () => this.onSaveSuccess('User updated successfully.'),
+        });
+    }
+    createUser() {
+        const model = this.formModel();
+        const createData = {
+            name: model.name,
+            email: model.email,
+            password: model.password,
+            phone: model.phone || undefined,
+            isActive: model.isActive,
+            emailVerified: model.emailVerified,
+        };
+        this.userService.insert(createData)
+            .pipe(takeUntilDestroyed(this.destroyRef), finalize(() => this.isLoading.set(false)))
+            .subscribe({
+            next: (response) => {
+                if (this.companyFeatureEnabled() && response.success && response.data) {
+                    this.assignUserToCompanyAndBranch(response.data.id);
+                }
+                this.onSaveSuccess('User created successfully.');
+            },
+        });
+    }
+    onSaveSuccess(message) {
+        this.messageService.add({ severity: 'success', summary: 'Success', detail: message });
+        this.router.navigate(['/administration/users']);
     }
     /**
      * Assign user to current company and branch
@@ -6144,7 +5567,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-user-form',
-                    standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     imports: [AngularModule, PrimeModule, FormField],
                     template: `
@@ -6258,34 +5680,19 @@ var userForm_component = /*#__PURE__*/Object.freeze({
     UserFormComponent: UserFormComponent
 });
 
-/**
- * User Company Permission Dialog
- * Shows all companies with checkboxes
- * Initially assigned companies are checked
- * Check to assign, uncheck to revoke
- */
 class UserCompanyPermissionDialogComponent {
     companyApi = inject(CompanyApiService);
     permissionApi = inject(UserPermissionApiService);
     messageService = inject(MessageService);
-    /** Dialog visibility */
     visible = input.required(...(ngDevMode ? [{ debugName: "visible" }] : []));
-    /** User to manage permissions for */
     user = input.required(...(ngDevMode ? [{ debugName: "user" }] : []));
-    /** Close event */
     closed = output();
-    /** Refresh event after changes */
     permissionsChanged = output();
-    /** Loading state */
     isLoading = signal(false, ...(ngDevMode ? [{ debugName: "isLoading" }] : []));
-    /** Saving state */
     isSaving = signal(false, ...(ngDevMode ? [{ debugName: "isSaving" }] : []));
-    /** Companies with assignment status */
     companies = signal([], ...(ngDevMode ? [{ debugName: "companies" }] : []));
-    /** Currently assigned company IDs */
     assignedCompanyIds = new Set();
     constructor() {
-        // Load companies and permissions when dialog becomes visible
         effect(() => {
             if (this.visible() && this.user()) {
                 this.loadData();
@@ -6298,23 +5705,19 @@ class UserCompanyPermissionDialogComponent {
             return;
         this.isLoading.set(true);
         try {
-            // Load all companies
             const companiesResponse = await firstValueFrom(this.companyApi.getAll('', {
                 pagination: { currentPage: 0, pageSize: 1000 },
                 filter: {},
                 select: [],
                 sort: {},
             }));
-            // Load user's assigned companies
             const assignedResponse = await firstValueFrom(this.permissionApi.getUserCompanies(currentUser.id));
-            // Build set of assigned company IDs
             this.assignedCompanyIds.clear();
             if (assignedResponse.data) {
                 assignedResponse.data.forEach((permission) => {
                     this.assignedCompanyIds.add(permission.companyId);
                 });
             }
-            // Map companies with assignment status
             const companiesWithStatus = (companiesResponse.data || []).map((company) => ({
                 ...company,
                 isAssigned: this.assignedCompanyIds.has(company.id),
@@ -6322,7 +5725,6 @@ class UserCompanyPermissionDialogComponent {
             this.companies.set(companiesWithStatus);
         }
         catch {
-            // Error toast handled by global interceptor
         }
         finally {
             this.isLoading.set(false);
@@ -6335,7 +5737,6 @@ class UserCompanyPermissionDialogComponent {
         this.isSaving.set(true);
         try {
             if (company.isAssigned) {
-                // Assign company
                 const response = await firstValueFrom(this.permissionApi.assignUserToCompany(currentUser.id, company.id));
                 if (response.success) {
                     this.assignedCompanyIds.add(company.id);
@@ -6348,7 +5749,6 @@ class UserCompanyPermissionDialogComponent {
                 }
             }
             else {
-                // Revoke company
                 const response = await firstValueFrom(this.permissionApi.revokeUserFromCompany(currentUser.id, company.id));
                 if (response.success) {
                     this.assignedCompanyIds.delete(company.id);
@@ -6362,9 +5762,7 @@ class UserCompanyPermissionDialogComponent {
             }
         }
         catch {
-            // Revert checkbox on error
             company.isAssigned = !company.isAssigned;
-            // Error toast handled by global interceptor
         }
         finally {
             this.isSaving.set(false);
@@ -6431,7 +5829,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-user-company-permission-dialog',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, DialogModule, ProgressSpinnerModule],
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     template: `
@@ -6489,76 +5886,42 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
                 }]
         }], ctorParameters: () => [], propDecorators: { visible: [{ type: i0.Input, args: [{ isSignal: true, alias: "visible", required: true }] }], user: [{ type: i0.Input, args: [{ isSignal: true, alias: "user", required: true }] }], closed: [{ type: i0.Output, args: ["closed"] }], permissionsChanged: [{ type: i0.Output, args: ["permissionsChanged"] }] } });
 
-/**
- * User Branch Permission Dialog
- *
- * Workflow:
- * 1. Dialog opens → Shows company dropdown with user's permitted companies
- * 2. User selects a company → Branches load for that company
- * 3. Branches show with checkboxes (checked = already assigned)
- * 4. Check to assign, uncheck to revoke
- *
- * Company dropdown only shows companies the user has company-level permissions for.
- * Branch permissions can only be assigned within user's permitted companies.
- */
 class UserBranchPermissionDialogComponent {
     branchApi = inject(BranchApiService);
     permissionApi = inject(UserPermissionApiService);
-    authState = inject(AuthStateService);
     messageService = inject(MessageService);
-    /** Dialog visibility */
     visible = input.required(...(ngDevMode ? [{ debugName: "visible" }] : []));
-    /** User to manage permissions for */
     user = input.required(...(ngDevMode ? [{ debugName: "user" }] : []));
-    /** Close event */
     closed = output();
-    /** Refresh event after changes */
     permissionsChanged = output();
-    /** Loading state */
     isLoading = signal(false, ...(ngDevMode ? [{ debugName: "isLoading" }] : []));
-    /** Saving state */
     isSaving = signal(false, ...(ngDevMode ? [{ debugName: "isSaving" }] : []));
-    /** Branches with assignment status */
     branches = signal([], ...(ngDevMode ? [{ debugName: "branches" }] : []));
-    /** Available companies (filtered by user's company permissions) */
     companies = signal([], ...(ngDevMode ? [{ debugName: "companies" }] : []));
-    /** Selected company ID */
     selectedCompanyId = null;
-    /** Current company from auth state */
-    currentCompany = computed(() => this.authState.company(), ...(ngDevMode ? [{ debugName: "currentCompany" }] : []));
-    /** Currently assigned branch IDs */
     assignedBranchIds = new Set();
     constructor() {
-        // Load user's companies and branches when dialog becomes visible
         effect(() => {
             if (this.visible() && this.user()) {
                 this.loadUserCompaniesAndData();
             }
         });
     }
-    /**
-     * Load user's assigned companies (does not auto-select or load branches)
-     */
     async loadUserCompaniesAndData() {
         const currentUser = this.user();
         if (!currentUser)
             return;
         try {
-            // Load user's company permissions
             const companiesResponse = await firstValueFrom(this.permissionApi.getUserCompanies(currentUser.id));
-            // Map to company dropdown options
             const userCompanies = (companiesResponse.data || []).map((permission) => ({
                 id: permission.companyId,
                 name: permission.companyName,
             }));
             this.companies.set(userCompanies);
-            // Clear selection and branches when dialog reopens
             this.selectedCompanyId = null;
             this.branches.set([]);
         }
-        catch {
-            // Error toast handled by global interceptor
-        }
+        catch { }
     }
     async loadData() {
         const currentUser = this.user();
@@ -6567,26 +5930,21 @@ class UserBranchPermissionDialogComponent {
             return;
         this.isLoading.set(true);
         try {
-            // Load all branches for selected company
             const branchesResponse = await firstValueFrom(this.branchApi.getAll('', {
                 pagination: { currentPage: 0, pageSize: 1000 },
                 filter: { companyId },
                 select: [],
                 sort: {},
             }));
-            // Load user's assigned branches
             const assignedResponse = await firstValueFrom(this.permissionApi.getUserBranches(currentUser.id));
-            // Build set of assigned branch IDs (filter by selected company)
             this.assignedBranchIds.clear();
             if (assignedResponse.data) {
                 assignedResponse.data.forEach((permission) => {
-                    // Filter by selected company
                     if (permission.companyId === companyId) {
                         this.assignedBranchIds.add(permission.branchId);
                     }
                 });
             }
-            // Map branches with assignment status
             const branchesWithStatus = (branchesResponse.data || []).map((branch) => ({
                 ...branch,
                 isAssigned: this.assignedBranchIds.has(branch.id),
@@ -6594,7 +5952,6 @@ class UserBranchPermissionDialogComponent {
             this.branches.set(branchesWithStatus);
         }
         catch {
-            // Error toast handled by global interceptor
         }
         finally {
             this.isLoading.set(false);
@@ -6612,7 +5969,6 @@ class UserBranchPermissionDialogComponent {
         this.isSaving.set(true);
         try {
             if (branch.isAssigned) {
-                // Assign branch
                 const response = await firstValueFrom(this.permissionApi.assignUserToBranch(currentUser.id, branch.id));
                 if (response.success) {
                     this.assignedBranchIds.add(branch.id);
@@ -6625,7 +5981,6 @@ class UserBranchPermissionDialogComponent {
                 }
             }
             else {
-                // Revoke branch
                 const response = await firstValueFrom(this.permissionApi.revokeUserFromBranch(currentUser.id, branch.id));
                 if (response.success) {
                     this.assignedBranchIds.delete(branch.id);
@@ -6639,9 +5994,7 @@ class UserBranchPermissionDialogComponent {
             }
         }
         catch {
-            // Revert checkbox on error
             branch.isAssigned = !branch.isAssigned;
-            // Error toast handled by global interceptor
         }
         finally {
             this.isSaving.set(false);
@@ -6727,7 +6080,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-user-branch-permission-dialog',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, DialogModule, ProgressSpinnerModule],
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     template: `
@@ -6849,12 +6201,14 @@ class UserListComponent {
         this.router.navigate(['/administration/users', user.id]);
     }
     onManageCompanyPermissions(user) {
-        this.selectedUser.set(user);
-        this.showCompanyDialog.set(true);
+        this.openPermissionDialog(user, this.showCompanyDialog);
     }
     onManageBranchPermissions(user) {
+        this.openPermissionDialog(user, this.showBranchDialog);
+    }
+    openPermissionDialog(user, dialogSignal) {
         this.selectedUser.set(user);
-        this.showBranchDialog.set(true);
+        dialogSignal.set(true);
     }
     onDelete(user) {
         this.confirmationService.confirm({
@@ -6996,7 +6350,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-user-list',
-                    standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     imports: [
                         AngularModule,
@@ -7217,13 +6570,11 @@ class VerifyEmailPageComponent {
         }
         this.isLoading.set(true);
         const email = this.resendFormModel().email;
+        // Always show success (security: don't reveal if email exists)
         this.authApi
             .resendVerification(email)
-            .pipe(takeUntilDestroyed(this.destroyRef))
-            .subscribe({
-            next: () => this.handleResendComplete(email),
-            error: () => this.handleResendComplete(email),
-        });
+            .pipe(takeUntilDestroyed(this.destroyRef), finalize(() => this.handleResendComplete(email)))
+            .subscribe();
     }
     handleResendComplete(email) {
         this.isLoading.set(false);
@@ -7366,7 +6717,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.3", ngImpor
             type: Component,
             args: [{
                     selector: 'lib-verify-email-page',
-                    standalone: true,
                     imports: [AngularModule, PrimeModule, FormField, AppFloatingConfigurator],
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     template: `
@@ -7511,5 +6861,5 @@ var verifyEmailPage_component = /*#__PURE__*/Object.freeze({
  * Generated bundle index. Do not edit.
  */
 
-export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateProviderAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isAuthEndpoint, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
+export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateProviderAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
 //# sourceMappingURL=flusys-ng-auth.mjs.map