@flusys/ng-auth 1.0.0-rc → 1.0.0

package/types/flusys-ng-auth.d.ts

@@ -1,4 +1,4 @@
-import { IMessageResponse, ApiResourceService, ISingleResponse, IUserProvider, IListResponse, IUserBasicInfo, ICompanyApiProvider, ICompanyBasicInfo, IUserPermissionProvider, IAuthStateProvider, IProfileRoleInfo, IProfileActionInfo, UploadFileFn } from '@flusys/ng-shared';
+import { IMessageResponse, ApiResourceService, ISingleResponse, ICompanyApiProvider, IListResponse, ICompanyBasicInfo, IAuthStateProvider, IUserPermissionProvider, IUserProvider, IUserBasicInfo, IProfileRoleInfo, IProfileActionInfo, UploadFileFn } from '@flusys/ng-shared';
 import * as rxjs from 'rxjs';
 import { Observable } from 'rxjs';
 import * as _angular_core from '@angular/core';
@@ -10,17 +10,10 @@ import * as _angular_forms_signals from '@angular/forms/signals';
 import * as _flusys_ng_auth from '@flusys/ng-auth';
 import * as _flusys_ng_core from '@flusys/ng-core';
 
-/**
- * Login Request Interface
- */
 interface ILoginRequest {
     email: string;
     password: string;
 }
-/**
- * Registration Request Interface
- * Supports both simple registration and company-based registration
- */
 interface IRegistrationRequest {
     name: string;
     email: string;
@@ -32,33 +25,19 @@ interface IRegistrationRequest {
     newCompanyPhone?: string;
     newCompanyAddress?: string;
 }
-/**
- * Select Company & Branch Request Interface
- * Used after login when user needs to select company and branch
- */
 interface ISelectRequest {
     sessionId: string;
     companyId: string;
     branchId: string;
 }
-/**
- * Switch Company Request Interface
- * Used to switch company/branch after login
- */
 interface ISwitchCompanyRequest {
     companyId: string;
     branchId: string;
 }
-/**
- * Change Password Request Interface
- */
 interface IChangePasswordRequest {
     currentPassword: string;
     newPassword: string;
 }
-/**
- * User Info Interface (used in responses)
- */
 interface IUserInfo {
     id: string;
     email: string;
@@ -70,84 +49,51 @@ interface IUserInfo {
     companyLogoId?: string;
     branchLogoId?: string;
 }
-/**
- * Company Info Interface (used in responses)
- */
 interface ICompanyInfo {
     id: string;
     name: string;
     slug?: string;
     logoId?: string | null;
 }
-/**
- * Branch Info Interface (used in responses)
- */
 interface IBranchInfo {
     id: string;
     name: string;
     slug?: string;
     logoId?: string | null;
 }
-/**
- * Branch Selection Info Interface (with additional fields)
- */
 interface IBranchSelectionInfo {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
 }
-/**
- * Company with Branches Interface (for selection response)
- */
 interface ICompanyWithBranches {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
     branches: IBranchSelectionInfo[];
 }
-/**
- * Login Response Interface
- * Returned on successful login with tokens
- */
 interface ILoginResponse {
     accessToken: string;
     refreshToken: string;
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
-    companyFeatureEnabled?: boolean;
 }
-/**
- * Me Response Interface
- * Returned by GET /auth/me endpoint
- * Contains only user data, no tokens
- */
 interface IMeResponse {
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
 }
-/**
- * Registration Response Interface
- * Returned on successful registration
- */
 interface IRegistrationResponse {
     accessToken?: string;
     refreshToken?: string;
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
-    companyFeatureEnabled?: boolean;
     requiresEmailVerification?: boolean;
 }
-/**
- * Company Selection Response Interface
- * Returned when user has multiple companies/branches to choose from
- */
 interface ICompanySelectionResponse {
     requiresSelection: true;
     sessionId: string;
@@ -155,41 +101,20 @@ interface ICompanySelectionResponse {
     user: IUserInfo;
     companies: ICompanyWithBranches[];
 }
-/**
- * Refresh Token Response Interface
- */
 interface IRefreshTokenResponse {
     accessToken: string;
     refreshToken?: string;
 }
-/**
- * Login Response when email verification required
- */
 interface ILoginRequiresEmailVerification {
     requiresEmailVerification: true;
     email: string;
     message: string;
 }
-/**
- * Auth Response Type - Can be login success, company selection, or email verification required
- */
 type AuthResponse = ILoginResponse | ICompanySelectionResponse | ILoginRequiresEmailVerification;
-/**
- * Type guard to check if response requires email verification
- */
 declare function isEmailVerificationRequired(response: AuthResponse): response is ILoginRequiresEmailVerification;
-/**
- * Type guard to check if response requires company selection
- */
 declare function isCompanySelectionResponse(response: AuthResponse): response is ICompanySelectionResponse;
-/**
- * Type guard to check if response is a successful login
- */
 declare function isLoginResponse(response: AuthResponse): response is ILoginResponse;
 
-/**
- * Create Company Branch Request Interface
- */
 interface ICreateBranchRequest {
     name: string;
     slug: string;
@@ -203,15 +128,9 @@ interface ICreateBranchRequest {
     isActive?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update Company Branch Request Interface
- */
 interface IUpdateBranchRequest extends Partial<Omit<ICreateBranchRequest, 'companyId'>> {
     id: string;
 }
-/**
- * Company Branch Response Interface
- */
 interface IBranch {
     id: string;
     name: string;
@@ -230,9 +149,6 @@ interface IBranch {
     updatedAt: Date | string;
 }
 
-/**
- * Create Company Request Interface
- */
 interface ICreateCompanyRequest {
     name: string;
     slug: string;
@@ -246,15 +162,9 @@ interface ICreateCompanyRequest {
     settings?: Record<string, unknown>;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update Company Request Interface
- */
 interface IUpdateCompanyRequest extends Partial<ICreateCompanyRequest> {
     id: string;
 }
-/**
- * Company Response Interface
- */
 interface ICompany {
     id: string;
     name: string;
@@ -273,88 +183,48 @@ interface ICompany {
     updatedAt: Date | string;
 }
 
-/**
- * Permission item for batch assignment/revocation
- */
 interface IPermissionItem {
-    /** Target ID (Company ID or Branch ID) */
     targetId: string;
-    /** Action: true to add permission, false to remove permission */
     isAdd: boolean;
 }
-/**
- * Batch assign/revoke user-company permissions request
- */
 interface IAssignUserCompanyRequest {
-    /** User ID to assign/revoke permissions for */
     userId: string;
-    /** List of company permissions to add or remove */
     items: IPermissionItem[];
 }
-/**
- * Batch assign/revoke user-branch permissions request
- */
 interface IAssignUserBranchRequest {
-    /** User ID to assign/revoke permissions for */
     userId: string;
-    /** List of branch permissions to add or remove */
     items: IPermissionItem[];
 }
-/**
- * User company permission with populated company details
- */
 interface IUserCompanyPermission {
-    /** Permission ID */
     id: string;
-    /** User ID */
     userId: string;
-    /** Company ID */
     companyId: string;
-    /** Company name */
     companyName: string;
-    /** Company slug */
     companySlug: string;
 }
-/**
- * User branch permission with populated branch details
- */
 interface IUserBranchPermission {
-    /** Permission ID */
     id: string;
-    /** User ID */
     userId: string;
-    /** Branch ID */
     branchId: string;
-    /** Branch name */
     branchName: string;
-    /** Branch slug */
     branchSlug: string;
-    /** Company ID this branch belongs to */
     companyId: string;
 }
-/**
- * Response for user companies
- */
 interface IUserCompaniesResponse {
+    success: boolean;
+    message: string;
     data: IUserCompanyPermission[];
 }
-/**
- * Response for user branches
- */
 interface IUserBranchesResponse {
+    success: boolean;
+    message: string;
     data: IUserBranchPermission[];
 }
-/**
- * Batch operation result response
- */
 interface IBatchOperationResponse {
     success: boolean;
     message: string;
 }
 
-/**
- * Create User Request Interface
- */
 interface ICreateUserRequest {
     name: string;
     email: string;
@@ -366,14 +236,12 @@ interface ICreateUserRequest {
     phoneVerified?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update User Request Interface
- */
 interface IUpdateUserRequest {
     id: string;
     name?: string;
     email?: string;
     password?: string;
+    oldPassword?: string;
     phone?: string;
     profilePictureId?: string;
     isActive?: boolean;
@@ -381,9 +249,6 @@ interface IUpdateUserRequest {
     phoneVerified?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * User Response Interface
- */
 interface IUser {
     id: string;
     name: string;
@@ -519,6 +384,7 @@ declare class AuthInitService {
 declare class AuthStateService {
     private readonly appConfig;
     private readonly router;
+    private readonly platform;
     private readonly _user;
     private readonly _accessToken;
     private readonly _tokenExpiresAt;
@@ -534,7 +400,6 @@ declare class AuthStateService {
     private readonly _selectionExpiresAt;
     readonly selectionSessionId: _angular_core.Signal<string | null>;
     readonly availableCompanies: _angular_core.Signal<ICompanyWithBranches[]>;
-    readonly selectionExpiresAt: _angular_core.Signal<Date | null>;
     readonly isAuthenticated: _angular_core.Signal<boolean>;
     readonly requiresCompanySelection: _angular_core.Signal<boolean>;
     readonly userName: _angular_core.Signal<string>;
@@ -545,10 +410,6 @@ declare class AuthStateService {
      * Used to proactively refresh token before requests fail.
      */
     readonly isTokenExpired: _angular_core.Signal<boolean>;
-    /**
-     * Check if we need to refresh on app load (token expired but refresh cookie may exist)
-     */
-    readonly needsRefreshOnLoad: _angular_core.Signal<boolean>;
     readonly tenantId: _angular_core.Signal<string | null>;
     constructor();
     setLoginState(response: ILoginResponse): void;
@@ -581,45 +442,11 @@ declare class AuthStateService {
 /**
  * Branch API Service
  * Signal-based service for branch CRUD operations
- * Branches default to current company context
- *
- * @example
- * ```typescript
- * branchService = inject(BranchApiService);
- *
- * // Set current company context
- * branchService.setCurrentCompanyId('company-uuid');
- *
- * // Access data via signals
- * branches = this.branchService.data;
- * isLoading = this.branchService.isLoading;
- *
- * // Fetch branches (will filter by current company)
- * this.branchService.fetchList('search');
- *
- * // Create branch (companyId will be auto-set if not provided)
- * await this.branchService.insertBranch({ name: 'New Branch', slug: 'new-branch' });
- * ```
  */
 declare class BranchApiService extends ApiResourceService<ICreateBranchRequest | IUpdateBranchRequest, IBranch> {
-    /** Current company context for branch operations */
-    readonly currentCompanyId: _angular_core.WritableSignal<string | null>;
-    /** Branches filtered by current company */
-    readonly companyBranches: _angular_core.Signal<IBranch[]>;
+    private readonly _currentCompanyId;
     constructor(http: HttpClient);
-    /**
-     * Set the current company context for branch operations
-     */
     setCurrentCompanyId(companyId: string | null): void;
-    /**
-     * Insert a new branch, auto-setting companyId if not provided
-     */
-    insertBranch(data: Omit<ICreateBranchRequest, 'companyId'> & {
-        companyId?: string;
-    }): Promise<ReturnType<typeof this.insertAsync>>;
-    /**
-     * Fetch branches for a specific company
-     */
     fetchByCompany(companyId: string, search?: string): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<BranchApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<BranchApiService>;
@@ -628,21 +455,6 @@ declare class BranchApiService extends ApiResourceService<ICreateBranchRequest |
 /**
  * Company API Service
  * Signal-based service for company CRUD operations
- *
- * @example
- * ```typescript
- * companyService = inject(CompanyApiService);
- *
- * // Access data via signals
- * companies = this.companyService.data;
- * isLoading = this.companyService.isLoading;
- *
- * // Fetch companies
- * this.companyService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create company
- * await this.companyService.insertAsync({ name: 'New Company', slug: 'new-company' });
- * ```
  */
 declare class CompanyApiService extends ApiResourceService<ICreateCompanyRequest | IUpdateCompanyRequest, ICompany> {
     constructor(http: HttpClient);
@@ -652,46 +464,16 @@ declare class CompanyApiService extends ApiResourceService<ICreateCompanyRequest
 
 /**
  * Token Refresh State Service
- *
- * Manages token refresh state in a request-safe manner for SSR environments.
- * Replaces module-level state that would be shared across requests in SSR.
- *
- * NOTE: Uses BehaviorSubject intentionally for RxJS interoperability.
- * The HTTP interceptor needs to queue concurrent requests and have them
- * wait for the new token via Observable subscription. This is a valid
- * pattern that signals cannot replicate directly (no multi-subscriber
- * async coordination). Signal is used for the boolean flag only.
- *
- * @example
- * ```typescript
- * const refreshState = inject(TokenRefreshStateService);
- *
- * if (refreshState.isRefreshing()) {
- *   // Queue request via refreshTokenSubject$
- * } else {
- *   refreshState.startRefresh();
- *   // Perform refresh
- * }
- * ```
+ * Manages token refresh state for SSR-safe request queuing.
+ * Uses BehaviorSubject for RxJS interop (multi-subscriber async coordination).
  */
 declare class TokenRefreshStateService {
-    /** Flag to track if token refresh is in progress */
     private readonly _isRefreshing;
     readonly isRefreshing: _angular_core.Signal<boolean>;
-    /** Subject to queue requests while refreshing */
     private readonly _refreshTokenSubject;
     readonly refreshTokenSubject$: rxjs.Observable<string | null>;
-    /**
-     * Mark refresh as started
-     */
     startRefresh(): void;
-    /**
-     * Mark refresh as completed and broadcast new token
-     */
     completeRefresh(newToken: string): void;
-    /**
-     * Mark refresh as failed
-     */
     failRefresh(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<TokenRefreshStateService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<TokenRefreshStateService>;
@@ -700,43 +482,9 @@ declare class TokenRefreshStateService {
 /**
  * User API Service
  * Signal-based service for user CRUD operations
- *
- * @example
- * ```typescript
- * userService = inject(UserApiService);
- *
- * // Access data via signals
- * users = this.userService.data;
- * isLoading = this.userService.isLoading;
- *
- * // Fetch users
- * this.userService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create user
- * await this.userService.insertAsync({
- *   name: 'John Doe',
- *   email: 'john@example.com',
- *   password: 'password123'
- * });
- * ```
  */
 declare class UserApiService extends ApiResourceService<ICreateUserRequest | IUpdateUserRequest, IUser> {
     constructor(http: HttpClient);
-    /**
-     * Verify user's email
-     */
-    verifyEmail(userId: string): Observable<IMessageResponse>;
-    /**
-     * Verify user's phone
-     */
-    verifyPhone(userId: string): Observable<IMessageResponse>;
-    /**
-     * Update user status (active/inactive)
-     */
-    updateStatus(userId: string, isActive: boolean): Observable<IMessageResponse>;
-    /**
-     * Update current user's profile
-     */
     updateProfile(data: IUpdateUserRequest): Observable<ISingleResponse<IUser>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<UserApiService>;
@@ -744,167 +492,29 @@ declare class UserApiService extends ApiResourceService<ICreateUserRequest | IUp
 
 /**
  * User Permission API Service
- *
  * Handles user-company and user-branch permission assignments.
- * Uses batch operations for efficient permission management.
- *
- * Backend Endpoints (POST-only RPC):
- * - POST /administration/permissions/user-company/assign - Batch assign/revoke company permissions
- * - POST /administration/permissions/get-user-company - Get user's companies
- * - POST /administration/permissions/user-branch/assign - Batch assign/revoke branch permissions
- * - POST /administration/permissions/get-user-branch - Get user's branches
  */
 declare class UserPermissionApiService {
     private readonly appConfig;
     private readonly http;
     private readonly baseUrl;
-    constructor();
-    /**
-     * Batch assign/revoke user-company permissions
-     *
-     * @example
-     * // Add company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: true },
-     *     { targetId: 'company-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: false }
-     *   ]
-     * });
-     */
     assignUserCompanies(data: IAssignUserCompanyRequest): Observable<IBatchOperationResponse>;
-    /**
-     * Assign single company to user (convenience method)
-     */
     assignUserToCompany(userId: string, companyId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Revoke single company from user (convenience method)
-     */
     revokeUserFromCompany(userId: string, companyId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Get user's company permissions
-     *
-     * @param userId - User ID to get companies for
-     * @returns Observable with user's company permissions
-     */
     getUserCompanies(userId: string): Observable<IUserCompaniesResponse>;
-    /**
-     * Batch assign/revoke user-branch permissions
-     *
-     * @example
-     * // Add branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: true },
-     *     { targetId: 'branch-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: false }
-     *   ]
-     * });
-     */
     assignUserBranches(data: IAssignUserBranchRequest): Observable<IBatchOperationResponse>;
-    /**
-     * Assign single branch to user (convenience method)
-     */
     assignUserToBranch(userId: string, branchId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Revoke single branch from user (convenience method)
-     */
     revokeUserFromBranch(userId: string, branchId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Get user's branch permissions
-     *
-     * @param userId - User ID to get branches for
-     * @returns Observable with user's branch permissions
-     */
-    getUserBranches(userId: string): Observable<IUserBranchesResponse>;
+    getUserBranches(userId: string, companyId?: string): Observable<IUserBranchesResponse>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserPermissionApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<UserPermissionApiService>;
 }
 
-/**
- * Auth Guard
- * Protects routes that require authentication.
- *
- * Session restoration is handled by guestGuard. This guard assumes
- * the session has already been restored if user accessed login page first.
- *
- * Handles company feature:
- * - If company feature enabled and no company selected, redirects to login
- *   (login page handles company selection as step 2)
- * - If not authenticated, redirects to login
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'dashboard',
- *   loadComponent: () => import('./dashboard.component'),
- *   canActivate: [authGuard]
- * }
- * ```
- */
+/** Protects routes requiring authentication */
 declare const authGuard: CanActivateFn;
-/**
- * Guest Guard
- * Protects auth routes (login, register) from authenticated users.
- * Redirects authenticated users to home page.
- *
- * CRITICAL: Unlike old implementation, this guard RESTORES the session first
- * before checking authentication. This handles the case when users directly
- * navigate to /auth/login via browser URL while having valid refresh token.
- *
- * Flow:
- * 1. Restore session (if needed) via AuthInitService.initialize()
- * 2. Check if user is authenticated
- * 3. If authenticated -> redirect to dashboard
- * 4. If not authenticated -> allow access to login page
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'auth/login',
- *   loadComponent: () => import('./login.component'),
- *   canActivate: [guestGuard]
- * }
- * ```
- */
+/** Protects auth routes from authenticated users, restores session first */
 declare const guestGuard: CanActivateFn;
-/**
- * Company Feature Guard
- * Protects routes that require company feature to be enabled.
- * Redirects to home if company feature is disabled.
- *
- * Use this guard on company/branch management routes.
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'administration/company',
- *   loadComponent: () => import('./company-list.component'),
- *   canActivate: [authGuard, companyFeatureGuard]
- * }
- * ```
- */
+/** Protects routes requiring company feature to be enabled */
 declare const companyFeatureGuard: CanActivateFn;
 
 /**
@@ -912,34 +522,7 @@ declare const companyFeatureGuard: CanActivateFn;
  */
 declare function authInterceptor(req: HttpRequest<unknown>, next: HttpHandlerFn): Observable<HttpEvent<unknown>>;
 
-/**
- * Token Refresh Interceptor
- * Handles token refresh both proactively and reactively.
- *
- * PROACTIVE REFRESH:
- * - Checks token expiry BEFORE making requests
- * - Refreshes token if expired or expiring soon (within 30 seconds)
- * - Prevents unnecessary 401 failures
- *
- * REACTIVE REFRESH:
- * - Still handles 401 errors as fallback
- * - Queues concurrent requests during refresh
- * - Redirects to login on refresh failure
- *
- * SECURITY:
- * - Token kept in memory only (not localStorage)
- * - Uses HTTP-only refresh token cookie
- * - SSR-safe: Uses injectable service
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * provideHttpClient(
- *   withFetch(),
- *   withInterceptors([authInterceptor, tokenRefreshInterceptor])
- * )
- * ```
- */
+/** Token Refresh Interceptor - Proactive and reactive token refresh with request queuing */
 declare function tokenRefreshInterceptor(req: HttpRequest<unknown>, next: HttpHandlerFn): Observable<HttpEvent<unknown>>;
 
 /**
@@ -962,86 +545,49 @@ declare const ADMINISTRATION_ROUTES: Routes;
 declare const PROFILE_ROUTES: Routes;
 
 /**
- * Auth Layout State Adapter
- * Bridges AuthStateService signals to ILayoutAuthState interface.
- * Provides ready-to-use integration between ng-auth, ng-layout, and ng-shared provider tokens.
+ * Auth Layout Provider Adapters
+ *
+ * Implements provider interfaces from ng-layout using ng-auth services.
+ * Bridges auth state and API to layout components.
+ *
+ * @example
+ * // In app.config.ts
+ * import { provideAuthLayoutIntegration } from '@flusys/ng-auth';
+ * providers: [...provideAuthLayoutIntegration()]
  */
 declare class AuthLayoutStateAdapter implements ILayoutAuthState {
     private readonly authState;
-    /**
-     * Maps company info to company info for layout.
-     * Falls back to app name from config when no company is selected.
-     */
     readonly currentCompanyInfo: Signal<ICompanyInfo$1 | null>;
-    /**
-     * Maps branch info to branch info for layout.
-     * Returns null when no branch is selected.
-     */
     readonly currentBranchInfo: Signal<IBranchInfo$1 | null>;
-    /**
-     * Maps user info from auth state to layout user info.
-     * Profile picture URL is managed separately by AuthLayoutSyncService via FileUrlService.
-     */
     readonly loginUserData: Signal<IUserInfo$1 | null>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthLayoutStateAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthLayoutStateAdapter>;
 }
-/**
- * Auth Layout API Adapter
- * Bridges AuthApiService to ILayoutAuthApi interface.
- * Handles logout and navigation for layout components.
- */
 declare class AuthLayoutApiAdapter implements ILayoutAuthApi {
     private readonly authApi;
     private readonly authState;
     private readonly permissionApi;
     private readonly router;
-    /**
-     * Logout the current user.
-     * Calls backend logout endpoint and resets local auth state.
-     * Auth state reset handles clearing all localStorage including company/branch.
-     */
     logOut(): Observable<any>;
-    /**
-     * Navigate to login page.
-     * Optionally preserves current URL as return URL.
-     */
     navigateLogin(withUrl?: boolean): void;
-    /**
-     * Switch to a different company and branch.
-     * Calls backend switch endpoint, then triggers full page reload to
-     * refresh permissions, reset component state, and re-filter all data.
-     */
     switchCompany(companyId: string, branchId: string): Observable<any>;
-    /**
-     * Get list of companies the logged-in user has permissions for.
-     * Uses permission API to filter by user's actual company-level permissions.
-     */
     getUserCompanies(): Observable<ICompanyInfo$1[]>;
-    /**
-     * Get branches for a specific company that the logged-in user has access to.
-     * Fetches all user branches and filters by companyId.
-     */
     getCompanyBranches(companyId: string): Observable<IBranchInfo$1[]>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthLayoutApiAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthLayoutApiAdapter>;
 }
 
 /**
- * Auth User Provider Adapter
+ * Auth Shared Provider Adapters
  *
- * Implements IUserProvider interface from ng-shared using UserApiService from ng-auth.
- * This allows IAM and other packages to access user data without depending on ng-auth directly.
+ * Implements provider interfaces from ng-shared using ng-auth services.
+ * Allows IAM, Storage, and Form-Builder packages to access auth data
+ * without depending on ng-auth directly.
  *
  * @example
  * // In app.config.ts
- * providers: [
- *   { provide: USER_PROVIDER, useClass: AuthUserProviderAdapter }
- * ]
- *
- * // In IAM component
- * private readonly userProvider = inject(USER_PROVIDER);
- * this.userProvider.getUsers({ page: 0, pageSize: 50 }).subscribe(...);
+ * import { provideAuthProviders } from '@flusys/ng-auth';
+ * providers: [...provideAuthProviders()]
  */
 declare class AuthUserProviderAdapter implements IUserProvider {
     private readonly userApi;
@@ -1057,19 +603,6 @@ declare class AuthUserProviderAdapter implements IUserProvider {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthUserProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthUserProviderAdapter>;
 }
-
-/**
- * Auth Company API Provider Adapter
- *
- * Implements ICompanyApiProvider interface from ng-shared using CompanyApiService.
- * Allows IAM package to access company data without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: COMPANY_API_PROVIDER, useClass: AuthCompanyApiProviderAdapter }
- * ]
- */
 declare class AuthCompanyApiProviderAdapter implements ICompanyApiProvider {
     private readonly companyApi;
     getCompanies(filter?: {
@@ -1080,97 +613,25 @@ declare class AuthCompanyApiProviderAdapter implements ICompanyApiProvider {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthCompanyApiProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthCompanyApiProviderAdapter>;
 }
-
-/**
- * Auth User Permission Provider Adapter
- *
- * Implements IUserPermissionProvider interface from ng-shared using UserPermissionApiService.
- * Allows IAM package to query user permissions without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: USER_PERMISSION_PROVIDER, useClass: AuthUserPermissionProviderAdapter }
- * ]
- */
 declare class AuthUserPermissionProviderAdapter implements IUserPermissionProvider {
     private readonly userPermissionApi;
-    getUserBranchPermissions(userId: string): Observable<ISingleResponse<any>>;
+    getUserBranchPermissions(userId: string, companyId?: string): Observable<ISingleResponse<any>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthUserPermissionProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthUserPermissionProviderAdapter>;
 }
-
-/**
- * Auth State Provider Adapter
- *
- * Implements IAuthStateProvider interface from ng-shared using auth services from ng-auth.
- * This allows feature packages (form-builder, etc.) to check auth state without
- * depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: AUTH_STATE_PROVIDER, useClass: AuthStateProviderAdapter }
- * ]
- *
- * // In form-builder component
- * private readonly authStateProvider = inject(AUTH_STATE_PROVIDER);
- * const isLoggedIn = this.authStateProvider.isAuthenticated();
- */
 declare class AuthStateProviderAdapter implements IAuthStateProvider {
     private readonly authState;
     private readonly authInit;
-    /**
-     * Signal indicating if user is currently authenticated
-     */
     get isAuthenticated(): Signal<boolean>;
-    /**
-     * Initialize auth state (restore session from cookies/storage)
-     * Returns Observable<void> that completes when initialization is done
-     */
     initialize(): Observable<void>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthStateProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthStateProviderAdapter>;
 }
 
-/**
- * Provides auth layout integration for ng-layout.
- * Call this in your app.config.ts to integrate ng-auth with ng-layout.
- *
- * Also registers LAYOUT_AUTH_STATE since AuthLayoutStateAdapter
- * implements both ILayoutAuthState and ICompanyContextProvider.
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     ...provideAuthLayoutIntegration(),
- *   ],
- * };
- * ```
- */
+/** Provides auth integration for ng-layout */
 declare function provideAuthLayoutIntegration(): Provider[];
 
-/**
- * Provide Auth Provider Adapters
- *
- * Registers auth implementations for provider interfaces from ng-shared.
- * This allows IAM and Storage packages to use auth services without direct dependencies.
- *
- * @example
- * // In app.config.ts
- * import { provideAuthProviders } from '@flusys/ng-auth';
- *
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     provideAuthProviders(),
- *     // ... other providers
- *   ]
- * };
- *
- * @returns Array of Angular providers
- */
+/** Provides auth implementations for ng-shared provider interfaces */
 declare function provideAuthProviders(): Provider[];
 
 /**
@@ -1178,33 +639,22 @@ declare function provideAuthProviders(): Provider[];
  *
  * Centralized endpoint definitions to prevent inconsistencies across interceptors
  * and services. All auth-related endpoints should be referenced from here.
- *
- * @example
- * ```typescript
- * if (isAuthEndpoint(req.url)) {
- *   // Skip interceptor logic
- * }
- * ```
  */
 declare const AUTH_ENDPOINTS: {
     readonly LOGIN: "/auth/login";
     readonly LOGOUT: "/auth/logout";
     readonly REFRESH: "/auth/refresh";
     readonly REGISTER: "/auth/register";
+    readonly ME: "/auth/me";
     readonly SELECT: "/auth/select";
     readonly SWITCH_COMPANY: "/auth/switch-company";
+    readonly CHANGE_PASSWORD: "/auth/change-password";
     readonly VERIFY_EMAIL: "/auth/verify-email";
     readonly FORGOT_PASSWORD: "/auth/forgot-password";
     readonly RESET_PASSWORD: "/auth/reset-password";
     readonly RESEND_VERIFICATION: "/auth/resend-verification";
 };
-/**
- * Check if a URL is an auth-related endpoint
- */
-declare function isAuthEndpoint(url: string): boolean;
-/**
- * Check if a URL is a specific auth endpoint
- */
+/** Check if a URL matches a specific endpoint */
 declare function isEndpoint(url: string, endpoint: string): boolean;
 
 interface ITab {
@@ -1212,6 +662,7 @@ interface ITab {
     label: string;
     icon: string;
     route: string;
+    permission: string;
     requiresCompanyFeature?: boolean;
 }
 /**
@@ -1223,14 +674,15 @@ interface ITab {
  */
 declare class AdministrationPageComponent {
     private readonly appConfig;
+    private readonly permissionValidator;
     /** All available tabs */
     private readonly allTabs;
     /** Check if company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Visible tabs based on config */
+    /** Visible tabs based on config and permissions */
     readonly visibleTabs: _angular_core.Signal<ITab[]>;
-    /** Dynamic subtitle based on visible features */
-    readonly subtitle: _angular_core.Signal<"Manage users, companies, and branches" | "Manage users">;
+    /** Dynamic subtitle based on visible tabs */
+    readonly subtitle: _angular_core.Signal<string>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AdministrationPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AdministrationPageComponent, "lib-administration-page", never, {}, {}, never, never, true, never>;
 }
@@ -1275,8 +727,15 @@ declare class BranchFormComponent {
     readonly isFormValid: _angular_core.Signal<boolean>;
     constructor();
     loadBranch(id: string): Promise<void>;
+    private toFormModel;
     generateSlug(): void;
     onSubmit(): Promise<void>;
+    private updateBranch;
+    private createBranch;
+    private buildOptionalFields;
+    private onSaveSuccess;
+    private getTargetCompanyId;
+    private navigateToList;
     onCancel(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<BranchFormComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<BranchFormComponent, "lib-branch-form", never, {}, {}, never, never, true, never>;
@@ -1360,10 +819,12 @@ declare class CompanyFormComponent {
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
     constructor();
-    loadCompany(id: string): Promise<void>;
+    private loadCompany;
     generateSlug(): void;
     onSubmit(): Promise<void>;
     onCancel(): void;
+    /** Build company data from form model */
+    private buildCompanyData;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<CompanyFormComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<CompanyFormComponent, "lib-company-form", never, {}, {}, never, never, true, never>;
 }
@@ -1396,7 +857,6 @@ declare class CompanyListComponent {
     readonly isLoading: _angular_core.Signal<boolean>;
     /** Total count from service */
     readonly total: _angular_core.Signal<number>;
-    loadCompanies(): void;
     onLazyLoad(event: {
         first?: number | null;
         rows?: number | null;
@@ -1423,30 +883,23 @@ declare class ForgotPasswordPageComponent {
     readonly forgotForm: _angular_forms_signals.FieldTree<IForgotPasswordFormModel, string | number>;
     readonly isFormValid: _angular_core.Signal<boolean>;
     onSubmit(): void;
+    private showEmailSent;
     resetForm(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ForgotPasswordPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<ForgotPasswordPageComponent, "lib-forgot-password-page", never, {}, {}, never, never, true, never>;
 }
 
-/** Login form model interface */
 interface ILoginFormModel {
     email: string;
     password: string;
     rememberMe: boolean;
 }
-/** Company selection form model interface */
 interface ISelectionFormModel {
     companyId: string;
     branchId: string;
     rememberSelection: boolean;
 }
 type LoginStep = 'credentials' | 'company-selection' | 'email-verification';
-/**
- * Login Page Component
- * Multi-step authentication flow:
- * - Step 1: Email/Password credentials
- * - Step 2: Company/Branch selection (when company feature enabled and user has multiple)
- */
 declare class LoginPageComponent {
     private readonly destroyRef;
     private readonly appConfig;
@@ -1457,36 +910,20 @@ declare class LoginPageComponent {
     readonly currentStep: _angular_core.WritableSignal<LoginStep>;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly unverifiedEmail: _angular_core.WritableSignal<string>;
-    /** Login form model */
     readonly loginFormModel: _angular_core.WritableSignal<ILoginFormModel>;
-    /** Login form with validation schema */
     readonly loginForm: _angular_forms_signals.FieldTree<ILoginFormModel, string | number>;
-    /** Check if login form is valid */
     readonly isLoginFormValid: _angular_core.Signal<boolean>;
-    /** Selection form model */
     readonly selectionFormModel: _angular_core.WritableSignal<ISelectionFormModel>;
-    /** Selection form with validation schema */
     readonly selectionForm: _angular_forms_signals.FieldTree<ISelectionFormModel, string | number>;
-    /** Check if selection form is valid */
     readonly isSelectionFormValid: _angular_core.Signal<boolean>;
-    /** Whether company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Session ID for company selection */
     private sessionId;
-    /** Available companies */
     readonly companies: _angular_core.WritableSignal<ICompanyWithBranches[]>;
-    /** User's name */
     readonly userName: _angular_core.WritableSignal<string>;
-    /** Branches for selected company */
     readonly branches: _angular_core.Signal<IBranchSelectionInfo[]>;
     constructor();
-    /**
-     * Restores pending company selection state from auth service.
-     * Called when user refreshes page during Step 2 of login flow.
-     */
     private restorePendingSelectionState;
     onSubmit(): void;
-    /** Handle company selection change */
     onCompanyChange(): void;
     onSelectCompany(): void;
     goBackToCredentials(): void;
@@ -1551,9 +988,11 @@ declare class ProfilePageComponent {
     readonly showRoles: _angular_core.Signal<boolean>;
     readonly showActions: _angular_core.Signal<boolean>;
     readonly showBottomRow: _angular_core.Signal<boolean>;
+    private readonly originalFormModel;
     readonly formModel: _angular_core.WritableSignal<IProfileFormModel>;
     readonly formTree: _angular_forms_signals.FieldTree<IProfileFormModel, string | number>;
     readonly isFormValid: _angular_core.Signal<boolean>;
+    readonly isFormDirty: _angular_core.Signal<boolean>;
     readonly passwordModel: _angular_core.WritableSignal<IPasswordFormModel>;
     readonly isPasswordLoading: _angular_core.WritableSignal<boolean>;
     readonly isPasswordFormValid: _angular_core.Signal<boolean>;
@@ -1689,7 +1128,11 @@ declare class UserFormComponent {
     readonly isFormValid: _angular_core.Signal<boolean>;
     constructor();
     loadUser(id: string): void;
+    private toFormModel;
     onSubmit(): void;
+    private updateUser;
+    private createUser;
+    private onSaveSuccess;
     /**
      * Assign user to current company and branch
      */
@@ -1737,6 +1180,7 @@ declare class UserListComponent {
     onEdit(user: IUser): void;
     onManageCompanyPermissions(user: IUser): void;
     onManageBranchPermissions(user: IUser): void;
+    private openPermissionDialog;
     onDelete(user: IUser): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserListComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserListComponent, "lib-user-list", never, {}, {}, never, never, true, never>;
@@ -1772,52 +1216,27 @@ declare class VerifyEmailPageComponent {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<VerifyEmailPageComponent, "lib-verify-email-page", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * User Branch Permission Dialog
- *
- * Workflow:
- * 1. Dialog opens → Shows company dropdown with user's permitted companies
- * 2. User selects a company → Branches load for that company
- * 3. Branches show with checkboxes (checked = already assigned)
- * 4. Check to assign, uncheck to revoke
- *
- * Company dropdown only shows companies the user has company-level permissions for.
- * Branch permissions can only be assigned within user's permitted companies.
- */
+interface BranchWithAssignment extends IBranch {
+    isAssigned: boolean;
+}
 declare class UserBranchPermissionDialogComponent {
     private readonly branchApi;
     private readonly permissionApi;
-    private readonly authState;
     private readonly messageService;
-    /** Dialog visibility */
     readonly visible: _angular_core.InputSignal<boolean>;
-    /** User to manage permissions for */
     readonly user: _angular_core.InputSignal<IUser | null>;
-    /** Close event */
     readonly closed: _angular_core.OutputEmitterRef<void>;
-    /** Refresh event after changes */
     readonly permissionsChanged: _angular_core.OutputEmitterRef<void>;
-    /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Saving state */
     readonly isSaving: _angular_core.WritableSignal<boolean>;
-    /** Branches with assignment status */
     readonly branches: _angular_core.WritableSignal<BranchWithAssignment[]>;
-    /** Available companies (filtered by user's company permissions) */
     readonly companies: _angular_core.WritableSignal<{
         id: string;
         name: string;
     }[]>;
-    /** Selected company ID */
     selectedCompanyId: string | null;
-    /** Current company from auth state */
-    readonly currentCompany: _angular_core.Signal<_flusys_ng_auth.ICompanyInfo | null>;
-    /** Currently assigned branch IDs */
     private assignedBranchIds;
     constructor();
-    /**
-     * Load user's assigned companies (does not auto-select or load branches)
-     */
     private loadUserCompaniesAndData;
     private loadData;
     onCompanyChange(): void;
@@ -1826,35 +1245,21 @@ declare class UserBranchPermissionDialogComponent {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserBranchPermissionDialogComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserBranchPermissionDialogComponent, "lib-user-branch-permission-dialog", never, { "visible": { "alias": "visible"; "required": true; "isSignal": true; }; "user": { "alias": "user"; "required": true; "isSignal": true; }; }, { "closed": "closed"; "permissionsChanged": "permissionsChanged"; }, never, never, true, never>;
 }
-interface BranchWithAssignment extends IBranch {
+
+interface CompanyWithAssignment extends ICompany {
     isAssigned: boolean;
 }
-
-/**
- * User Company Permission Dialog
- * Shows all companies with checkboxes
- * Initially assigned companies are checked
- * Check to assign, uncheck to revoke
- */
 declare class UserCompanyPermissionDialogComponent {
     private readonly companyApi;
     private readonly permissionApi;
     private readonly messageService;
-    /** Dialog visibility */
     readonly visible: _angular_core.InputSignal<boolean>;
-    /** User to manage permissions for */
     readonly user: _angular_core.InputSignal<IUser | null>;
-    /** Close event */
     readonly closed: _angular_core.OutputEmitterRef<void>;
-    /** Refresh event after changes */
     readonly permissionsChanged: _angular_core.OutputEmitterRef<void>;
-    /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Saving state */
     readonly isSaving: _angular_core.WritableSignal<boolean>;
-    /** Companies with assignment status */
     readonly companies: _angular_core.WritableSignal<CompanyWithAssignment[]>;
-    /** Currently assigned company IDs */
     private assignedCompanyIds;
     constructor();
     private loadData;
@@ -1863,9 +1268,6 @@ declare class UserCompanyPermissionDialogComponent {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserCompanyPermissionDialogComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserCompanyPermissionDialogComponent, "lib-user-company-permission-dialog", never, { "visible": { "alias": "visible"; "required": true; "isSignal": true; }; "user": { "alias": "user"; "required": true; "isSignal": true; }; }, { "closed": "closed"; "permissionsChanged": "permissionsChanged"; }, never, never, true, never>;
 }
-interface CompanyWithAssignment extends ICompany {
-    isAssigned: boolean;
-}
 
-export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateProviderAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isAuthEndpoint, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
+export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateProviderAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
 export type { AuthResponse, IAssignUserBranchRequest, IAssignUserCompanyRequest, IBatchOperationResponse, IBranch, IBranchInfo, IBranchSelectionInfo, IChangePasswordRequest, ICompany, ICompanyInfo, ICompanySelectionResponse, ICompanyWithBranches, ICreateBranchRequest, ICreateCompanyRequest, ICreateUserRequest, ILoginRequest, ILoginRequiresEmailVerification, ILoginResponse, IMeResponse, IPermissionItem, IRefreshTokenResponse, IRegistrationRequest, IRegistrationResponse, ISelectRequest, ISwitchCompanyRequest, IUpdateBranchRequest, IUpdateCompanyRequest, IUpdateUserRequest, IUser, IUserBranchPermission, IUserBranchesResponse, IUserCompaniesResponse, IUserCompanyPermission, IUserInfo };