@honuware/ui 0.1.0

package/README.md

@@ -0,0 +1,78 @@
+# @honuware/ui
+
+Reusable, brand-free Angular UI + server-access framework — the shared component library behind the Knotty Yoga app, packaged for reuse by other Angular apps that talk to a compatible ("honuware") backend.
+
+Published as **eight secondary entry points** under `@honuware/ui/*`; import only what you need — each is independently tree-shakeable (`sideEffects: false`).
+
+## Install
+
+```bash
+npm install @honuware/ui
+```
+
+Peer dependencies (Angular 21 — install if you don't already have them): `@angular/animations`, `@angular/cdk`, `@angular/common`, `@angular/core`, `@angular/forms`, `@angular/material`, `@angular/router`, and `rxjs`. The library's only runtime dependency is `tslib`.
+
+## Entry points
+
+| Entry | What's in it |
+|---|---|
+| `@honuware/ui/foundation` | `ToastService`, `hw-confirm-dialog`, fuse animations, microsecond date-formatting utils, `sanitizeReturnUrl`. No internal deps. |
+| `@honuware/ui/access` | The narrow `CrudAccess` / `AuthAccess` / `PhotoAccess` interfaces + `HONUWARE_*_ACCESS` tokens; framework DTOs (`DatabaseSchema`, `DataResults`, `ColumnDataInfo`, admin/photo types, `UserInfo`/`LoginInfo`…); the RFC 7807 stack (`ProblemDetails`, `ErrorService`); `CsrfInterceptor`; `PhotoUrlBuilder`; the request-serializing proxy + default HTTP implementations; and `provideHonuwareAccess()`. |
+| `@honuware/ui/controls` | Schema-driven field controls (`hw-simple-text` / `-long-text` / `-simple-bool` / `-simple-enum` / `-simple-date`), the `hw-composite-control` type dispatcher, and `hw-fk-picker`. |
+| `@honuware/ui/photos` | `hw-photo-upload` — drag-drop, client-side resize/re-encode to JPEG, deferred-upload mode, `userMode` avatar path. |
+| `@honuware/ui/auth` | `AuthService` + `AuthData`/permission helpers, the five route guards, `ErrorInterceptor`, the login/register/verify pages (`hw-login` / `-register` / `-verify`), the `AUTH_ROUTES` config token, and the `tryTokenLoginInitializer` bootstrap factory. |
+| `@honuware/ui/crud` | The generic table editor: `DatabaseSchemaService`, table-binding utils, the `hw-table-view-control` / `hw-composite-row-control` containers, the TableView/Edit/New pages, and the `CRUD_EDITOR_ROUTES` token. |
+| `@honuware/ui/square` | `SquarePaymentService` (Web Payments SDK loader + card tokenizer) behind the `SQUARE_CONFIG` token. Depends on nothing internal. |
+| `@honuware/ui/testing` | In-memory mocks for tests — `MockCrudAccess` (schema-driven store), `MockAuthAccess` (session simulator), `MockPhotoAccess`, and `provideHonuwareAccessMock()`. |
+
+**Layering** (an entry may import only the entries below it): foundation → access → {controls, photos, auth} → crud; `square` is standalone; `testing` depends on access + auth.
+
+## Configuring the framework
+
+Library components inject **narrow tokens** rather than a concrete client, so you wire them once.
+
+### Server access
+
+```ts
+import { provideHonuwareAccess } from '@honuware/ui/access';
+
+providers: [
+  // 'http' (default): the built-in request-serializing proxy over the standard
+  // honuware endpoints, off a base path (HONUWARE_API_BASE, default '/api').
+  provideHonuwareAccess(),
+]
+```
+
+Or point the three `HONUWARE_{CRUD,AUTH,PHOTO}_ACCESS` tokens at your own client. For tests, use mock mode:
+
+```ts
+import { provideHonuwareAccessMock } from '@honuware/ui/testing';
+providers: [provideHonuwareAccessMock({ crud: { schema } })]
+```
+
+### Config tokens
+
+- **`AUTH_ROUTES`** (`@honuware/ui/auth`) — where login/register/change-password live + the post-login `returnUrl` allowlist. Guards, the auth pages, and `ErrorInterceptor` read it.
+- **`CRUD_EDITOR_ROUTES`** (`@honuware/ui/crud`) — the base path the generic table editor is mounted at.
+- **`SQUARE_CONFIG`** (`@honuware/ui/square`) — the Square `applicationId` / `locationId` / `scriptUrl`.
+- **`tryTokenLoginInitializer`** (`@honuware/ui/auth`) — wire into an `APP_INITIALIZER` (`deps: [AuthService]`) for silent re-auth at bootstrap.
+
+Each token has a sensible root-provided default, so the minimal setup is `provideHonuwareAccess()` + a Material theme.
+
+## Styling
+
+The components use **Angular Material**, so a consumer **must** set up a Material theme — otherwise the components render unstyled:
+
+```scss
+// styles.scss
+@use '@angular/material' as mat;
+// … your mat.theme(...) definition / include
+```
+
+The library reads **no CSS custom properties** — you don't need to define any `--vars`. Component styles are self-contained (inlined at build); there is no global stylesheet to import.
+
+**Caveat (pre-"Website Makeover").** A handful of component styles still hardcode colors — an M2 indigo/pink palette assumption, plus semantic colors like `#f44336` (errors) and `#d1d5db` (card borders). A consumer whose Material theme differs will see these until the makeover moves them onto theme / CSS-variable hooks.
+
+## License
+
+Apache-2.0

package/fesm2022/honuware-ui-access.mjs

@@ -0,0 +1,557 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, Inject, Injectable, inject } from '@angular/core';
+import { Observable } from 'rxjs';
+import { map } from 'rxjs/operators';
+import * as i1 from '@angular/common/http';
+
+// Base path for the honuware server API. Relative '/api' matches every
+// current deployment shape (Angular dev proxy, same-origin Nginx/CloudFront);
+// a consumer hosting the API elsewhere overrides this token.
+const HONUWARE_API_BASE = new InjectionToken('HONUWARE_API_BASE', {
+    providedIn: 'root',
+    factory: () => '/api',
+});
+
+// Default HttpClient implementation of the framework CRUD surface against the
+// standard honuware endpoints. New consumers get this via
+// provideHonuwareAccess() (wrapped in the serializing proxy); knottyyoga keeps
+// its own ServerAccessNetwork. Endpoints mirror the app's network layer.
+class CrudHttpAccess {
+    http;
+    base;
+    constructor(http, base) {
+        this.http = http;
+        this.base = base;
+    }
+    addItem(body) {
+        return this.http.post(`${this.base}/add_item`, body, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    addItemFetchPrimaryKey(body) {
+        return this.http.post(`${this.base}/add_item_fetch_primary_key`, body, { withCredentials: true, responseType: 'text' }).pipe(map((response) => {
+            const obj = JSON.parse(response);
+            return obj[Object.keys(obj)[0]];
+        }));
+    }
+    getTableRows(tableName) {
+        return this.http.get(`${this.base}/get_table_rows/${tableName}`, { withCredentials: true });
+    }
+    getRowsByColumn(tableName, columnName, ascending, pageSize, pageNumber) {
+        const asc = ascending ? 1 : 0;
+        return this.http.get(`${this.base}/get_rows_by_column/${tableName}/${columnName}/${asc}/${pageSize}/${pageNumber}`, { withCredentials: true });
+    }
+    getFilteredTableRows(tableName, columnName, ascending, pageSize, page, filterPairs) {
+        return this.http.post(`${this.base}/get_filtered_table_rows`, {
+            table_name: tableName,
+            column_name: columnName,
+            asc: ascending,
+            page_size: pageSize,
+            page,
+            filter_pairs: filterPairs,
+        }, { withCredentials: true });
+    }
+    getRow(tableName, columnName, columnValue) {
+        return this.http.get(`${this.base}/get_row/${tableName}/${columnName}/${columnValue}`, { withCredentials: true });
+    }
+    getRowByValues(tableName, filterPairs) {
+        return this.http.post(`${this.base}/get_row_by_values`, {
+            table_name: tableName,
+            filter_pairs: filterPairs,
+        }, { withCredentials: true });
+    }
+    updateItem(body) {
+        return this.http.post(`${this.base}/update_item`, body, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    deleteItem(tableName, columnName, columnValue) {
+        return this.http.get(`${this.base}/delete_item/${tableName}/${columnName}/${columnValue}`, { withCredentials: true })
+            .pipe(map(() => void 0));
+    }
+    getDbSchema() {
+        return this.http.get(`${this.base}/get_db_schema`, { withCredentials: true });
+    }
+    getFkOptions(tableName, searchText, pageSize) {
+        return this.http.post(`${this.base}/get_fk_options`, {
+            table_name: tableName,
+            search_text: searchText,
+            page_size: pageSize,
+        }, { withCredentials: true });
+    }
+    resolveFkDisplay(parentTableName, values) {
+        return this.http.post(`${this.base}/resolve_fk_display`, {
+            parent_table_name: parentTableName,
+            values,
+        }, { withCredentials: true });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: CrudHttpAccess, deps: [{ token: i1.HttpClient }, { token: HONUWARE_API_BASE }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: CrudHttpAccess, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: CrudHttpAccess, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [{ type: i1.HttpClient }, { type: undefined, decorators: [{
+                    type: Inject,
+                    args: [HONUWARE_API_BASE]
+                }] }] });
+
+// Default HttpClient implementation of the framework auth/account surface.
+class AuthHttpAccess {
+    http;
+    base;
+    constructor(http, base) {
+        this.http = http;
+        this.base = base;
+    }
+    register(firstName, lastName, email, password) {
+        return this.http.post(`${this.base}/register`, {
+            first_name: firstName,
+            last_name: lastName,
+            email,
+            password,
+        }, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    verify(email, secret) {
+        return this.http.post(`${this.base}/verify`, { email, secret }, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    login(loginInfo) {
+        return this.http.post(`${this.base}/login`, loginInfo, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    logout() {
+        return this.http.post(`${this.base}/logout`, null, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    me() {
+        return this.http.get(`${this.base}/me`, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    remember() {
+        return this.http.post(`${this.base}/remember`, null, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    getUserInfo() {
+        return this.http.post(`${this.base}/get_user_info`, null, { withCredentials: true });
+    }
+    setUserInfo(userInfo) {
+        return this.http.post(`${this.base}/set_user_info`, userInfo, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    updateUserPassword(passwordInfo) {
+        return this.http.post(`${this.base}/update_user_password`, passwordInfo, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: AuthHttpAccess, deps: [{ token: i1.HttpClient }, { token: HONUWARE_API_BASE }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: AuthHttpAccess, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: AuthHttpAccess, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [{ type: i1.HttpClient }, { type: undefined, decorators: [{
+                    type: Inject,
+                    args: [HONUWARE_API_BASE]
+                }] }] });
+
+// Default HttpClient implementation of the framework photo surface.
+class PhotoHttpAccess {
+    http;
+    base;
+    constructor(http, base) {
+        this.http = http;
+        this.base = base;
+    }
+    uploadPhoto(tableName, tableItemId, imageData, imageType) {
+        const type = imageType.split('/').pop() || imageType;
+        const url = `${this.base}/upload_photo/${encodeURIComponent(tableName)}/${tableItemId}/${encodeURIComponent(type)}`;
+        return this.http.post(url, imageData, { withCredentials: true });
+    }
+    uploadUserPhoto(imageData, imageType) {
+        const type = imageType.split('/').pop() || imageType;
+        const url = `${this.base}/upload_user_photo/${encodeURIComponent(type)}`;
+        return this.http.post(url, imageData, { withCredentials: true });
+    }
+    deletePhoto(tableName, tableItemId) {
+        const url = `${this.base}/delete_photo/${encodeURIComponent(tableName)}/${tableItemId}`;
+        return this.http.post(url, null, { withCredentials: true }).pipe(map(() => void 0));
+    }
+    hasPhoto(tableName, tableItemId) {
+        const url = `${this.base}/has_photo/${encodeURIComponent(tableName)}/${tableItemId}`;
+        return this.http.get(url, { withCredentials: true });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: PhotoHttpAccess, deps: [{ token: i1.HttpClient }, { token: HONUWARE_API_BASE }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: PhotoHttpAccess, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: PhotoHttpAccess, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [{ type: i1.HttpClient }, { type: undefined, decorators: [{
+                    type: Inject,
+                    args: [HONUWARE_API_BASE]
+                }] }] });
+
+// Request-serializing façade over the default HTTP implementations. A honuware
+// server allows one transaction per session and rejects concurrent requests,
+// so every call is queued and run one at a time (the library twin of the app's
+// ServerAccessProxy). This is the default a new consumer gets via
+// provideHonuwareAccess({ mode: 'http' }); knottyyoga wires its own proxy.
+class HonuwareAccessProxy {
+    crud;
+    auth;
+    photo;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    queue = [];
+    busy = false;
+    constructor(crud, auth, photo) {
+        this.crud = crud;
+        this.auth = auth;
+        this.photo = photo;
+    }
+    serialize(factory) {
+        return new Observable((subscriber) => {
+            this.queue.push({ factory, subscriber });
+            this.pump();
+        });
+    }
+    pump() {
+        if (this.busy)
+            return;
+        const next = this.queue.shift();
+        if (!next)
+            return;
+        this.busy = true;
+        next.factory().subscribe({
+            next: (value) => next.subscriber.next(value),
+            error: (err) => { next.subscriber.error(err); this.busy = false; this.pump(); },
+            complete: () => { next.subscriber.complete(); this.busy = false; this.pump(); },
+        });
+    }
+    // --- CrudAccess ---
+    addItem(body) { return this.serialize(() => this.crud.addItem(body)); }
+    addItemFetchPrimaryKey(body) { return this.serialize(() => this.crud.addItemFetchPrimaryKey(body)); }
+    getTableRows(tableName) { return this.serialize(() => this.crud.getTableRows(tableName)); }
+    getRowsByColumn(t, c, a, s, p) { return this.serialize(() => this.crud.getRowsByColumn(t, c, a, s, p)); }
+    getFilteredTableRows(t, c, a, s, p, f) { return this.serialize(() => this.crud.getFilteredTableRows(t, c, a, s, p, f)); }
+    getRow(t, c, v) { return this.serialize(() => this.crud.getRow(t, c, v)); }
+    getRowByValues(t, f) { return this.serialize(() => this.crud.getRowByValues(t, f)); }
+    updateItem(body) { return this.serialize(() => this.crud.updateItem(body)); }
+    deleteItem(t, c, v) { return this.serialize(() => this.crud.deleteItem(t, c, v)); }
+    getDbSchema() { return this.serialize(() => this.crud.getDbSchema()); }
+    getFkOptions(t, s, p) { return this.serialize(() => this.crud.getFkOptions(t, s, p)); }
+    resolveFkDisplay(t, v) { return this.serialize(() => this.crud.resolveFkDisplay(t, v)); }
+    // --- AuthAccess ---
+    register(f, l, e, p) { return this.serialize(() => this.auth.register(f, l, e, p)); }
+    verify(email, secret) { return this.serialize(() => this.auth.verify(email, secret)); }
+    login(loginInfo) { return this.serialize(() => this.auth.login(loginInfo)); }
+    logout() { return this.serialize(() => this.auth.logout()); }
+    me() { return this.serialize(() => this.auth.me()); }
+    remember() { return this.serialize(() => this.auth.remember()); }
+    getUserInfo() { return this.serialize(() => this.auth.getUserInfo()); }
+    setUserInfo(userInfo) { return this.serialize(() => this.auth.setUserInfo(userInfo)); }
+    updateUserPassword(passwordInfo) { return this.serialize(() => this.auth.updateUserPassword(passwordInfo)); }
+    // --- PhotoAccess ---
+    uploadPhoto(t, id, data, type) { return this.serialize(() => this.photo.uploadPhoto(t, id, data, type)); }
+    uploadUserPhoto(data, type) { return this.serialize(() => this.photo.uploadUserPhoto(data, type)); }
+    deletePhoto(t, id) { return this.serialize(() => this.photo.deletePhoto(t, id)); }
+    hasPhoto(t, id) { return this.serialize(() => this.photo.hasPhoto(t, id)); }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: HonuwareAccessProxy, deps: [{ token: CrudHttpAccess }, { token: AuthHttpAccess }, { token: PhotoHttpAccess }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: HonuwareAccessProxy, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: HonuwareAccessProxy, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [{ type: CrudHttpAccess }, { type: AuthHttpAccess }, { type: PhotoHttpAccess }] });
+
+// Narrow injection seams over the server-access layer. Framework-generic
+// consumers (controls, auth, photos, the generic CRUD editor) inject these
+// instead of a full ~250-method app interface, so a foreign app can satisfy
+// them with a 25-method implementation.
+//
+// The default resolves to HonuwareAccessProxy — the request-serializing façade
+// over the default HTTP implementations — so a consumer that does nothing gets
+// working, correctly-serialized access to the standard honuware endpoints. An
+// app that has its own request-serializing client (like knottyyoga's
+// ServerAccessProxy) overrides these tokens to point at it.
+const HONUWARE_CRUD_ACCESS = new InjectionToken('HONUWARE_CRUD_ACCESS', { providedIn: 'root', factory: () => inject(HonuwareAccessProxy) });
+const HONUWARE_AUTH_ACCESS = new InjectionToken('HONUWARE_AUTH_ACCESS', { providedIn: 'root', factory: () => inject(HonuwareAccessProxy) });
+const HONUWARE_PHOTO_ACCESS = new InjectionToken('HONUWARE_PHOTO_ACCESS', { providedIn: 'root', factory: () => inject(HonuwareAccessProxy) });
+// Convenience wiring for a consumer's app config. `mode: 'http'` (default) is
+// equivalent to the token defaults; `mode: 'mock'` requires the caller to
+// supply crud/auth/photo implementations (the testing entry point provides a
+// wrapper that fills them in).
+function provideHonuwareAccess(config = {}) {
+    if (config.mode === 'mock') {
+        if (!config.crud || !config.auth || !config.photo) {
+            throw new Error('provideHonuwareAccess({ mode: "mock" }) requires crud, auth, and photo implementations.');
+        }
+        return [
+            { provide: HONUWARE_CRUD_ACCESS, useValue: config.crud },
+            { provide: HONUWARE_AUTH_ACCESS, useValue: config.auth },
+            { provide: HONUWARE_PHOTO_ACCESS, useValue: config.photo },
+        ];
+    }
+    return [
+        { provide: HONUWARE_CRUD_ACCESS, useExisting: HonuwareAccessProxy },
+        { provide: HONUWARE_AUTH_ACCESS, useExisting: HonuwareAccessProxy },
+        { provide: HONUWARE_PHOTO_ACCESS, useExisting: HonuwareAccessProxy },
+    ];
+}
+
+// Builds the <img src> URLs for server-scaled photos, so no component
+// string-concatenates API paths. Callers append their own cache-busting query
+// params when they need them.
+class PhotoUrlBuilder {
+    apiBase;
+    constructor(apiBase) {
+        this.apiBase = apiBase;
+    }
+    scaledPhotoUrl(tableName, tableItemId, width, height) {
+        return `${this.apiBase}/get_scaled_photo/${tableName}/${tableItemId}/${width}/${height}`;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: PhotoUrlBuilder, deps: [{ token: HONUWARE_API_BASE }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: PhotoUrlBuilder, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: PhotoUrlBuilder, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }], ctorParameters: () => [{ type: undefined, decorators: [{
+                    type: Inject,
+                    args: [HONUWARE_API_BASE]
+                }] }] });
+
+/** Error type constants matching server-side ErrorCodes */
+const ErrorTypes = {
+    VALIDATION_ERROR: 'validation_error',
+    BAD_REQUEST: 'bad_request',
+    NOT_AUTHENTICATED: 'not_authenticated',
+    INVALID_CREDENTIALS: 'invalid_credentials',
+    SESSION_EXPIRED: 'session_expired',
+    NOT_AUTHORIZED: 'not_authorized',
+    NOT_FOUND: 'not_found',
+    IDEMPOTENCY_CONFLICT: 'idempotency_conflict',
+    INTERNAL_ERROR: 'internal_error',
+    PAYMENT_DECLINED: 'payment_declined',
+    PAYMENT_FAILED: 'payment_failed',
+    VOUCHER_INVALID: 'voucher_invalid',
+    SEATS_EXCEEDED: 'seats_exceeded',
+    BOOKING_CONFLICT: 'booking_conflict',
+};
+/** Check if an error response is in RFC 7807 format */
+function isProblemDetails(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'type' in error &&
+        'status' in error &&
+        typeof error.type === 'string' &&
+        typeof error.status === 'number');
+}
+
+class ErrorService {
+    /**
+     * Parse an HTTP error response into RFC 7807 ProblemDetails format.
+     * Handles both new RFC 7807 responses and legacy plain-text errors.
+     */
+    parseError(error) {
+        // Check if response is already RFC 7807 format
+        if (isProblemDetails(error.error)) {
+            return error.error;
+        }
+        // Fallback for legacy plain-text errors
+        return {
+            type: this.inferTypeFromStatus(error.status),
+            title: this.getTitleForStatus(error.status),
+            status: error.status,
+            detail: this.extractDetailFromError(error),
+        };
+    }
+    /**
+     * Get user-friendly message from a ProblemDetails error.
+     * The detail field should already be user-friendly.
+     */
+    getUserFriendlyMessage(error) {
+        return error.detail || error.title || 'An error occurred';
+    }
+    inferTypeFromStatus(status) {
+        switch (status) {
+            case 400:
+                return 'bad_request';
+            case 401:
+                return 'not_authenticated';
+            case 403:
+                return 'not_authorized';
+            case 404:
+                return 'not_found';
+            case 409:
+                return 'idempotency_conflict';
+            case 402:
+                return 'payment_failed';
+            default:
+                return 'internal_error';
+        }
+    }
+    getTitleForStatus(status) {
+        switch (status) {
+            case 400:
+                return 'Bad Request';
+            case 401:
+                return 'Authentication Required';
+            case 403:
+                return 'Not Authorized';
+            case 404:
+                return 'Not Found';
+            case 409:
+                return 'Conflict';
+            case 402:
+                return 'Payment Failed';
+            case 500:
+                return 'Internal Server Error';
+            default:
+                return 'Error';
+        }
+    }
+    extractDetailFromError(error) {
+        // If error body is a string, use it directly
+        if (typeof error.error === 'string' && error.error.length > 0) {
+            return error.error;
+        }
+        // If there's an error message property
+        if (error.error?.message) {
+            return error.error.message;
+        }
+        // Use HTTP status text as fallback
+        if (error.statusText && error.statusText !== 'Unknown Error') {
+            return error.statusText;
+        }
+        // Final fallback
+        return 'An unexpected error occurred. Please try again later.';
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: ErrorService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: ErrorService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: ErrorService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
+        }] });
+
+const CSRF_COOKIE_NAME = 'csrft';
+const CSRF_HEADER_NAME = 'X-CSRF-Token';
+const STATE_CHANGING_METHODS = new Set([
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+]);
+/**
+ * Phase 4.3 of the security review: companion to the server-side
+ * CsrfGuard middleware.
+ *
+ * On every state-changing request, read the `csrft` cookie that the
+ * backend set at login time (Phase 4.1), and copy its value into the
+ * `X-CSRF-Token` header. The double-submit pattern: an attacker on
+ * a different origin cannot read the cookie value across origins, so
+ * they can't forge a matching header.
+ *
+ * GETs / HEADs / OPTIONS pass through untouched. Requests that fire
+ * before the user has logged in (no cookie present) pass through
+ * unmodified — the server-side guard exempts the bootstrap endpoints
+ * (login / register / remember / verify) explicitly, so these still
+ * succeed.
+ */
+class CsrfInterceptor {
+    intercept(request, next) {
+        if (!STATE_CHANGING_METHODS.has(request.method.toUpperCase())) {
+            return next.handle(request);
+        }
+        const token = this.readCsrfCookie();
+        if (!token) {
+            return next.handle(request);
+        }
+        const cloned = request.clone({
+            setHeaders: { [CSRF_HEADER_NAME]: token },
+        });
+        return next.handle(cloned);
+    }
+    readCsrfCookie() {
+        if (typeof document === 'undefined' || !document.cookie)
+            return null;
+        const pairs = document.cookie.split(';');
+        for (const pair of pairs) {
+            const eq = pair.indexOf('=');
+            if (eq < 0)
+                continue;
+            const key = pair.slice(0, eq).trim();
+            if (key === CSRF_COOKIE_NAME) {
+                return pair.slice(eq + 1).trim();
+            }
+        }
+        return null;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: CsrfInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: CsrfInterceptor });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: CsrfInterceptor, decorators: [{
+            type: Injectable
+        }] });
+
+function ColumnDataInfoFromJSON(obj) {
+    const input = obj;
+    function parseString(val) {
+        if (val === null)
+            return undefined;
+        return typeof val === 'string' ? val : undefined;
+    }
+    function parseBool(val) {
+        if (val === null)
+            return undefined;
+        if (val === 't')
+            return true;
+        if (val === 'f')
+            return false;
+        return undefined;
+    }
+    function parseNumber(val) {
+        if (val === null)
+            return undefined;
+        if (typeof val === 'string') {
+            const num = Number(val);
+            return isNaN(num) ? undefined : num;
+        }
+        return undefined;
+    }
+    function parseStringArray(val) {
+        if (!Array.isArray(val))
+            return undefined;
+        return val.filter((v) => typeof v === 'string');
+    }
+    return {
+        column_name: parseString(input['column_name']),
+        type: parseString(input['type']),
+        primary_key: parseBool(input['primary_key']),
+        unique: parseBool(input['unique']),
+        nullable: parseBool(input['nullable']),
+        column_friendly_name: parseString(input['column_friendly_name']),
+        label: parseString(input['label']),
+        hint: parseString(input['hint']),
+        place_holder: parseString(input['place_holder']),
+        regex: parseString(input['regex']),
+        html_input_type: parseString(input['html_input_type']),
+        required: parseBool(input['required']),
+        max_length: parseNumber(input['max_length']),
+        default_value: parseString(input['default_value']),
+        rows: parseNumber(input['rows']),
+        hidden: parseBool(input['hidden']),
+        readonly: parseBool(input['readonly']),
+        enum_values: parseStringArray(input['enum_values']),
+    };
+}
+
+/*
+ * @honuware/ui/access
+ *
+ * The framework server-access seam: the narrow CrudAccess / AuthAccess /
+ * PhotoAccess interfaces + injection tokens, the framework DTO types
+ * (ColumnDataInfo + JSON conversion, DataResults, DatabaseSchema, TableSchema,
+ * ForeignKeyInfo, admin.types, photo.types), the RFC 7807 stack (ApiError +
+ * ErrorService), CsrfInterceptor, PhotoUrlBuilder, the request-serializing
+ * proxy, and the default HTTP implementations (provideHonuwareAccess).
+ */
+// Interfaces + request/response types
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { AuthHttpAccess, ColumnDataInfoFromJSON, CrudHttpAccess, CsrfInterceptor, ErrorService, ErrorTypes, HONUWARE_API_BASE, HONUWARE_AUTH_ACCESS, HONUWARE_CRUD_ACCESS, HONUWARE_PHOTO_ACCESS, HonuwareAccessProxy, PhotoHttpAccess, PhotoUrlBuilder, isProblemDetails, provideHonuwareAccess };
+//# sourceMappingURL=honuware-ui-access.mjs.map