@honuware/ui 0.1.0

package/fesm2022/honuware-ui-auth.mjs

@@ -0,0 +1,503 @@
+import * as i0 from '@angular/core';
+import { Inject, Injectable, InjectionToken, inject, Component } from '@angular/core';
+import { BehaviorSubject, of, throwError, firstValueFrom } from 'rxjs';
+import { mergeMap, tap, map, catchError } from 'rxjs/operators';
+import * as i5 from '@honuware/ui/access';
+import { HONUWARE_AUTH_ACCESS, ErrorTypes } from '@honuware/ui/access';
+import * as i3 from '@angular/router';
+import { Router, RouterLink } from '@angular/router';
+import * as i1 from '@angular/forms';
+import { Validators, ReactiveFormsModule } from '@angular/forms';
+import * as i6 from '@angular/material/form-field';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import * as i7 from '@angular/material/input';
+import { MatInputModule } from '@angular/material/input';
+import * as i8 from '@angular/material/button';
+import { MatButtonModule } from '@angular/material/button';
+import { MatIcon } from '@angular/material/icon';
+import * as i9 from '@angular/material/checkbox';
+import { MatCheckboxModule } from '@angular/material/checkbox';
+import * as i4 from '@honuware/ui/foundation';
+import { sanitizeReturnUrl } from '@honuware/ui/foundation';
+
+const DEFAULT_NON_AUTH_DATA = {
+    isAuth: false,
+};
+function hasPermission(authData, permission) {
+    return authData.isAuth && authData.permissions.includes(permission);
+}
+function hasManageProducts(authData) {
+    return (authData.isAuth && authData.isAdmin) || hasPermission(authData, 'manage_products');
+}
+function hasStaffAccess(authData) {
+    return (authData.isAuth && authData.isAdmin)
+        || hasPermission(authData, 'instructor')
+        || hasPermission(authData, 'admin_portal')
+        || hasPermission(authData, 'provider');
+}
+
+class AuthService {
+    authAccess;
+    _authDataSubject = new BehaviorSubject(DEFAULT_NON_AUTH_DATA);
+    get authData$() {
+        return this._authDataSubject.asObservable();
+    }
+    get authData() {
+        return this._authDataSubject.value;
+    }
+    constructor(authAccess) {
+        this.authAccess = authAccess;
+    }
+    updateAuthData(userInfo) {
+        const isAdmin = (userInfo.roles || []).includes('admin');
+        const updated = {
+            isAuth: true,
+            personId: userInfo.person_id,
+            firstName: userInfo.first_name,
+            lastName: userInfo.last_name,
+            email: userInfo.email,
+            createdAt: userInfo.created_at,
+            roles: userInfo.roles,
+            permissions: userInfo.permissions,
+            isAdmin: isAdmin,
+            mustChangePassword: userInfo.must_change_password ?? false,
+        };
+        this._authDataSubject.next(updated);
+    }
+    setUserInfo(firstName, lastName, email) {
+        const body = {
+            first_name: firstName,
+            last_name: lastName,
+            email: email
+        };
+        return this.authAccess.setUserInfo(body).pipe(mergeMap(() => this.authAccess.getUserInfo()), tap((ui) => this.updateAuthData(ui)), map(() => void 0));
+    }
+    doSetUserInfo(firstName, lastName, email) {
+        this.setUserInfo(firstName, lastName, email).subscribe();
+    }
+    updateUserPassword(oldPassword, newPassword) {
+        const body = {
+            old_password: oldPassword,
+            new_password: newPassword,
+        };
+        return this.authAccess.updateUserPassword(body);
+    }
+    doUpdateUserPassword(oldPassword, newPassword) {
+        this.updateUserPassword(oldPassword, newPassword).subscribe();
+    }
+    tryTokenLogin() {
+        // Path A: session token valid -> get user info
+        return this.authAccess.me().pipe(mergeMap(() => this.authAccess.getUserInfo().pipe(tap((ui) => this.updateAuthData(ui)), map(() => true))), catchError((err) => {
+            // If 401, attempt device remember token flow
+            if (err?.status === 401) {
+                return this.authAccess.remember().pipe(mergeMap(() => this.authAccess.me()), mergeMap(() => this.authAccess.getUserInfo().pipe(tap((ui) => this.updateAuthData(ui)), map(() => true))), catchError(() => of(false)));
+            }
+            return of(false);
+        }));
+    }
+    login(email, password, remember) {
+        const body = { email, password, remember };
+        return this.authAccess.login(body).pipe(mergeMap(() => this.authAccess.getUserInfo().pipe(tap((ui) => this.updateAuthData(ui)), map(() => void 0))));
+    }
+    logout() {
+        return this.authAccess.logout().pipe(tap(() => this._authDataSubject.next(DEFAULT_NON_AUTH_DATA)));
+    }
+    register(firstName, lastName, email, password) {
+        return this.authAccess.register(firstName, lastName, email, password);
+    }
+    // Phase 3.3 of the security review: the SPA's /verify route lands
+    // here. The verification email's link points at the SPA, which calls
+    // this and then immediately scrubs the URL via history.replaceState.
+    verify(email, secret) {
+        return this.authAccess.verify(email, secret);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: AuthService, deps: [{ token: HONUWARE_AUTH_ACCESS }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: AuthService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: AuthService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root',
+                }]
+        }], ctorParameters: () => [{ type: undefined, decorators: [{
+                    type: Inject,
+                    args: [HONUWARE_AUTH_ACCESS]
+                }] }] });
+
+const DEFAULT_AUTH_ROUTES = {
+    loginPath: '/login',
+    registerPath: '/register',
+    postLogoutPath: '/',
+    mustChangePasswordPath: '/my/update-user-password',
+    returnUrlAllowlist: ['/my', '/admin', '/manage', '/staff', '/calendar', '/shop'],
+};
+// Root-provided with the knottyyoga defaults, so nothing needs wiring today.
+// When the auth layer moves into @honuware/ui/auth the library token drops the
+// app default and each consumer provides its own AuthRoutes.
+const AUTH_ROUTES = new InjectionToken('AUTH_ROUTES', {
+    providedIn: 'root',
+    factory: () => DEFAULT_AUTH_ROUTES,
+});
+
+const AdminGuard = () => {
+    const router = inject(Router);
+    const authService = inject(AuthService);
+    const routes = inject(AUTH_ROUTES);
+    if (!authService.authData.isAuth || !authService.authData.isAdmin) {
+        return router.parseUrl(routes.postLogoutPath);
+    }
+    return true;
+};
+const AuthGuard = (route, state) => {
+    const router = inject(Router);
+    const authService = inject(AuthService);
+    const routes = inject(AUTH_ROUTES);
+    const url = state.url;
+    // Allow access to login and register without auth
+    if (url.startsWith(routes.loginPath) || url.startsWith(routes.registerPath)) {
+        return true;
+    }
+    if (!authService.authData.isAuth) {
+        const returnUrl = encodeURIComponent(url);
+        return router.parseUrl(`${routes.loginPath}?returnUrl=${returnUrl}`);
+    }
+    // Force password change if required (allow access to the change password page itself)
+    if (authService.authData.mustChangePassword &&
+        !url.startsWith(routes.mustChangePasswordPath)) {
+        return router.parseUrl(routes.mustChangePasswordPath);
+    }
+    return true;
+};
+const ManageProductsGuard = () => {
+    const router = inject(Router);
+    const authService = inject(AuthService);
+    const routes = inject(AUTH_ROUTES);
+    if (!hasManageProducts(authService.authData)) {
+        return router.parseUrl(routes.postLogoutPath);
+    }
+    return true;
+};
+const StaffGuard = () => {
+    const router = inject(Router);
+    const authService = inject(AuthService);
+    const routes = inject(AUTH_ROUTES);
+    if (!hasStaffAccess(authService.authData)) {
+        return router.parseUrl(routes.postLogoutPath);
+    }
+    return true;
+};
+const NoAuthGuard = () => {
+    const router = inject(Router);
+    const authService = inject(AuthService);
+    const routes = inject(AUTH_ROUTES);
+    if (authService.authData.isAuth) {
+        return router.parseUrl(routes.postLogoutPath);
+    }
+    return true;
+};
+
+class ErrorInterceptor {
+    errorService;
+    router;
+    authRoutes;
+    constructor(errorService, router, authRoutes) {
+        this.errorService = errorService;
+        this.router = router;
+        this.authRoutes = authRoutes;
+    }
+    intercept(request, next) {
+        return next.handle(request).pipe(catchError((error) => {
+            const problemDetails = this.errorService.parseError(error);
+            // Handle session expired globally - redirect to login
+            if (problemDetails.type === ErrorTypes.SESSION_EXPIRED ||
+                (problemDetails.type === ErrorTypes.NOT_AUTHENTICATED &&
+                    !this.isAuthEndpoint(request.url))) {
+                this.router.navigate([this.authRoutes.loginPath]);
+            }
+            // Create extended error with parsed problem details
+            const parsedError = Object.assign(error, {
+                problemDetails,
+            });
+            return throwError(() => parsedError);
+        }));
+    }
+    isAuthEndpoint(url) {
+        const authEndpoints = ['/api/login', '/api/register', '/api/me', '/api/remember'];
+        return authEndpoints.some((endpoint) => url.includes(endpoint));
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: ErrorInterceptor, deps: [{ token: i5.ErrorService }, { token: i3.Router }, { token: AUTH_ROUTES }], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: ErrorInterceptor });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: ErrorInterceptor, decorators: [{
+            type: Injectable
+        }], ctorParameters: () => [{ type: i5.ErrorService }, { type: i3.Router }, { type: undefined, decorators: [{
+                    type: Inject,
+                    args: [AUTH_ROUTES]
+                }] }] });
+
+class LoginComponent {
+    fb;
+    authService;
+    router;
+    route;
+    toastService;
+    errorService;
+    authRoutes;
+    form;
+    hidePassword = true;
+    returnUrl;
+    constructor(fb, authService, router, route, toastService, errorService, authRoutes) {
+        this.fb = fb;
+        this.authService = authService;
+        this.router = router;
+        this.route = route;
+        this.toastService = toastService;
+        this.errorService = errorService;
+        this.authRoutes = authRoutes;
+        this.form = this.fb.group({
+            email: ['', [Validators.required]],
+            password: ['', [Validators.required]],
+            remember: [false],
+        });
+        // Phase 10.2: never trust the raw query parameter — see
+        // sanitizeReturnUrl above for the threat model.
+        this.returnUrl = sanitizeReturnUrl(this.route.snapshot.queryParamMap.get('returnUrl'), this.authRoutes.returnUrlAllowlist);
+    }
+    togglePasswordVisibility() {
+        this.hidePassword = !this.hidePassword;
+    }
+    onSignIn() {
+        if (this.form.invalid) {
+            this.form.markAllAsTouched();
+            return;
+        }
+        const email = this.form.get('email')?.value ?? '';
+        const password = this.form.get('password')?.value ?? '';
+        const remember = !!this.form.get('remember')?.value;
+        this.authService.login(email, password, remember).subscribe({
+            next: () => {
+                if (this.authService.authData.isAuth && this.authService.authData.mustChangePassword) {
+                    this.router.navigateByUrl(this.authRoutes.mustChangePasswordPath);
+                }
+                else {
+                    this.router.navigateByUrl(this.returnUrl);
+                }
+            },
+            error: (err) => {
+                const problem = this.errorService.parseError(err);
+                this.toastService.error(this.errorService.getUserFriendlyMessage(problem));
+            },
+        });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: LoginComponent, deps: [{ token: i1.FormBuilder }, { token: AuthService }, { token: i3.Router }, { token: i3.ActivatedRoute }, { token: i4.ToastService }, { token: i5.ErrorService }, { token: AUTH_ROUTES }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.18", type: LoginComponent, isStandalone: true, selector: "hw-login", ngImport: i0, template: "<div\n  class=\"max-w-[420px] p-6 flex flex-col gap-8 mx-auto my-8 border border-gray-300 rounded-lg\"\n>\n  <h1 class=\"text-center text-2xl\">Log In</h1>\n\n  <form [formGroup]=\"form\" (submit)=\"onSignIn()\" class=\"flex flex-col gap-4\">\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Email</mat-label>\n      <input id=\"email\" matInput type=\"text\" formControlName=\"email\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Password</mat-label>\n      <input id=\"password\"\n             matInput\n             [type]=\"hidePassword ? 'password' : 'text'\"\n             formControlName=\"password\" />\n      <button type=\"button\"\n              matSuffix\n              (click)=\"togglePasswordVisibility()\"\n              class=\"mr-2\">\n        <mat-icon>\n          {{\n          hidePassword ? \"visibility_off\" : \"visibility\"\n          }}\n        </mat-icon>\n      </button>\n    </mat-form-field>\n\n    <mat-checkbox id=\"remember\" formControlName=\"remember\">Remember Me</mat-checkbox>\n\n    <button mat-raised-button id=\"signIn\" color=\"primary\" type=\"submit\">Sign in</button>\n  </form>\n\n  <a\n    id=\"create-account-link\"\n    [routerLink]=\"'/register'\"\n    color=\"primary\"\n    class=\"text-center\"\n  >\n    Create an account\n  </a>\n</div>\n", styles: [""], dependencies: [{ kind: "ngmodule", type: ReactiveFormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.FormGroupDirective, selector: "[formGroup]", inputs: ["formGroup"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: i1.FormControlName, selector: "[formControlName]", inputs: ["formControlName", "disabled", "ngModel"], outputs: ["ngModelChange"] }, { kind: "ngmodule", type: MatFormFieldModule }, { kind: "component", type: i6.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i6.MatLabel, selector: "mat-label" }, { kind: "directive", type: i6.MatSuffix, selector: "[matSuffix], [matIconSuffix], [matTextSuffix]", inputs: ["matTextSuffix"] }, { kind: "ngmodule", type: MatInputModule }, { kind: "directive", type: i7.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }, { kind: "ngmodule", type: MatButtonModule }, { kind: "component", type: i8.MatButton, selector: "    button[matButton], a[matButton], button[mat-button], button[mat-raised-button],    button[mat-flat-button], button[mat-stroked-button], a[mat-button], a[mat-raised-button],    a[mat-flat-button], a[mat-stroked-button]  ", inputs: ["matButton"], exportAs: ["matButton", "matAnchor"] }, { kind: "ngmodule", type: MatCheckboxModule }, { kind: "component", type: i9.MatCheckbox, selector: "mat-checkbox", inputs: ["aria-label", "aria-labelledby", "aria-describedby", "aria-expanded", "aria-controls", "aria-owns", "id", "required", "labelPosition", "name", "value", "disableRipple", "tabIndex", "color", "disabledInteractive", "checked", "disabled", "indeterminate"], outputs: ["change", "indeterminateChange"], exportAs: ["matCheckbox"] }, { kind: "component", type: MatIcon, selector: "mat-icon", inputs: ["color", "inline", "svgIcon", "fontSet", "fontIcon"], exportAs: ["matIcon"] }, { kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "routerLink"] }] });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: LoginComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'hw-login', standalone: true, imports: [
+                        ReactiveFormsModule,
+                        MatFormFieldModule,
+                        MatInputModule,
+                        MatButtonModule,
+                        MatCheckboxModule,
+                        MatIcon,
+                        RouterLink
+                    ], template: "<div\n  class=\"max-w-[420px] p-6 flex flex-col gap-8 mx-auto my-8 border border-gray-300 rounded-lg\"\n>\n  <h1 class=\"text-center text-2xl\">Log In</h1>\n\n  <form [formGroup]=\"form\" (submit)=\"onSignIn()\" class=\"flex flex-col gap-4\">\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Email</mat-label>\n      <input id=\"email\" matInput type=\"text\" formControlName=\"email\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Password</mat-label>\n      <input id=\"password\"\n             matInput\n             [type]=\"hidePassword ? 'password' : 'text'\"\n             formControlName=\"password\" />\n      <button type=\"button\"\n              matSuffix\n              (click)=\"togglePasswordVisibility()\"\n              class=\"mr-2\">\n        <mat-icon>\n          {{\n          hidePassword ? \"visibility_off\" : \"visibility\"\n          }}\n        </mat-icon>\n      </button>\n    </mat-form-field>\n\n    <mat-checkbox id=\"remember\" formControlName=\"remember\">Remember Me</mat-checkbox>\n\n    <button mat-raised-button id=\"signIn\" color=\"primary\" type=\"submit\">Sign in</button>\n  </form>\n\n  <a\n    id=\"create-account-link\"\n    [routerLink]=\"'/register'\"\n    color=\"primary\"\n    class=\"text-center\"\n  >\n    Create an account\n  </a>\n</div>\n" }]
+        }], ctorParameters: () => [{ type: i1.FormBuilder }, { type: AuthService }, { type: i3.Router }, { type: i3.ActivatedRoute }, { type: i4.ToastService }, { type: i5.ErrorService }, { type: undefined, decorators: [{
+                    type: Inject,
+                    args: [AUTH_ROUTES]
+                }] }] });
+
+class RegisterComponent {
+    fb;
+    authService;
+    router;
+    toastService;
+    errorService;
+    authRoutes;
+    form;
+    hidePassword = true;
+    constructor(fb, authService, router, toastService, errorService, authRoutes) {
+        this.fb = fb;
+        this.authService = authService;
+        this.router = router;
+        this.toastService = toastService;
+        this.errorService = errorService;
+        this.authRoutes = authRoutes;
+        this.form = this.fb.group({
+            email: ['', [Validators.required, Validators.email]],
+            first_name: ['', [Validators.required]],
+            last_name: ['', [Validators.required]],
+            password: ['', [Validators.required]],
+            password2: ['', [Validators.required]],
+        }, { validators: this.passwordsMatchValidator });
+    }
+    togglePasswordVisibility() {
+        this.hidePassword = !this.hidePassword;
+    }
+    // Custom validator that flags mismatch only when both fields are dirty and values differ
+    passwordsMatchValidator(group) {
+        const password = group.get('password');
+        const password2 = group.get('password2');
+        if (!password || !password2)
+            return null;
+        const bothDirty = password.dirty && password2.dirty;
+        const mismatch = password.value !== password2.value;
+        if (bothDirty && mismatch) {
+            password2.setErrors({ mismatch: true });
+            return { mismatch: true };
+        }
+        else {
+            // Clear mismatch error when aligned or not both dirty
+            if (password2.hasError('mismatch')) {
+                const otherErrors = { ...password2.errors };
+                delete otherErrors['mismatch'];
+                password2.setErrors(Object.keys(otherErrors).length ? otherErrors : null);
+            }
+            return null;
+        }
+    }
+    onRegister() {
+        if (this.form.invalid) {
+            this.form.markAllAsTouched();
+            return;
+        }
+        const email = this.form.get('email')?.value ?? '';
+        const firstName = this.form.get('first_name')?.value ?? '';
+        const lastName = this.form.get('last_name')?.value ?? '';
+        const password = this.form.get('password')?.value ?? '';
+        this.authService.register(firstName, lastName, email, password).subscribe({
+            next: () => this.router.navigate([this.authRoutes.loginPath]),
+            error: (err) => {
+                const problem = this.errorService.parseError(err);
+                this.toastService.error(this.errorService.getUserFriendlyMessage(problem));
+            }
+        });
+    }
+    showPasswordMismatch() {
+        const password = this.form.get('password');
+        const password2 = this.form.get('password2');
+        if (!password || !password2)
+            return false;
+        return !!password.dirty && !!password2.dirty && password.value !== password2.value;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: RegisterComponent, deps: [{ token: i1.FormBuilder }, { token: AuthService }, { token: i3.Router }, { token: i4.ToastService }, { token: i5.ErrorService }, { token: AUTH_ROUTES }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.18", type: RegisterComponent, isStandalone: true, selector: "hw-register", ngImport: i0, template: "<div\n  class=\"max-w-[420px] p-6 flex flex-col gap-8 mx-auto my-8 border border-gray-300 rounded-lg\"\n  >\n  <h1 class=\"text-center text-2xl\">Create Account</h1>\n\n  <form [formGroup]=\"form\" (ngSubmit)=\"onRegister()\" class=\"flex flex-col gap-4\">\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Email</mat-label>\n      <input id=\"email\" matInput type=\"email\" formControlName=\"email\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>First name</mat-label>\n      <input id=\"first_name\" matInput type=\"text\" formControlName=\"first_name\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Last name</mat-label>\n      <input id=\"last_name\" matInput type=\"text\" formControlName=\"last_name\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Password</mat-label>\n      <input id=\"password\" matInput [type]=\"hidePassword ? 'password' : 'text'\" formControlName=\"password\" />\n      <button type=\"button\"\n        matSuffix\n        (click)=\"togglePasswordVisibility()\"\n        class=\"mr-2\">\n        <mat-icon>\n          {{\n          hidePassword ? \"visibility_off\" : \"visibility\"\n          }}\n        </mat-icon>\n      </button>\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Reenter password</mat-label>\n      <input id=\"password2\" matInput [type]=\"hidePassword ? 'password' : 'text'\" formControlName=\"password2\" />\n      <button type=\"button\"\n        matSuffix\n        (click)=\"togglePasswordVisibility()\"\n        class=\"mr-2\">\n        <mat-icon>\n          {{\n          hidePassword ? \"visibility_off\" : \"visibility\"\n          }}\n        </mat-icon>\n      </button>\n      @if (showPasswordMismatch()) {\n        <mat-error>\n          Passwords do not match.\n        </mat-error>\n      }\n    </mat-form-field>\n\n    <button id=\"Register\" mat-raised-button color=\"primary\" type=\"submit\">\n      Register\n    </button>\n  </form>\n</div>\n", styles: [".register-container{max-width:480px;margin:2rem auto;padding:1.5rem;display:flex;flex-direction:column;gap:1rem}form{display:flex;flex-direction:column;gap:1rem}.full-width{width:100%}\n"], dependencies: [{ kind: "ngmodule", type: ReactiveFormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.FormGroupDirective, selector: "[formGroup]", inputs: ["formGroup"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: i1.FormControlName, selector: "[formControlName]", inputs: ["formControlName", "disabled", "ngModel"], outputs: ["ngModelChange"] }, { kind: "ngmodule", type: MatFormFieldModule }, { kind: "component", type: i6.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i6.MatLabel, selector: "mat-label" }, { kind: "directive", type: i6.MatError, selector: "mat-error, [matError]", inputs: ["id"] }, { kind: "directive", type: i6.MatSuffix, selector: "[matSuffix], [matIconSuffix], [matTextSuffix]", inputs: ["matTextSuffix"] }, { kind: "ngmodule", type: MatInputModule }, { kind: "directive", type: i7.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }, { kind: "ngmodule", type: MatButtonModule }, { kind: "component", type: i8.MatButton, selector: "    button[matButton], a[matButton], button[mat-button], button[mat-raised-button],    button[mat-flat-button], button[mat-stroked-button], a[mat-button], a[mat-raised-button],    a[mat-flat-button], a[mat-stroked-button]  ", inputs: ["matButton"], exportAs: ["matButton", "matAnchor"] }, { kind: "component", type: MatIcon, selector: "mat-icon", inputs: ["color", "inline", "svgIcon", "fontSet", "fontIcon"], exportAs: ["matIcon"] }] });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: RegisterComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'hw-register', standalone: true, imports: [ReactiveFormsModule, MatFormFieldModule, MatInputModule, MatButtonModule, MatIcon], template: "<div\n  class=\"max-w-[420px] p-6 flex flex-col gap-8 mx-auto my-8 border border-gray-300 rounded-lg\"\n  >\n  <h1 class=\"text-center text-2xl\">Create Account</h1>\n\n  <form [formGroup]=\"form\" (ngSubmit)=\"onRegister()\" class=\"flex flex-col gap-4\">\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Email</mat-label>\n      <input id=\"email\" matInput type=\"email\" formControlName=\"email\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>First name</mat-label>\n      <input id=\"first_name\" matInput type=\"text\" formControlName=\"first_name\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Last name</mat-label>\n      <input id=\"last_name\" matInput type=\"text\" formControlName=\"last_name\" />\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Password</mat-label>\n      <input id=\"password\" matInput [type]=\"hidePassword ? 'password' : 'text'\" formControlName=\"password\" />\n      <button type=\"button\"\n        matSuffix\n        (click)=\"togglePasswordVisibility()\"\n        class=\"mr-2\">\n        <mat-icon>\n          {{\n          hidePassword ? \"visibility_off\" : \"visibility\"\n          }}\n        </mat-icon>\n      </button>\n    </mat-form-field>\n\n    <mat-form-field appearance=\"outline\">\n      <mat-label>Reenter password</mat-label>\n      <input id=\"password2\" matInput [type]=\"hidePassword ? 'password' : 'text'\" formControlName=\"password2\" />\n      <button type=\"button\"\n        matSuffix\n        (click)=\"togglePasswordVisibility()\"\n        class=\"mr-2\">\n        <mat-icon>\n          {{\n          hidePassword ? \"visibility_off\" : \"visibility\"\n          }}\n        </mat-icon>\n      </button>\n      @if (showPasswordMismatch()) {\n        <mat-error>\n          Passwords do not match.\n        </mat-error>\n      }\n    </mat-form-field>\n\n    <button id=\"Register\" mat-raised-button color=\"primary\" type=\"submit\">\n      Register\n    </button>\n  </form>\n</div>\n", styles: [".register-container{max-width:480px;margin:2rem auto;padding:1.5rem;display:flex;flex-direction:column;gap:1rem}form{display:flex;flex-direction:column;gap:1rem}.full-width{width:100%}\n"] }]
+        }], ctorParameters: () => [{ type: i1.FormBuilder }, { type: AuthService }, { type: i3.Router }, { type: i4.ToastService }, { type: i5.ErrorService }, { type: undefined, decorators: [{
+                    type: Inject,
+                    args: [AUTH_ROUTES]
+                }] }] });
+
+/**
+ * Phase 3.3 of the security review.
+ *
+ * The verification email links at this SPA route — `/verify?email=…&secret=…` —
+ * rather than at the API. The component:
+ *
+ *   1. Reads `email` and `secret` from the query string.
+ *   2. Immediately calls `AuthService.verify(email, secret)` (POST /api/verify).
+ *   3. Right after firing the request, scrubs the URL via
+ *      `history.replaceState({}, '', '/verify-success')` so the secret
+ *      stops appearing in the URL bar / browser history. We do this
+ *      synchronously, NOT inside the response callback, so the URL is
+ *      sanitized whether the request succeeds, fails, or is delayed.
+ *   4. On success or failure, routes to `/login` with a toast. The two
+ *      paths use different toasts but the toast text never echoes the
+ *      server's error detail — failed verifications all collapse to one
+ *      generic message to avoid distinguishing "wrong secret" from
+ *      "expired" from "already verified".
+ */
+class VerifyComponent {
+    route;
+    router;
+    authService;
+    toastService;
+    authRoutes;
+    constructor(route, router, authService, toastService, authRoutes) {
+        this.route = route;
+        this.router = router;
+        this.authService = authService;
+        this.toastService = toastService;
+        this.authRoutes = authRoutes;
+    }
+    ngOnInit() {
+        const email = this.route.snapshot.queryParamMap.get('email') ?? '';
+        const secret = this.route.snapshot.queryParamMap.get('secret') ?? '';
+        if (!email || !secret) {
+            this.scrubUrl();
+            this.toastService.error('Verification link is missing required parameters.');
+            this.router.navigate([this.authRoutes.loginPath]);
+            return;
+        }
+        // Fire the verification request first, THEN scrub the URL. The
+        // secret is in memory either way; the goal of the scrub is to keep
+        // it out of the browser's URL bar and history. Doing it before
+        // we're sure about the response means even a slow / failed request
+        // doesn't leave the secret visible.
+        const verify$ = this.authService.verify(email, secret);
+        this.scrubUrl();
+        verify$.subscribe({
+            next: () => {
+                this.toastService.success('Email verified — please log in.');
+                this.router.navigate([this.authRoutes.loginPath]);
+            },
+            error: () => {
+                // Phase 3.3: don't echo the server error detail. All failure
+                // modes (wrong secret, expired, already-used) collapse to a
+                // single generic message.
+                this.toastService.error('Verification failed or expired. Please try again.');
+                this.router.navigate([this.authRoutes.loginPath]);
+            },
+        });
+    }
+    scrubUrl() {
+        // We can't replace the path via Router.navigate without triggering
+        // a route change here — `history.replaceState` mutates only the URL
+        // bar / history entry. The `/verify-success` path doesn't need to
+        // be a real route; we navigate to /login on the next tick anyway.
+        window.history.replaceState({}, '', '/verify-success');
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: VerifyComponent, deps: [{ token: i3.ActivatedRoute }, { token: i3.Router }, { token: AuthService }, { token: i4.ToastService }, { token: AUTH_ROUTES }], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.18", type: VerifyComponent, isStandalone: true, selector: "hw-verify", ngImport: i0, template: "<div class=\"verify-container\">\n  <p>Verifying your email...</p>\n</div>\n", styles: [".verify-container{display:flex;align-items:center;justify-content:center;min-height:50vh;padding:2rem;text-align:center}\n"] });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.18", ngImport: i0, type: VerifyComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'hw-verify', standalone: true, imports: [], template: "<div class=\"verify-container\">\n  <p>Verifying your email...</p>\n</div>\n", styles: [".verify-container{display:flex;align-items:center;justify-content:center;min-height:50vh;padding:2rem;text-align:center}\n"] }]
+        }], ctorParameters: () => [{ type: i3.ActivatedRoute }, { type: i3.Router }, { type: AuthService }, { type: i4.ToastService }, { type: undefined, decorators: [{
+                    type: Inject,
+                    args: [AUTH_ROUTES]
+                }] }] });
+
+// Phase 10.1 of the security review: try silent re-auth at bootstrap so
+// the SPA hydrates `authData$` BEFORE the first route activates. Without
+// this an authenticated user lands on a public-looking shell, sees the
+// guarded route bounce them to /login, and only then gets logged in by
+// the device-token flow.
+//
+// Returns a thunk (factory) so Angular invokes it AFTER DI sets up the
+// AuthService graph. We resolve regardless of outcome — a network blip
+// or invalid cookie should not block app bootstrap. A consumer wires this
+// into an APP_INITIALIZER with `deps: [AuthService]`.
+function tryTokenLoginInitializer(authService) {
+    return () => firstValueFrom(authService.tryTokenLogin())
+        .then(() => void 0)
+        .catch(() => void 0);
+}
+
+/*
+ * @honuware/ui/auth — the auth layer: AuthService + AuthData/permission
+ * helpers, the five route guards, the ErrorInterceptor, the login/register/
+ * verify pages (selectors `hw-`), the AUTH_ROUTES config token, and the
+ * tryTokenLogin bootstrap initializer. Depends on foundation + access.
+ */
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { AUTH_ROUTES, AdminGuard, AuthGuard, AuthService, DEFAULT_AUTH_ROUTES, DEFAULT_NON_AUTH_DATA, ErrorInterceptor, LoginComponent, ManageProductsGuard, NoAuthGuard, RegisterComponent, StaffGuard, VerifyComponent, hasManageProducts, hasPermission, hasStaffAccess, tryTokenLoginInitializer };
+//# sourceMappingURL=honuware-ui-auth.mjs.map