@kengcom202/kcore-ui 0.4.0 → 0.5.0

package/fesm2022/kengcom202-kcore-ui.mjs

@@ -5,6 +5,7 @@ import { FormBuilder, FormsModule, NG_VALUE_ACCESSOR, ReactiveFormsModule, Valid
 import { HttpClient, HttpErrorResponse } from "@angular/common/http";
 import { ActivatedRoute, Router, RouterLink } from "@angular/router";
 import { catchError, throwError } from "rxjs";
+import { toSignal } from "@angular/core/rxjs-interop";
 var AnchoredPopup = class {
 	anchor;
 	component;
@@ -1395,7 +1396,8 @@ const KC_AUTH_CONFIG = new InjectionToken("KC_AUTH_CONFIG");
 const KC_AUTH_PATHS = {
 	login: "/login",
 	register: "/register",
-	ssoCallback: "/sso-callback"
+	ssoCallback: "/sso-callback",
+	thaidCallback: "/thaid-callback"
 };
 function resolveKcAuthConfig(o) {
 	return {
@@ -1404,7 +1406,8 @@ function resolveKcAuthConfig(o) {
 		apiBase: (o.apiBase ?? "/api").replace(/\/+$/, ""),
 		homeUrl: o.homeUrl || "/",
 		sso: o.sso ? { label: o.sso.label || "SSO" } : null,
-		passwordLogin: o.passwordLogin !== false || !o.sso,
+		thaid: o.thaid ? { label: o.thaid.label || "ThaiD" } : null,
+		passwordLogin: o.passwordLogin !== false || !o.sso && !o.thaid,
 		register: o.register ?? "none",
 		orgLabel: o.orgLabel || "หน่วยงาน",
 		adminRoles: o.adminRoles ?? ["admin"],
@@ -1418,6 +1421,12 @@ function provideKcAuth(options) {
 		useValue: resolveKcAuthConfig(options)
 	}]);
 }
+const KC_LOGIN_LOCK_SECONDS = 300;
+function kcLoginRetryAfter(err) {
+	if (!(err instanceof HttpErrorResponse) || err.status !== 429) return 0;
+	const s = Number(err.error?.retryAfter);
+	return Number.isFinite(s) && s > 0 ? Math.ceil(s) : 300;
+}
 function kcErrorMessage(err, fallback) {
 	if (err instanceof HttpErrorResponse) {
 		const m = err.error?.message;
@@ -1429,6 +1438,7 @@ function kcErrorMessage(err, fallback) {
 const SESSION_KEY = "kc_session";
 const KC_SSO_STATE_KEY = "kc_sso_state";
 const KC_SSO_TICKET_KEY = "kc_sso_ticket";
+const KC_THAID_STATE_KEY = "kc_thaid_state";
 const KC_RETURN_URL_KEY = "kc_return_url";
 function kcTokenExpired(token, now = Date.now()) {
 	const part = token.split(".")[1];
@@ -1492,6 +1502,7 @@ var KcAuthService = class KcAuthService {
 		for (const k of [
 			KC_SSO_STATE_KEY,
 			KC_SSO_TICKET_KEY,
+			KC_THAID_STATE_KEY,
 			KC_RETURN_URL_KEY
 		]) this.storage("sessionStorage")?.removeItem(k);
 	}
@@ -1719,6 +1730,9 @@ const AUTH_CSS = `
 .kc-auth-field-error { color: var(--kc-auth-danger, #c62828); font-size: 0.86em; }
 .kc-auth-hint { margin: 2px 0 0; color: var(--kc-auth-muted, #806f80); font-size: 0.86em; }
 .kc-auth-check { display: inline-flex; align-items: center; gap: 6px; cursor: pointer; user-select: none; }
+.kc-auth-check:has(input:disabled) { cursor: not-allowed; opacity: 0.7; }
+.kc-auth-methods { display: flex; flex-wrap: wrap; align-items: center; gap: 10px 22px; }
+.kc-auth-methods > .kc-auth-btn { margin-left: auto; min-width: 110px; }
 
 /* ---- ปุ่ม ---- */
 .kc-auth-actions { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 8px; margin-top: 6px; }
@@ -1760,7 +1774,7 @@ const AUTH_CSS = `
 .kc-auth-btn-row { display: flex; gap: 10px; margin-top: 6px; }
 .kc-auth-btn-row > .kc-auth-btn { flex: 1 1 0; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
 /* ปิดรหัสผ่าน: ปุ่ม SSO ปุ่มเดียวตรงกลาง */
-.kc-auth-sso-only { display: flex; justify-content: center; padding: 8px 0 4px; }
+.kc-auth-sso-only { display: flex; flex-direction: column; align-items: center; gap: 10px; padding: 8px 0 4px; }
 .kc-auth-sso-only > .kc-auth-btn { min-width: 75%; height: 46px; padding: 0 24px; font-size: 1.05em; }
 .kc-auth-btn.block { display: flex; width: 100%; }
 .kc-auth-btn.sm { height: 30px; padding: 0 10px; font-size: 0.93em; }
@@ -1981,6 +1995,23 @@ i0.ɵɵngDeclareClassMetadata({
 	}],
 	ctorParameters: () => []
 });
+const KC_LOGIN_LOCK_KEY = "kc_login_lock";
+const lockKey = (username) => username.trim().toLowerCase();
+function readLocks(storage) {
+	try {
+		const raw = JSON.parse(storage?.getItem("kc_login_lock") ?? "{}");
+		const now = Date.now();
+		return Object.fromEntries(Object.entries(raw && typeof raw === "object" ? raw : {}).filter((e) => typeof e[1] === "number" && e[1] > now));
+	} catch {
+		return {};
+	}
+}
+function writeLocks(storage, locks) {
+	try {
+		if (Object.keys(locks).length) storage?.setItem(KC_LOGIN_LOCK_KEY, JSON.stringify(locks));
+		else storage?.removeItem(KC_LOGIN_LOCK_KEY);
+	} catch {}
+}
 var KcLoginComponent = class KcLoginComponent {
 	config = inject(KC_AUTH_CONFIG);
 	paths = KC_AUTH_PATHS;
@@ -1988,19 +2019,57 @@ var KcLoginComponent = class KcLoginComponent {
 	http = inject(HttpClient);
 	router = inject(Router);
 	route = inject(ActivatedRoute);
+	doc = inject(DOCUMENT);
 	busy = signal("", ...ngDevMode ? [{ debugName: "busy" }] : /* istanbul ignore next */ []);
+	methods = signal({
+		password: true,
+		sso: true,
+		thaid: true
+	}, ...ngDevMode ? [{ debugName: "methods" }] : /* istanbul ignore next */ []);
+	external = computed(() => [...this.config.sso && this.methods().sso ? [{
+		key: "sso",
+		label: this.config.sso.label,
+		stateKey: KC_SSO_STATE_KEY
+	}] : [], ...this.config.thaid && this.methods().thaid ? [{
+		key: "thaid",
+		label: this.config.thaid.label,
+		stateKey: KC_THAID_STATE_KEY
+	}] : []], ...ngDevMode ? [{ debugName: "external" }] : /* istanbul ignore next */ []);
+	showPassword = computed(() => this.config.passwordLogin && this.methods().password || !this.external().length, ...ngDevMode ? [{ debugName: "showPassword" }] : /* istanbul ignore next */ []);
 	message = signal(null, ...ngDevMode ? [{ debugName: "message" }] : /* istanbul ignore next */ []);
 	form = inject(FormBuilder).nonNullable.group({
 		username: ["", Validators.required],
 		password: ["", Validators.required]
 	});
+	locks = signal(readLocks(this.storage()), ...ngDevMode ? [{ debugName: "locks" }] : /* istanbul ignore next */ []);
+	now = signal(Date.now(), ...ngDevMode ? [{ debugName: "now" }] : /* istanbul ignore next */ []);
+	username = toSignal(this.form.controls.username.valueChanges, { initialValue: "" });
+	lockLeft = computed(() => {
+		const until = this.locks()[lockKey(this.username())] ?? 0;
+		return Math.max(0, Math.ceil((until - this.now()) / 1e3));
+	}, ...ngDevMode ? [{ debugName: "lockLeft" }] : /* istanbul ignore next */ []);
+	lockText = computed(() => {
+		const s = this.lockLeft();
+		return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")}`;
+	}, ...ngDevMode ? [{ debugName: "lockText" }] : /* istanbul ignore next */ []);
+	timer;
 	constructor() {
 		ensureAuthStyles();
+		inject(DestroyRef).onDestroy(() => this.stopTimer());
+		if (Object.keys(this.locks()).length) this.startTimer();
 	}
 	get returnUrl() {
 		return this.auth.safeReturnUrl(this.route.snapshot.queryParamMap.get("returnUrl"));
 	}
 	ngOnInit() {
+		this.http.get(`${this.config.apiBase}/user/login-methods`).subscribe({
+			next: (m) => this.methods.set({
+				password: m?.password !== false,
+				sso: m?.sso !== false,
+				thaid: m?.thaid !== false
+			}),
+			error: () => {}
+		});
 		if (this.route.snapshot.queryParamMap.get("expired") === "1") this.message.set({
 			text: "หมดเวลาการใช้งาน กรุณาเข้าสู่ระบบใหม่",
 			error: false
@@ -2008,7 +2077,7 @@ var KcLoginComponent = class KcLoginComponent {
 		else if (this.auth.isLoggedIn()) this.router.navigateByUrl(this.returnUrl);
 	}
 	submit() {
-		if (this.busy()) return;
+		if (this.busy() || this.lockLeft()) return;
 		const v = this.form.getRawValue();
 		if (!v.username.trim() || !v.password) {
 			this.message.set({
@@ -2024,33 +2093,66 @@ var KcLoginComponent = class KcLoginComponent {
 			password: v.password
 		}).subscribe({
 			next: (res) => {
+				this.setLock(v.username, 0);
 				this.auth.start(res);
 				this.router.navigateByUrl(this.returnUrl);
 			},
 			error: (err) => {
 				this.busy.set("");
-				this.message.set({
+				const wait = kcLoginRetryAfter(err);
+				if (wait) this.setLock(v.username, Date.now() + wait * 1e3);
+				else this.message.set({
 					text: kcErrorMessage(err, "เข้าสู่ระบบไม่สำเร็จ"),
 					error: true
 				});
 			}
 		});
 	}
-	startSso() {
-		const sso = this.config.sso;
-		if (!sso || this.busy()) return;
-		this.busy.set("sso");
+	setLock(username, until) {
+		const next = { ...this.locks() };
+		if (until) next[lockKey(username)] = until;
+		else delete next[lockKey(username)];
+		this.locks.set(next);
+		this.now.set(Date.now());
+		writeLocks(this.storage(), next);
+		if (until) this.startTimer();
+	}
+	startTimer() {
+		this.timer ??= setInterval(() => {
+			this.now.set(Date.now());
+			const live = Object.fromEntries(Object.entries(this.locks()).filter(([, until]) => until > this.now()));
+			if (Object.keys(live).length === Object.keys(this.locks()).length) return;
+			this.locks.set(live);
+			writeLocks(this.storage(), live);
+			if (!Object.keys(live).length) this.stopTimer();
+		}, 1e3);
+	}
+	stopTimer() {
+		clearInterval(this.timer);
+		this.timer = void 0;
+	}
+	storage() {
+		try {
+			return this.doc.defaultView?.localStorage ?? null;
+		} catch {
+			return null;
+		}
+	}
+	startExternal(key) {
+		const p = this.external().find((x) => x.key === key);
+		if (!p || this.busy()) return;
+		this.busy.set(key);
 		this.message.set(null);
-		this.http.get(`${this.config.apiBase}/user/sso/authorize-url`).subscribe({
+		this.http.get(`${this.config.apiBase}/user/${key}/authorize-url`).subscribe({
 			next: ({ url, state }) => {
-				this.auth.setTemp(KC_SSO_STATE_KEY, state);
+				this.auth.setTemp(p.stateKey, state);
 				this.auth.setTemp(KC_RETURN_URL_KEY, this.returnUrl);
 				this.auth.redirect(url);
 			},
 			error: (err) => {
 				this.busy.set("");
 				this.message.set({
-					text: err.status === 404 ? `ระบบยังไม่ได้ตั้งค่าการเข้าสู่ระบบด้วย ${sso.label}` : kcErrorMessage(err, `ไม่สามารถเชื่อมต่อ ${sso.label} ได้ กรุณาลองใหม่อีกครั้ง`),
+					text: err.status === 404 ? `ระบบยังไม่ได้ตั้งค่าการเข้าสู่ระบบด้วย ${p.label}` : kcErrorMessage(err, `ไม่สามารถเชื่อมต่อ ${p.label} ได้ กรุณาลองใหม่อีกครั้ง`),
 					error: true
 				});
 			}
@@ -2080,11 +2182,15 @@ var KcLoginComponent = class KcLoginComponent {
         <h1 class="kc-auth-title">{{ config.appName }}</h1>
         <p class="kc-auth-subtitle">ลงชื่อเข้าสู่ระบบ</p>
 
-        @if (message(); as m) {
+        @if (lockLeft()) {
+        <div class="kc-auth-alert error" role="alert">
+          เข้าสู่ระบบไม่สำเร็จเกินจำนวนครั้งที่กำหนด กรุณารอ {{ lockText() }} นาที แล้วลองใหม่อีกครั้ง
+        </div>
+        } @else if (message(); as m) {
         <div class="kc-auth-alert" [class.error]="m.error" [class.info]="!m.error" role="alert">{{ m.text }}</div>
         }
 
-        @if (config.passwordLogin) {
+        @if (showPassword()) {
         <form [formGroup]="form" (ngSubmit)="submit()" novalidate>
           <label class="kc-auth-field">
             <span>ชื่อผู้ใช้</span>
@@ -2094,31 +2200,34 @@ var KcLoginComponent = class KcLoginComponent {
             <span>รหัสผ่าน</span>
             <kc-password><input class="kc-auth-input" type="password" formControlName="password" autocomplete="current-password" /></kc-password>
           </label>
-          <!-- ปุ่มเข้าสู่ระบบกับ SSO อยู่บรรทัดเดียวกัน แบ่งครึ่ง — ปุ่ม SSO ใช้แค่ชื่อเพื่อให้พอดีครึ่งการ์ด -->
+          <!-- ปุ่มเข้าสู่ระบบกับ SSO / ThaiD อยู่บรรทัดเดียวกัน แบ่งเท่ากัน — ปุ่มภายนอกใช้แค่ชื่อเพื่อให้พอดี -->
           <div class="kc-auth-btn-row">
-            <button type="submit" class="kc-auth-btn primary" [disabled]="!!busy()">
-              {{ busy() === 'password' ? 'กำลังเข้าสู่ระบบ...' : 'เข้าสู่ระบบ' }}
+            <button type="submit" class="kc-auth-btn primary" [disabled]="!!busy() || !!lockLeft()">
+              {{ busy() === 'password' ? 'กำลังเข้าสู่ระบบ...' : lockLeft() ? 'รอ ' + lockText() : 'เข้าสู่ระบบ' }}
             </button>
-            @if (config.sso; as sso) {
-            <button type="button" class="kc-auth-btn outline" [disabled]="!!busy()" (click)="startSso()"
-              [attr.title]="'เข้าสู่ระบบด้วย ' + sso.label">
-              {{ busy() === 'sso' ? 'กำลังเชื่อมต่อ...' : sso.label }}
+            @for (p of external(); track p.key) {
+            <button type="button" class="kc-auth-btn outline" [disabled]="!!busy()" (click)="startExternal(p.key)"
+              [attr.title]="'เข้าสู่ระบบด้วย ' + p.label">
+              {{ busy() === p.key ? 'กำลังเชื่อมต่อ...' : p.label }}
             </button>
             }
           </div>
         </form>
-        } @else if (config.sso; as sso) {
-        <!-- ปิดรหัสผ่าน: มีแต่ปุ่ม SSO ตรงกลาง -->
+        } @else {
+        <!-- ปิดรหัสผ่าน: มีแต่ปุ่ม SSO / ThaiD ตรงกลาง -->
         <div class="kc-auth-sso-only">
-          <button type="button" class="kc-auth-btn primary" [disabled]="!!busy()" (click)="startSso()">
-            {{ busy() === 'sso' ? 'กำลังเชื่อมต่อ...' : 'เข้าสู่ระบบด้วย ' + sso.label }}
+          @for (p of external(); track p.key) {
+          <button type="button" class="kc-auth-btn" [class.primary]="$first" [class.outline]="!$first" [disabled]="!!busy()"
+            (click)="startExternal(p.key)">
+            {{ busy() === p.key ? 'กำลังเชื่อมต่อ...' : 'เข้าสู่ระบบด้วย ' + p.label }}
           </button>
+          }
         </div>
         }
 
         @if (config.register === 'form') {
         <p class="kc-auth-footer">ยังไม่มีบัญชี? <a class="kc-auth-link" [routerLink]="paths.register">ลงทะเบียน</a></p>
-        } @else if (config.register === 'sso' && config.sso) {
+        } @else if (config.register === 'sso' && config.sso && methods().sso) {
         <p class="kc-auth-footer">ผู้ใช้ใหม่ กดปุ่ม {{ config.sso.label }} เพื่อลงทะเบียน</p>
         }
         <ng-content />
@@ -2221,11 +2330,15 @@ i0.ɵɵngDeclareClassMetadata({
         <h1 class="kc-auth-title">{{ config.appName }}</h1>
         <p class="kc-auth-subtitle">ลงชื่อเข้าสู่ระบบ</p>
 
-        @if (message(); as m) {
+        @if (lockLeft()) {
+        <div class="kc-auth-alert error" role="alert">
+          เข้าสู่ระบบไม่สำเร็จเกินจำนวนครั้งที่กำหนด กรุณารอ {{ lockText() }} นาที แล้วลองใหม่อีกครั้ง
+        </div>
+        } @else if (message(); as m) {
         <div class="kc-auth-alert" [class.error]="m.error" [class.info]="!m.error" role="alert">{{ m.text }}</div>
         }
 
-        @if (config.passwordLogin) {
+        @if (showPassword()) {
         <form [formGroup]="form" (ngSubmit)="submit()" novalidate>
           <label class="kc-auth-field">
             <span>ชื่อผู้ใช้</span>
@@ -2235,31 +2348,34 @@ i0.ɵɵngDeclareClassMetadata({
             <span>รหัสผ่าน</span>
             <kc-password><input class="kc-auth-input" type="password" formControlName="password" autocomplete="current-password" /></kc-password>
           </label>
-          <!-- ปุ่มเข้าสู่ระบบกับ SSO อยู่บรรทัดเดียวกัน แบ่งครึ่ง — ปุ่ม SSO ใช้แค่ชื่อเพื่อให้พอดีครึ่งการ์ด -->
+          <!-- ปุ่มเข้าสู่ระบบกับ SSO / ThaiD อยู่บรรทัดเดียวกัน แบ่งเท่ากัน — ปุ่มภายนอกใช้แค่ชื่อเพื่อให้พอดี -->
           <div class="kc-auth-btn-row">
-            <button type="submit" class="kc-auth-btn primary" [disabled]="!!busy()">
-              {{ busy() === 'password' ? 'กำลังเข้าสู่ระบบ...' : 'เข้าสู่ระบบ' }}
+            <button type="submit" class="kc-auth-btn primary" [disabled]="!!busy() || !!lockLeft()">
+              {{ busy() === 'password' ? 'กำลังเข้าสู่ระบบ...' : lockLeft() ? 'รอ ' + lockText() : 'เข้าสู่ระบบ' }}
             </button>
-            @if (config.sso; as sso) {
-            <button type="button" class="kc-auth-btn outline" [disabled]="!!busy()" (click)="startSso()"
-              [attr.title]="'เข้าสู่ระบบด้วย ' + sso.label">
-              {{ busy() === 'sso' ? 'กำลังเชื่อมต่อ...' : sso.label }}
+            @for (p of external(); track p.key) {
+            <button type="button" class="kc-auth-btn outline" [disabled]="!!busy()" (click)="startExternal(p.key)"
+              [attr.title]="'เข้าสู่ระบบด้วย ' + p.label">
+              {{ busy() === p.key ? 'กำลังเชื่อมต่อ...' : p.label }}
             </button>
             }
           </div>
         </form>
-        } @else if (config.sso; as sso) {
-        <!-- ปิดรหัสผ่าน: มีแต่ปุ่ม SSO ตรงกลาง -->
+        } @else {
+        <!-- ปิดรหัสผ่าน: มีแต่ปุ่ม SSO / ThaiD ตรงกลาง -->
         <div class="kc-auth-sso-only">
-          <button type="button" class="kc-auth-btn primary" [disabled]="!!busy()" (click)="startSso()">
-            {{ busy() === 'sso' ? 'กำลังเชื่อมต่อ...' : 'เข้าสู่ระบบด้วย ' + sso.label }}
+          @for (p of external(); track p.key) {
+          <button type="button" class="kc-auth-btn" [class.primary]="$first" [class.outline]="!$first" [disabled]="!!busy()"
+            (click)="startExternal(p.key)">
+            {{ busy() === p.key ? 'กำลังเชื่อมต่อ...' : 'เข้าสู่ระบบด้วย ' + p.label }}
           </button>
+          }
         </div>
         }
 
         @if (config.register === 'form') {
         <p class="kc-auth-footer">ยังไม่มีบัญชี? <a class="kc-auth-link" [routerLink]="paths.register">ลงทะเบียน</a></p>
-        } @else if (config.register === 'sso' && config.sso) {
+        } @else if (config.register === 'sso' && config.sso && methods().sso) {
         <p class="kc-auth-footer">ผู้ใช้ใหม่ กดปุ่ม {{ config.sso.label }} เพื่อลงทะเบียน</p>
         }
         <ng-content />
@@ -2678,22 +2794,35 @@ i0.ɵɵngDeclareClassMetadata({
 	}],
 	ctorParameters: () => []
 });
-var KcSsoCallbackComponent = class KcSsoCallbackComponent {
+const CALLBACK_TEMPLATE = `
+  <div class="kc-auth-screen">
+    <div class="kc-auth-card center">
+      <h1 class="kc-auth-title">{{ label }}</h1>
+      @if (failed()) {
+      <div class="kc-auth-alert error" role="alert" style="margin-top: 16px">{{ message() }}</div>
+      <a class="kc-auth-btn" [routerLink]="paths.login">กลับไปหน้าเข้าสู่ระบบ</a>
+      } @else {
+      <p class="kc-auth-subtitle" style="margin-bottom: 0">{{ message() }}</p>
+      }
+    </div>
+  </div>
+`;
+var KcExternalCallbackBase = class KcExternalCallbackBase {
 	config = inject(KC_AUTH_CONFIG);
 	auth = inject(KcAuthService);
 	http = inject(HttpClient);
-	route = inject(ActivatedRoute);
 	router = inject(Router);
+	route = inject(ActivatedRoute);
 	paths = KC_AUTH_PATHS;
-	label = this.config.sso?.label ?? "SSO";
-	message = signal(`กำลังเข้าสู่ระบบผ่าน ${this.label}...`, ...ngDevMode ? [{ debugName: "message" }] : /* istanbul ignore next */ []);
+	message = signal("", ...ngDevMode ? [{ debugName: "message" }] : /* istanbul ignore next */ []);
 	failed = signal(false, ...ngDevMode ? [{ debugName: "failed" }] : /* istanbul ignore next */ []);
 	constructor() {
 		ensureAuthStyles();
 	}
 	ngOnInit() {
+		this.message.set(`กำลังเข้าสู่ระบบผ่าน ${this.label}...`);
 		const params = this.route.snapshot.queryParamMap;
-		const expectedState = this.auth.takeTemp(KC_SSO_STATE_KEY);
+		const expectedState = this.auth.takeTemp(this.stateKey);
 		const code = params.get("code");
 		if (params.get("error")) {
 			this.fail(`${this.label} ปฏิเสธการเข้าสู่ระบบ กรุณาลองใหม่อีกครั้ง`);
@@ -2701,9 +2830,9 @@ var KcSsoCallbackComponent = class KcSsoCallbackComponent {
 		}
 		if (!code) {
 			this.message.set(`กำลังเชื่อมต่อกับ ${this.label}...`);
-			this.http.get(`${this.config.apiBase}/user/sso/authorize-url`).subscribe({
+			this.http.get(`${this.config.apiBase}/user/${this.endpoint}/authorize-url`).subscribe({
 				next: ({ url, state }) => {
-					this.auth.setTemp(KC_SSO_STATE_KEY, state);
+					this.auth.setTemp(this.stateKey, state);
 					this.auth.redirect(url);
 				},
 				error: () => this.fail(`ไม่สามารถเชื่อมต่อ ${this.label} ได้ กรุณาเริ่มเข้าสู่ระบบใหม่`)
@@ -2714,14 +2843,52 @@ var KcSsoCallbackComponent = class KcSsoCallbackComponent {
 			this.fail("คำขอเข้าสู่ระบบไม่ถูกต้อง (state ไม่ตรงกัน) กรุณาเริ่มเข้าสู่ระบบใหม่");
 			return;
 		}
+		this.exchange(code);
+	}
+	signIn(session) {
+		this.auth.start(session);
+		this.router.navigateByUrl(this.auth.safeReturnUrl(this.auth.takeTemp(KC_RETURN_URL_KEY)), { replaceUrl: true });
+	}
+	fail(message) {
+		this.message.set(message);
+		this.failed.set(true);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.1",
+		ngImport: i0,
+		type: KcExternalCallbackBase,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Directive
+	});
+	static ɵdir = i0.ɵɵngDeclareDirective({
+		minVersion: "14.0.0",
+		version: "22.2.1",
+		type: KcExternalCallbackBase,
+		isStandalone: true,
+		ngImport: i0
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.1",
+	ngImport: i0,
+	type: KcExternalCallbackBase,
+	decorators: [{ type: Directive }],
+	ctorParameters: () => []
+});
+var KcSsoCallbackComponent = class KcSsoCallbackComponent extends KcExternalCallbackBase {
+	label = this.config.sso?.label ?? "SSO";
+	endpoint = "sso";
+	stateKey = KC_SSO_STATE_KEY;
+	exchange(code) {
 		this.http.post(`${this.config.apiBase}/user/sso/callback`, { code }).subscribe({
 			next: (res) => {
 				if (res.mode === "signed-in" && res.token && res.user) {
-					this.auth.start({
+					this.signIn({
 						token: res.token,
 						user: res.user
 					});
-					this.router.navigateByUrl(this.auth.safeReturnUrl(this.auth.takeTemp(KC_RETURN_URL_KEY)), { replaceUrl: true });
 					return;
 				}
 				if (res.mode === "register" && res.ticket) {
@@ -2735,16 +2902,12 @@ var KcSsoCallbackComponent = class KcSsoCallbackComponent {
 			error: (err) => this.fail(kcErrorMessage(err, `ไม่สามารถเข้าสู่ระบบผ่าน ${this.label} ได้`))
 		});
 	}
-	fail(message) {
-		this.message.set(message);
-		this.failed.set(true);
-	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
 		version: "22.2.1",
 		ngImport: i0,
 		type: KcSsoCallbackComponent,
-		deps: [],
+		deps: null,
 		target: i0.ɵɵFactoryTarget.Component
 	});
 	static ɵcmp = i0.ɵɵngDeclareComponent({
@@ -2753,20 +2916,9 @@ var KcSsoCallbackComponent = class KcSsoCallbackComponent {
 		type: KcSsoCallbackComponent,
 		isStandalone: true,
 		selector: "kc-sso-callback",
+		usesInheritance: true,
 		ngImport: i0,
-		template: `
-    <div class="kc-auth-screen">
-      <div class="kc-auth-card center">
-        <h1 class="kc-auth-title">{{ label }}</h1>
-        @if (failed()) {
-        <div class="kc-auth-alert error" role="alert" style="margin-top: 16px">{{ message() }}</div>
-        <a class="kc-auth-btn" [routerLink]="paths.login">กลับไปหน้าเข้าสู่ระบบ</a>
-        } @else {
-        <p class="kc-auth-subtitle" style="margin-bottom: 0">{{ message() }}</p>
-        }
-      </div>
-    </div>
-  `,
+		template: "\n  <div class=\"kc-auth-screen\">\n    <div class=\"kc-auth-card center\">\n      <h1 class=\"kc-auth-title\">{{ label }}</h1>\n      @if (failed()) {\n      <div class=\"kc-auth-alert error\" role=\"alert\" style=\"margin-top: 16px\">{{ message() }}</div>\n      <a class=\"kc-auth-btn\" [routerLink]=\"paths.login\">กลับไปหน้าเข้าสู่ระบบ</a>\n      } @else {\n      <p class=\"kc-auth-subtitle\" style=\"margin-bottom: 0\">{{ message() }}</p>\n      }\n    </div>\n  </div>\n",
 		isInline: true,
 		dependencies: [{
 			kind: "directive",
@@ -2800,22 +2952,73 @@ i0.ɵɵngDeclareClassMetadata({
 			selector: "kc-sso-callback",
 			standalone: true,
 			imports: [RouterLink],
-			template: `
-    <div class="kc-auth-screen">
-      <div class="kc-auth-card center">
-        <h1 class="kc-auth-title">{{ label }}</h1>
-        @if (failed()) {
-        <div class="kc-auth-alert error" role="alert" style="margin-top: 16px">{{ message() }}</div>
-        <a class="kc-auth-btn" [routerLink]="paths.login">กลับไปหน้าเข้าสู่ระบบ</a>
-        } @else {
-        <p class="kc-auth-subtitle" style="margin-bottom: 0">{{ message() }}</p>
-        }
-      </div>
-    </div>
-  `
+			template: CALLBACK_TEMPLATE
 		}]
-	}],
-	ctorParameters: () => []
+	}]
+});
+var KcThaidCallbackComponent = class KcThaidCallbackComponent extends KcExternalCallbackBase {
+	label = this.config.thaid?.label ?? "ThaiD";
+	endpoint = "thaid";
+	stateKey = KC_THAID_STATE_KEY;
+	exchange(code) {
+		this.http.post(`${this.config.apiBase}/user/thaid/callback`, { code }).subscribe({
+			next: (res) => res?.token && res.user ? this.signIn(res) : this.fail("ไม่สามารถเข้าสู่ระบบได้ กรุณาลองใหม่อีกครั้ง"),
+			error: (err) => this.fail(kcErrorMessage(err, `ไม่สามารถเข้าสู่ระบบผ่าน ${this.label} ได้`))
+		});
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.1",
+		ngImport: i0,
+		type: KcThaidCallbackComponent,
+		deps: null,
+		target: i0.ɵɵFactoryTarget.Component
+	});
+	static ɵcmp = i0.ɵɵngDeclareComponent({
+		minVersion: "17.0.0",
+		version: "22.2.1",
+		type: KcThaidCallbackComponent,
+		isStandalone: true,
+		selector: "kc-thaid-callback",
+		usesInheritance: true,
+		ngImport: i0,
+		template: "\n  <div class=\"kc-auth-screen\">\n    <div class=\"kc-auth-card center\">\n      <h1 class=\"kc-auth-title\">{{ label }}</h1>\n      @if (failed()) {\n      <div class=\"kc-auth-alert error\" role=\"alert\" style=\"margin-top: 16px\">{{ message() }}</div>\n      <a class=\"kc-auth-btn\" [routerLink]=\"paths.login\">กลับไปหน้าเข้าสู่ระบบ</a>\n      } @else {\n      <p class=\"kc-auth-subtitle\" style=\"margin-bottom: 0\">{{ message() }}</p>\n      }\n    </div>\n  </div>\n",
+		isInline: true,
+		dependencies: [{
+			kind: "directive",
+			type: RouterLink,
+			selector: "[routerLink]",
+			inputs: [
+				"target",
+				"queryParams",
+				"fragment",
+				"queryParamsHandling",
+				"state",
+				"info",
+				"relativeTo",
+				"preserveFragment",
+				"skipLocationChange",
+				"replaceUrl",
+				"browserUrl",
+				"routerLink"
+			]
+		}]
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.1",
+	ngImport: i0,
+	type: KcThaidCallbackComponent,
+	decorators: [{
+		type: Component,
+		args: [{
+			selector: "kc-thaid-callback",
+			standalone: true,
+			imports: [RouterLink],
+			template: CALLBACK_TEMPLATE
+		}]
+	}]
 });
 function kcAuthRoutes() {
 	return [
@@ -2833,6 +3036,11 @@ function kcAuthRoutes() {
 			path: "sso-callback",
 			component: KcSsoCallbackComponent,
 			title: "เข้าสู่ระบบ"
+		},
+		{
+			path: "thaid-callback",
+			component: KcThaidCallbackComponent,
+			title: "เข้าสู่ระบบ"
 		}
 	];
 }
@@ -3163,6 +3371,33 @@ var KcConfigUsersComponent = class KcConfigUsersComponent {
 	search = signal("", ...ngDevMode ? [{ debugName: "search" }] : /* istanbul ignore next */ []);
 	editing = signal(null, ...ngDevMode ? [{ debugName: "editing" }] : /* istanbul ignore next */ []);
 	myId = computed(() => this.auth.user()?.id ?? "", ...ngDevMode ? [{ debugName: "myId" }] : /* istanbul ignore next */ []);
+	methodsSaved = signal(null, ...ngDevMode ? [{ debugName: "methodsSaved" }] : /* istanbul ignore next */ []);
+	methodsDraft = signal(null, ...ngDevMode ? [{ debugName: "methodsDraft" }] : /* istanbul ignore next */ []);
+	savingMethods = signal(false, ...ngDevMode ? [{ debugName: "savingMethods" }] : /* istanbul ignore next */ []);
+	methodsError = signal("", ...ngDevMode ? [{ debugName: "methodsError" }] : /* istanbul ignore next */ []);
+	methodOptions = computed(() => [
+		...this.config.passwordLogin ? [{
+			key: "password",
+			label: "ชื่อผู้ใช้ / รหัสผ่าน"
+		}] : [],
+		...this.config.sso ? [{
+			key: "sso",
+			label: this.config.sso.label
+		}] : [],
+		...this.config.thaid ? [{
+			key: "thaid",
+			label: this.config.thaid.label
+		}] : []
+	], ...ngDevMode ? [{ debugName: "methodOptions" }] : /* istanbul ignore next */ []);
+	enabledCount = computed(() => {
+		const m = this.methodsDraft();
+		return m ? this.methodOptions().filter((o) => m[o.key]).length : 0;
+	}, ...ngDevMode ? [{ debugName: "enabledCount" }] : /* istanbul ignore next */ []);
+	methodsDirty = computed(() => {
+		const a = this.methodsDraft();
+		const b = this.methodsSaved();
+		return !!a && !!b && (a.password !== b.password || a.sso !== b.sso || a.thaid !== b.thaid);
+	}, ...ngDevMode ? [{ debugName: "methodsDirty" }] : /* istanbul ignore next */ []);
 	orgOptions = computed(() => [{
 		value: "",
 		label: "-- ไม่ระบุ --"
@@ -3188,6 +3423,51 @@ var KcConfigUsersComponent = class KcConfigUsersComponent {
 	}
 	ngOnInit() {
 		this.load();
+		this.http.get(`${this.config.apiBase}/user/login-methods`).subscribe({
+			next: (m) => {
+				const v = {
+					password: m?.password !== false,
+					sso: m?.sso !== false,
+					thaid: m?.thaid !== false
+				};
+				this.methodsSaved.set(v);
+				this.methodsDraft.set({ ...v });
+			},
+			error: () => {}
+		});
+	}
+	toggleMethod(key, on) {
+		const m = this.methodsDraft();
+		if (!m) return;
+		const next = {
+			...m,
+			[key]: on
+		};
+		if (!this.methodOptions().some((o) => next[o.key])) return;
+		this.methodsError.set("");
+		this.methodsDraft.set(next);
+	}
+	saveMethods() {
+		const m = this.methodsDraft();
+		if (!m || this.savingMethods()) return;
+		if (!this.methodOptions().some((o) => m[o.key])) {
+			this.methodsError.set("ต้องเปิดการเข้าสู่ระบบอย่างน้อย 1 วิธี");
+			return;
+		}
+		this.savingMethods.set(true);
+		this.http.put(`${this.config.apiBase}/config/login-methods`, m).subscribe({
+			next: (res) => {
+				this.savingMethods.set(false);
+				this.methodsSaved.set({ ...m });
+				this.methodsError.set("");
+				this.error.set("");
+				this.success.set(res?.message || "บันทึกวิธีเข้าสู่ระบบเรียบร้อยแล้ว");
+			},
+			error: (err) => {
+				this.savingMethods.set(false);
+				this.methodsError.set(kcErrorMessage(err, "บันทึกวิธีเข้าสู่ระบบไม่สำเร็จ"));
+			}
+		});
 	}
 	load() {
 		this.loading.set(true);
@@ -3286,6 +3566,30 @@ var KcConfigUsersComponent = class KcConfigUsersComponent {
       <div class="kc-auth-alert success" role="status">{{ success() }}</div>
       }
 
+      @if (methodOptions().length > 1 && methodsDraft(); as m) {
+      <div class="kc-auth-panel">
+        <h2 class="kc-auth-panel-title">วิธีเข้าสู่ระบบ</h2>
+        <div class="kc-auth-methods">
+          @for (o of methodOptions(); track o.key) {
+          <label class="kc-auth-check">
+            <input type="checkbox" [checked]="m[o.key]" [disabled]="savingMethods() || (m[o.key] && enabledCount() === 1)"
+              (change)="toggleMethod(o.key, $any($event.target).checked)" />
+            {{ o.label }}
+          </label>
+          }
+          <button type="button" class="kc-auth-btn primary" [disabled]="savingMethods() || !methodsDirty()" (click)="saveMethods()">
+            {{ savingMethods() ? 'กำลังบันทึก...' : 'บันทึก' }}
+          </button>
+        </div>
+        @if (methodsError()) {
+        <div class="kc-auth-alert error" role="alert" style="margin: 10px 0 0">{{ methodsError() }}</div>
+        }
+        <p class="kc-auth-hint" style="margin: 10px 0 0">
+          ต้องเปิดอย่างน้อย 1 วิธี — ก่อนปิดวิธีอื่น ให้ลองเข้าสู่ระบบด้วยวิธีที่จะเหลือให้ได้ก่อน มีผลกับการเข้าสู่ระบบครั้งถัดไป (ผู้ที่เข้าอยู่แล้วใช้งานต่อได้)
+        </p>
+      </div>
+      }
+
       <div class="kc-auth-panel">
         <input class="kc-auth-input" type="search" [placeholder]="'ค้นหาชื่อผู้ใช้ ชื่อ-สกุล ' + config.orgLabel + ' ระดับผู้ใช้ หรืออีเมล'"
           [ngModel]="search()" (ngModelChange)="search.set($event)" aria-label="ค้นหาผู้ใช้" />
@@ -3499,6 +3803,30 @@ i0.ɵɵngDeclareClassMetadata({
       <div class="kc-auth-alert success" role="status">{{ success() }}</div>
       }
 
+      @if (methodOptions().length > 1 && methodsDraft(); as m) {
+      <div class="kc-auth-panel">
+        <h2 class="kc-auth-panel-title">วิธีเข้าสู่ระบบ</h2>
+        <div class="kc-auth-methods">
+          @for (o of methodOptions(); track o.key) {
+          <label class="kc-auth-check">
+            <input type="checkbox" [checked]="m[o.key]" [disabled]="savingMethods() || (m[o.key] && enabledCount() === 1)"
+              (change)="toggleMethod(o.key, $any($event.target).checked)" />
+            {{ o.label }}
+          </label>
+          }
+          <button type="button" class="kc-auth-btn primary" [disabled]="savingMethods() || !methodsDirty()" (click)="saveMethods()">
+            {{ savingMethods() ? 'กำลังบันทึก...' : 'บันทึก' }}
+          </button>
+        </div>
+        @if (methodsError()) {
+        <div class="kc-auth-alert error" role="alert" style="margin: 10px 0 0">{{ methodsError() }}</div>
+        }
+        <p class="kc-auth-hint" style="margin: 10px 0 0">
+          ต้องเปิดอย่างน้อย 1 วิธี — ก่อนปิดวิธีอื่น ให้ลองเข้าสู่ระบบด้วยวิธีที่จะเหลือให้ได้ก่อน มีผลกับการเข้าสู่ระบบครั้งถัดไป (ผู้ที่เข้าอยู่แล้วใช้งานต่อได้)
+        </p>
+      </div>
+      }
+
       <div class="kc-auth-panel">
         <input class="kc-auth-input" type="search" [placeholder]="'ค้นหาชื่อผู้ใช้ ชื่อ-สกุล ' + config.orgLabel + ' ระดับผู้ใช้ หรืออีเมล'"
           [ngModel]="search()" (ngModelChange)="search.set($event)" aria-label="ค้นหาผู้ใช้" />
@@ -4115,6 +4443,6 @@ i0.ɵɵngDeclareClassMetadata({
 	}],
 	ctorParameters: () => []
 });
-export { AnchoredPopup, ClockPickerDirective, ClockPickerPopupComponent, DatePickerDirective, DatePickerPopupComponent, KC_AUTH_CONFIG, KC_AUTH_PATHS, KC_RETURN_URL_KEY, KC_SSO_STATE_KEY, KC_SSO_TICKET_KEY, KcAuthService, KcConfigKclluComponent, KcConfigUsersComponent, KcLoginComponent, KcPasswordToggleComponent, KcProfileComponent, KcRegisterComponent, KcSsoCallbackComponent, PICKER_CSS, SearchSelectComponent, ThaiDatePickerComponent, ensurePickerStyles, fixThaiText, formatDate, kcAdminGuard, kcAuthGuard, kcAuthInterceptor, kcAuthRoutes, kcErrorMessage, kcTokenExpired, parseDate, provideKcAuth, provideThaiPasteFix, resolveKcAuthConfig, toBuddhistText, toChristianText };
+export { AnchoredPopup, ClockPickerDirective, ClockPickerPopupComponent, DatePickerDirective, DatePickerPopupComponent, KC_AUTH_CONFIG, KC_AUTH_PATHS, KC_LOGIN_LOCK_KEY, KC_LOGIN_LOCK_SECONDS, KC_RETURN_URL_KEY, KC_SSO_STATE_KEY, KC_SSO_TICKET_KEY, KC_THAID_STATE_KEY, KcAuthService, KcConfigKclluComponent, KcConfigUsersComponent, KcLoginComponent, KcPasswordToggleComponent, KcProfileComponent, KcRegisterComponent, KcSsoCallbackComponent, KcThaidCallbackComponent, PICKER_CSS, SearchSelectComponent, ThaiDatePickerComponent, ensurePickerStyles, fixThaiText, formatDate, kcAdminGuard, kcAuthGuard, kcAuthInterceptor, kcAuthRoutes, kcErrorMessage, kcLoginRetryAfter, kcTokenExpired, parseDate, provideKcAuth, provideThaiPasteFix, resolveKcAuthConfig, toBuddhistText, toChristianText };
 
 //# sourceMappingURL=kengcom202-kcore-ui.mjs.map