@lenne.tech/ng-base 18.1.3 → 22.0.0

package/fesm2022/lenne.tech-ng-base-auth-provide.mjs

@@ -0,0 +1,939 @@
+import * as i0 from "@angular/core";
+import { InjectionToken, Injector, PLATFORM_ID, Service, TransferState, computed, inject, makeEnvironmentProviders, makeStateKey, provideAppInitializer, signal } from "@angular/core";
+import { Router } from "@angular/router";
+import { LT_FETCH, LT_RUNTIME_CONFIG, LtApiUrlService, LtCookieService, isLtAbsoluteUrl, ltCredentialsFetch, ltSha256, mergeLtFeatureOptions } from "@lenne.tech/ng-base";
+import { DOCUMENT, isPlatformServer } from "@angular/common";
+import { HttpErrorResponse } from "@angular/common/http";
+import { catchError, from, switchMap, throwError } from "rxjs";
+const LT_AUTH_STATE_COOKIE_DEFAULT = "lt-auth-state";
+const LT_JWT_TOKEN_COOKIE_DEFAULT = "lt-jwt-token";
+const LT_AUTH_DEFAULTS = {
+	basePath: "/iam",
+	cookieNames: {
+		state: LT_AUTH_STATE_COOKIE_DEFAULT,
+		token: LT_JWT_TOKEN_COOKIE_DEFAULT
+	},
+	enableAdmin: false,
+	enablePasskey: true,
+	enableTwoFactor: true,
+	interceptor: {
+		enabled: true,
+		publicPaths: []
+	},
+	loginPath: "/auth/login",
+	plugins: [],
+	systemSetup: {
+		enabled: false,
+		setupPath: "/auth/setup"
+	},
+	twoFactorRedirectPath: "/auth/2fa"
+};
+const LT_AUTH_INPUT_OPTIONS = new InjectionToken("LT_AUTH_INPUT_OPTIONS", { factory: () => ({}) });
+const LT_AUTH_OPTIONS = new InjectionToken("LT_AUTH_OPTIONS", { factory: () => {
+	const runtime = inject(LT_RUNTIME_CONFIG, { optional: true });
+	const merged = mergeLtFeatureOptions(LT_AUTH_DEFAULTS, inject(LT_AUTH_INPUT_OPTIONS), runtime?.lt.auth);
+	return {
+		...merged,
+		cookieNames: resolveLtAuthCookieNames(merged.cookieNames, runtime?.cookiePrefix)
+	};
+} });
+function resolveLtCookiePrefix(raw) {
+	return typeof raw === "string" ? raw.trim().replace(/[^A-Za-z0-9._-]/g, "") : "";
+}
+function resolveLtAuthCookieNames(configured, cookiePrefix) {
+	const prefix = resolveLtCookiePrefix(cookiePrefix);
+	return {
+		state: configured?.state && configured.state !== "lt-auth-state" ? configured.state : prefix ? `${prefix}-auth-state` : LT_AUTH_STATE_COOKIE_DEFAULT,
+		token: configured?.token && configured.token !== "lt-jwt-token" ? configured.token : prefix ? `${prefix}-jwt-token` : LT_JWT_TOKEN_COOKIE_DEFAULT
+	};
+}
+const LT_AUTH_COOKIE_MAX_AGE = 604800;
+const BETTER_AUTH_COOKIES = [
+	"better-auth.session_token",
+	"better-auth.session",
+	"__Secure-better-auth.session_token",
+	"session_token",
+	"session"
+];
+const BETTER_AUTH_COOKIE_PATHS = [
+	"/",
+	"/api",
+	"/api/iam",
+	"/iam"
+];
+function resolveLtAuthState(cookieString, stateCookieName) {
+	const prefix = `${stateCookieName}=`;
+	let fallback = null;
+	for (const entry of (cookieString || "").split(/;\s*/)) {
+		if (!entry.startsWith(prefix)) continue;
+		try {
+			const state = JSON.parse(decodeURIComponent(entry.slice(prefix.length)));
+			if (state?.user) return state;
+			if (state) fallback = state;
+		} catch {}
+	}
+	return fallback;
+}
+var LtAuthStateService = class LtAuthStateService {
+	cookies = inject(LtCookieService);
+	options = inject(LT_AUTH_OPTIONS);
+	document = inject(DOCUMENT);
+	isServer = isPlatformServer(inject(PLATFORM_ID));
+	get cookieNames() {
+		return this.options.cookieNames;
+	}
+	readState() {
+		return resolveLtAuthState(this.cookies.raw(), this.cookieNames.state);
+	}
+	writeState(state) {
+		if (this.isServer) return;
+		const encoded = JSON.stringify(state);
+		if (encodeURIComponent(encoded).length > 3500 && typeof ngDevMode !== "undefined" && ngDevMode) console.warn(`[@lenne.tech/ng-base] The auth-state cookie is ${encodeURIComponent(encoded).length} bytes; browsers drop cookies over 4 KB.`);
+		this.cookies.set(this.cookieNames.state, encoded, { maxAge: LT_AUTH_COOKIE_MAX_AGE });
+	}
+	getAuthMode() {
+		return this.readState()?.authMode === "jwt" ? "jwt" : "cookie";
+	}
+	setAuthMode(mode) {
+		const current = this.readState();
+		this.writeState({
+			authMode: mode,
+			user: current?.user ?? null
+		});
+	}
+	getJwtToken() {
+		if (this.isServer) return null;
+		let invalid = false;
+		for (const raw of this.cookies.getAll(this.cookieNames.token)) {
+			const token = parseToken(raw);
+			if (isLtJwtShaped(token)) return token;
+			invalid ||= !!token;
+		}
+		if (invalid) this.deleteEverywhere(this.cookieNames.token);
+		return null;
+	}
+	setJwtToken(token) {
+		if (this.isServer) return false;
+		if (!token) {
+			this.deleteEverywhere(this.cookieNames.token);
+			return false;
+		}
+		if (!isLtJwtShaped(token)) {
+			this.deleteEverywhere(this.cookieNames.token);
+			console.warn("[@lenne.tech/ng-base] Refused to store a token that is not a JWT as JWT.");
+			return false;
+		}
+		this.cookies.set(this.cookieNames.token, JSON.stringify(token), { maxAge: LT_AUTH_COOKIE_MAX_AGE });
+		return true;
+	}
+	purgeInvalidJwt() {
+		if (this.isServer) return false;
+		if (!this.cookies.getAll(this.cookieNames.token).map(parseToken).some((token) => token && !isLtJwtShaped(token))) return false;
+		this.deleteEverywhere(this.cookieNames.token);
+		const state = this.readState();
+		if (state?.authMode === "jwt") this.writeState({
+			authMode: "cookie",
+			user: state.user
+		});
+		return true;
+	}
+	isAuthenticated() {
+		return !!this.readState()?.user;
+	}
+	readUser() {
+		return this.readState()?.user ?? null;
+	}
+	clearAuthCookies() {
+		if (this.isServer) return;
+		this.deleteEverywhere(this.cookieNames.state);
+		this.deleteEverywhere(this.cookieNames.token);
+		for (const name of BETTER_AUTH_COOKIES) for (const path of BETTER_AUTH_COOKIE_PATHS) this.cookies.delete(name, { path });
+	}
+	deleteEverywhere(name) {
+		const host = this.document.location?.hostname;
+		this.cookies.delete(name, { path: "/" });
+		if (host) this.cookies.delete(name, {
+			domain: host,
+			path: "/"
+		});
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtAuthStateService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtAuthStateService
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.4",
+	ngImport: i0,
+	type: LtAuthStateService,
+	decorators: [{ type: Service }]
+});
+function isLtJwtShaped(value) {
+	return typeof value === "string" && value.startsWith("eyJ") && value.split(".").length === 3 && value.split(".").every((part) => part.length > 0);
+}
+function ltJwtExpiresWithin(token, marginMs, now = Date.now()) {
+	const payload = token.split(".")[1];
+	if (!payload) return false;
+	try {
+		const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+		const claims = JSON.parse(atob(base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=")));
+		return typeof claims.exp === "number" && claims.exp * 1e3 - now <= marginMs;
+	} catch {
+		return false;
+	}
+}
+function parseToken(raw) {
+	if (!raw) return null;
+	try {
+		const parsed = JSON.parse(raw);
+		return typeof parsed === "string" && parsed ? parsed : null;
+	} catch {
+		return raw;
+	}
+}
+const LT_AUTH_PUBLIC_PATHS = [
+	"/auth/login",
+	"/auth/register",
+	"/auth/forgot-password",
+	"/auth/reset-password",
+	"/auth/2fa",
+	"/auth/setup",
+	"/auth/verify-email"
+];
+const LT_AUTH_ENDPOINT_FRAGMENTS = [
+	"/sign-in",
+	"/sign-up",
+	"/sign-out",
+	"/forgot-password",
+	"/reset-password",
+	"/verify-email",
+	"/get-session",
+	"/list-sessions",
+	"/revoke-session",
+	"/revoke-other-sessions",
+	"/token",
+	"/passkey/",
+	"/list-user-passkeys",
+	"/generate-register-options",
+	"/verify-registration",
+	"/generate-authenticate-options",
+	"/verify-authentication",
+	"/two-factor/"
+];
+const LT_AUTH_COOKIE_PATHS = [
+	"/passkey/",
+	"/two-factor/",
+	"/2fa/",
+	"/get-session"
+];
+function isLtAuthEndpoint(url) {
+	return LT_AUTH_ENDPOINT_FRAGMENTS.some((fragment) => url.includes(fragment));
+}
+function ltUrlRequiresCookies(url) {
+	return LT_AUTH_COOKIE_PATHS.some((path) => url.includes(path));
+}
+function ltRequestUrl(input) {
+	if (typeof input === "string") return input;
+	return input instanceof URL ? input.href : input.url;
+}
+function ltPathOf(url) {
+	return url.split(/[?#]/)[0] || "/";
+}
+function isLtApiRequest(url, baseUrl, origin) {
+	if (baseUrl && hasPrefix(url, baseUrl)) return true;
+	let path = url;
+	if (origin && origin !== "null" && hasPrefix(url, origin)) path = url.slice(origin.length) || "/";
+	if (!path.startsWith("/") || path.startsWith("//")) return false;
+	if (hasPrefix(path, "/api")) return true;
+	if (!baseUrl) return true;
+	return baseUrl.startsWith("/") && hasPrefix(path, baseUrl);
+}
+function hasPrefix(value, prefix) {
+	if (!value.startsWith(prefix)) return false;
+	const next = value.charAt(prefix.length);
+	return next === "" || next === "/" || next === "?" || next === "#" || prefix.endsWith("/");
+}
+const LT_SESSION_ALIVE_TTL_MS = 1e3;
+const LT_SESSION_LOSS_GUARD_MS = 1e3;
+function createLtSessionLossDetector(host, config) {
+	let handling = false;
+	let aliveUntil = 0;
+	const isPublicRoute = () => {
+		const current = host.currentUrl();
+		if (!current) return false;
+		const path = ltPathOf(current);
+		return config.publicPaths.some((publicPath) => path.startsWith(publicPath));
+	};
+	const probe = async () => {
+		if (Date.now() < aliveUntil) return true;
+		let verdict;
+		try {
+			const response = await host.probeSession();
+			if (response.status === 401 || response.status === 403) return false;
+			if (!response.ok) return null;
+			const data = await response.json().catch(() => null);
+			verdict = Boolean(data && (data.user || data.session));
+			if (verdict && host.isJwtMode()) await host.switchToJwtMode().catch(() => false);
+		} catch {
+			return null;
+		}
+		if (verdict) aliveUntil = Date.now() + LT_SESSION_ALIVE_TTL_MS;
+		return verdict;
+	};
+	return { async handle(url) {
+		if (!config.enabled || handling || url && isLtAuthEndpoint(url) || isPublicRoute() || !host.isAuthenticated()) return false;
+		handling = true;
+		let loggedOut = false;
+		try {
+			if (await probe() !== false) return false;
+			loggedOut = true;
+			host.clearUser();
+			const current = host.currentUrl();
+			const redirect = current && ltPathOf(current) !== config.loginPath ? `?redirect=${encodeURIComponent(current)}` : "";
+			host.navigate(`${config.loginPath}${redirect}`);
+			return true;
+		} catch (error) {
+			console.error("[@lenne.tech/ng-base] Handling a 401 failed:", error);
+			return loggedOut;
+		} finally {
+			if (loggedOut) setTimeout(() => {
+				handling = false;
+			}, LT_SESSION_LOSS_GUARD_MS);
+			else handling = false;
+		}
+	} };
+}
+const LT_AUTH_SIGN_OUT_HOOKS = new InjectionToken("LT_AUTH_SIGN_OUT_HOOKS", { factory: () => [] });
+const LT_AUTH_FEATURES_STATE_KEY = makeStateKey("lt-auth-features");
+const LT_VALIDATE_SESSION_TIMEOUT_MS = 1e4;
+const FEATURES_TIMEOUT_MS = 5e3;
+const AUTHZ_KEYS = [
+	"banExpires",
+	"banReason",
+	"banned",
+	"emailVerified",
+	"role",
+	"roles",
+	"twoFactorEnabled"
+];
+function readLtAuthAnswer(result) {
+	const outer = result && typeof result === "object" ? result : {};
+	const data = outer["data"] && typeof outer["data"] === "object" ? outer["data"] : {};
+	const pick = (key) => data[key] ?? outer[key];
+	const token = pick("token");
+	const user = pick("user");
+	const sessionObject = pick("session");
+	const failed = !!outer["error"] || pick("success") === false;
+	const proven = pick("success") === true || typeof token === "string" && !!token || !!sessionObject && typeof sessionObject === "object";
+	return {
+		emailVerificationRequired: pick("emailVerificationRequired") === true,
+		jwt: isLtJwtShaped(token) ? token : null,
+		session: proven && !failed,
+		twoFactor: pick("requiresTwoFactor") === true || pick("twoFactorRedirect") === true,
+		user: user && typeof user === "object" ? user : null
+	};
+}
+var LtAuthStore = class LtAuthStore {
+	api = inject(LtApiUrlService);
+	authState = inject(LtAuthStateService);
+	options = inject(LT_AUTH_OPTIONS);
+	runtimeConfig = inject(LT_RUNTIME_CONFIG, { optional: true });
+	transferState = inject(TransferState);
+	injector = inject(Injector);
+	document = inject(DOCUMENT);
+	signOutHooks = inject(LT_AUTH_SIGN_OUT_HOOKS);
+	isServer = isPlatformServer(inject(PLATFORM_ID));
+	purgedInvalidJwt = this.authState.purgeInvalidJwt();
+	initialState = this.authState.readState();
+	transferredFeatures = this.isServer ? null : this.transferState.get(LT_AUTH_FEATURES_STATE_KEY, null);
+	userState = signal(this.initialState?.user ?? null, ...ngDevMode ? [{ debugName: "userState" }] : /* istanbul ignore next */ []);
+	modeState = signal(this.initialState?.authMode === "jwt" ? "jwt" : "cookie", ...ngDevMode ? [{ debugName: "modeState" }] : /* istanbul ignore next */ []);
+	loadingState = signal(false, ...ngDevMode ? [{ debugName: "loadingState" }] : /* istanbul ignore next */ []);
+	featuresState = signal(this.transferredFeatures ?? {}, ...ngDevMode ? [{ debugName: "featuresState" }] : /* istanbul ignore next */ []);
+	featuresLoaded = this.transferredFeatures !== null;
+	featuresRequest = null;
+	jwtMint = null;
+	sessionLoss = createLtSessionLossDetector({
+		clearUser: () => this.clearUser(),
+		currentUrl: () => this.currentUrl(),
+		isAuthenticated: () => this.isAuthenticated(),
+		isJwtMode: () => this.isJwtMode(),
+		navigate: (url) => this.navigate(url),
+		probeSession: () => this.fetchWithAuth(this.authUrl("/get-session"), { method: "GET" }),
+		switchToJwtMode: () => this.switchToJwtMode()
+	}, {
+		enabled: this.options.interceptor.enabled,
+		loginPath: this.options.loginPath,
+		publicPaths: [.../* @__PURE__ */ new Set([
+			...LT_AUTH_PUBLIC_PATHS,
+			...this.options.interceptor.publicPaths,
+			this.options.loginPath,
+			this.options.twoFactorRedirectPath,
+			this.options.systemSetup.setupPath
+		])]
+	});
+	user = this.userState.asReadonly();
+	isAuthenticated = computed(() => !!this.userState(), ...ngDevMode ? [{ debugName: "isAuthenticated" }] : /* istanbul ignore next */ []);
+	authMode = this.modeState.asReadonly();
+	isJwtMode = computed(() => this.modeState() === "jwt", ...ngDevMode ? [{ debugName: "isJwtMode" }] : /* istanbul ignore next */ []);
+	isLoading = this.loadingState.asReadonly();
+	isAdmin = computed(() => hasLtRole(this.userState(), "admin"), ...ngDevMode ? [{ debugName: "isAdmin" }] : /* istanbul ignore next */ []);
+	is2FAEnabled = computed(() => !!this.userState()?.twoFactorEnabled, ...ngDevMode ? [{ debugName: "is2FAEnabled" }] : /* istanbul ignore next */ []);
+	features = this.featuresState.asReadonly();
+	passkeySupported = computed(() => this.options.enablePasskey && !!this.featuresState()["passkey"] && typeof globalThis.PublicKeyCredential !== "undefined", ...ngDevMode ? [{ debugName: "passkeySupported" }] : /* istanbul ignore next */ []);
+	jwtToken() {
+		return this.isJwtMode() ? this.authState.getJwtToken() : null;
+	}
+	hasRole(role) {
+		return hasLtRole(this.userState(), role);
+	}
+	hasAnyRole(...roles) {
+		return roles.some((role) => hasLtRole(this.userState(), role));
+	}
+	fetchFeatures() {
+		if (this.isServer && this.api.resolve().missing) return Promise.resolve(this.featuresState());
+		if (!this.featuresRequest) this.featuresRequest = this.loadFeatures().finally(() => {
+			this.featuresRequest = null;
+		});
+		return this.featuresRequest;
+	}
+	ensureFeatures() {
+		return this.featuresLoaded ? Promise.resolve(this.featuresState()) : this.fetchFeatures();
+	}
+	setUser(user, mode = "cookie") {
+		const normalised = user ? {
+			...user,
+			image: user.image ?? void 0
+		} : null;
+		this.userState.set(normalised);
+		this.modeState.set(mode);
+		this.authState.writeState({
+			authMode: mode,
+			user: normalised
+		});
+	}
+	clearUser() {
+		this.userState.set(null);
+		this.modeState.set("cookie");
+		this.authState.clearAuthCookies();
+	}
+	async signOut(options) {
+		this.loadingState.set(true);
+		try {
+			const userId = this.userState()?.id;
+			for (const hook of this.signOutHooks) await runHook(() => hook.beforeSignOut?.(userId ? String(userId) : null), "beforeSignOut");
+			try {
+				await this.fetchWithAuth(this.authUrl("/sign-out"), {
+					body: "{}",
+					credentials: "include",
+					headers: {
+						...options?.headers,
+						"content-type": "application/json"
+					},
+					method: "POST",
+					signal: options?.signal
+				});
+			} catch (error) {
+				console.error("[@lenne.tech/ng-base] The sign-out request failed; the local session is cleared anyway:", error);
+			}
+			this.clearUser();
+			for (const hook of this.signOutHooks) await runHook(() => hook.afterSignOut?.(), "afterSignOut");
+		} finally {
+			this.loadingState.set(false);
+		}
+	}
+	async validateSession() {
+		if (this.isServer) return !!this.cachedUser();
+		try {
+			const sessionUser = (await withTimeout(this.fetchSession(), LT_VALIDATE_SESSION_TIMEOUT_MS))?.user;
+			if (sessionUser) {
+				this.setUser(this.mergeSessionUser(sessionUser), this.modeState());
+				if (!this.isJwtMode()) this.prefetchJwt();
+				return true;
+			}
+			const cached = this.cachedUser();
+			if (cached) {
+				if (!this.userState()) this.userState.set(cached);
+				this.prefetchJwt();
+				return true;
+			}
+			return false;
+		} catch {
+			return !!this.cachedUser();
+		}
+	}
+	async fetchWithAuth(input, init = {}) {
+		const url = ltRequestUrl(input);
+		if (!isLtApiRequest(url, this.api.resolve().baseUrl, this.document.location?.origin)) return ltCredentialsFetch(input, init);
+		const ownAuthorization = new Headers(init.headers ?? (input instanceof Request ? input.headers : void 0)).has("Authorization");
+		const sentToken = !ownAuthorization && this.isJwtMode() ? await this.currentJwt() : null;
+		const retryInput = input instanceof Request ? input.clone() : input;
+		const response = await this.send(input, init, url, sentToken, this.isJwtMode());
+		if (response.status !== 401) return response;
+		const freshToken = ownAuthorization ? null : await this.recoverFrom401(url, sentToken);
+		const final = freshToken ? await this.send(retryInput, init, url, freshToken, true) : response;
+		if (final.status === 401) this.handleUnauthorized(url);
+		return final;
+	}
+	async recoverFrom401(url, sentToken) {
+		if (this.isServer || isLtAuthEndpoint(url) || !this.isAuthenticated()) return null;
+		if (sentToken && ltUrlRequiresCookies(url)) return null;
+		const current = this.jwtToken();
+		if (current && current !== sentToken) return current;
+		return this.mintJwt();
+	}
+	handleUnauthorized(url) {
+		if (this.isServer) return Promise.resolve(false);
+		return this.sessionLoss.handle(url);
+	}
+	async switchToJwtMode() {
+		return !!await this.mintJwt();
+	}
+	async refreshJwtToken() {
+		if (!this.isJwtMode() || !this.authState.getJwtToken()) return false;
+		return !!await this.mintJwt();
+	}
+	absoluteAppUrl(path) {
+		if (isLtAbsoluteUrl(path)) return path;
+		const origin = this.isServer ? "" : this.document.location?.origin;
+		const base = (this.runtimeConfig?.siteUrl || (origin && origin !== "null" ? origin : "")).replace(/\/+$/, "");
+		if (!base) throw new Error("[@lenne.tech/ng-base] absoluteAppUrl: no site URL known. Set NG_PUBLIC_SITE_URL.");
+		return `${base}${path.startsWith("/") ? path : `/${path}`}`;
+	}
+	authUrl(path) {
+		const basePath = (this.options.basePath || "/iam").replace(/\/+$/, "");
+		return this.api.buildUrl(`${basePath.startsWith("/") ? basePath : `/${basePath}`}${path}`);
+	}
+	async withLoading(task) {
+		this.loadingState.set(true);
+		try {
+			return await task();
+		} finally {
+			this.loadingState.set(false);
+		}
+	}
+	applyAuthResult(result) {
+		const answer = readLtAuthAnswer(result);
+		if (answer.twoFactor || answer.emailVerificationRequired || !answer.session || !answer.user) return false;
+		if (answer.jwt) {
+			this.authState.setJwtToken(answer.jwt);
+			this.setUser(answer.user, "jwt");
+			return true;
+		}
+		this.setUser(answer.user, "cookie");
+		this.prefetchJwt();
+		return true;
+	}
+	async adoptVerifiedSession(result) {
+		const { jwt, user } = readLtAuthAnswer(result);
+		const mode = jwt && this.authState.setJwtToken(jwt) ? "jwt" : "cookie";
+		if (user) {
+			this.setUser(user, mode);
+			if (mode === "cookie") this.prefetchJwt();
+			return this.userState() ?? void 0;
+		}
+		this.modeState.set(mode);
+		const loaded = await this.loadSessionUser(mode);
+		if (!loaded) this.clearUser();
+		return loaded;
+	}
+	async loadSessionUser(mode = this.modeState()) {
+		try {
+			const data = await this.fetchSession();
+			if (!data?.user) return;
+			this.setUser(this.mergeSessionUser(data.user), mode);
+			if (mode === "cookie") this.prefetchJwt();
+			return this.userState() ?? void 0;
+		} catch {
+			return;
+		}
+	}
+	async currentJwt() {
+		const token = this.jwtToken();
+		return this.jwtNeedsRefresh() ? await this.mintJwt() ?? token : token;
+	}
+	jwtNeedsRefresh() {
+		const token = this.jwtToken();
+		return !!token && !this.isServer && ltJwtExpiresWithin(token, 6e4);
+	}
+	navigateKeepingRedirect(path) {
+		const router = this.injector.get(Router, null);
+		const current = router ? router.parseUrl(router.url).queryParams["redirect"] : new URLSearchParams(this.document.location?.search ?? "").get("redirect");
+		const redirect = typeof current === "string" && current.startsWith("/") && !current.startsWith("//") ? current : null;
+		if (!redirect || /[?&]redirect=/.test(path)) {
+			this.navigate(path);
+			return;
+		}
+		this.navigate(`${path}${path.includes("?") ? "&" : "?"}redirect=${encodeURIComponent(redirect)}`);
+	}
+	navigate(url) {
+		const router = this.injector.get(Router, null);
+		if (router) {
+			router.navigateByUrl(url).catch((error) => console.error("[@lenne.tech/ng-base] Navigation failed:", error));
+			return;
+		}
+		if (!this.isServer) this.document.location.assign(url);
+	}
+	mergeSessionUser(sessionUser) {
+		const cached = this.cachedUser();
+		if (!cached?.id || !sessionUser?.id || cached.id !== sessionUser.id) return sessionUser;
+		const merged = {
+			...cached,
+			...sessionUser
+		};
+		for (const key of AUTHZ_KEYS) if (!(key in sessionUser)) delete merged[key];
+		return merged;
+	}
+	cachedUser() {
+		return this.authState.readUser() ?? this.userState();
+	}
+	async fetchSession() {
+		const response = await this.fetchWithAuth(this.authUrl("/get-session"), { method: "GET" });
+		if (!response.ok) return null;
+		return await response.json().catch(() => null) ?? null;
+	}
+	mintJwt() {
+		if (this.isServer) return Promise.resolve(null);
+		if (!this.jwtMint) this.jwtMint = this.requestJwt().then((token) => {
+			if (token && this.authState.setJwtToken(token)) {
+				this.modeState.set("jwt");
+				this.persistState();
+				return token;
+			}
+			return null;
+		}).finally(() => {
+			this.jwtMint = null;
+		});
+		return this.jwtMint;
+	}
+	prefetchJwt() {
+		if (this.isServer) return;
+		this.requestJwt().then((token) => {
+			if (token && this.userState()) this.authState.setJwtToken(token);
+		});
+	}
+	async requestJwt() {
+		const current = this.jwtToken();
+		const bearer = current && !ltJwtExpiresWithin(current, 0) ? current : null;
+		try {
+			const response = await fetch(this.authUrl("/token"), {
+				credentials: "include",
+				headers: bearer ? { Authorization: `Bearer ${bearer}` } : void 0,
+				method: "GET"
+			});
+			if (!response.ok) return null;
+			return stringOrNull((await response.json())?.token);
+		} catch {
+			return null;
+		}
+	}
+	async loadFeatures() {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), FEATURES_TIMEOUT_MS);
+		try {
+			const response = await fetch(this.authUrl("/features"), {
+				headers: { accept: "application/json" },
+				signal: controller.signal
+			});
+			if (response.ok) {
+				const body = await response.json();
+				if (body && typeof body === "object" && !Array.isArray(body)) {
+					this.featuresState.set(body);
+					this.featuresLoaded = true;
+					if (this.isServer) this.transferState.set(LT_AUTH_FEATURES_STATE_KEY, body);
+				}
+			}
+		} catch {} finally {
+			clearTimeout(timer);
+		}
+		return this.featuresState();
+	}
+	send(input, init, url, token, jwtMode) {
+		const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : void 0));
+		if (token && !headers.has("Authorization")) headers.set("Authorization", `Bearer ${token}`);
+		const credentials = init.credentials ?? (jwtMode && !ltUrlRequiresCookies(url) ? "omit" : "include");
+		return fetch(input, {
+			...init,
+			credentials,
+			headers
+		});
+	}
+	persistState() {
+		this.authState.writeState({
+			authMode: this.modeState(),
+			user: this.userState()
+		});
+	}
+	currentUrl() {
+		const router = this.injector.get(Router, null);
+		if (router) return router.url;
+		const location = this.document.location;
+		return location ? `${location.pathname}${location.search}${location.hash}` : null;
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtAuthStore,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtAuthStore
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.4",
+	ngImport: i0,
+	type: LtAuthStore,
+	decorators: [{ type: Service }]
+});
+function hasLtRole(user, role) {
+	if (!user || !role) return false;
+	return user.role === role || Array.isArray(user.roles) && user.roles.includes(role);
+}
+function stringOrNull(value) {
+	return typeof value === "string" && value ? value : null;
+}
+async function runHook(hook, name) {
+	try {
+		await hook();
+	} catch (error) {
+		console.error(`[@lenne.tech/ng-base] A sign-out hook (${name}) failed:`, error);
+	}
+}
+function withTimeout(promise, ms) {
+	let timer;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(null), ms);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+const LT_SYSTEM_SETUP_STATE_KEY = makeStateKey("lt-system-setup");
+const LT_SYSTEM_SETUP_TOKEN_HEADER = "X-System-Setup-Token";
+var LtSystemSetupService = class LtSystemSetupService {
+	api = inject(LtApiUrlService);
+	fetch = inject(LT_FETCH);
+	transferState = inject(TransferState);
+	isServer = isPlatformServer(inject(PLATFORM_ID));
+	transferred = this.isServer ? null : this.transferState.get(LT_SYSTEM_SETUP_STATE_KEY, null);
+	needsSetupState = signal(this.transferred ? this.transferred.needsSetup : null, ...ngDevMode ? [{ debugName: "needsSetupState" }] : /* istanbul ignore next */ []);
+	httpInitEnabledState = signal(this.transferred ? this.transferred.httpInitEnabled !== false : null, ...ngDevMode ? [{ debugName: "httpInitEnabledState" }] : /* istanbul ignore next */ []);
+	httpInitTokenRequiredState = signal(this.transferred ? this.transferred.httpInitTokenRequired === true : null, ...ngDevMode ? [{ debugName: "httpInitTokenRequiredState" }] : /* istanbul ignore next */ []);
+	statusRequest = null;
+	needsSetup = this.needsSetupState.asReadonly();
+	httpInitEnabled = this.httpInitEnabledState.asReadonly();
+	httpInitTokenRequired = this.httpInitTokenRequiredState.asReadonly();
+	checkSetupStatus() {
+		if (this.isServer && this.api.resolve().missing) {
+			this.api.reportMissing();
+			return Promise.resolve({ needsSetup: false });
+		}
+		if (!this.statusRequest) this.statusRequest = this.loadStatus().finally(() => {
+			this.statusRequest = null;
+		});
+		return this.statusRequest;
+	}
+	async initSetup(input) {
+		const url = this.api.buildUrl("/system-setup/init");
+		const password = await ltSha256(input.password);
+		const token = input.token?.trim();
+		const headers = {
+			accept: "application/json",
+			"content-type": "application/json"
+		};
+		if (token) headers[LT_SYSTEM_SETUP_TOKEN_HEADER] = token;
+		const response = await this.fetch(url, {
+			body: JSON.stringify({
+				email: input.email,
+				name: input.name,
+				password
+			}),
+			headers,
+			method: "POST"
+		});
+		if (!response.ok) {
+			const error = await toSetupError(response);
+			if (response.status === 403) await this.checkSetupStatus();
+			throw error;
+		}
+		this.needsSetupState.set(false);
+	}
+	async loadStatus() {
+		try {
+			const response = await this.fetch(this.api.buildUrl("/system-setup/status"), { headers: { accept: "application/json" } });
+			if (!response.ok) throw new Error(`HTTP ${response.status}`);
+			const data = await response.json() ?? {};
+			const status = {
+				httpInitEnabled: typeof data["httpInitEnabled"] === "boolean" ? data["httpInitEnabled"] : true,
+				httpInitTokenRequired: data["httpInitTokenRequired"] === true,
+				needsSetup: data["needsSetup"] === true
+			};
+			this.needsSetupState.set(status.needsSetup);
+			this.httpInitEnabledState.set(status.httpInitEnabled ?? true);
+			this.httpInitTokenRequiredState.set(status.httpInitTokenRequired ?? false);
+			if (this.isServer) this.transferState.set(LT_SYSTEM_SETUP_STATE_KEY, status);
+			return status;
+		} catch {
+			this.needsSetupState.set(false);
+			return { needsSetup: false };
+		}
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtSystemSetupService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtSystemSetupService
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.4",
+	ngImport: i0,
+	type: LtSystemSetupService,
+	decorators: [{ type: Service }]
+});
+async function toSetupError(response) {
+	const text = await response.text().catch(() => "");
+	let data = text;
+	try {
+		data = text ? JSON.parse(text) : null;
+	} catch {}
+	const bodyMessage = data && typeof data === "object" ? data.message : data;
+	const message = typeof bodyMessage === "string" && bodyMessage ? bodyMessage : `[POST] /system-setup/init: ${response.status} ${response.statusText}`.trim();
+	return Object.assign(new Error(message), {
+		data,
+		status: response.status,
+		statusCode: response.status
+	});
+}
+const ltAuthGuard = (_route, state) => inject(LtAuthStore).isAuthenticated() ? true : loginTree(state);
+function ltGuestGuard(redirectTo = "/app") {
+	return () => inject(LtAuthStore).isAuthenticated() ? inject(Router).parseUrl(redirectTo) : true;
+}
+function ltRoleGuard(roles, redirectTo = "/") {
+	const wanted = Array.isArray(roles) ? roles : [roles];
+	return (_route, state) => {
+		const auth = inject(LtAuthStore);
+		if (!auth.isAuthenticated()) return loginTree(state);
+		const user = auth.user();
+		return wanted.some((role) => hasLtRole(user, role)) ? true : inject(Router).parseUrl(redirectTo);
+	};
+}
+const ltSystemSetupGuard = async (_route, state) => {
+	const options = inject(LT_AUTH_OPTIONS);
+	if (!options.systemSetup.enabled) return true;
+	const setup = inject(LtSystemSetupService);
+	const router = inject(Router);
+	try {
+		if (setup.needsSetup() === null) await setup.checkSetupStatus();
+		const path = ltPathOf(state.url);
+		const setupPath = options.systemSetup.setupPath;
+		if (setup.needsSetup() === true && setup.httpInitEnabled() !== false && path !== setupPath) return router.parseUrl(setupPath);
+		if (setup.needsSetup() === false && path === setupPath) return router.parseUrl(options.loginPath);
+	} catch {}
+	return true;
+};
+function loginTree(state) {
+	const options = inject(LT_AUTH_OPTIONS);
+	return inject(Router).createUrlTree([options.loginPath], { queryParams: { redirect: state.url } });
+}
+var LtUnauthorizedHandler = class LtUnauthorizedHandler {
+	auth = inject(LtAuthStore);
+	handle(url) {
+		return this.auth.handleUnauthorized(url);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtUnauthorizedHandler,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.4",
+		ngImport: i0,
+		type: LtUnauthorizedHandler
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.4",
+	ngImport: i0,
+	type: LtUnauthorizedHandler,
+	decorators: [{ type: Service }]
+});
+const ltAuthInterceptor = (request, next) => {
+	if (isPlatformServer(inject(PLATFORM_ID))) return next(request);
+	const api = inject(LtApiUrlService);
+	if (!isLtApiRequest(request.url, api.resolve().baseUrl, inject(DOCUMENT).location?.origin)) return next(request);
+	const auth = inject(LtAuthStore);
+	const handler = inject(LtUnauthorizedHandler);
+	const url = request.urlWithParams;
+	const ownAuthorization = request.headers.has("Authorization");
+	const authorize = (token) => request.clone(token && !ownAuthorization ? {
+		setHeaders: { Authorization: `Bearer ${token}` },
+		withCredentials: true
+	} : { withCredentials: true });
+	const reportAndRethrow = (error) => {
+		if (isUnauthorized(error)) handler.handle(url);
+		return throwError(() => error);
+	};
+	const send = (sentToken) => next(authorize(sentToken)).pipe(catchError((error) => {
+		if (!isUnauthorized(error) || ownAuthorization) return reportAndRethrow(error);
+		return from(auth.recoverFrom401(url, sentToken)).pipe(switchMap((token) => token ? next(authorize(token)).pipe(catchError(reportAndRethrow)) : reportAndRethrow(error)));
+	}));
+	return !ownAuthorization && auth.jwtNeedsRefresh() ? from(auth.currentJwt()).pipe(switchMap(send)) : send(ownAuthorization ? null : auth.jwtToken());
+};
+function isUnauthorized(error) {
+	return error instanceof HttpErrorResponse && error.status === 401;
+}
+function provideLtAuth(options = {}) {
+	return makeEnvironmentProviders([
+		{
+			provide: LT_AUTH_INPUT_OPTIONS,
+			useValue: options
+		},
+		{
+			provide: LT_FETCH,
+			useFactory: () => {
+				const auth = inject(LtAuthStore);
+				return (input, init) => auth.fetchWithAuth(input, init);
+			}
+		},
+		provideAppInitializer(() => {
+			const auth = inject(LtAuthStore);
+			if (isPlatformServer(inject(PLATFORM_ID))) return auth.ensureFeatures().then(() => void 0);
+			auth.ensureFeatures();
+			auth.validateSession();
+		})
+	]);
+}
+export { LT_AUTH_COOKIE_MAX_AGE, LT_AUTH_COOKIE_PATHS, LT_AUTH_DEFAULTS, LT_AUTH_ENDPOINT_FRAGMENTS, LT_AUTH_FEATURES_STATE_KEY, LT_AUTH_INPUT_OPTIONS, LT_AUTH_OPTIONS, LT_AUTH_PUBLIC_PATHS, LT_AUTH_SIGN_OUT_HOOKS, LT_AUTH_STATE_COOKIE_DEFAULT, LT_JWT_TOKEN_COOKIE_DEFAULT, LT_SYSTEM_SETUP_STATE_KEY, LT_SYSTEM_SETUP_TOKEN_HEADER, LT_VALIDATE_SESSION_TIMEOUT_MS, LtAuthStateService, LtAuthStore, LtSystemSetupService, LtUnauthorizedHandler, hasLtRole, isLtApiRequest, isLtAuthEndpoint, ltAuthGuard, ltAuthInterceptor, ltGuestGuard, ltRoleGuard, ltSystemSetupGuard, provideLtAuth, readLtAuthAnswer, resolveLtAuthCookieNames, resolveLtAuthState, resolveLtCookiePrefix };
+
+//# sourceMappingURL=lenne.tech-ng-base-auth-provide.mjs.map