@lenne.tech/ng-base 22.0.4 → 22.1.0

package/CLAUDE.md

@@ -28,6 +28,11 @@ relatively. Changes to the vendored core belong upstream in `lenneTech/ng-base`.
 
 - Auth goes through `LtAuthService` only. Never send a plaintext password: the service hashes every credential
   (SHA-256) itself, so pass the raw form value once and never hash it yourself as well.
+- `lt-jwt-token` holds a JWT or nothing. After a passkey or 2FA sign-in never store a token yourself:
+  `authenticateWithPasskey()` returns `{ success, error?, user? }`, and `twoFactor.verifyTotp()` / `verifyBackupCode()`
+  set the session and return no session token.
+- SSR backend calls are anonymous (also `fetchWithAuth`): load user data in the browser (`afterNextRender()`, or a
+  resource that only starts when `isPlatformBrowser(…)`), render public data on the server, never decide access there.
 - `lt-auth-state` is a UI cache. Guards (`ltAuthGuard`, `ltRoleGuard`) gate UI only; the backend authorises every
   request. Do not build security decisions on `isAdmin()`.
 - Redirect/callback URLs for auth mails are absolute app URLs from `NG_PUBLIC_SITE_URL` (`LtAuthService.absoluteAppUrl`),

package/README.md

@@ -153,6 +153,31 @@ root route `canActivateChild: [ltSystemSetupGuard]`. Import the guards, `ltAuthI
 no Better Auth, 2FA or passkey code. `LtAuthService` (`/auth`) shares the same state and belongs on the pages that sign
 in, register, verify 2FA or manage passkeys. `/auth` re-exports everything of `/auth/provide`, so either import works.
 
+`lt-jwt-token` holds a JWT or nothing. After 2FA or a passkey sign-in never store a token yourself: the service puts the
+session in place, `authenticateWithPasskey()` returns `{ success, error?, user? }`, and `twoFactor.verifyTotp()` /
+`verifyBackupCode()` drop Better Auth's opaque session token from their answer (a JWT of `cookies: false` stays).
+
+## Server-side rendering: backend calls are anonymous
+
+During SSR every API call of ng-base goes out **without** the user's session: `LT_FETCH` / `fetchWithAuth`,
+`ltAuthInterceptor`, the AI services and offline sync. The server takes the auth state from the `lt-auth-state` cookie,
+a display cache for UI gating and no proof of a session, and never reads `lt-jwt-token`; Node's `fetch` does not forward
+the browser's cookies. The session cookie `iam.session_token` belongs to the API host anyway (host-only unless
+nest-server's `crossSubDomainCookies` is set), so the app server usually never receives it.
+
+For pages that show user data:
+
+- **Load it in the browser**, for example in `afterNextRender()` or a resource that only starts when
+  `isPlatformBrowser(…)`, with a skeleton for the first paint. `resource()` / `httpResource()` run during SSR too.
+- **Render only public data on the server**, and never decide access there: a guard that reads `lt-auth-state` decides
+  what to render, the API decides what the user may see.
+- If a page truly needs user data in the SSR HTML, that needs a route of the app's own server that forwards the
+  request's session to the API, set up per project together with a shared cookie domain. ng-base does not do it.
+
+Unlike nuxt-extensions, `fetchWithAuth` is anonymous during SSR too (nuxt-extensions sends the request's `lt-jwt-token`
+as bearer there): no SSR output depends on one user's token, and a cached route can never serve one user's data to the
+next.
+
 ## Texts (de/en)
 
 Library texts are German and English, chosen by the browser language, `LtI18nService.setLocale()` or an app i18n
@@ -221,19 +246,23 @@ Differences to bug.lt 1.6.9:
   has no subtree error capture): the app's `ErrorHandler` is wrapped (it keeps handling every error) and
   `LtBugReportService.reportError()` reports by hand; `LtBugReportService.open()` replaces `useBugReport().openModal()`.
 
-## Differences to nuxt-extensions 1.25.0
+## Differences to nuxt-extensions 4.0.1
+
+ng-base follows nuxt-extensions release for release (last compared: 1.26.0 to 4.0.1). Behaviour that is the same in both
+(2FA and passkey sign-in never expose the session token, one auth fetch with JWT renewal and `basePath`, file URLs on the
+API with `GET /files/id/:id`, TUS on `/tus`, `enableAdmin` off with a warning, error translations that never hold back the
+start, `includeDisabled` for AI prompts) is not listed. What differs on purpose:
 
 - Composables with per-call state are `inject…()` factories bound to the injection context (`injectLtTusUpload()`,
   `injectLtAiChat()`, `injectLtOfflineSync()`); shared state lives in root services (`LtAuthService`, `LtAi…Service`).
-- Bugs not ported: the user is set after 2FA verification; one shared auth fetch (`LT_FETCH`) refreshes a stale JWT for
-  AI, SSE and sync too; file URLs resolve against the API; the TUS endpoint defaults to `/tus`; the missing
-  `passkeyAlreadyRegistered` text exists; transitions use Angular `animate.enter`/`animate.leave` classes.
+- `fetchWithAuth` is anonymous during SSR too (see "Server-side rendering: backend calls are anonymous").
+- Transitions use Angular `animate.enter` / `animate.leave` classes with CSS variables for the durations, no Tailwind
+  duration utilities.
 - nest-server's real JWT mode (`cookies: false`, env `NSC__COOKIES=false`) works end to end: a JWT in a sign-in, 2FA or
   passkey answer puts the store into JWT mode, session checks keep the mode (a bearer-proven session never falls back to
   cookie mode), and a JWT expiring within 60 s is refreshed with itself as bearer before it is sent (nest-server's JWTs
   live 15 minutes and there is no cookie to mint a new one). An opaque Better Auth session token is never stored. Before
   nest-server 12.7.0 the browser must reach the API same-origin in this mode (`NG_PUBLIC_API_PROXY=true`).
-- The Better Auth admin plugin is off by default (`enableAdmin`), nest-server does not serve it.
 - Passkeys work without `@better-auth/passkey` (WebAuthn calls go straight to `/iam/passkey/*`); the plugin can still be
   passed via `provideLtAuth({ plugins })`.
 - Pre-hydration input is preserved (`provideLtNgBase({ preHydrationInput })`, on by default): the first change
@@ -242,8 +271,6 @@ Differences to bug.lt 1.6.9:
   HTML that blocks the native submit of forms without `action` before hydration (no password in a GET URL).
 - Not ported: the form-label association repair (a Nuxt UI/reka-ui id divergence that Angular's id handling does not
   have).
-- File URLs use nest-server 12.5's real routes (`/files/id/:id`, `/files/info/:id`); nuxt-extensions built
-  `/files/:id` and `/files/download/:id`, which answer 404.
 
 ## Vendor mode
 

package/fesm2022/lenne.tech-ng-base-ai.mjs

@@ -53,7 +53,7 @@ var LtAiHttpService = class LtAiHttpService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiHttpService,
 		deps: [],
@@ -61,14 +61,14 @@ var LtAiHttpService = class LtAiHttpService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiHttpService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiHttpService,
 	decorators: [{ type: Service }]
@@ -384,7 +384,7 @@ var LtAiAdminService = class LtAiAdminService {
 	listInteractions = () => this.http.request("GET", "/interactions");
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiAdminService,
 		deps: [],
@@ -392,14 +392,14 @@ var LtAiAdminService = class LtAiAdminService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiAdminService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiAdminService,
 	decorators: [{ type: Service }]
@@ -425,7 +425,7 @@ var LtAiConnectionsService = class LtAiConnectionsService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiConnectionsService,
 		deps: [],
@@ -433,14 +433,14 @@ var LtAiConnectionsService = class LtAiConnectionsService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiConnectionsService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiConnectionsService,
 	decorators: [{ type: Service }]
@@ -463,7 +463,7 @@ var LtAiPlaceholdersService = class LtAiPlaceholdersService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiPlaceholdersService,
 		deps: [],
@@ -471,14 +471,14 @@ var LtAiPlaceholdersService = class LtAiPlaceholdersService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiPlaceholdersService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiPlaceholdersService,
 	decorators: [{ type: Service }]
@@ -522,7 +522,7 @@ var LtAiPromptsService = class LtAiPromptsService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiPromptsService,
 		deps: [],
@@ -530,14 +530,14 @@ var LtAiPromptsService = class LtAiPromptsService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiPromptsService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiPromptsService,
 	decorators: [{ type: Service }]
@@ -572,7 +572,7 @@ var LtAiService = class LtAiService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiService,
 		deps: [],
@@ -580,14 +580,14 @@ var LtAiService = class LtAiService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiService,
 	decorators: [{ type: Service }]
@@ -612,7 +612,7 @@ var LtAiSettingsService = class LtAiSettingsService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiSettingsService,
 		deps: [],
@@ -620,14 +620,14 @@ var LtAiSettingsService = class LtAiSettingsService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiSettingsService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiSettingsService,
 	decorators: [{ type: Service }]
@@ -712,7 +712,7 @@ var LtAiStatusService = class LtAiStatusService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiStatusService,
 		deps: [],
@@ -720,14 +720,14 @@ var LtAiStatusService = class LtAiStatusService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiStatusService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiStatusService,
 	decorators: [{ type: Service }]
@@ -746,7 +746,7 @@ var LtAiUsageService = class LtAiUsageService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiUsageService,
 		deps: [],
@@ -754,14 +754,14 @@ var LtAiUsageService = class LtAiUsageService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAiUsageService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAiUsageService,
 	decorators: [{ type: Service }]

package/fesm2022/lenne.tech-ng-base-auth-provide.mjs

@@ -1,7 +1,7 @@
 import * as i0 from "@angular/core";
 import { InjectionToken, Injector, PLATFORM_ID, Service, TransferState, computed, inject, makeEnvironmentProviders, makeStateKey, provideAppInitializer, signal } from "@angular/core";
 import { Router } from "@angular/router";
-import { LT_FETCH, LT_RUNTIME_CONFIG, LtApiUrlService, LtCookieService, isLtAbsoluteUrl, ltCredentialsFetch, ltSha256, mergeLtFeatureOptions } from "@lenne.tech/ng-base";
+import { LT_FETCH, LT_RUNTIME_CONFIG, LtApiUrlService, LtCookieService, isLtAbsoluteUrl, ltCredentialsFetch, ltSha256, mergeLtFeatureOptions, warnLtOnce } from "@lenne.tech/ng-base";
 import { DOCUMENT, isPlatformServer } from "@angular/common";
 import { HttpErrorResponse } from "@angular/common/http";
 import { catchError, from, switchMap, throwError } from "rxjs";
@@ -165,7 +165,7 @@ var LtAuthStateService = class LtAuthStateService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAuthStateService,
 		deps: [],
@@ -173,14 +173,14 @@ var LtAuthStateService = class LtAuthStateService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAuthStateService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAuthStateService,
 	decorators: [{ type: Service }]
@@ -657,6 +657,7 @@ var LtAuthStore = class LtAuthStore {
 				if (body && typeof body === "object" && !Array.isArray(body)) {
 					this.featuresState.set(body);
 					this.featuresLoaded = true;
+					if (this.options.enableAdmin && body["admin"] !== true) warnLtOnce("admin-plugin-unserved", "[@lenne.tech/ng-base] provideLtAuth({ enableAdmin: true }) is set, but the API reports no admin plugin (no `admin` in /iam/features): admin.* calls answer 404, and ng-base does not hash the passwords of admin.createUser / admin.setUserPassword. Switch enableAdmin off unless the backend serves the Better Auth admin routes.");
 					if (this.isServer) this.transferState.set(LT_AUTH_FEATURES_STATE_KEY, body);
 				}
 			}
@@ -689,7 +690,7 @@ var LtAuthStore = class LtAuthStore {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAuthStore,
 		deps: [],
@@ -697,14 +698,14 @@ var LtAuthStore = class LtAuthStore {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtAuthStore
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtAuthStore,
 	decorators: [{ type: Service }]
@@ -802,7 +803,7 @@ var LtSystemSetupService = class LtSystemSetupService {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtSystemSetupService,
 		deps: [],
@@ -810,14 +811,14 @@ var LtSystemSetupService = class LtSystemSetupService {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtSystemSetupService
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtSystemSetupService,
 	decorators: [{ type: Service }]
@@ -874,7 +875,7 @@ var LtUnauthorizedHandler = class LtUnauthorizedHandler {
 	}
 	static ɵfac = i0.ɵɵngDeclareFactory({
 		minVersion: "12.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtUnauthorizedHandler,
 		deps: [],
@@ -882,14 +883,14 @@ var LtUnauthorizedHandler = class LtUnauthorizedHandler {
 	});
 	static ɵprov = i0.ɵɵngDeclareService({
 		minVersion: "22.0.0",
-		version: "22.2.4",
+		version: "22.2.5",
 		ngImport: i0,
 		type: LtUnauthorizedHandler
 	});
 };
 i0.ɵɵngDeclareClassMetadata({
 	minVersion: "12.0.0",
-	version: "22.2.4",
+	version: "22.2.5",
 	ngImport: i0,
 	type: LtUnauthorizedHandler,
 	decorators: [{ type: Service }]
@@ -940,6 +941,6 @@ function provideLtAuth(options = {}) {
 		})
 	]);
 }
-export { LT_AUTH_COOKIE_MAX_AGE, LT_AUTH_COOKIE_PATHS, LT_AUTH_DEFAULTS, LT_AUTH_ENDPOINT_FRAGMENTS, LT_AUTH_FEATURES_STATE_KEY, LT_AUTH_INPUT_OPTIONS, LT_AUTH_OPTIONS, LT_AUTH_PUBLIC_PATHS, LT_AUTH_SIGN_OUT_HOOKS, LT_AUTH_STATE_COOKIE_DEFAULT, LT_JWT_TOKEN_COOKIE_DEFAULT, LT_SYSTEM_SETUP_STATE_KEY, LT_SYSTEM_SETUP_TOKEN_HEADER, LT_VALIDATE_SESSION_TIMEOUT_MS, LtAuthStateService, LtAuthStore, LtSystemSetupService, LtUnauthorizedHandler, hasLtRole, isLtApiRequest, isLtAuthEndpoint, ltAuthGuard, ltAuthInterceptor, ltGuestGuard, ltRoleGuard, ltSystemSetupGuard, provideLtAuth, readLtAuthAnswer, resolveLtAuthCookieNames, resolveLtAuthState, resolveLtCookiePrefix };
+export { LT_AUTH_COOKIE_MAX_AGE, LT_AUTH_COOKIE_PATHS, LT_AUTH_DEFAULTS, LT_AUTH_ENDPOINT_FRAGMENTS, LT_AUTH_FEATURES_STATE_KEY, LT_AUTH_INPUT_OPTIONS, LT_AUTH_OPTIONS, LT_AUTH_PUBLIC_PATHS, LT_AUTH_SIGN_OUT_HOOKS, LT_AUTH_STATE_COOKIE_DEFAULT, LT_JWT_TOKEN_COOKIE_DEFAULT, LT_SYSTEM_SETUP_STATE_KEY, LT_SYSTEM_SETUP_TOKEN_HEADER, LT_VALIDATE_SESSION_TIMEOUT_MS, LtAuthStateService, LtAuthStore, LtSystemSetupService, LtUnauthorizedHandler, hasLtRole, isLtApiRequest, isLtAuthEndpoint, isLtJwtShaped, ltAuthGuard, ltAuthInterceptor, ltGuestGuard, ltRoleGuard, ltSystemSetupGuard, provideLtAuth, readLtAuthAnswer, resolveLtAuthCookieNames, resolveLtAuthState, resolveLtCookiePrefix };
 
 //# sourceMappingURL=lenne.tech-ng-base-auth-provide.mjs.map