@masterteam/gateway-auth 0.0.17 → 0.0.19

package/fesm2022/masterteam-gateway-auth.mjs

@@ -1,11 +1,11 @@
+import { firstValueFrom, EMPTY, of, defer, from, isObservable, map, tap as tap$1, shareReplay, finalize, catchError as catchError$1, throwError, switchMap as switchMap$1 } from 'rxjs';
 import { HttpClient, HttpContextToken, HttpBackend } from '@angular/common/http';
 import * as i0 from '@angular/core';
 import { InjectionToken, inject, Injectable, computed, input, ChangeDetectionStrategy, Component, signal, effect } from '@angular/core';
-import { EMPTY, of, isObservable, from, firstValueFrom, map, tap as tap$1, shareReplay, finalize, catchError as catchError$1, throwError, switchMap } from 'rxjs';
 import { Action, Selector, State, Store, select } from '@ngxs/store';
 import { Router, ActivatedRoute } from '@angular/router';
 import { ModalService } from '@masterteam/components/modal';
-import { mergeMap, catchError, tap } from 'rxjs/operators';
+import { switchMap, mergeMap, catchError, tap } from 'rxjs/operators';
 import * as i2 from '@angular/common';
 import { NgTemplateOutlet, CommonModule } from '@angular/common';
 import * as i1 from '@angular/forms';
@@ -66,6 +66,48 @@ function resolveApplicationCodeOption(applicationCode) {
     const normalized = value?.trim();
     return normalized ? normalized : null;
 }
+const applicationContextCache = new Map();
+function buildApplicationContextUrl(applicationApiBaseUrl) {
+    if (!applicationApiBaseUrl) {
+        return null;
+    }
+    const base = normalizeGatewayBase(applicationApiBaseUrl);
+    if (!base) {
+        return null;
+    }
+    const path = GATEWAY_AUTH_ENDPOINTS.applicationContext;
+    if (/\/api\/?$/i.test(base)) {
+        return `${base.replace(/\/+$/, '')}/${path}`;
+    }
+    return `${base}/api/${path}`;
+}
+function clearApplicationContextCache(applicationApiBaseUrl) {
+    if (applicationApiBaseUrl) {
+        applicationContextCache.delete(applicationApiBaseUrl);
+        return;
+    }
+    applicationContextCache.clear();
+}
+async function fetchApplicationContextCode(http, applicationApiBaseUrl) {
+    const url = buildApplicationContextUrl(applicationApiBaseUrl);
+    if (!url || !applicationApiBaseUrl) {
+        return null;
+    }
+    const cacheKey = applicationApiBaseUrl;
+    const cached = applicationContextCache.get(cacheKey);
+    if (cached) {
+        return cached;
+    }
+    const promise = firstValueFrom(http.get(url))
+        .then((response) => response?.data?.applicationCode?.trim() || null)
+        .catch(() => null);
+    applicationContextCache.set(cacheKey, promise);
+    const code = await promise;
+    if (!code) {
+        applicationContextCache.delete(cacheKey);
+    }
+    return code;
+}
 function resolveGatewayDeviceToken(deviceToken) {
     const configuredToken = typeof deviceToken === 'function' ? deviceToken() : deviceToken;
     const normalizedConfiguredToken = configuredToken?.trim();
@@ -438,6 +480,7 @@ const AUTH_STATE_DEFAULTS = {
     applicationsLoading: false,
     appSessions: {},
     appLaunchLoading: {},
+    activeApplicationCode: null,
 };
 function pruneRateLimit(rateLimit) {
     if (!rateLimit) {
@@ -482,6 +525,7 @@ function sanitizePersistedAuthState(obj) {
         applicationsLoading: false,
         appSessions: pruneAppSessions(obj?.appSessions ?? null),
         appLaunchLoading: {},
+        activeApplicationCode: obj?.activeApplicationCode ?? null,
     };
 }
 
@@ -557,6 +601,9 @@ let GatewayAuthState = class GatewayAuthState {
     static appLaunchLoading(state) {
         return state.appLaunchLoading;
     }
+    static activeApplicationCode(state) {
+        return state.activeApplicationCode;
+    }
     login(ctx, action) {
         if (this.isRateLimitActive(ctx, 'login')) {
             return EMPTY;
@@ -567,26 +614,37 @@ let GatewayAuthState = class GatewayAuthState {
             pendingMfa: null,
             twoFactorRequired: false,
         });
-        const applicationCode = action.payload.applicationCode ??
-            resolveApplicationCodeOption(this.options.applicationCode) ??
-            undefined;
-        return this.http
+        return this.resolveApplicationCode$(action.payload.applicationCode).pipe(switchMap((applicationCode) => this.http
             .post(this.gatewayAuthMutationUrl(GATEWAY_AUTH_ENDPOINTS.login), {
             userName: action.payload.userName,
             password: action.payload.password,
-            applicationCode,
+            applicationCode: applicationCode ?? undefined,
             isEncrypted: action.payload.isEncrypted ?? false,
             deviceToken: action.payload.deviceToken || this.deviceToken,
             recaptchaToken: action.payload.recaptchaToken,
             recaptchaAction: action.payload.recaptchaAction,
         })
-            .pipe(mergeMap((response) => this.handleLoginResponse(ctx, response.data)), catchError((error) => {
+            .pipe(mergeMap((response) => this.handleLoginResponse(ctx, response.data, applicationCode)), catchError((error) => {
             if (this.handleRateLimit(ctx, error, 'login')) {
                 return of(null);
             }
             ctx.dispatch(new LoginFailure(getGatewayErrorMessage(error, 'Login failed')));
             return of(null);
-        }));
+        }))));
+    }
+    resolveApplicationCode$(explicitCode) {
+        if (explicitCode) {
+            return of(explicitCode);
+        }
+        const configured = resolveApplicationCodeOption(this.options.applicationCode);
+        if (configured) {
+            return of(configured);
+        }
+        const applicationApiBaseUrl = this.options.getApplicationApiBaseUrl?.();
+        if (!applicationApiBaseUrl) {
+            return of(null);
+        }
+        return defer(() => from(fetchApplicationContextCode(this.http, applicationApiBaseUrl)));
     }
     verifyMfa(ctx, action) {
         const pendingMfa = ctx.getState().pendingMfa;
@@ -736,6 +794,7 @@ let GatewayAuthState = class GatewayAuthState {
             applications: [],
             appSessions: {},
             appLaunchLoading: {},
+            activeApplicationCode: null,
         });
     }
     logout(ctx, action) {
@@ -871,6 +930,7 @@ let GatewayAuthState = class GatewayAuthState {
                     [data.applicationCode]: session,
                 },
                 appLaunchLoading: this.removeLoadingFlag(ctx, code),
+                activeApplicationCode: data.applicationCode,
             });
             if (action.navigate && session.launchUrl) {
                 try {
@@ -918,10 +978,20 @@ let GatewayAuthState = class GatewayAuthState {
     clearAppSession(ctx, action) {
         const sessions = { ...ctx.getState().appSessions };
         delete sessions[action.applicationCode];
-        ctx.patchState({ appSessions: sessions });
+        const state = ctx.getState();
+        ctx.patchState({
+            appSessions: sessions,
+            activeApplicationCode: state.activeApplicationCode === action.applicationCode
+                ? null
+                : state.activeApplicationCode,
+        });
     }
     clearAllAppSessions(ctx) {
-        ctx.patchState({ appSessions: {}, applications: [] });
+        ctx.patchState({
+            appSessions: {},
+            applications: [],
+            activeApplicationCode: null,
+        });
     }
     removeLoadingFlag(ctx, code) {
         const next = { ...ctx.getState().appLaunchLoading };
@@ -955,7 +1025,7 @@ let GatewayAuthState = class GatewayAuthState {
         }));
         return true;
     }
-    handleLoginResponse(ctx, session) {
+    handleLoginResponse(ctx, session, resolvedApplicationCode) {
         if (session.requiresTwoFactor) {
             ctx.patchState({
                 user: null,
@@ -993,18 +1063,20 @@ let GatewayAuthState = class GatewayAuthState {
             twoFactorRequired: false,
             appSessions: {},
             appLaunchLoading: {},
+            activeApplicationCode: null,
         });
-        return this.toObservable(this.options.afterLogin?.(session, ctx)).pipe(mergeMap(() => this.maybeAutoLaunchApplication(ctx)), tap(() => {
+        return this.toObservable(this.options.afterLogin?.(session, ctx)).pipe(mergeMap(() => this.maybeAutoLaunchApplication(ctx, resolvedApplicationCode)), tap(() => {
             this.router.navigateByUrl(this.resolveAuthenticatedRoute(), {
                 replaceUrl: true,
             });
         }));
     }
-    maybeAutoLaunchApplication(ctx) {
+    maybeAutoLaunchApplication(ctx, resolvedApplicationCode) {
         if (!this.options.autoLaunchApplicationOnLogin) {
             return of(null);
         }
-        const code = resolveApplicationCodeOption(this.options.applicationCode);
+        const code = resolvedApplicationCode ??
+            resolveApplicationCodeOption(this.options.applicationCode);
         if (!code) {
             return of(null);
         }
@@ -1185,6 +1257,9 @@ __decorate([
 __decorate([
     Selector()
 ], GatewayAuthState, "appLaunchLoading", null);
+__decorate([
+    Selector()
+], GatewayAuthState, "activeApplicationCode", null);
 GatewayAuthState = __decorate([
     State({
         name: 'auth',
@@ -1217,6 +1292,7 @@ class GatewayAuthFacade {
     applicationsLoading = select(GatewayAuthState.applicationsLoading);
     appSessions = select(GatewayAuthState.appSessions);
     appLaunchLoading = select(GatewayAuthState.appLaunchLoading);
+    activeApplicationCode = select(GatewayAuthState.activeApplicationCode);
     hasError = computed(() => this.error() !== null, ...(ngDevMode ? [{ debugName: "hasError" }] : /* istanbul ignore next */ []));
     isReady = computed(() => !this.loading() && this.error() === null, ...(ngDevMode ? [{ debugName: "isReady" }] : /* istanbul ignore next */ []));
     userDisplayName = computed(() => this.user()?.user?.displayName || '', ...(ngDevMode ? [{ debugName: "userDisplayName" }] : /* istanbul ignore next */ []));
@@ -1523,8 +1599,14 @@ const prepareRequest = (req, token, markRetried, baseUrl) => {
     }
     return modifiedReq;
 };
-const resolveRequestScope = (req, options, auth) => {
-    const useGatewayBaseUrl = options.shouldUseGatewayApiBaseUrl?.(req) ?? false;
+const urlMatchesBase = (url, baseUrl) => {
+    if (!baseUrl || !isAbsoluteUrl(url)) {
+        return false;
+    }
+    return url.startsWith(normalizeBase(baseUrl));
+};
+const resolveRequestScope = (req, options, auth, gatewayApiBaseUrl) => {
+    // 1. Per-request override wins.
     const explicitCode = options.resolveApplicationCodeForRequest?.(req);
     if (explicitCode) {
         const session = auth.getAppSession(explicitCode);
@@ -1532,13 +1614,21 @@ const resolveRequestScope = (req, options, auth) => {
             scope: 'application',
             applicationCode: explicitCode,
             session,
-            useGatewayBaseUrl,
+            useGatewayBaseUrl: false,
         };
     }
-    if (useGatewayBaseUrl) {
+    // 2. Caller hint via request context.
+    if (options.shouldUseGatewayApiBaseUrl?.(req)) {
         return { scope: 'gateway', useGatewayBaseUrl: true };
     }
-    const defaultCode = resolveApplicationCodeOption(options.applicationCode);
+    // 3. Absolute URL pointing at the Gateway base must use GatewaySession.
+    //    Covers /api/auth/*, /api/auth/me/applications, /api/applications/{code}/launch.
+    if (urlMatchesBase(req.url, gatewayApiBaseUrl)) {
+        return { scope: 'gateway', useGatewayBaseUrl: false };
+    }
+    // 4. Otherwise treat as app scope when a session exists.
+    const defaultCode = resolveApplicationCodeOption(options.applicationCode) ??
+        auth.activeApplicationCode();
     if (defaultCode) {
         const session = auth.getAppSession(defaultCode);
         if (session) {
@@ -1546,11 +1636,12 @@ const resolveRequestScope = (req, options, auth) => {
                 scope: 'application',
                 applicationCode: defaultCode,
                 session,
-                useGatewayBaseUrl,
+                useGatewayBaseUrl: false,
             };
         }
     }
-    return { scope: 'gateway', useGatewayBaseUrl };
+    // 5. No app session known yet — fall back to GatewaySession.
+    return { scope: 'gateway', useGatewayBaseUrl: false };
 };
 const gatewayAuthInterceptor = (req, next) => {
     if (isAssetRequest(req.url)) {
@@ -1565,7 +1656,7 @@ const gatewayAuthInterceptor = (req, next) => {
     const refreshSkewMs = resolveAccessTokenRefreshSkewMs(options.accessTokenRefreshSkewMs);
     const isAuthRequest = isGatewayAuthRequestUrl(req.url, gatewayApiBaseUrl);
     const alreadyRetried = req.context.get(GATEWAY_AUTH_RETRY_CONTEXT);
-    const resolved = resolveRequestScope(req, options, auth);
+    const resolved = resolveRequestScope(req, options, auth, gatewayApiBaseUrl);
     const baseUrl = resolved.useGatewayBaseUrl
         ? gatewayApiBaseUrl
         : appApiBaseUrl;
@@ -1607,7 +1698,7 @@ const gatewayAuthInterceptor = (req, next) => {
                 auth.logout();
             }
             return throwError(() => refreshError);
-        }), switchMap((tokens) => next(prepareRequest(req, tokens.accessToken, true, baseUrl))));
+        }), switchMap$1((tokens) => next(prepareRequest(req, tokens.accessToken, true, baseUrl))));
     }
     return next(prepareRequest(req, tokenToAttach, false, baseUrl)).pipe(catchError$1((error) => {
         if (error?.status !== 401 || isAuthRequest || alreadyRetried) {
@@ -1640,7 +1731,7 @@ const gatewayAuthInterceptor = (req, next) => {
                 auth.logout();
             }
             return throwError(() => refreshError);
-        }), switchMap((tokens) => next(prepareRequest(req, tokens.accessToken, true, baseUrl))));
+        }), switchMap$1((tokens) => next(prepareRequest(req, tokens.accessToken, true, baseUrl))));
     }));
 };
 
@@ -1989,5 +2080,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.8", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_STATE_DEFAULTS, ClearAllAppSessions, ClearAppSession, ClearError, ClearPendingMfa, ClearRateLimit, ExchangeSsoCode, GATEWAY_AUTH_ACCESS_TOKEN_REFRESH_SKEW_MS, GATEWAY_AUTH_DEVICE_TOKEN, GATEWAY_AUTH_DEVICE_TOKEN_STORAGE_KEY, GATEWAY_AUTH_ENDPOINTS, GATEWAY_AUTH_NGSW_BYPASS_PARAM, GATEWAY_AUTH_OPTIONS, GATEWAY_AUTH_RETRY_CONTEXT, GATEWAY_RATE_LIMIT_ERROR_CODE, GATEWAY_RATE_LIMIT_STATUS, GatewayAuthFacade, GatewayAuthState, GatewayLoginPage, GatewayMfa, GatewaySsoButtons, GatewaySsoCallback, GatewaySsoSession, LaunchApplication, LoadApplications, LoadSsoProviders, Login, LoginFailure, LoginSuccess, Logout, ResendMfa, SetAppSession, SetApplications, SetRateLimit, StartSso, UpdateAppTokens, UpdateTokens, UpdateUserData, VerifyMfa, buildGatewayUrl, buildSsoStartUrl, createSecureClientState, extractGatewayRateLimitInfo, gatewayAuthInterceptor, getGatewayErrorMessage, hasGatewayTokens, isExpired, isGatewayAuthRequestUrl, mapGatewayTokens, mapGatewayUser, normalizeGatewayBase, readPersistedGatewayAuthTokens, resolveAccessTokenRefreshSkewMs, resolveApiDateValue, resolveApplicationCodeOption, resolveGatewayAuthPath, resolveGatewayDeviceToken, sanitizePersistedAuthState, withGatewayAuthNgswBypass };
+export { AUTH_STATE_DEFAULTS, ClearAllAppSessions, ClearAppSession, ClearError, ClearPendingMfa, ClearRateLimit, ExchangeSsoCode, GATEWAY_AUTH_ACCESS_TOKEN_REFRESH_SKEW_MS, GATEWAY_AUTH_DEVICE_TOKEN, GATEWAY_AUTH_DEVICE_TOKEN_STORAGE_KEY, GATEWAY_AUTH_ENDPOINTS, GATEWAY_AUTH_NGSW_BYPASS_PARAM, GATEWAY_AUTH_OPTIONS, GATEWAY_AUTH_RETRY_CONTEXT, GATEWAY_RATE_LIMIT_ERROR_CODE, GATEWAY_RATE_LIMIT_STATUS, GatewayAuthFacade, GatewayAuthState, GatewayLoginPage, GatewayMfa, GatewaySsoButtons, GatewaySsoCallback, GatewaySsoSession, LaunchApplication, LoadApplications, LoadSsoProviders, Login, LoginFailure, LoginSuccess, Logout, ResendMfa, SetAppSession, SetApplications, SetRateLimit, StartSso, UpdateAppTokens, UpdateTokens, UpdateUserData, VerifyMfa, buildApplicationContextUrl, buildGatewayUrl, buildSsoStartUrl, clearApplicationContextCache, createSecureClientState, extractGatewayRateLimitInfo, fetchApplicationContextCode, gatewayAuthInterceptor, getGatewayErrorMessage, hasGatewayTokens, isExpired, isGatewayAuthRequestUrl, mapGatewayTokens, mapGatewayUser, normalizeGatewayBase, readPersistedGatewayAuthTokens, resolveAccessTokenRefreshSkewMs, resolveApiDateValue, resolveApplicationCodeOption, resolveGatewayAuthPath, resolveGatewayDeviceToken, sanitizePersistedAuthState, withGatewayAuthNgswBypass };
 //# sourceMappingURL=masterteam-gateway-auth.mjs.map