@mintplayer/ng-spark-auth 22.1.0 → 22.2.0

package/fesm2022/mintplayer-ng-spark-auth-auth-bar.mjs

@@ -1,7 +1,7 @@
 import * as i0 from '@angular/core';
 import { inject, ChangeDetectionStrategy, Component } from '@angular/core';
 import { Router, RouterLink } from '@angular/router';
-import { SPARK_AUTH_CONFIG } from '@mintplayer/ng-spark-auth/models';
+import { SPARK_AUTH_CONFIG, resolveSignInUrl } from '@mintplayer/ng-spark-auth/models';
 import { SparkAuthService } from '@mintplayer/ng-spark-auth/core';
 import { TranslateKeyPipe } from '@mintplayer/ng-spark-auth/pipes';
 
@@ -9,6 +9,8 @@ class SparkAuthBarComponent {
     authService = inject(SparkAuthService);
     config = inject(SPARK_AUTH_CONFIG);
     router = inject(Router);
+    /** Same target the guard and interceptor use, so the bar cannot link somewhere they would not send you. */
+    signInUrl = resolveSignInUrl(this.config, this.router);
     async onLogout() {
         try {
             await this.authService.logout();
@@ -21,11 +23,11 @@ class SparkAuthBarComponent {
         }
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.0", ngImport: i0, type: SparkAuthBarComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.0.0", type: SparkAuthBarComponent, isStandalone: true, selector: "spark-auth-bar", ngImport: i0, template: "@if (authService.isAuthenticated()) {\n  <span class=\"me-2\">{{ authService.user()?.userName }}</span>\n  <button class=\"btn btn-outline-light btn-sm\" (click)=\"onLogout()\">{{ 'auth.logout' | t }}</button>\n} @else {\n  <a class=\"btn btn-outline-light btn-sm\" [routerLink]=\"config.loginUrl\">{{ 'auth.login' | t }}</a>\n}\n", dependencies: [{ kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "browserUrl", "routerLink"] }, { kind: "pipe", type: TranslateKeyPipe, name: "t" }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.0.0", type: SparkAuthBarComponent, isStandalone: true, selector: "spark-auth-bar", ngImport: i0, template: "@if (authService.isAuthenticated()) {\n  <span class=\"me-2\">{{ authService.user()?.userName }}</span>\n  <button class=\"btn btn-outline-light btn-sm\" (click)=\"onLogout()\">{{ 'auth.logout' | t }}</button>\n} @else {\n  <a class=\"btn btn-outline-light btn-sm\" [routerLink]=\"signInUrl\">{{ 'auth.login' | t }}</a>\n}\n", dependencies: [{ kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "browserUrl", "routerLink"] }, { kind: "pipe", type: TranslateKeyPipe, name: "t" }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.0", ngImport: i0, type: SparkAuthBarComponent, decorators: [{
             type: Component,
-            args: [{ selector: 'spark-auth-bar', standalone: true, changeDetection: ChangeDetectionStrategy.OnPush, imports: [RouterLink, TranslateKeyPipe], template: "@if (authService.isAuthenticated()) {\n  <span class=\"me-2\">{{ authService.user()?.userName }}</span>\n  <button class=\"btn btn-outline-light btn-sm\" (click)=\"onLogout()\">{{ 'auth.logout' | t }}</button>\n} @else {\n  <a class=\"btn btn-outline-light btn-sm\" [routerLink]=\"config.loginUrl\">{{ 'auth.login' | t }}</a>\n}\n" }]
+            args: [{ selector: 'spark-auth-bar', standalone: true, changeDetection: ChangeDetectionStrategy.OnPush, imports: [RouterLink, TranslateKeyPipe], template: "@if (authService.isAuthenticated()) {\n  <span class=\"me-2\">{{ authService.user()?.userName }}</span>\n  <button class=\"btn btn-outline-light btn-sm\" (click)=\"onLogout()\">{{ 'auth.logout' | t }}</button>\n} @else {\n  <a class=\"btn btn-outline-light btn-sm\" [routerLink]=\"signInUrl\">{{ 'auth.login' | t }}</a>\n}\n" }]
         }] });
 
 /**

package/fesm2022/mintplayer-ng-spark-auth-auth-bar.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mintplayer-ng-spark-auth-auth-bar.mjs","sources":["../../auth-bar/src/spark-auth-bar.component.ts","../../auth-bar/src/spark-auth-bar.component.html","../../auth-bar/mintplayer-ng-spark-auth-auth-bar.ts"],"sourcesContent":["import { ChangeDetectionStrategy, Component, inject } from '@angular/core';\nimport { RouterLink, Router } from '@angular/router';\nimport { SPARK_AUTH_CONFIG } from '@mintplayer/ng-spark-auth/models';\nimport { SparkAuthService } from '@mintplayer/ng-spark-auth/core';\nimport { TranslateKeyPipe } from '@mintplayer/ng-spark-auth/pipes';\n\n@Component({\n  selector: 'spark-auth-bar',\n  standalone: true,\n  changeDetection: ChangeDetectionStrategy.OnPush,\n  imports: [RouterLink, TranslateKeyPipe],\n  templateUrl: './spark-auth-bar.component.html',\n})\nexport class SparkAuthBarComponent {\n  readonly authService = inject(SparkAuthService);\n  readonly config = inject(SPARK_AUTH_CONFIG);\n  private readonly router = inject(Router);\n\n  async onLogout(): Promise<void> {\n    try {\n      await this.authService.logout();\n    } finally {\n      // Always navigate away from the authenticated area, even if the server-side\n      // logout call fails (network error, session already expired, etc.). The local\n      // session state has been cleared by SparkAuthService regardless.\n      this.router.navigateByUrl('/');\n    }\n  }\n}\n\nexport default SparkAuthBarComponent;\n","@if (authService.isAuthenticated()) {\n  <span class=\"me-2\">{{ authService.user()?.userName }}</span>\n  <button class=\"btn btn-outline-light btn-sm\" (click)=\"onLogout()\">{{ 'auth.logout' | t }}</button>\n} @else {\n  <a class=\"btn btn-outline-light btn-sm\" [routerLink]=\"config.loginUrl\">{{ 'auth.login' | t }}</a>\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;;;MAaa,qBAAqB,CAAA;AACvB,IAAA,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;AACtC,IAAA,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1B,IAAA,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAExC,IAAA,MAAM,QAAQ,GAAA;AACZ,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;QACjC;gBAAU;;;;AAIR,YAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;QAChC;IACF;uGAdW,qBAAqB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA;AAArB,IAAA,OAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,qBAAqB,EAAA,YAAA,EAAA,IAAA,EAAA,QAAA,EAAA,gBAAA,EAAA,QAAA,EAAA,EAAA,EAAA,QAAA,ECblC,4UAMA,EAAA,YAAA,EAAA,CAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EDIY,UAAU,6OAAE,gBAAgB,EAAA,IAAA,EAAA,GAAA,EAAA,CAAA,EAAA,eAAA,EAAA,EAAA,CAAA,uBAAA,CAAA,MAAA,EAAA,CAAA;;2FAG3B,qBAAqB,EAAA,UAAA,EAAA,CAAA;kBAPjC,SAAS;+BACE,gBAAgB,EAAA,UAAA,EACd,IAAI,EAAA,eAAA,EACC,uBAAuB,CAAC,MAAM,EAAA,OAAA,EACtC,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAA,QAAA,EAAA,4UAAA,EAAA;;;AEVzC;;AAEG;;;;"}
+{"version":3,"file":"mintplayer-ng-spark-auth-auth-bar.mjs","sources":["../../auth-bar/src/spark-auth-bar.component.ts","../../auth-bar/src/spark-auth-bar.component.html","../../auth-bar/mintplayer-ng-spark-auth-auth-bar.ts"],"sourcesContent":["import { ChangeDetectionStrategy, Component, inject } from '@angular/core';\nimport { RouterLink, Router } from '@angular/router';\nimport { SPARK_AUTH_CONFIG, resolveSignInUrl } from '@mintplayer/ng-spark-auth/models';\nimport { SparkAuthService } from '@mintplayer/ng-spark-auth/core';\nimport { TranslateKeyPipe } from '@mintplayer/ng-spark-auth/pipes';\n\n@Component({\n  selector: 'spark-auth-bar',\n  standalone: true,\n  changeDetection: ChangeDetectionStrategy.OnPush,\n  imports: [RouterLink, TranslateKeyPipe],\n  templateUrl: './spark-auth-bar.component.html',\n})\nexport class SparkAuthBarComponent {\n  readonly authService = inject(SparkAuthService);\n  readonly config = inject(SPARK_AUTH_CONFIG);\n  private readonly router = inject(Router);\n\n  /** Same target the guard and interceptor use, so the bar cannot link somewhere they would not send you. */\n  readonly signInUrl = resolveSignInUrl(this.config, this.router);\n\n  async onLogout(): Promise<void> {\n    try {\n      await this.authService.logout();\n    } finally {\n      // Always navigate away from the authenticated area, even if the server-side\n      // logout call fails (network error, session already expired, etc.). The local\n      // session state has been cleared by SparkAuthService regardless.\n      this.router.navigateByUrl('/');\n    }\n  }\n}\n\nexport default SparkAuthBarComponent;\n","@if (authService.isAuthenticated()) {\n  <span class=\"me-2\">{{ authService.user()?.userName }}</span>\n  <button class=\"btn btn-outline-light btn-sm\" (click)=\"onLogout()\">{{ 'auth.logout' | t }}</button>\n} @else {\n  <a class=\"btn btn-outline-light btn-sm\" [routerLink]=\"signInUrl\">{{ 'auth.login' | t }}</a>\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;;;MAaa,qBAAqB,CAAA;AACvB,IAAA,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;AACtC,IAAA,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1B,IAAA,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;;IAG/B,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;AAE/D,IAAA,MAAM,QAAQ,GAAA;AACZ,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;QACjC;gBAAU;;;;AAIR,YAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;QAChC;IACF;uGAjBW,qBAAqB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA;AAArB,IAAA,OAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,qBAAqB,EAAA,YAAA,EAAA,IAAA,EAAA,QAAA,EAAA,gBAAA,EAAA,QAAA,EAAA,EAAA,EAAA,QAAA,ECblC,sUAMA,EAAA,YAAA,EAAA,CAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EDIY,UAAU,6OAAE,gBAAgB,EAAA,IAAA,EAAA,GAAA,EAAA,CAAA,EAAA,eAAA,EAAA,EAAA,CAAA,uBAAA,CAAA,MAAA,EAAA,CAAA;;2FAG3B,qBAAqB,EAAA,UAAA,EAAA,CAAA;kBAPjC,SAAS;+BACE,gBAAgB,EAAA,UAAA,EACd,IAAI,EAAA,eAAA,EACC,uBAAuB,CAAC,MAAM,EAAA,OAAA,EACtC,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAA,QAAA,EAAA,sUAAA,EAAA;;;AEVzC;;AAEG;;;;"}

package/fesm2022/mintplayer-ng-spark-auth-core.mjs

@@ -39,6 +39,15 @@ class SparkAuthService {
         await this.csrfRefresh();
         this.currentUser.set(null);
     }
+    /**
+     * What sign-in methods this deployment actually offers.
+     *
+     * Read from the server rather than assumed from the client's own route configuration: the two are
+     * configured independently, and a mismatch is otherwise invisible until a user hits it.
+     */
+    async capabilities() {
+        return await firstValueFrom(this.http.get(`${this.config.apiBasePath}/capabilities`));
+    }
     async csrfRefresh() {
         await firstValueFrom(this.http.post(`${this.config.apiBasePath}/csrf-refresh`, {}));
     }

package/fesm2022/mintplayer-ng-spark-auth-core.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mintplayer-ng-spark-auth-core.mjs","sources":["../../core/src/spark-auth.service.ts","../../core/src/spark-auth-translation.service.ts","../../core/mintplayer-ng-spark-auth-core.ts"],"sourcesContent":["import { computed, inject, Injectable, NgZone, signal } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { firstValueFrom } from 'rxjs';\nimport {\n  AuthUser,\n  SPARK_AUTH_CONFIG,\n  SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE,\n  SparkExternalLoginError,\n  SparkExternalLoginOptions,\n  SparkExternalLoginResult,\n} from '@mintplayer/ng-spark-auth/models';\n\n/** How often the popup is checked for a manual close. */\nconst POPUP_CLOSE_POLL_MS = 400;\n\n@Injectable({ providedIn: 'root' })\nexport class SparkAuthService {\n  private readonly http = inject(HttpClient);\n  private readonly config = inject(SPARK_AUTH_CONFIG);\n  private readonly zone = inject(NgZone);\n\n  private readonly currentUser = signal<AuthUser | null>(null);\n\n  readonly user = this.currentUser.asReadonly();\n  readonly isAuthenticated = computed(() => this.currentUser()?.isAuthenticated === true);\n\n  constructor() {\n    this.checkAuth();\n  }\n\n  async login(email: string, password: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/login?useCookies=true`, { email, password }));\n    await this.csrfRefresh();\n    await this.checkAuth();\n  }\n\n  async loginTwoFactor(twoFactorCode: string, twoFactorRecoveryCode?: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/login?useCookies=true`, {\n      twoFactorCode,\n      twoFactorRecoveryCode,\n    }));\n    await this.csrfRefresh();\n    await this.checkAuth();\n  }\n\n  async register(email: string, password: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/register`, { email, password }));\n  }\n\n  async logout(): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/logout`, {}));\n    await this.csrfRefresh();\n    this.currentUser.set(null);\n  }\n\n  async csrfRefresh(): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/csrf-refresh`, {}));\n  }\n\n  async checkAuth(): Promise<AuthUser | null> {\n    try {\n      const user = await firstValueFrom(this.http.get<AuthUser>(`${this.config.apiBasePath}/me`));\n      this.currentUser.set(user);\n      return user;\n    } catch {\n      this.currentUser.set(null);\n      return null;\n    }\n  }\n\n  /**\n   * Signs in through an external provider (GitHub, Google, …) and leaves this service's\n   * `user()` signal up to date, exactly as `login()` does.\n   *\n   * The whole handshake lives here: opening the window, listening for the callback's\n   * message, checking its origin, detecting a popup the user closed by hand, tearing the\n   * listener and poll down on every exit path, and re-reading the session afterwards.\n   * Callers get an outcome, not a protocol — which is the point, because the previous\n   * hand-rolled version leaked its listener whenever the user simply closed the window.\n   *\n   * In `'redirect'` mode the returned promise never settles: this document is being\n   * replaced, and the outcome arrives as the next page load rather than as a value.\n   */\n  loginWithProvider(provider: string, options: SparkExternalLoginOptions = {}): Promise<SparkExternalLoginResult> {\n    const { returnUrl = this.config.defaultRedirectUrl, mode = 'popup' } = options;\n    const url = `${this.config.apiBasePath}/external-login?provider=${encodeURIComponent(provider)}`\n      + `&returnUrl=${encodeURIComponent(returnUrl)}`;\n\n    if (mode === 'redirect') {\n      window.location.assign(url);\n      return new Promise<SparkExternalLoginResult>(() => { /* the page is going away */ });\n    }\n\n    return new Promise<SparkExternalLoginResult>((resolve) => {\n      const popup = window.open(`${url}&popup=1`, 'spark-external-login', 'width=600,height=700');\n      if (!popup) {\n        resolve({ success: false, error: 'popup_blocked' });\n        return;\n      }\n\n      // One settle path, so the listener and the poll cannot outlive the flow no matter\n      // which of the four ways it ends.\n      let settled = false;\n      const settle = (error?: SparkExternalLoginError) => {\n        if (settled) return;\n        settled = true;\n        window.removeEventListener('message', onMessage);\n        clearInterval(poll);\n        popup.close();\n\n        this.zone.run(async () => {\n          if (!error) await this.checkAuth();\n          resolve(error ? { success: false, error } : { success: true });\n        });\n      };\n\n      const onMessage = (event: MessageEvent) => {\n        if (event.origin !== window.location.origin) return;\n        if (event.data?.type !== SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE) return;\n        settle(event.data.success ? undefined : (event.data.error ?? 'no_login_info'));\n      };\n\n      // A user who closes the window never posts anything, so without this the promise\n      // and its listener would both live forever.\n      const poll = setInterval(() => {\n        if (popup.closed) settle('popup_closed');\n      }, POPUP_CLOSE_POLL_MS);\n\n      window.addEventListener('message', onMessage);\n    });\n  }\n\n  async forgotPassword(email: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/forgotPassword`, { email }));\n  }\n\n  async resetPassword(email: string, resetCode: string, newPassword: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/resetPassword`, {\n      email,\n      resetCode,\n      newPassword,\n    }));\n  }\n}\n","import { Injectable, inject, signal, type Signal } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { firstValueFrom } from 'rxjs';\n\ntype TranslatedString = Record<string, string>;\n\n/** Read the global language signal set by @mintplayer/ng-spark */\nconst currentLanguage: Signal<string> =\n  (globalThis as any).__sparkCurrentLanguage ?? signal('en');\n\n@Injectable({ providedIn: 'root' })\nexport class SparkAuthTranslationService {\n  private readonly http = inject(HttpClient);\n  private readonly translationsMap = signal<Record<string, TranslatedString>>({});\n\n  constructor() {\n    this.loadTranslations();\n  }\n\n  private async loadTranslations(): Promise<void> {\n    try {\n      const t = await firstValueFrom(this.http.get<Record<string, TranslatedString>>('/spark/translations'));\n      this.translationsMap.set(t);\n    } catch {\n      // Translations failed to load; keys will be shown as-is\n    }\n  }\n\n  t(key: string): string {\n    const ts = this.translationsMap()[key];\n    if (!ts) return key;\n    const lang = currentLanguage();\n    return ts[lang] ?? ts['en'] ?? Object.values(ts)[0] ?? key;\n  }\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;;AAYA;AACA,MAAM,mBAAmB,GAAG,GAAG;MAGlB,gBAAgB,CAAA;AACV,IAAA,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;AACzB,IAAA,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAClC,IAAA,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IAErB,WAAW,GAAG,MAAM,CAAkB,IAAI;oFAAC;AAEnD,IAAA,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE;AACpC,IAAA,eAAe,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,KAAK,IAAI;wFAAC;AAEvF,IAAA,WAAA,GAAA;QACE,IAAI,CAAC,SAAS,EAAE;IAClB;AAEA,IAAA,MAAM,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAA;QACzC,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,sBAAA,CAAwB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnH,QAAA,MAAM,IAAI,CAAC,WAAW,EAAE;AACxB,QAAA,MAAM,IAAI,CAAC,SAAS,EAAE;IACxB;AAEA,IAAA,MAAM,cAAc,CAAC,aAAqB,EAAE,qBAA8B,EAAA;AACxE,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,wBAAwB,EAAE;YAC5F,aAAa;YACb,qBAAqB;AACtB,SAAA,CAAC,CAAC;AACH,QAAA,MAAM,IAAI,CAAC,WAAW,EAAE;AACxB,QAAA,MAAM,IAAI,CAAC,SAAS,EAAE;IACxB;AAEA,IAAA,MAAM,QAAQ,CAAC,KAAa,EAAE,QAAgB,EAAA;QAC5C,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,SAAA,CAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxG;AAEA,IAAA,MAAM,MAAM,GAAA;AACV,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,OAAA,CAAS,EAAE,EAAE,CAAC,CAAC;AACnF,QAAA,MAAM,IAAI,CAAC,WAAW,EAAE;AACxB,QAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;IAC5B;AAEA,IAAA,MAAM,WAAW,GAAA;AACf,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,aAAA,CAAe,EAAE,EAAE,CAAC,CAAC;IAC3F;AAEA,IAAA,MAAM,SAAS,GAAA;AACb,QAAA,IAAI;YACF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAW,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,GAAA,CAAK,CAAC,CAAC;AAC3F,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;AAC1B,YAAA,OAAO,IAAI;QACb;AAAE,QAAA,MAAM;AACN,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;AAC1B,YAAA,OAAO,IAAI;QACb;IACF;AAEA;;;;;;;;;;;;AAYG;AACH,IAAA,iBAAiB,CAAC,QAAgB,EAAE,OAAA,GAAqC,EAAE,EAAA;AACzE,QAAA,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,GAAG,OAAO,EAAE,GAAG,OAAO;AAC9E,QAAA,MAAM,GAAG,GAAG,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,yBAAA,EAA4B,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC1F,cAAA,CAAA,WAAA,EAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;AAEjD,QAAA,IAAI,IAAI,KAAK,UAAU,EAAE;AACvB,YAAA,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3B,OAAO,IAAI,OAAO,CAA2B,MAAK,EAAgC,CAAC,CAAC;QACtF;AAEA,QAAA,OAAO,IAAI,OAAO,CAA2B,CAAC,OAAO,KAAI;AACvD,YAAA,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA,EAAG,GAAG,CAAA,QAAA,CAAU,EAAE,sBAAsB,EAAE,sBAAsB,CAAC;YAC3F,IAAI,CAAC,KAAK,EAAE;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;gBACnD;YACF;;;YAIA,IAAI,OAAO,GAAG,KAAK;AACnB,YAAA,MAAM,MAAM,GAAG,CAAC,KAA+B,KAAI;AACjD,gBAAA,IAAI,OAAO;oBAAE;gBACb,OAAO,GAAG,IAAI;AACd,gBAAA,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChD,aAAa,CAAC,IAAI,CAAC;gBACnB,KAAK,CAAC,KAAK,EAAE;AAEb,gBAAA,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAW;AACvB,oBAAA,IAAI,CAAC,KAAK;AAAE,wBAAA,MAAM,IAAI,CAAC,SAAS,EAAE;oBAClC,OAAO,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChE,gBAAA,CAAC,CAAC;AACJ,YAAA,CAAC;AAED,YAAA,MAAM,SAAS,GAAG,CAAC,KAAmB,KAAI;gBACxC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;oBAAE;AAC7C,gBAAA,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,iCAAiC;oBAAE;gBAC5D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;AAChF,YAAA,CAAC;;;AAID,YAAA,MAAM,IAAI,GAAG,WAAW,CAAC,MAAK;gBAC5B,IAAI,KAAK,CAAC,MAAM;oBAAE,MAAM,CAAC,cAAc,CAAC;YAC1C,CAAC,EAAE,mBAAmB,CAAC;AAEvB,YAAA,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC;AAC/C,QAAA,CAAC,CAAC;IACJ;IAEA,MAAM,cAAc,CAAC,KAAa,EAAA;QAChC,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,eAAA,CAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG;AAEA,IAAA,MAAM,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,WAAmB,EAAA;AACvE,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,gBAAgB,EAAE;YACpF,KAAK;YACL,SAAS;YACT,WAAW;AACZ,SAAA,CAAC,CAAC;IACL;uGA9HW,gBAAgB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAhB,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,gBAAgB,cADH,MAAM,EAAA,CAAA;;2FACnB,gBAAgB,EAAA,UAAA,EAAA,CAAA;kBAD5B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACTlC;AACA,MAAM,eAAe,GAClB,UAAkB,CAAC,sBAAsB,IAAI,MAAM,CAAC,IAAI,CAAC;MAG/C,2BAA2B,CAAA;AACrB,IAAA,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IACzB,eAAe,GAAG,MAAM,CAAmC,EAAE;wFAAC;AAE/E,IAAA,WAAA,GAAA;QACE,IAAI,CAAC,gBAAgB,EAAE;IACzB;AAEQ,IAAA,MAAM,gBAAgB,GAAA;AAC5B,QAAA,IAAI;AACF,YAAA,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmC,qBAAqB,CAAC,CAAC;AACtG,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B;AAAE,QAAA,MAAM;;QAER;IACF;AAEA,IAAA,CAAC,CAAC,GAAW,EAAA;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC;AACtC,QAAA,IAAI,CAAC,EAAE;AAAE,YAAA,OAAO,GAAG;AACnB,QAAA,MAAM,IAAI,GAAG,eAAe,EAAE;QAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;IAC5D;uGAtBW,2BAA2B,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAA3B,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,2BAA2B,cADd,MAAM,EAAA,CAAA;;2FACnB,2BAA2B,EAAA,UAAA,EAAA,CAAA;kBADvC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACVlC;;AAEG;;;;"}
+{"version":3,"file":"mintplayer-ng-spark-auth-core.mjs","sources":["../../core/src/spark-auth.service.ts","../../core/src/spark-auth-translation.service.ts","../../core/mintplayer-ng-spark-auth-core.ts"],"sourcesContent":["import { computed, inject, Injectable, NgZone, signal } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { firstValueFrom } from 'rxjs';\nimport {\n  AuthUser,\n  SPARK_AUTH_CONFIG,\n  SparkAuthCapabilities,\n  SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE,\n  SparkExternalLoginError,\n  SparkExternalLoginOptions,\n  SparkExternalLoginResult,\n} from '@mintplayer/ng-spark-auth/models';\n\n/** How often the popup is checked for a manual close. */\nconst POPUP_CLOSE_POLL_MS = 400;\n\n@Injectable({ providedIn: 'root' })\nexport class SparkAuthService {\n  private readonly http = inject(HttpClient);\n  private readonly config = inject(SPARK_AUTH_CONFIG);\n  private readonly zone = inject(NgZone);\n\n  private readonly currentUser = signal<AuthUser | null>(null);\n\n  readonly user = this.currentUser.asReadonly();\n  readonly isAuthenticated = computed(() => this.currentUser()?.isAuthenticated === true);\n\n  constructor() {\n    this.checkAuth();\n  }\n\n  async login(email: string, password: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/login?useCookies=true`, { email, password }));\n    await this.csrfRefresh();\n    await this.checkAuth();\n  }\n\n  async loginTwoFactor(twoFactorCode: string, twoFactorRecoveryCode?: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/login?useCookies=true`, {\n      twoFactorCode,\n      twoFactorRecoveryCode,\n    }));\n    await this.csrfRefresh();\n    await this.checkAuth();\n  }\n\n  async register(email: string, password: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/register`, { email, password }));\n  }\n\n  async logout(): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/logout`, {}));\n    await this.csrfRefresh();\n    this.currentUser.set(null);\n  }\n\n  /**\n   * What sign-in methods this deployment actually offers.\n   *\n   * Read from the server rather than assumed from the client's own route configuration: the two are\n   * configured independently, and a mismatch is otherwise invisible until a user hits it.\n   */\n  async capabilities(): Promise<SparkAuthCapabilities> {\n    return await firstValueFrom(\n      this.http.get<SparkAuthCapabilities>(`${this.config.apiBasePath}/capabilities`));\n  }\n\n  async csrfRefresh(): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/csrf-refresh`, {}));\n  }\n\n  async checkAuth(): Promise<AuthUser | null> {\n    try {\n      const user = await firstValueFrom(this.http.get<AuthUser>(`${this.config.apiBasePath}/me`));\n      this.currentUser.set(user);\n      return user;\n    } catch {\n      this.currentUser.set(null);\n      return null;\n    }\n  }\n\n  /**\n   * Signs in through an external provider (GitHub, Google, …) and leaves this service's\n   * `user()` signal up to date, exactly as `login()` does.\n   *\n   * The whole handshake lives here: opening the window, listening for the callback's\n   * message, checking its origin, detecting a popup the user closed by hand, tearing the\n   * listener and poll down on every exit path, and re-reading the session afterwards.\n   * Callers get an outcome, not a protocol — which is the point, because the previous\n   * hand-rolled version leaked its listener whenever the user simply closed the window.\n   *\n   * In `'redirect'` mode the returned promise never settles: this document is being\n   * replaced, and the outcome arrives as the next page load rather than as a value.\n   */\n  loginWithProvider(provider: string, options: SparkExternalLoginOptions = {}): Promise<SparkExternalLoginResult> {\n    const { returnUrl = this.config.defaultRedirectUrl, mode = 'popup' } = options;\n    const url = `${this.config.apiBasePath}/external-login?provider=${encodeURIComponent(provider)}`\n      + `&returnUrl=${encodeURIComponent(returnUrl)}`;\n\n    if (mode === 'redirect') {\n      window.location.assign(url);\n      return new Promise<SparkExternalLoginResult>(() => { /* the page is going away */ });\n    }\n\n    return new Promise<SparkExternalLoginResult>((resolve) => {\n      const popup = window.open(`${url}&popup=1`, 'spark-external-login', 'width=600,height=700');\n      if (!popup) {\n        resolve({ success: false, error: 'popup_blocked' });\n        return;\n      }\n\n      // One settle path, so the listener and the poll cannot outlive the flow no matter\n      // which of the four ways it ends.\n      let settled = false;\n      const settle = (error?: SparkExternalLoginError) => {\n        if (settled) return;\n        settled = true;\n        window.removeEventListener('message', onMessage);\n        clearInterval(poll);\n        popup.close();\n\n        this.zone.run(async () => {\n          if (!error) await this.checkAuth();\n          resolve(error ? { success: false, error } : { success: true });\n        });\n      };\n\n      const onMessage = (event: MessageEvent) => {\n        if (event.origin !== window.location.origin) return;\n        if (event.data?.type !== SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE) return;\n        settle(event.data.success ? undefined : (event.data.error ?? 'no_login_info'));\n      };\n\n      // A user who closes the window never posts anything, so without this the promise\n      // and its listener would both live forever.\n      const poll = setInterval(() => {\n        if (popup.closed) settle('popup_closed');\n      }, POPUP_CLOSE_POLL_MS);\n\n      window.addEventListener('message', onMessage);\n    });\n  }\n\n  async forgotPassword(email: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/forgotPassword`, { email }));\n  }\n\n  async resetPassword(email: string, resetCode: string, newPassword: string): Promise<void> {\n    await firstValueFrom(this.http.post<void>(`${this.config.apiBasePath}/resetPassword`, {\n      email,\n      resetCode,\n      newPassword,\n    }));\n  }\n}\n","import { Injectable, inject, signal, type Signal } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { firstValueFrom } from 'rxjs';\n\ntype TranslatedString = Record<string, string>;\n\n/** Read the global language signal set by @mintplayer/ng-spark */\nconst currentLanguage: Signal<string> =\n  (globalThis as any).__sparkCurrentLanguage ?? signal('en');\n\n@Injectable({ providedIn: 'root' })\nexport class SparkAuthTranslationService {\n  private readonly http = inject(HttpClient);\n  private readonly translationsMap = signal<Record<string, TranslatedString>>({});\n\n  constructor() {\n    this.loadTranslations();\n  }\n\n  private async loadTranslations(): Promise<void> {\n    try {\n      const t = await firstValueFrom(this.http.get<Record<string, TranslatedString>>('/spark/translations'));\n      this.translationsMap.set(t);\n    } catch {\n      // Translations failed to load; keys will be shown as-is\n    }\n  }\n\n  t(key: string): string {\n    const ts = this.translationsMap()[key];\n    if (!ts) return key;\n    const lang = currentLanguage();\n    return ts[lang] ?? ts['en'] ?? Object.values(ts)[0] ?? key;\n  }\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;;AAaA;AACA,MAAM,mBAAmB,GAAG,GAAG;MAGlB,gBAAgB,CAAA;AACV,IAAA,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;AACzB,IAAA,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAClC,IAAA,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IAErB,WAAW,GAAG,MAAM,CAAkB,IAAI;oFAAC;AAEnD,IAAA,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE;AACpC,IAAA,eAAe,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,KAAK,IAAI;wFAAC;AAEvF,IAAA,WAAA,GAAA;QACE,IAAI,CAAC,SAAS,EAAE;IAClB;AAEA,IAAA,MAAM,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAA;QACzC,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,sBAAA,CAAwB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnH,QAAA,MAAM,IAAI,CAAC,WAAW,EAAE;AACxB,QAAA,MAAM,IAAI,CAAC,SAAS,EAAE;IACxB;AAEA,IAAA,MAAM,cAAc,CAAC,aAAqB,EAAE,qBAA8B,EAAA;AACxE,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,wBAAwB,EAAE;YAC5F,aAAa;YACb,qBAAqB;AACtB,SAAA,CAAC,CAAC;AACH,QAAA,MAAM,IAAI,CAAC,WAAW,EAAE;AACxB,QAAA,MAAM,IAAI,CAAC,SAAS,EAAE;IACxB;AAEA,IAAA,MAAM,QAAQ,CAAC,KAAa,EAAE,QAAgB,EAAA;QAC5C,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,SAAA,CAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxG;AAEA,IAAA,MAAM,MAAM,GAAA;AACV,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,OAAA,CAAS,EAAE,EAAE,CAAC,CAAC;AACnF,QAAA,MAAM,IAAI,CAAC,WAAW,EAAE;AACxB,QAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;IAC5B;AAEA;;;;;AAKG;AACH,IAAA,MAAM,YAAY,GAAA;AAChB,QAAA,OAAO,MAAM,cAAc,CACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAwB,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,aAAA,CAAe,CAAC,CAAC;IACpF;AAEA,IAAA,MAAM,WAAW,GAAA;AACf,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,aAAA,CAAe,EAAE,EAAE,CAAC,CAAC;IAC3F;AAEA,IAAA,MAAM,SAAS,GAAA;AACb,QAAA,IAAI;YACF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAW,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,GAAA,CAAK,CAAC,CAAC;AAC3F,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;AAC1B,YAAA,OAAO,IAAI;QACb;AAAE,QAAA,MAAM;AACN,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;AAC1B,YAAA,OAAO,IAAI;QACb;IACF;AAEA;;;;;;;;;;;;AAYG;AACH,IAAA,iBAAiB,CAAC,QAAgB,EAAE,OAAA,GAAqC,EAAE,EAAA;AACzE,QAAA,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,GAAG,OAAO,EAAE,GAAG,OAAO;AAC9E,QAAA,MAAM,GAAG,GAAG,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,yBAAA,EAA4B,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC1F,cAAA,CAAA,WAAA,EAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;AAEjD,QAAA,IAAI,IAAI,KAAK,UAAU,EAAE;AACvB,YAAA,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3B,OAAO,IAAI,OAAO,CAA2B,MAAK,EAAgC,CAAC,CAAC;QACtF;AAEA,QAAA,OAAO,IAAI,OAAO,CAA2B,CAAC,OAAO,KAAI;AACvD,YAAA,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA,EAAG,GAAG,CAAA,QAAA,CAAU,EAAE,sBAAsB,EAAE,sBAAsB,CAAC;YAC3F,IAAI,CAAC,KAAK,EAAE;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;gBACnD;YACF;;;YAIA,IAAI,OAAO,GAAG,KAAK;AACnB,YAAA,MAAM,MAAM,GAAG,CAAC,KAA+B,KAAI;AACjD,gBAAA,IAAI,OAAO;oBAAE;gBACb,OAAO,GAAG,IAAI;AACd,gBAAA,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChD,aAAa,CAAC,IAAI,CAAC;gBACnB,KAAK,CAAC,KAAK,EAAE;AAEb,gBAAA,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAW;AACvB,oBAAA,IAAI,CAAC,KAAK;AAAE,wBAAA,MAAM,IAAI,CAAC,SAAS,EAAE;oBAClC,OAAO,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChE,gBAAA,CAAC,CAAC;AACJ,YAAA,CAAC;AAED,YAAA,MAAM,SAAS,GAAG,CAAC,KAAmB,KAAI;gBACxC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;oBAAE;AAC7C,gBAAA,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,iCAAiC;oBAAE;gBAC5D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;AAChF,YAAA,CAAC;;;AAID,YAAA,MAAM,IAAI,GAAG,WAAW,CAAC,MAAK;gBAC5B,IAAI,KAAK,CAAC,MAAM;oBAAE,MAAM,CAAC,cAAc,CAAC;YAC1C,CAAC,EAAE,mBAAmB,CAAC;AAEvB,YAAA,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC;AAC/C,QAAA,CAAC,CAAC;IACJ;IAEA,MAAM,cAAc,CAAC,KAAa,EAAA;QAChC,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA,eAAA,CAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG;AAEA,IAAA,MAAM,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,WAAmB,EAAA;AACvE,QAAA,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,WAAW,gBAAgB,EAAE;YACpF,KAAK;YACL,SAAS;YACT,WAAW;AACZ,SAAA,CAAC,CAAC;IACL;uGAzIW,gBAAgB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAhB,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,gBAAgB,cADH,MAAM,EAAA,CAAA;;2FACnB,gBAAgB,EAAA,UAAA,EAAA,CAAA;kBAD5B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACVlC;AACA,MAAM,eAAe,GAClB,UAAkB,CAAC,sBAAsB,IAAI,MAAM,CAAC,IAAI,CAAC;MAG/C,2BAA2B,CAAA;AACrB,IAAA,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IACzB,eAAe,GAAG,MAAM,CAAmC,EAAE;wFAAC;AAE/E,IAAA,WAAA,GAAA;QACE,IAAI,CAAC,gBAAgB,EAAE;IACzB;AAEQ,IAAA,MAAM,gBAAgB,GAAA;AAC5B,QAAA,IAAI;AACF,YAAA,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmC,qBAAqB,CAAC,CAAC;AACtG,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B;AAAE,QAAA,MAAM;;QAER;IACF;AAEA,IAAA,CAAC,CAAC,GAAW,EAAA;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC;AACtC,QAAA,IAAI,CAAC,EAAE;AAAE,YAAA,OAAO,GAAG;AACnB,QAAA,MAAM,IAAI,GAAG,eAAe,EAAE;QAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;IAC5D;uGAtBW,2BAA2B,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAA3B,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,2BAA2B,cADd,MAAM,EAAA,CAAA;;2FACnB,2BAA2B,EAAA,UAAA,EAAA,CAAA;kBADvC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACVlC;;AAEG;;;;"}

package/fesm2022/mintplayer-ng-spark-auth-guards.mjs

@@ -1,6 +1,6 @@
 import { inject } from '@angular/core';
 import { Router } from '@angular/router';
-import { SPARK_AUTH_CONFIG } from '@mintplayer/ng-spark-auth/models';
+import { SPARK_AUTH_CONFIG, resolveSignInUrl } from '@mintplayer/ng-spark-auth/models';
 import { SparkAuthService } from '@mintplayer/ng-spark-auth/core';
 
 const sparkAuthGuard = (route, state) => {
@@ -10,7 +10,7 @@ const sparkAuthGuard = (route, state) => {
     if (authService.isAuthenticated()) {
         return true;
     }
-    return router.createUrlTree([config.loginUrl], {
+    return router.createUrlTree([resolveSignInUrl(config, router)], {
         queryParams: { returnUrl: state.url },
     });
 };

package/fesm2022/mintplayer-ng-spark-auth-guards.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mintplayer-ng-spark-auth-guards.mjs","sources":["../../guards/src/spark-auth.guard.ts","../../guards/mintplayer-ng-spark-auth-guards.ts"],"sourcesContent":["import { inject } from '@angular/core';\nimport { CanActivateFn, Router } from '@angular/router';\nimport { SPARK_AUTH_CONFIG } from '@mintplayer/ng-spark-auth/models';\nimport { SparkAuthService } from '@mintplayer/ng-spark-auth/core';\n\nexport const sparkAuthGuard: CanActivateFn = (route, state) => {\n  const authService = inject(SparkAuthService);\n  const router = inject(Router);\n  const config = inject(SPARK_AUTH_CONFIG);\n\n  if (authService.isAuthenticated()) {\n    return true;\n  }\n\n  return router.createUrlTree([config.loginUrl], {\n    queryParams: { returnUrl: state.url },\n  });\n};\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;MAKa,cAAc,GAAkB,CAAC,KAAK,EAAE,KAAK,KAAI;AAC5D,IAAA,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAC5C,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAC7B,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAExC,IAAA,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE;AACjC,QAAA,OAAO,IAAI;IACb;IAEA,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;AAC7C,QAAA,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;AACtC,KAAA,CAAC;AACJ;;ACjBA;;AAEG;;;;"}
+{"version":3,"file":"mintplayer-ng-spark-auth-guards.mjs","sources":["../../guards/src/spark-auth.guard.ts","../../guards/mintplayer-ng-spark-auth-guards.ts"],"sourcesContent":["import { inject } from '@angular/core';\nimport { CanActivateFn, Router } from '@angular/router';\nimport { SPARK_AUTH_CONFIG, resolveSignInUrl } from '@mintplayer/ng-spark-auth/models';\nimport { SparkAuthService } from '@mintplayer/ng-spark-auth/core';\n\nexport const sparkAuthGuard: CanActivateFn = (route, state) => {\n  const authService = inject(SparkAuthService);\n  const router = inject(Router);\n  const config = inject(SPARK_AUTH_CONFIG);\n\n  if (authService.isAuthenticated()) {\n    return true;\n  }\n\n  return router.createUrlTree([resolveSignInUrl(config, router)], {\n    queryParams: { returnUrl: state.url },\n  });\n};\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;MAKa,cAAc,GAAkB,CAAC,KAAK,EAAE,KAAK,KAAI;AAC5D,IAAA,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAC5C,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAC7B,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAExC,IAAA,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE;AACjC,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE;AAC9D,QAAA,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;AACtC,KAAA,CAAC;AACJ;;ACjBA;;AAEG;;;;"}

package/fesm2022/mintplayer-ng-spark-auth-interceptors.mjs

@@ -1,7 +1,7 @@
 import { inject } from '@angular/core';
 import { Router } from '@angular/router';
 import { tap } from 'rxjs';
-import { SPARK_AUTH_CONFIG, sanitizeReturnUrl } from '@mintplayer/ng-spark-auth/models';
+import { SPARK_AUTH_CONFIG, sanitizeReturnUrl, resolveSignInUrl } from '@mintplayer/ng-spark-auth/models';
 
 const sparkAuthInterceptor = (req, next) => {
     const config = inject(SPARK_AUTH_CONFIG);
@@ -18,7 +18,7 @@ const sparkAuthInterceptor = (req, next) => {
                 // back as an open redirect after authentication.
                 const pathOnly = router.url.split('?')[0].split('#')[0];
                 const returnUrl = sanitizeReturnUrl(pathOnly, config.defaultRedirectUrl);
-                router.navigate([config.loginUrl], {
+                router.navigate([resolveSignInUrl(config, router)], {
                     queryParams: { returnUrl },
                 });
             }

package/fesm2022/mintplayer-ng-spark-auth-interceptors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mintplayer-ng-spark-auth-interceptors.mjs","sources":["../../interceptors/src/spark-auth.interceptor.ts","../../interceptors/mintplayer-ng-spark-auth-interceptors.ts"],"sourcesContent":["import { inject } from '@angular/core';\nimport { HttpInterceptorFn } from '@angular/common/http';\nimport { Router } from '@angular/router';\nimport { tap } from 'rxjs';\nimport { SPARK_AUTH_CONFIG, sanitizeReturnUrl } from '@mintplayer/ng-spark-auth/models';\n\nexport const sparkAuthInterceptor: HttpInterceptorFn = (req, next) => {\n  const config = inject(SPARK_AUTH_CONFIG);\n  const router = inject(Router);\n\n  return next(req).pipe(\n    tap({\n      error: (error) => {\n        if (\n          error.status === 401 &&\n          !req.url.startsWith(config.apiBasePath)\n        ) {\n          // R2-L4: drop query string and fragment from the captured URL before\n          // putting it on the login URL. The unmodified router.url leaks\n          // in-app draft text / document IDs / search queries into the next\n          // access log entry for /login. Also pass through the same sanitizer\n          // the login component uses so a path with embedded // can't reflect\n          // back as an open redirect after authentication.\n          const pathOnly = router.url.split('?')[0].split('#')[0];\n          const returnUrl = sanitizeReturnUrl(pathOnly, config.defaultRedirectUrl);\n          router.navigate([config.loginUrl], {\n            queryParams: { returnUrl },\n          });\n        }\n      },\n    }),\n  );\n};\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;MAMa,oBAAoB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AACnE,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AACxC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,GAAG,CAAC;AACF,QAAA,KAAK,EAAE,CAAC,KAAK,KAAI;AACf,YAAA,IACE,KAAK,CAAC,MAAM,KAAK,GAAG;gBACpB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EACvC;;;;;;;gBAOA,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;oBACjC,WAAW,EAAE,EAAE,SAAS,EAAE;AAC3B,iBAAA,CAAC;YACJ;QACF,CAAC;AACF,KAAA,CAAC,CACH;AACH;;AChCA;;AAEG;;;;"}
+{"version":3,"file":"mintplayer-ng-spark-auth-interceptors.mjs","sources":["../../interceptors/src/spark-auth.interceptor.ts","../../interceptors/mintplayer-ng-spark-auth-interceptors.ts"],"sourcesContent":["import { inject } from '@angular/core';\nimport { HttpInterceptorFn } from '@angular/common/http';\nimport { Router } from '@angular/router';\nimport { tap } from 'rxjs';\nimport { SPARK_AUTH_CONFIG, resolveSignInUrl, sanitizeReturnUrl } from '@mintplayer/ng-spark-auth/models';\n\nexport const sparkAuthInterceptor: HttpInterceptorFn = (req, next) => {\n  const config = inject(SPARK_AUTH_CONFIG);\n  const router = inject(Router);\n\n  return next(req).pipe(\n    tap({\n      error: (error) => {\n        if (\n          error.status === 401 &&\n          !req.url.startsWith(config.apiBasePath)\n        ) {\n          // R2-L4: drop query string and fragment from the captured URL before\n          // putting it on the login URL. The unmodified router.url leaks\n          // in-app draft text / document IDs / search queries into the next\n          // access log entry for /login. Also pass through the same sanitizer\n          // the login component uses so a path with embedded // can't reflect\n          // back as an open redirect after authentication.\n          const pathOnly = router.url.split('?')[0].split('#')[0];\n          const returnUrl = sanitizeReturnUrl(pathOnly, config.defaultRedirectUrl);\n          router.navigate([resolveSignInUrl(config, router)], {\n            queryParams: { returnUrl },\n          });\n        }\n      },\n    }),\n  );\n};\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;MAMa,oBAAoB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AACnE,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;AACxC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,GAAG,CAAC;AACF,QAAA,KAAK,EAAE,CAAC,KAAK,KAAI;AACf,YAAA,IACE,KAAK,CAAC,MAAM,KAAK,GAAG;gBACpB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EACvC;;;;;;;gBAOA,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE;oBAClD,WAAW,EAAE,EAAE,SAAS,EAAE;AAC3B,iBAAA,CAAC;YACJ;QACF,CAAC;AACF,KAAA,CAAC,CACH;AACH;;AChCA;;AAEG;;;;"}

package/fesm2022/mintplayer-ng-spark-auth-models.mjs

@@ -1,4 +1,4 @@
-import { InjectionToken } from '@angular/core';
+import { InjectionToken, isDevMode } from '@angular/core';
 
 const SPARK_AUTH_CONFIG = new InjectionToken('SPARK_AUTH_CONFIG');
 const defaultSparkAuthConfig = {
@@ -41,9 +41,46 @@ function sanitizeReturnUrl(value, defaultUrl) {
 
 const SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE = 'spark:external-login';
 
+/**
+ * Where to send someone who is not signed in.
+ *
+ * `loginUrl` is the single source of truth for this, and the only thing the guard, the interceptor
+ * and the auth bar should consult — an application that turns off local credentials points it at
+ * its own sign-in landing route.
+ *
+ * The reason this is a function rather than a property read is the failure mode it closes: nothing
+ * connects `loginUrl` to the routes that actually exist, so pointing it at a route that was never
+ * registered produces a redirect into a blank page with no type error, no build failure and no
+ * runtime error. In development that now warns, once, naming the value and the fix.
+ */
+function resolveSignInUrl(config, router) {
+    if (isDevMode() && !warned && !routeExists(router, config.loginUrl)) {
+        warned = true;
+        console.warn(`[ng-spark-auth] loginUrl is "${config.loginUrl}", but no route matches it, so redirecting an `
+            + `unauthenticated user will land on a blank page. If this app runs with local credentials `
+            + `disabled, point loginUrl at its sign-in route (for example provideSparkAuth({ loginUrl: '/sign-in' })).`);
+    }
+    return config.loginUrl;
+}
+let warned = false;
+function routeExists(router, url) {
+    const target = url.replace(/^\/+/, '').split('?')[0].split('#')[0];
+    return matches(router.config, target);
+}
+function matches(routes, target, prefix = '') {
+    return routes.some(route => {
+        const path = [prefix, route.path ?? ''].filter(Boolean).join('/');
+        if (path === target)
+            return true;
+        // A wildcard route would match anything, including a URL nobody registered — treating it as a
+        // match would make this check always pass and warn about nothing.
+        return route.children ? matches(route.children, target, path) : false;
+    });
+}
+
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE, defaultSparkAuthConfig, isSafeReturnUrl, sanitizeReturnUrl };
+export { SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE, defaultSparkAuthConfig, isSafeReturnUrl, resolveSignInUrl, sanitizeReturnUrl };
 //# sourceMappingURL=mintplayer-ng-spark-auth-models.mjs.map

package/fesm2022/mintplayer-ng-spark-auth-models.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mintplayer-ng-spark-auth-models.mjs","sources":["../../models/src/auth-config.ts","../../models/src/auth-route-config.ts","../../models/src/return-url.ts","../../models/src/external-login.ts","../../models/mintplayer-ng-spark-auth-models.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\n\nexport interface SparkAuthConfig {\n  apiBasePath: string;\n  defaultRedirectUrl: string;\n  loginUrl: string;\n}\n\nexport const SPARK_AUTH_CONFIG = new InjectionToken<SparkAuthConfig>('SPARK_AUTH_CONFIG');\n\nexport const defaultSparkAuthConfig: SparkAuthConfig = {\n  apiBasePath: '/spark/auth',\n  defaultRedirectUrl: '/',\n  loginUrl: '/login',\n};\n","import { InjectionToken, Type } from '@angular/core';\n\nexport type SparkAuthRouteEntry = string | { path: string; component?: Type<unknown> };\n\nexport interface SparkAuthRouteConfig {\n  login?: SparkAuthRouteEntry;\n  twoFactor?: SparkAuthRouteEntry;\n  register?: SparkAuthRouteEntry;\n  forgotPassword?: SparkAuthRouteEntry;\n  resetPassword?: SparkAuthRouteEntry;\n}\n\nexport type SparkAuthRoutePaths = Required<Record<keyof SparkAuthRouteConfig, string>>;\n\nexport const SPARK_AUTH_ROUTE_PATHS = new InjectionToken<SparkAuthRoutePaths>('SPARK_AUTH_ROUTE_PATHS');\n","/**\n * Shared validator for `returnUrl` query parameters consumed by the auth\n * components and interceptor. The framework-side equivalent in\n * `SparkAuthenticationExtensions.SanitizeReturnUrl` enforces the same rule;\n * keep them in sync.\n *\n * Accepts only local in-app paths:\n * - Must start with a single `/`.\n * - Must not start with `//` or `/\\` (protocol-relative navigation that some\n *   browsers and routers interpret as an external host).\n * - Must not contain CR/LF (defensive — the value flows into Router state and\n *   eventually back into a `router.navigateByUrl` call).\n *\n * Returns the supplied default for anything else, never throws. Per R2-H9.\n */\nexport function isSafeReturnUrl(value: string | null | undefined): boolean {\n  if (!value) return false;\n  if (/[\\r\\n]/.test(value)) return false;\n  if (!value.startsWith('/')) return false;\n  if (value.length >= 2 && (value[1] === '/' || value[1] === '\\\\')) return false;\n  return true;\n}\n\nexport function sanitizeReturnUrl(\n  value: string | null | undefined,\n  defaultUrl: string,\n): string {\n  return isSafeReturnUrl(value) ? (value as string) : defaultUrl;\n}\n","/** How the user is sent to the external provider, and how the result comes back. */\nexport type SparkExternalLoginMode = 'popup' | 'redirect';\n\nexport interface SparkExternalLoginOptions {\n  /** Where to land after a successful sign-in. Server-side sanitized to an in-app path. */\n  returnUrl?: string;\n  /** Defaults to `'popup'`. */\n  mode?: SparkExternalLoginMode;\n}\n\n/**\n * Why an external login did not sign anyone in. The three `no_login_info` /\n * `email_not_verified` / `account_creation_failed` codes come from the server; the two\n * `popup_*` codes are raised here, because the browser is the only place that can observe\n * them. Deliberately coarse — never enough to tell \"no such account\" from anything else.\n */\nexport type SparkExternalLoginError =\n  | 'no_login_info'\n  | 'email_not_verified'\n  | 'account_creation_failed'\n  | 'popup_blocked'\n  | 'popup_closed';\n\nexport interface SparkExternalLoginResult {\n  success: boolean;\n  error?: SparkExternalLoginError;\n}\n\n/** The message the callback page posts back to the window that opened it. */\nexport interface SparkExternalLoginMessage {\n  type: 'spark:external-login';\n  success: boolean;\n  error?: SparkExternalLoginError;\n}\n\nexport const SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE = 'spark:external-login';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;MAQa,iBAAiB,GAAG,IAAI,cAAc,CAAkB,mBAAmB;AAEjF,MAAM,sBAAsB,GAAoB;AACrD,IAAA,WAAW,EAAE,aAAa;AAC1B,IAAA,kBAAkB,EAAE,GAAG;AACvB,IAAA,QAAQ,EAAE,QAAQ;;;MCCP,sBAAsB,GAAG,IAAI,cAAc,CAAsB,wBAAwB;;ACdtG;;;;;;;;;;;;;;AAcG;AACG,SAAU,eAAe,CAAC,KAAgC,EAAA;AAC9D,IAAA,IAAI,CAAC,KAAK;AAAE,QAAA,OAAO,KAAK;AACxB,IAAA,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;AAAE,QAAA,OAAO,KAAK;AACtC,IAAA,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;AAAE,QAAA,OAAO,KAAK;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAAE,QAAA,OAAO,KAAK;AAC9E,IAAA,OAAO,IAAI;AACb;AAEM,SAAU,iBAAiB,CAC/B,KAAgC,EAChC,UAAkB,EAAA;AAElB,IAAA,OAAO,eAAe,CAAC,KAAK,CAAC,GAAI,KAAgB,GAAG,UAAU;AAChE;;ACOO,MAAM,iCAAiC,GAAG;;ACnCjD;;AAEG;;;;"}
+{"version":3,"file":"mintplayer-ng-spark-auth-models.mjs","sources":["../../models/src/auth-config.ts","../../models/src/auth-route-config.ts","../../models/src/return-url.ts","../../models/src/external-login.ts","../../models/src/sign-in-redirect.ts","../../models/mintplayer-ng-spark-auth-models.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\n\nexport interface SparkAuthConfig {\n  apiBasePath: string;\n  defaultRedirectUrl: string;\n  loginUrl: string;\n}\n\nexport const SPARK_AUTH_CONFIG = new InjectionToken<SparkAuthConfig>('SPARK_AUTH_CONFIG');\n\nexport const defaultSparkAuthConfig: SparkAuthConfig = {\n  apiBasePath: '/spark/auth',\n  defaultRedirectUrl: '/',\n  loginUrl: '/login',\n};\n","import { InjectionToken, Type } from '@angular/core';\n\nexport type SparkAuthRouteEntry = string | { path: string; component?: Type<unknown> };\n\n/**\n * How much of the local-credential (email + password) page family to route.\n *\n * Mirrors the server's `SparkLocalCredentials`, and for the same reason it is a mode rather\n * than five independent switches: the pages form a star centred on the login page, and every\n * template dereferences its siblings' paths unconditionally, so removing any proper subset\n * leaves a dangling link. The family is the unit on both tiers.\n */\nexport type SparkLocalCredentialsMode = 'full' | 'sign-in-only' | 'disabled';\n\n/** The routable local-credential pages. Kept separate from {@link SparkAuthRouteConfig} so that\n * adding non-route options below cannot widen {@link SparkAuthRoutePaths}. */\nexport interface SparkAuthRouteEntries {\n  /** The provider-button landing page. Routed whenever local credentials are limited. */\n  signIn?: SparkAuthRouteEntry;\n  login?: SparkAuthRouteEntry;\n  twoFactor?: SparkAuthRouteEntry;\n  register?: SparkAuthRouteEntry;\n  forgotPassword?: SparkAuthRouteEntry;\n  resetPassword?: SparkAuthRouteEntry;\n}\n\nexport interface SparkAuthRouteConfig extends SparkAuthRouteEntries {\n  /**\n   * Defaults to `'full'`, which routes every page — the behaviour of every version before this\n   * option existed. Set it to match the server's `LocalCredentials` mode; `GET /spark/auth/capabilities`\n   * reports what the server is actually running.\n   */\n  localCredentials?: SparkLocalCredentialsMode;\n}\n\n/**\n * Every path is present regardless of mode. The pages that are dropped are dropped together, so no\n * surviving template can dereference a missing sibling — which is what lets this stay `Required`\n * and keeps the change additive for consumers.\n */\nexport type SparkAuthRoutePaths = Required<Record<keyof SparkAuthRouteEntries, string>>;\n\nexport const SPARK_AUTH_ROUTE_PATHS = new InjectionToken<SparkAuthRoutePaths>('SPARK_AUTH_ROUTE_PATHS');\n","/**\n * Shared validator for `returnUrl` query parameters consumed by the auth\n * components and interceptor. The framework-side equivalent in\n * `SparkAuthenticationExtensions.SanitizeReturnUrl` enforces the same rule;\n * keep them in sync.\n *\n * Accepts only local in-app paths:\n * - Must start with a single `/`.\n * - Must not start with `//` or `/\\` (protocol-relative navigation that some\n *   browsers and routers interpret as an external host).\n * - Must not contain CR/LF (defensive — the value flows into Router state and\n *   eventually back into a `router.navigateByUrl` call).\n *\n * Returns the supplied default for anything else, never throws. Per R2-H9.\n */\nexport function isSafeReturnUrl(value: string | null | undefined): boolean {\n  if (!value) return false;\n  if (/[\\r\\n]/.test(value)) return false;\n  if (!value.startsWith('/')) return false;\n  if (value.length >= 2 && (value[1] === '/' || value[1] === '\\\\')) return false;\n  return true;\n}\n\nexport function sanitizeReturnUrl(\n  value: string | null | undefined,\n  defaultUrl: string,\n): string {\n  return isSafeReturnUrl(value) ? (value as string) : defaultUrl;\n}\n","/** How the user is sent to the external provider, and how the result comes back. */\nexport type SparkExternalLoginMode = 'popup' | 'redirect';\n\nexport interface SparkExternalLoginOptions {\n  /** Where to land after a successful sign-in. Server-side sanitized to an in-app path. */\n  returnUrl?: string;\n  /** Defaults to `'popup'`. */\n  mode?: SparkExternalLoginMode;\n}\n\n/**\n * Why an external login did not sign anyone in. The three `no_login_info` /\n * `email_not_verified` / `account_creation_failed` codes come from the server; the two\n * `popup_*` codes are raised here, because the browser is the only place that can observe\n * them. Deliberately coarse — never enough to tell \"no such account\" from anything else.\n */\nexport type SparkExternalLoginError =\n  | 'no_login_info'\n  | 'email_not_verified'\n  | 'account_creation_failed'\n  | 'popup_blocked'\n  | 'popup_closed';\n\nexport interface SparkExternalLoginResult {\n  success: boolean;\n  error?: SparkExternalLoginError;\n}\n\n/** The message the callback page posts back to the window that opened it. */\nexport interface SparkExternalLoginMessage {\n  type: 'spark:external-login';\n  success: boolean;\n  error?: SparkExternalLoginError;\n}\n\nexport const SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE = 'spark:external-login';\n","import { isDevMode } from '@angular/core';\nimport { Route, Router } from '@angular/router';\nimport { SparkAuthConfig } from './auth-config';\n\n/**\n * Where to send someone who is not signed in.\n *\n * `loginUrl` is the single source of truth for this, and the only thing the guard, the interceptor\n * and the auth bar should consult — an application that turns off local credentials points it at\n * its own sign-in landing route.\n *\n * The reason this is a function rather than a property read is the failure mode it closes: nothing\n * connects `loginUrl` to the routes that actually exist, so pointing it at a route that was never\n * registered produces a redirect into a blank page with no type error, no build failure and no\n * runtime error. In development that now warns, once, naming the value and the fix.\n */\nexport function resolveSignInUrl(config: SparkAuthConfig, router: Router): string {\n  if (isDevMode() && !warned && !routeExists(router, config.loginUrl)) {\n    warned = true;\n    console.warn(\n      `[ng-spark-auth] loginUrl is \"${config.loginUrl}\", but no route matches it, so redirecting an `\n      + `unauthenticated user will land on a blank page. If this app runs with local credentials `\n      + `disabled, point loginUrl at its sign-in route (for example provideSparkAuth({ loginUrl: '/sign-in' })).`,\n    );\n  }\n\n  return config.loginUrl;\n}\n\nlet warned = false;\n\nfunction routeExists(router: Router, url: string): boolean {\n  const target = url.replace(/^\\/+/, '').split('?')[0].split('#')[0];\n  return matches(router.config, target);\n}\n\nfunction matches(routes: Route[], target: string, prefix = ''): boolean {\n  return routes.some(route => {\n    const path = [prefix, route.path ?? ''].filter(Boolean).join('/');\n    if (path === target) return true;\n    // A wildcard route would match anything, including a URL nobody registered — treating it as a\n    // match would make this check always pass and warn about nothing.\n    return route.children ? matches(route.children, target, path) : false;\n  });\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;MAQa,iBAAiB,GAAG,IAAI,cAAc,CAAkB,mBAAmB;AAEjF,MAAM,sBAAsB,GAAoB;AACrD,IAAA,WAAW,EAAE,aAAa;AAC1B,IAAA,kBAAkB,EAAE,GAAG;AACvB,IAAA,QAAQ,EAAE,QAAQ;;;MC6BP,sBAAsB,GAAG,IAAI,cAAc,CAAsB,wBAAwB;;AC1CtG;;;;;;;;;;;;;;AAcG;AACG,SAAU,eAAe,CAAC,KAAgC,EAAA;AAC9D,IAAA,IAAI,CAAC,KAAK;AAAE,QAAA,OAAO,KAAK;AACxB,IAAA,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;AAAE,QAAA,OAAO,KAAK;AACtC,IAAA,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;AAAE,QAAA,OAAO,KAAK;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAAE,QAAA,OAAO,KAAK;AAC9E,IAAA,OAAO,IAAI;AACb;AAEM,SAAU,iBAAiB,CAC/B,KAAgC,EAChC,UAAkB,EAAA;AAElB,IAAA,OAAO,eAAe,CAAC,KAAK,CAAC,GAAI,KAAgB,GAAG,UAAU;AAChE;;ACOO,MAAM,iCAAiC,GAAG;;AC/BjD;;;;;;;;;;;AAWG;AACG,SAAU,gBAAgB,CAAC,MAAuB,EAAE,MAAc,EAAA;AACtE,IAAA,IAAI,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACnE,MAAM,GAAG,IAAI;AACb,QAAA,OAAO,CAAC,IAAI,CACV,gCAAgC,MAAM,CAAC,QAAQ,CAAA,8CAAA;cAC7C,CAAA,wFAAA;AACA,cAAA,CAAA,uGAAA,CAAyG,CAC5G;IACH;IAEA,OAAO,MAAM,CAAC,QAAQ;AACxB;AAEA,IAAI,MAAM,GAAG,KAAK;AAElB,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW,EAAA;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;AACvC;AAEA,SAAS,OAAO,CAAC,MAAe,EAAE,MAAc,EAAE,MAAM,GAAG,EAAE,EAAA;AAC3D,IAAA,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,IAAG;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjE,IAAI,IAAI,KAAK,MAAM;AAAE,YAAA,OAAO,IAAI;;;QAGhC,OAAO,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK;AACvE,IAAA,CAAC,CAAC;AACJ;;AC5CA;;AAEG;;;;"}

package/fesm2022/mintplayer-ng-spark-auth-routes.mjs

@@ -1,45 +1,63 @@
 import { SPARK_AUTH_ROUTE_PATHS } from '@mintplayer/ng-spark-auth/models';
 
-function resolveEntry(entry, defaultPath, defaultLoader) {
-    if (entry === undefined || typeof entry === 'string') {
-        return {
-            path: typeof entry === 'string' ? entry : defaultPath,
-            loadComponent: defaultLoader,
-        };
-    }
-    return {
-        path: entry.path,
-        loadComponent: entry.component
-            ? () => Promise.resolve(entry.component)
-            : defaultLoader,
-    };
+/** The routed path for an entry, independent of how its component is loaded. */
+function entryPath(entry, defaultPath) {
+    if (entry === undefined)
+        return defaultPath;
+    return typeof entry === 'string' ? entry : entry.path;
+}
+/** An explicitly supplied component wins over the library's lazy import. */
+function child(entry, path, defaultLoader) {
+    const component = typeof entry === 'object' && entry.component ? entry.component : undefined;
+    return { path, loadComponent: component ? () => Promise.resolve(component) : defaultLoader };
 }
+/**
+ * The routes for Spark's authentication pages.
+ *
+ * `config.localCredentials` chooses how much of the email/password family to route, mirroring the
+ * server's `SparkLocalCredentials`. `GET /spark/auth/capabilities` reports what the server is
+ * actually running, so the two can be checked against each other.
+ *
+ * The `import()` expressions live *inside* the branches that need them. That placement is the point:
+ * a bundler decides whether to emit a lazy chunk from whether the `import()` call site is reachable,
+ * not from whether the route object referencing it survives — so filtering the children array after
+ * the fact would still ship every page. Excluded pages must have no reachable `import()` at all.
+ *
+ * `SPARK_AUTH_ROUTE_PATHS` is still provided in full. The excluded pages are excluded together, so
+ * nothing that survives can link to something that does not, and the token stays `Required`.
+ */
 function sparkAuthRoutes(config) {
-    const login = resolveEntry(config?.login, 'login', () => import('@mintplayer/ng-spark-auth/login').then(m => m.SparkLoginComponent));
-    const twoFactor = resolveEntry(config?.twoFactor, 'login/two-factor', () => import('@mintplayer/ng-spark-auth/two-factor').then(m => m.SparkTwoFactorComponent));
-    const register = resolveEntry(config?.register, 'register', () => import('@mintplayer/ng-spark-auth/register').then(m => m.SparkRegisterComponent));
-    const forgotPassword = resolveEntry(config?.forgotPassword, 'forgot-password', () => import('@mintplayer/ng-spark-auth/forgot-password').then(m => m.SparkForgotPasswordComponent));
-    const resetPassword = resolveEntry(config?.resetPassword, 'reset-password', () => import('@mintplayer/ng-spark-auth/reset-password').then(m => m.SparkResetPasswordComponent));
+    const mode = config?.localCredentials ?? 'full';
     const paths = {
-        login: '/' + login.path,
-        twoFactor: '/' + twoFactor.path,
-        register: '/' + register.path,
-        forgotPassword: '/' + forgotPassword.path,
-        resetPassword: '/' + resetPassword.path,
+        signIn: '/' + entryPath(config?.signIn, 'sign-in'),
+        login: '/' + entryPath(config?.login, 'login'),
+        twoFactor: '/' + entryPath(config?.twoFactor, 'login/two-factor'),
+        register: '/' + entryPath(config?.register, 'register'),
+        forgotPassword: '/' + entryPath(config?.forgotPassword, 'forgot-password'),
+        resetPassword: '/' + entryPath(config?.resetPassword, 'reset-password'),
     };
+    const children = [];
+    // Only when local credentials are limited. In 'full' mode the login page is already the landing
+    // page, and emitting a second one would change the routes of every app that never opted in.
+    if (mode !== 'full') {
+        children.push(child(config?.signIn, entryPath(config?.signIn, 'sign-in'), () => import('@mintplayer/ng-spark-auth/sign-in').then(m => m.SparkSignInComponent)));
+    }
+    if (mode !== 'disabled') {
+        children.push(child(config?.login, entryPath(config?.login, 'login'), () => import('@mintplayer/ng-spark-auth/login').then(m => m.SparkLoginComponent)), 
+        // Reachable only from the login page's RequiresTwoFactor branch, and it posts to the same
+        // /login endpoint — so it belongs to password sign-in, not to authentication in general.
+        child(config?.twoFactor, entryPath(config?.twoFactor, 'login/two-factor'), () => import('@mintplayer/ng-spark-auth/two-factor').then(m => m.SparkTwoFactorComponent)), child(config?.forgotPassword, entryPath(config?.forgotPassword, 'forgot-password'), () => import('@mintplayer/ng-spark-auth/forgot-password').then(m => m.SparkForgotPasswordComponent)), child(config?.resetPassword, entryPath(config?.resetPassword, 'reset-password'), () => import('@mintplayer/ng-spark-auth/reset-password').then(m => m.SparkResetPasswordComponent)));
+    }
+    if (mode === 'full') {
+        children.push(child(config?.register, entryPath(config?.register, 'register'), () => import('@mintplayer/ng-spark-auth/register').then(m => m.SparkRegisterComponent)));
+    }
     return [
         {
             path: '',
             providers: [
                 { provide: SPARK_AUTH_ROUTE_PATHS, useValue: paths },
             ],
-            children: [
-                { path: login.path, loadComponent: login.loadComponent },
-                { path: twoFactor.path, loadComponent: twoFactor.loadComponent },
-                { path: register.path, loadComponent: register.loadComponent },
-                { path: forgotPassword.path, loadComponent: forgotPassword.loadComponent },
-                { path: resetPassword.path, loadComponent: resetPassword.loadComponent },
-            ],
+            children,
         },
     ];
 }

package/fesm2022/mintplayer-ng-spark-auth-routes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mintplayer-ng-spark-auth-routes.mjs","sources":["../../routes/src/spark-auth-routes.ts","../../routes/mintplayer-ng-spark-auth-routes.ts"],"sourcesContent":["import { SPARK_AUTH_ROUTE_PATHS, SparkAuthRouteConfig, SparkAuthRouteEntry, SparkAuthRoutePaths } from '@mintplayer/ng-spark-auth/models';\n\ninterface ResolvedEntry {\n  path: string;\n  loadComponent: () => Promise<any>;\n}\n\nfunction resolveEntry(\n  entry: SparkAuthRouteEntry | undefined,\n  defaultPath: string,\n  defaultLoader: () => Promise<any>,\n): ResolvedEntry {\n  if (entry === undefined || typeof entry === 'string') {\n    return {\n      path: typeof entry === 'string' ? entry : defaultPath,\n      loadComponent: defaultLoader,\n    };\n  }\n  return {\n    path: entry.path,\n    loadComponent: entry.component\n      ? () => Promise.resolve(entry.component!)\n      : defaultLoader,\n  };\n}\n\nexport function sparkAuthRoutes(config?: SparkAuthRouteConfig): any[] {\n  const login = resolveEntry(config?.login, 'login',\n    () => import('@mintplayer/ng-spark-auth/login').then(m => m.SparkLoginComponent));\n  const twoFactor = resolveEntry(config?.twoFactor, 'login/two-factor',\n    () => import('@mintplayer/ng-spark-auth/two-factor').then(m => m.SparkTwoFactorComponent));\n  const register = resolveEntry(config?.register, 'register',\n    () => import('@mintplayer/ng-spark-auth/register').then(m => m.SparkRegisterComponent));\n  const forgotPassword = resolveEntry(config?.forgotPassword, 'forgot-password',\n    () => import('@mintplayer/ng-spark-auth/forgot-password').then(m => m.SparkForgotPasswordComponent));\n  const resetPassword = resolveEntry(config?.resetPassword, 'reset-password',\n    () => import('@mintplayer/ng-spark-auth/reset-password').then(m => m.SparkResetPasswordComponent));\n\n  const paths: SparkAuthRoutePaths = {\n    login: '/' + login.path,\n    twoFactor: '/' + twoFactor.path,\n    register: '/' + register.path,\n    forgotPassword: '/' + forgotPassword.path,\n    resetPassword: '/' + resetPassword.path,\n  };\n\n  return [\n    {\n      path: '',\n      providers: [\n        { provide: SPARK_AUTH_ROUTE_PATHS, useValue: paths },\n      ],\n      children: [\n        { path: login.path, loadComponent: login.loadComponent },\n        { path: twoFactor.path, loadComponent: twoFactor.loadComponent },\n        { path: register.path, loadComponent: register.loadComponent },\n        { path: forgotPassword.path, loadComponent: forgotPassword.loadComponent },\n        { path: resetPassword.path, loadComponent: resetPassword.loadComponent },\n      ],\n    },\n  ];\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;AAOA,SAAS,YAAY,CACnB,KAAsC,EACtC,WAAmB,EACnB,aAAiC,EAAA;IAEjC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QACpD,OAAO;AACL,YAAA,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG,WAAW;AACrD,YAAA,aAAa,EAAE,aAAa;SAC7B;IACH;IACA,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC;cACjB,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,SAAU;AACxC,cAAE,aAAa;KAClB;AACH;AAEM,SAAU,eAAe,CAAC,MAA6B,EAAA;AAC3D,IAAA,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAC/C,MAAM,OAAO,iCAAiC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,CAAC;AACnF,IAAA,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAClE,MAAM,OAAO,sCAAsC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,uBAAuB,CAAC,CAAC;AAC5F,IAAA,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EACxD,MAAM,OAAO,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAC;AACzF,IAAA,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAC3E,MAAM,OAAO,2CAA2C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,4BAA4B,CAAC,CAAC;AACtG,IAAA,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,gBAAgB,EACxE,MAAM,OAAO,0CAA0C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,2BAA2B,CAAC,CAAC;AAEpG,IAAA,MAAM,KAAK,GAAwB;AACjC,QAAA,KAAK,EAAE,GAAG,GAAG,KAAK,CAAC,IAAI;AACvB,QAAA,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC,IAAI;AAC/B,QAAA,QAAQ,EAAE,GAAG,GAAG,QAAQ,CAAC,IAAI;AAC7B,QAAA,cAAc,EAAE,GAAG,GAAG,cAAc,CAAC,IAAI;AACzC,QAAA,aAAa,EAAE,GAAG,GAAG,aAAa,CAAC,IAAI;KACxC;IAED,OAAO;AACL,QAAA;AACE,YAAA,IAAI,EAAE,EAAE;AACR,YAAA,SAAS,EAAE;AACT,gBAAA,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE;AACrD,aAAA;AACD,YAAA,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;gBACxD,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE;gBAChE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE;gBAC9D,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,aAAa,EAAE;gBAC1E,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE;AACzE,aAAA;AACF,SAAA;KACF;AACH;;AC7DA;;AAEG;;;;"}
+{"version":3,"file":"mintplayer-ng-spark-auth-routes.mjs","sources":["../../routes/src/spark-auth-routes.ts","../../routes/mintplayer-ng-spark-auth-routes.ts"],"sourcesContent":["import { SPARK_AUTH_ROUTE_PATHS, SparkAuthRouteConfig, SparkAuthRouteEntry, SparkAuthRoutePaths } from '@mintplayer/ng-spark-auth/models';\n\ntype Loader = () => Promise<any>;\n\ninterface Child {\n  path: string;\n  loadComponent: Loader;\n}\n\n/** The routed path for an entry, independent of how its component is loaded. */\nfunction entryPath(entry: SparkAuthRouteEntry | undefined, defaultPath: string): string {\n  if (entry === undefined) return defaultPath;\n  return typeof entry === 'string' ? entry : entry.path;\n}\n\n/** An explicitly supplied component wins over the library's lazy import. */\nfunction child(entry: SparkAuthRouteEntry | undefined, path: string, defaultLoader: Loader): Child {\n  const component = typeof entry === 'object' && entry.component ? entry.component : undefined;\n  return { path, loadComponent: component ? () => Promise.resolve(component) : defaultLoader };\n}\n\n/**\n * The routes for Spark's authentication pages.\n *\n * `config.localCredentials` chooses how much of the email/password family to route, mirroring the\n * server's `SparkLocalCredentials`. `GET /spark/auth/capabilities` reports what the server is\n * actually running, so the two can be checked against each other.\n *\n * The `import()` expressions live *inside* the branches that need them. That placement is the point:\n * a bundler decides whether to emit a lazy chunk from whether the `import()` call site is reachable,\n * not from whether the route object referencing it survives — so filtering the children array after\n * the fact would still ship every page. Excluded pages must have no reachable `import()` at all.\n *\n * `SPARK_AUTH_ROUTE_PATHS` is still provided in full. The excluded pages are excluded together, so\n * nothing that survives can link to something that does not, and the token stays `Required`.\n */\nexport function sparkAuthRoutes(config?: SparkAuthRouteConfig): any[] {\n  const mode = config?.localCredentials ?? 'full';\n\n  const paths: SparkAuthRoutePaths = {\n    signIn: '/' + entryPath(config?.signIn, 'sign-in'),\n    login: '/' + entryPath(config?.login, 'login'),\n    twoFactor: '/' + entryPath(config?.twoFactor, 'login/two-factor'),\n    register: '/' + entryPath(config?.register, 'register'),\n    forgotPassword: '/' + entryPath(config?.forgotPassword, 'forgot-password'),\n    resetPassword: '/' + entryPath(config?.resetPassword, 'reset-password'),\n  };\n\n  const children: Child[] = [];\n\n  // Only when local credentials are limited. In 'full' mode the login page is already the landing\n  // page, and emitting a second one would change the routes of every app that never opted in.\n  if (mode !== 'full') {\n    children.push(\n      child(config?.signIn, entryPath(config?.signIn, 'sign-in'),\n        () => import('@mintplayer/ng-spark-auth/sign-in').then(m => m.SparkSignInComponent)),\n    );\n  }\n\n  if (mode !== 'disabled') {\n    children.push(\n      child(config?.login, entryPath(config?.login, 'login'),\n        () => import('@mintplayer/ng-spark-auth/login').then(m => m.SparkLoginComponent)),\n      // Reachable only from the login page's RequiresTwoFactor branch, and it posts to the same\n      // /login endpoint — so it belongs to password sign-in, not to authentication in general.\n      child(config?.twoFactor, entryPath(config?.twoFactor, 'login/two-factor'),\n        () => import('@mintplayer/ng-spark-auth/two-factor').then(m => m.SparkTwoFactorComponent)),\n      child(config?.forgotPassword, entryPath(config?.forgotPassword, 'forgot-password'),\n        () => import('@mintplayer/ng-spark-auth/forgot-password').then(m => m.SparkForgotPasswordComponent)),\n      child(config?.resetPassword, entryPath(config?.resetPassword, 'reset-password'),\n        () => import('@mintplayer/ng-spark-auth/reset-password').then(m => m.SparkResetPasswordComponent)),\n    );\n  }\n\n  if (mode === 'full') {\n    children.push(\n      child(config?.register, entryPath(config?.register, 'register'),\n        () => import('@mintplayer/ng-spark-auth/register').then(m => m.SparkRegisterComponent)),\n    );\n  }\n\n  return [\n    {\n      path: '',\n      providers: [\n        { provide: SPARK_AUTH_ROUTE_PATHS, useValue: paths },\n      ],\n      children,\n    },\n  ];\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;AASA;AACA,SAAS,SAAS,CAAC,KAAsC,EAAE,WAAmB,EAAA;IAC5E,IAAI,KAAK,KAAK,SAAS;AAAE,QAAA,OAAO,WAAW;AAC3C,IAAA,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC,IAAI;AACvD;AAEA;AACA,SAAS,KAAK,CAAC,KAAsC,EAAE,IAAY,EAAE,aAAqB,EAAA;IACxF,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,SAAS;IAC5F,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,aAAa,EAAE;AAC9F;AAEA;;;;;;;;;;;;;;AAcG;AACG,SAAU,eAAe,CAAC,MAA6B,EAAA;AAC3D,IAAA,MAAM,IAAI,GAAG,MAAM,EAAE,gBAAgB,IAAI,MAAM;AAE/C,IAAA,MAAM,KAAK,GAAwB;QACjC,MAAM,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;QAClD,KAAK,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QAC9C,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC;QACjE,QAAQ,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;QACvD,cAAc,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,iBAAiB,CAAC;QAC1E,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,gBAAgB,CAAC;KACxE;IAED,MAAM,QAAQ,GAAY,EAAE;;;AAI5B,IAAA,IAAI,IAAI,KAAK,MAAM,EAAE;AACnB,QAAA,QAAQ,CAAC,IAAI,CACX,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EACxD,MAAM,OAAO,mCAAmC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC,CACvF;IACH;AAEA,IAAA,IAAI,IAAI,KAAK,UAAU,EAAE;AACvB,QAAA,QAAQ,CAAC,IAAI,CACX,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EACpD,MAAM,OAAO,iCAAiC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,CAAC;;;QAGnF,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,EACvE,MAAM,OAAO,sCAAsC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAC5F,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAChF,MAAM,OAAO,2CAA2C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,4BAA4B,CAAC,CAAC,EACtG,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,gBAAgB,CAAC,EAC7E,MAAM,OAAO,0CAA0C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,2BAA2B,CAAC,CAAC,CACrG;IACH;AAEA,IAAA,IAAI,IAAI,KAAK,MAAM,EAAE;AACnB,QAAA,QAAQ,CAAC,IAAI,CACX,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC7D,MAAM,OAAO,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAC1F;IACH;IAEA,OAAO;AACL,QAAA;AACE,YAAA,IAAI,EAAE,EAAE;AACR,YAAA,SAAS,EAAE;AACT,gBAAA,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE;AACrD,aAAA;YACD,QAAQ;AACT,SAAA;KACF;AACH;;AC1FA;;AAEG;;;;"}

package/fesm2022/mintplayer-ng-spark-auth-sign-in.mjs

@@ -0,0 +1,80 @@
+import * as i0 from '@angular/core';
+import { inject, signal, isDevMode, ChangeDetectionStrategy, Component } from '@angular/core';
+import { RouterLink } from '@angular/router';
+import { Color } from '@mintplayer/ng-bootstrap';
+import { BsAlertComponent } from '@mintplayer/ng-bootstrap/alert';
+import { BsCardComponent, BsCardHeaderComponent } from '@mintplayer/ng-bootstrap/card';
+import { BsSpinnerComponent } from '@mintplayer/ng-bootstrap/spinner';
+import { SPARK_AUTH_ROUTE_PATHS } from '@mintplayer/ng-spark-auth/models';
+import { SparkAuthService } from '@mintplayer/ng-spark-auth/core';
+import { TranslateKeyPipe } from '@mintplayer/ng-spark-auth/pipes';
+
+/**
+ * The sign-in landing page for an application whose local credentials are turned off — a button per
+ * external provider, and a link to the password form when there still is one.
+ *
+ * The providers come from `GET /spark/auth/capabilities` rather than from a list the application
+ * hard-codes. That is the point of the component: every consumer that hand-rolled this before wrote
+ * the scheme name as a string literal, which is a silent mismatch waiting to happen the moment the
+ * server's provider registration changes.
+ */
+class SparkSignInComponent {
+    authService = inject(SparkAuthService);
+    routePaths = inject(SPARK_AUTH_ROUTE_PATHS);
+    colors = Color;
+    providers = signal([], /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "providers" }] : /* istanbul ignore next */ []));
+    localCredentialsAvailable = signal(false, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "localCredentialsAvailable" }] : /* istanbul ignore next */ []));
+    loading = signal(true, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "loading" }] : /* istanbul ignore next */ []));
+    failed = signal(false, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "failed" }] : /* istanbul ignore next */ []));
+    constructor() {
+        void this.load();
+    }
+    async load() {
+        try {
+            const capabilities = await this.authService.capabilities();
+            this.providers.set(capabilities.externalProviders);
+            this.localCredentialsAvailable.set(capabilities.localCredentials !== 'Disabled');
+            this.warnOnMismatch(capabilities);
+        }
+        catch {
+            // A sign-in page that renders nothing looks identical to one whose providers all failed to
+            // load, so say which happened rather than showing an empty page.
+            this.failed.set(true);
+        }
+        finally {
+            this.loading.set(false);
+        }
+    }
+    /**
+     * The routes are a build-time decision and the server's mode a deployment-time one, so they can
+     * disagree without anything failing loudly. Reaching this page at all means the app routed it,
+     * which it only does when local credentials are meant to be limited.
+     */
+    warnOnMismatch(capabilities) {
+        if (isDevMode() && capabilities.localCredentials === 'Full') {
+            console.warn('[ng-spark-auth] This app routes the sign-in landing page, but the server reports '
+                + 'localCredentials = Full. The two are configured independently — check that '
+                + "sparkAuthRoutes({ localCredentials: … }) matches AddAuthentication's LocalCredentials mode.");
+        }
+    }
+    signInWith(provider) {
+        void this.authService.loginWithProvider(provider.scheme);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.0", ngImport: i0, type: SparkSignInComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "22.0.0", type: SparkSignInComponent, isStandalone: true, selector: "spark-sign-in", ngImport: i0, template: "<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (loading()) {\n        <div class=\"text-center\"><bs-spinner /></div>\n      } @else if (failed()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-0\">{{ 'auth.signInUnavailable' | t }}</bs-alert>\n      } @else {\n        @for (provider of providers(); track provider.scheme) {\n          <button type=\"button\" class=\"btn btn-outline-primary w-100 mb-2\" (click)=\"signInWith(provider)\">\n            {{ provider.displayName }}\n          </button>\n        } @empty {\n          <bs-alert [type]=\"colors.warning\" class=\"mb-0\">{{ 'auth.noSignInMethods' | t }}</bs-alert>\n        }\n\n        @if (localCredentialsAvailable()) {\n          <div class=\"text-center mt-3\">\n            <a [routerLink]=\"routePaths.login\">{{ 'auth.login' | t }}</a>\n          </div>\n        }\n      }\n    </div>\n  </bs-card>\n</div>\n", dependencies: [{ kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "browserUrl", "routerLink"] }, { kind: "component", type: BsAlertComponent, selector: "bs-alert", inputs: ["type", "announce", "isVisible"], outputs: ["isVisibleChange", "afterOpenedOrClosed"] }, { kind: "component", type: BsCardComponent, selector: "bs-card", inputs: ["color", "outline"] }, { kind: "component", type: BsCardHeaderComponent, selector: "bs-card-header", inputs: ["color", "navStyle"] }, { kind: "component", type: BsSpinnerComponent, selector: "bs-spinner", inputs: ["type", "color"] }, { kind: "pipe", type: TranslateKeyPipe, name: "t" }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.0", ngImport: i0, type: SparkSignInComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'spark-sign-in', standalone: true, changeDetection: ChangeDetectionStrategy.OnPush, imports: [RouterLink, BsAlertComponent, BsCardComponent, BsCardHeaderComponent, BsSpinnerComponent, TranslateKeyPipe], template: "<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (loading()) {\n        <div class=\"text-center\"><bs-spinner /></div>\n      } @else if (failed()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-0\">{{ 'auth.signInUnavailable' | t }}</bs-alert>\n      } @else {\n        @for (provider of providers(); track provider.scheme) {\n          <button type=\"button\" class=\"btn btn-outline-primary w-100 mb-2\" (click)=\"signInWith(provider)\">\n            {{ provider.displayName }}\n          </button>\n        } @empty {\n          <bs-alert [type]=\"colors.warning\" class=\"mb-0\">{{ 'auth.noSignInMethods' | t }}</bs-alert>\n        }\n\n        @if (localCredentialsAvailable()) {\n          <div class=\"text-center mt-3\">\n            <a [routerLink]=\"routePaths.login\">{{ 'auth.login' | t }}</a>\n          </div>\n        }\n      }\n    </div>\n  </bs-card>\n</div>\n" }]
+        }], ctorParameters: () => [] });
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { SparkSignInComponent };
+//# sourceMappingURL=mintplayer-ng-spark-auth-sign-in.mjs.map

package/fesm2022/mintplayer-ng-spark-auth-sign-in.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mintplayer-ng-spark-auth-sign-in.mjs","sources":["../../sign-in/src/spark-sign-in.component.ts","../../sign-in/src/spark-sign-in.component.html","../../sign-in/mintplayer-ng-spark-auth-sign-in.ts"],"sourcesContent":["import { ChangeDetectionStrategy, Component, inject, isDevMode, signal } from '@angular/core';\nimport { RouterLink } from '@angular/router';\nimport { Color } from '@mintplayer/ng-bootstrap';\nimport { BsAlertComponent } from '@mintplayer/ng-bootstrap/alert';\nimport { BsCardComponent, BsCardHeaderComponent } from '@mintplayer/ng-bootstrap/card';\nimport { BsSpinnerComponent } from '@mintplayer/ng-bootstrap/spinner';\nimport { SPARK_AUTH_ROUTE_PATHS, SparkAuthCapabilities, SparkExternalProvider } from '@mintplayer/ng-spark-auth/models';\nimport { SparkAuthService } from '@mintplayer/ng-spark-auth/core';\nimport { TranslateKeyPipe } from '@mintplayer/ng-spark-auth/pipes';\n\n/**\n * The sign-in landing page for an application whose local credentials are turned off — a button per\n * external provider, and a link to the password form when there still is one.\n *\n * The providers come from `GET /spark/auth/capabilities` rather than from a list the application\n * hard-codes. That is the point of the component: every consumer that hand-rolled this before wrote\n * the scheme name as a string literal, which is a silent mismatch waiting to happen the moment the\n * server's provider registration changes.\n */\n@Component({\n  selector: 'spark-sign-in',\n  standalone: true,\n  changeDetection: ChangeDetectionStrategy.OnPush,\n  imports: [RouterLink, BsAlertComponent, BsCardComponent, BsCardHeaderComponent, BsSpinnerComponent, TranslateKeyPipe],\n  templateUrl: './spark-sign-in.component.html',\n})\nexport class SparkSignInComponent {\n  private readonly authService = inject(SparkAuthService);\n  readonly routePaths = inject(SPARK_AUTH_ROUTE_PATHS);\n  readonly colors = Color;\n\n  readonly providers = signal<SparkExternalProvider[]>([]);\n  readonly localCredentialsAvailable = signal(false);\n  readonly loading = signal(true);\n  readonly failed = signal(false);\n\n  constructor() {\n    void this.load();\n  }\n\n  private async load(): Promise<void> {\n    try {\n      const capabilities = await this.authService.capabilities();\n      this.providers.set(capabilities.externalProviders);\n      this.localCredentialsAvailable.set(capabilities.localCredentials !== 'Disabled');\n      this.warnOnMismatch(capabilities);\n    } catch {\n      // A sign-in page that renders nothing looks identical to one whose providers all failed to\n      // load, so say which happened rather than showing an empty page.\n      this.failed.set(true);\n    } finally {\n      this.loading.set(false);\n    }\n  }\n\n  /**\n   * The routes are a build-time decision and the server's mode a deployment-time one, so they can\n   * disagree without anything failing loudly. Reaching this page at all means the app routed it,\n   * which it only does when local credentials are meant to be limited.\n   */\n  private warnOnMismatch(capabilities: SparkAuthCapabilities): void {\n    if (isDevMode() && capabilities.localCredentials === 'Full') {\n      console.warn(\n        '[ng-spark-auth] This app routes the sign-in landing page, but the server reports '\n        + 'localCredentials = Full. The two are configured independently — check that '\n        + \"sparkAuthRoutes({ localCredentials: … }) matches AddAuthentication's LocalCredentials mode.\",\n      );\n    }\n  }\n\n  signInWith(provider: SparkExternalProvider): void {\n    void this.authService.loginWithProvider(provider.scheme);\n  }\n}\n\nexport default SparkSignInComponent;\n","<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (loading()) {\n        <div class=\"text-center\"><bs-spinner /></div>\n      } @else if (failed()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-0\">{{ 'auth.signInUnavailable' | t }}</bs-alert>\n      } @else {\n        @for (provider of providers(); track provider.scheme) {\n          <button type=\"button\" class=\"btn btn-outline-primary w-100 mb-2\" (click)=\"signInWith(provider)\">\n            {{ provider.displayName }}\n          </button>\n        } @empty {\n          <bs-alert [type]=\"colors.warning\" class=\"mb-0\">{{ 'auth.noSignInMethods' | t }}</bs-alert>\n        }\n\n        @if (localCredentialsAvailable()) {\n          <div class=\"text-center mt-3\">\n            <a [routerLink]=\"routePaths.login\">{{ 'auth.login' | t }}</a>\n          </div>\n        }\n      }\n    </div>\n  </bs-card>\n</div>\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;;;;;;;;;AAUA;;;;;;;;AAQG;MAQU,oBAAoB,CAAA;AACd,IAAA,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAC9C,IAAA,UAAU,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC3C,MAAM,GAAG,KAAK;IAEd,SAAS,GAAG,MAAM,CAA0B,EAAE;kFAAC;IAC/C,yBAAyB,GAAG,MAAM,CAAC,KAAK;kGAAC;IACzC,OAAO,GAAG,MAAM,CAAC,IAAI;gFAAC;IACtB,MAAM,GAAG,MAAM,CAAC,KAAK;+EAAC;AAE/B,IAAA,WAAA,GAAA;AACE,QAAA,KAAK,IAAI,CAAC,IAAI,EAAE;IAClB;AAEQ,IAAA,MAAM,IAAI,GAAA;AAChB,QAAA,IAAI;YACF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC;YAClD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,KAAK,UAAU,CAAC;AAChF,YAAA,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC;QACnC;AAAE,QAAA,MAAM;;;AAGN,YAAA,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACvB;gBAAU;AACR,YAAA,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QACzB;IACF;AAEA;;;;AAIG;AACK,IAAA,cAAc,CAAC,YAAmC,EAAA;QACxD,IAAI,SAAS,EAAE,IAAI,YAAY,CAAC,gBAAgB,KAAK,MAAM,EAAE;YAC3D,OAAO,CAAC,IAAI,CACV;kBACE;AACA,kBAAA,6FAA6F,CAChG;QACH;IACF;AAEA,IAAA,UAAU,CAAC,QAA+B,EAAA;QACxC,KAAK,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC1D;uGA9CW,oBAAoB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA;AAApB,IAAA,OAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,oBAAoB,EAAA,YAAA,EAAA,IAAA,EAAA,QAAA,EAAA,eAAA,EAAA,QAAA,EAAA,EAAA,EAAA,QAAA,EC1BjC,mkCA4BA,EAAA,YAAA,EAAA,CAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EDLY,UAAU,EAAA,QAAA,EAAA,cAAA,EAAA,MAAA,EAAA,CAAA,QAAA,EAAA,aAAA,EAAA,UAAA,EAAA,qBAAA,EAAA,OAAA,EAAA,MAAA,EAAA,YAAA,EAAA,kBAAA,EAAA,oBAAA,EAAA,YAAA,EAAA,YAAA,EAAA,YAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAE,gBAAgB,EAAA,QAAA,EAAA,UAAA,EAAA,MAAA,EAAA,CAAA,MAAA,EAAA,UAAA,EAAA,WAAA,CAAA,EAAA,OAAA,EAAA,CAAA,iBAAA,EAAA,qBAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAE,eAAe,EAAA,QAAA,EAAA,SAAA,EAAA,MAAA,EAAA,CAAA,OAAA,EAAA,SAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAE,qBAAqB,EAAA,QAAA,EAAA,gBAAA,EAAA,MAAA,EAAA,CAAA,OAAA,EAAA,UAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAE,kBAAkB,6EAAE,gBAAgB,EAAA,IAAA,EAAA,GAAA,EAAA,CAAA,EAAA,eAAA,EAAA,EAAA,CAAA,uBAAA,CAAA,MAAA,EAAA,CAAA;;2FAGzG,oBAAoB,EAAA,UAAA,EAAA,CAAA;kBAPhC,SAAS;AACE,YAAA,IAAA,EAAA,CAAA,EAAA,QAAA,EAAA,eAAe,cACb,IAAI,EAAA,eAAA,EACC,uBAAuB,CAAC,MAAM,WACtC,CAAC,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,EAAA,QAAA,EAAA,mkCAAA,EAAA;;;AEvBvH;;AAEG;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mintplayer/ng-spark-auth",
   "private": false,
-  "version": "22.1.0",
+  "version": "22.2.0",
   "description": "Angular authentication library for MintPlayer.Spark",
   "repository": {
     "type": "git",
@@ -71,6 +71,10 @@
       "types": "./types/mintplayer-ng-spark-auth-routes.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-auth-routes.mjs"
     },
+    "./sign-in": {
+      "types": "./types/mintplayer-ng-spark-auth-sign-in.d.ts",
+      "default": "./fesm2022/mintplayer-ng-spark-auth-sign-in.mjs"
+    },
     "./two-factor": {
       "types": "./types/mintplayer-ng-spark-auth-two-factor.d.ts",
       "default": "./fesm2022/mintplayer-ng-spark-auth-two-factor.mjs"

package/types/mintplayer-ng-spark-auth-auth-bar.d.ts

@@ -6,6 +6,8 @@ declare class SparkAuthBarComponent {
     readonly authService: SparkAuthService;
     readonly config: _mintplayer_ng_spark_auth_models.SparkAuthConfig;
     private readonly router;
+    /** Same target the guard and interceptor use, so the bar cannot link somewhere they would not send you. */
+    readonly signInUrl: string;
     onLogout(): Promise<void>;
     static ɵfac: i0.ɵɵFactoryDeclaration<SparkAuthBarComponent, never>;
     static ɵcmp: i0.ɵɵComponentDeclaration<SparkAuthBarComponent, "spark-auth-bar", never, {}, {}, never, never, true, never>;

package/types/mintplayer-ng-spark-auth-core.d.ts

@@ -1,5 +1,5 @@
 import * as i0 from '@angular/core';
-import { AuthUser, SparkExternalLoginOptions, SparkExternalLoginResult } from '@mintplayer/ng-spark-auth/models';
+import { AuthUser, SparkAuthCapabilities, SparkExternalLoginOptions, SparkExternalLoginResult } from '@mintplayer/ng-spark-auth/models';
 
 declare class SparkAuthService {
     private readonly http;
@@ -13,6 +13,13 @@ declare class SparkAuthService {
     loginTwoFactor(twoFactorCode: string, twoFactorRecoveryCode?: string): Promise<void>;
     register(email: string, password: string): Promise<void>;
     logout(): Promise<void>;
+    /**
+     * What sign-in methods this deployment actually offers.
+     *
+     * Read from the server rather than assumed from the client's own route configuration: the two are
+     * configured independently, and a mismatch is otherwise invisible until a user hits it.
+     */
+    capabilities(): Promise<SparkAuthCapabilities>;
     csrfRefresh(): Promise<void>;
     checkAuth(): Promise<AuthUser | null>;
     /**

package/types/mintplayer-ng-spark-auth-forgot-password.d.ts

@@ -7,7 +7,7 @@ declare class SparkForgotPasswordComponent {
     private readonly fb;
     private readonly authService;
     private readonly translation;
-    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteConfig, string>>;
+    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteEntries, string>>;
     colors: typeof Color;
     readonly loading: _angular_core.WritableSignal<boolean>;
     readonly errorMessage: _angular_core.WritableSignal<string>;

package/types/mintplayer-ng-spark-auth-login.d.ts

@@ -10,7 +10,7 @@ declare class SparkLoginComponent {
     private readonly route;
     private readonly config;
     private readonly translation;
-    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteConfig, string>>;
+    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteEntries, string>>;
     colors: typeof Color;
     readonly loading: _angular_core.WritableSignal<boolean>;
     readonly errorMessage: _angular_core.WritableSignal<string>;

package/types/mintplayer-ng-spark-auth-models.d.ts

@@ -1,4 +1,5 @@
 import { InjectionToken, Type } from '@angular/core';
+import { Router } from '@angular/router';
 
 interface AuthUser {
     isAuthenticated: boolean;
@@ -15,19 +16,63 @@ interface SparkAuthConfig {
 declare const SPARK_AUTH_CONFIG: InjectionToken<SparkAuthConfig>;
 declare const defaultSparkAuthConfig: SparkAuthConfig;
 
+/** An external provider a user can actually click, as reported by the server. */
+interface SparkExternalProvider {
+    scheme: string;
+    displayName: string;
+}
+/**
+ * What `GET /spark/auth/capabilities` reports: how much of the local-credential surface this
+ * application mounts, and which external providers are registered.
+ *
+ * This exists so the two tiers cannot silently disagree. The route config is a build-time choice
+ * and the server's mode is a deployment-time one; without a channel between them, a mismatch shows
+ * up as a form that posts into a 404, or a sign-in page with no way to sign in.
+ */
+interface SparkAuthCapabilities {
+    localCredentials: 'Full' | 'SignInOnly' | 'Disabled';
+    externalProviders: SparkExternalProvider[];
+}
+
 type SparkAuthRouteEntry = string | {
     path: string;
     component?: Type<unknown>;
 };
-interface SparkAuthRouteConfig {
+/**
+ * How much of the local-credential (email + password) page family to route.
+ *
+ * Mirrors the server's `SparkLocalCredentials`, and for the same reason it is a mode rather
+ * than five independent switches: the pages form a star centred on the login page, and every
+ * template dereferences its siblings' paths unconditionally, so removing any proper subset
+ * leaves a dangling link. The family is the unit on both tiers.
+ */
+type SparkLocalCredentialsMode = 'full' | 'sign-in-only' | 'disabled';
+/** The routable local-credential pages. Kept separate from {@link SparkAuthRouteConfig} so that
+ * adding non-route options below cannot widen {@link SparkAuthRoutePaths}. */
+interface SparkAuthRouteEntries {
+    /** The provider-button landing page. Routed whenever local credentials are limited. */
+    signIn?: SparkAuthRouteEntry;
     login?: SparkAuthRouteEntry;
     twoFactor?: SparkAuthRouteEntry;
     register?: SparkAuthRouteEntry;
     forgotPassword?: SparkAuthRouteEntry;
     resetPassword?: SparkAuthRouteEntry;
 }
-type SparkAuthRoutePaths = Required<Record<keyof SparkAuthRouteConfig, string>>;
-declare const SPARK_AUTH_ROUTE_PATHS: InjectionToken<Required<Record<keyof SparkAuthRouteConfig, string>>>;
+interface SparkAuthRouteConfig extends SparkAuthRouteEntries {
+    /**
+     * Defaults to `'full'`, which routes every page — the behaviour of every version before this
+     * option existed. Set it to match the server's `LocalCredentials` mode; `GET /spark/auth/capabilities`
+     * reports what the server is actually running.
+     */
+    localCredentials?: SparkLocalCredentialsMode;
+}
+/**
+ * Every path is present regardless of mode. The pages that are dropped are dropped together, so no
+ * surviving template can dereference a missing sibling — which is what lets this stay `Required`
+ * and keeps the change additive for consumers.
+ */
+type SparkAuthRoutePaths = Required<Record<keyof SparkAuthRouteEntries, string>>;
+declare const SPARK_AUTH_ROUTE_PATHS: InjectionToken<Required<Record<keyof SparkAuthRouteEntries, string>>>;
 
 /**
  * Shared validator for `returnUrl` query parameters consumed by the auth
@@ -74,5 +119,19 @@ interface SparkExternalLoginMessage {
 }
 declare const SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE = "spark:external-login";
 
-export { SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE, defaultSparkAuthConfig, isSafeReturnUrl, sanitizeReturnUrl };
-export type { AuthUser, SparkAuthConfig, SparkAuthRouteConfig, SparkAuthRouteEntry, SparkAuthRoutePaths, SparkExternalLoginError, SparkExternalLoginMessage, SparkExternalLoginMode, SparkExternalLoginOptions, SparkExternalLoginResult };
+/**
+ * Where to send someone who is not signed in.
+ *
+ * `loginUrl` is the single source of truth for this, and the only thing the guard, the interceptor
+ * and the auth bar should consult — an application that turns off local credentials points it at
+ * its own sign-in landing route.
+ *
+ * The reason this is a function rather than a property read is the failure mode it closes: nothing
+ * connects `loginUrl` to the routes that actually exist, so pointing it at a route that was never
+ * registered produces a redirect into a blank page with no type error, no build failure and no
+ * runtime error. In development that now warns, once, naming the value and the fix.
+ */
+declare function resolveSignInUrl(config: SparkAuthConfig, router: Router): string;
+
+export { SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE, defaultSparkAuthConfig, isSafeReturnUrl, resolveSignInUrl, sanitizeReturnUrl };
+export type { AuthUser, SparkAuthCapabilities, SparkAuthConfig, SparkAuthRouteConfig, SparkAuthRouteEntries, SparkAuthRouteEntry, SparkAuthRoutePaths, SparkExternalLoginError, SparkExternalLoginMessage, SparkExternalLoginMode, SparkExternalLoginOptions, SparkExternalLoginResult, SparkExternalProvider, SparkLocalCredentialsMode };

package/types/mintplayer-ng-spark-auth-register.d.ts

@@ -8,7 +8,7 @@ declare class SparkRegisterComponent {
     private readonly authService;
     private readonly router;
     private readonly translation;
-    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteConfig, string>>;
+    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteEntries, string>>;
     colors: typeof Color;
     readonly loading: _angular_core.WritableSignal<boolean>;
     readonly errorMessage: _angular_core.WritableSignal<string>;

package/types/mintplayer-ng-spark-auth-reset-password.d.ts

@@ -10,7 +10,7 @@ declare class SparkResetPasswordComponent implements OnInit {
     private readonly router;
     private readonly route;
     private readonly translation;
-    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteConfig, string>>;
+    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteEntries, string>>;
     colors: typeof Color;
     readonly loading: _angular_core.WritableSignal<boolean>;
     readonly errorMessage: _angular_core.WritableSignal<string>;

package/types/mintplayer-ng-spark-auth-routes.d.ts

@@ -1,5 +1,20 @@
 import { SparkAuthRouteConfig } from '@mintplayer/ng-spark-auth/models';
 
+/**
+ * The routes for Spark's authentication pages.
+ *
+ * `config.localCredentials` chooses how much of the email/password family to route, mirroring the
+ * server's `SparkLocalCredentials`. `GET /spark/auth/capabilities` reports what the server is
+ * actually running, so the two can be checked against each other.
+ *
+ * The `import()` expressions live *inside* the branches that need them. That placement is the point:
+ * a bundler decides whether to emit a lazy chunk from whether the `import()` call site is reachable,
+ * not from whether the route object referencing it survives — so filtering the children array after
+ * the fact would still ship every page. Excluded pages must have no reachable `import()` at all.
+ *
+ * `SPARK_AUTH_ROUTE_PATHS` is still provided in full. The excluded pages are excluded together, so
+ * nothing that survives can link to something that does not, and the token stays `Required`.
+ */
 declare function sparkAuthRoutes(config?: SparkAuthRouteConfig): any[];
 
 export { sparkAuthRoutes };

package/types/mintplayer-ng-spark-auth-sign-in.d.ts

@@ -0,0 +1,36 @@
+import * as _angular_core from '@angular/core';
+import * as _mintplayer_ng_spark_auth_models from '@mintplayer/ng-spark-auth/models';
+import { SparkExternalProvider } from '@mintplayer/ng-spark-auth/models';
+import { Color } from '@mintplayer/ng-bootstrap';
+
+/**
+ * The sign-in landing page for an application whose local credentials are turned off — a button per
+ * external provider, and a link to the password form when there still is one.
+ *
+ * The providers come from `GET /spark/auth/capabilities` rather than from a list the application
+ * hard-codes. That is the point of the component: every consumer that hand-rolled this before wrote
+ * the scheme name as a string literal, which is a silent mismatch waiting to happen the moment the
+ * server's provider registration changes.
+ */
+declare class SparkSignInComponent {
+    private readonly authService;
+    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteEntries, string>>;
+    readonly colors: typeof Color;
+    readonly providers: _angular_core.WritableSignal<SparkExternalProvider[]>;
+    readonly localCredentialsAvailable: _angular_core.WritableSignal<boolean>;
+    readonly loading: _angular_core.WritableSignal<boolean>;
+    readonly failed: _angular_core.WritableSignal<boolean>;
+    constructor();
+    private load;
+    /**
+     * The routes are a build-time decision and the server's mode a deployment-time one, so they can
+     * disagree without anything failing loudly. Reaching this page at all means the app routed it,
+     * which it only does when local credentials are meant to be limited.
+     */
+    private warnOnMismatch;
+    signInWith(provider: SparkExternalProvider): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<SparkSignInComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<SparkSignInComponent, "spark-sign-in", never, {}, {}, never, never, true, never>;
+}
+
+export { SparkSignInComponent };

package/types/mintplayer-ng-spark-auth-two-factor.d.ts

@@ -10,7 +10,7 @@ declare class SparkTwoFactorComponent {
     private readonly route;
     private readonly config;
     private readonly translation;
-    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteConfig, string>>;
+    readonly routePaths: Required<Record<keyof _mintplayer_ng_spark_auth_models.SparkAuthRouteEntries, string>>;
     colors: typeof Color;
     readonly loading: _angular_core.WritableSignal<boolean>;
     readonly errorMessage: _angular_core.WritableSignal<string>;