@mintplayer/ng-spark 22.29.0 → 22.31.0

package/fesm2022/mintplayer-ng-spark-auth-login.mjs

@@ -0,0 +1,282 @@
+import * as i0 from "@angular/core";
+import { ChangeDetectionStrategy, Component, computed, inject, signal } from "@angular/core";
+import * as i1 from "@angular/forms";
+import { FormBuilder, ReactiveFormsModule, Validators } from "@angular/forms";
+import { ActivatedRoute, Router, RouterLink } from "@angular/router";
+import { HttpErrorResponse } from "@angular/common/http";
+import { Color } from "@mintplayer/ng-bootstrap";
+import { BsAlertComponent } from "@mintplayer/ng-bootstrap/alert";
+import { BsCardComponent, BsCardHeaderComponent } from "@mintplayer/ng-bootstrap/card";
+import { BsFormComponent, BsFormControlDirective } from "@mintplayer/ng-bootstrap/form";
+import { BsCheckboxComponent } from "@mintplayer/ng-bootstrap/checkbox";
+import { BsSpinnerComponent } from "@mintplayer/ng-bootstrap/spinner";
+import { SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, passkeysSupported, sanitizeReturnUrl } from "@mintplayer/ng-spark/auth/models";
+import { SparkAuthService, SparkAuthTranslationService } from "@mintplayer/ng-spark/auth/core";
+import { SparkExternalLoginButtonsComponent } from "@mintplayer/ng-spark/auth/external-login";
+import { TranslateKeyPipe } from "@mintplayer/ng-spark/auth/pipes";
+var SparkLoginComponent = class SparkLoginComponent {
+	fb = inject(FormBuilder);
+	authService = inject(SparkAuthService);
+	router = inject(Router);
+	route = inject(ActivatedRoute);
+	config = inject(SPARK_AUTH_CONFIG);
+	translation = inject(SparkAuthTranslationService);
+	routePaths = inject(SPARK_AUTH_ROUTE_PATHS);
+	colors = Color;
+	loading = signal(false, ...ngDevMode ? [{ debugName: "loading" }] : /* istanbul ignore next */ []);
+	errorMessage = signal("", ...ngDevMode ? [{ debugName: "errorMessage" }] : /* istanbul ignore next */ []);
+	passkeysAvailable = signal(false, ...ngDevMode ? [{ debugName: "passkeysAvailable" }] : /* istanbul ignore next */ []);
+	passkeyBusy = signal(false, ...ngDevMode ? [{ debugName: "passkeyBusy" }] : /* istanbul ignore next */ []);
+	signInIdentifiers = signal(["email", "userName"], ...ngDevMode ? [{ debugName: "signInIdentifiers" }] : /* istanbul ignore next */ []);
+	identifierField = computed(() => {
+		const kinds = this.signInIdentifiers();
+		const email = kinds.includes("email");
+		const userName = kinds.includes("userName");
+		if (email && !userName) return {
+			label: "auth.email",
+			type: "email",
+			autocomplete: "email"
+		};
+		if (userName && !email) return {
+			label: "auth.userName",
+			type: "text",
+			autocomplete: "username"
+		};
+		return {
+			label: "auth.emailOrUserName",
+			type: "text",
+			autocomplete: "username"
+		};
+	}, ...ngDevMode ? [{ debugName: "identifierField" }] : /* istanbul ignore next */ []);
+	constructor() {
+		this.loadCapabilities();
+	}
+	async loadCapabilities() {
+		try {
+			const capabilities = await this.authService.capabilities();
+			this.passkeysAvailable.set(capabilities.passkeys === true && passkeysSupported());
+			if (capabilities.signInIdentifiers?.length) this.signInIdentifiers.set(capabilities.signInIdentifiers);
+		} catch {
+			this.passkeysAvailable.set(false);
+		}
+	}
+	async signInWithPasskey() {
+		this.errorMessage.set("");
+		this.passkeyBusy.set(true);
+		try {
+			const returnUrl = sanitizeReturnUrl(this.route.snapshot.queryParamMap.get("returnUrl"), this.config.defaultRedirectUrl);
+			const result = await this.authService.signInWithPasskey();
+			if (result.success) {
+				await this.router.navigateByUrl(returnUrl);
+				return;
+			}
+			if (result.error === "cancelled") return;
+			this.errorMessage.set(this.translation.t(result.error === "locked_out" ? "auth.lockedOut" : "auth.passkeyFailed"));
+		} finally {
+			this.passkeyBusy.set(false);
+		}
+	}
+	form = this.fb.group({
+		email: ["", Validators.required],
+		password: ["", Validators.required],
+		rememberMe: [false]
+	});
+	async onSubmit() {
+		if (this.form.invalid) return;
+		this.loading.set(true);
+		this.errorMessage.set("");
+		const { email, password, rememberMe } = this.form.value;
+		try {
+			await this.authService.login(email, password, rememberMe === true);
+			const returnUrl = sanitizeReturnUrl(this.route.snapshot.queryParamMap.get("returnUrl"), this.config.defaultRedirectUrl);
+			this.router.navigateByUrl(returnUrl);
+		} catch (err) {
+			if (err instanceof HttpErrorResponse && err.status === 401 && err.error?.detail === "RequiresTwoFactor") {
+				const returnUrl = sanitizeReturnUrl(this.route.snapshot.queryParamMap.get("returnUrl"), this.config.defaultRedirectUrl);
+				this.router.navigate([this.routePaths.twoFactor], { queryParams: { returnUrl } });
+			} else this.errorMessage.set(this.translation.t("auth.invalidCredentials"));
+		} finally {
+			this.loading.set(false);
+		}
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: SparkLoginComponent,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Component
+	});
+	static ɵcmp = i0.ɵɵngDeclareComponent({
+		minVersion: "17.0.0",
+		version: "22.2.0",
+		type: SparkLoginComponent,
+		isStandalone: true,
+		selector: "spark-login",
+		ngImport: i0,
+		template: "<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (errorMessage()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-3\">{{ errorMessage() }}</bs-alert>\n      }\n\n      <!-- The same provider buttons as the sign-in landing page. They render nothing when the server\n           reports no provider, and so does the divider, which only separates them from the form. -->\n      <spark-external-login-buttons #externalLogin />\n      @if (externalLogin.hasProviders()) {\n        <div class=\"text-center text-muted my-2 spark-login-or\">{{ 'auth.or' | t }}</div>\n      }\n\n      <bs-form>\n        <form [formGroup]=\"form\" (ngSubmit)=\"onSubmit()\">\n          <div class=\"mb-3\">\n            <label for=\"email\" class=\"form-label\">{{ identifierField().label | t }}</label>\n            <input\n              [type]=\"identifierField().type\"\n              id=\"email\"\n              formControlName=\"email\"\n              [attr.autocomplete]=\"identifierField().autocomplete\"\n            />\n          </div>\n\n          <div class=\"mb-3\">\n            <label for=\"password\" class=\"form-label\">{{ 'auth.password' | t }}</label>\n            <input\n              type=\"password\"\n              id=\"password\"\n              formControlName=\"password\"\n              autocomplete=\"current-password\"\n            />\n          </div>\n\n          <div class=\"mb-3\">\n            <bs-checkbox [type]=\"'checkbox'\" formControlName=\"rememberMe\" [name]=\"'rememberMe'\">{{ 'auth.rememberMe' | t }}</bs-checkbox>\n          </div>\n\n          <button\n            type=\"submit\"\n            class=\"btn btn-primary w-100\"\n            [disabled]=\"loading()\"\n          >\n            @if (loading()) {\n              <bs-spinner class=\"me-1\" />\n            }\n            {{ 'auth.login' | t }}\n          </button>\n        </form>\n      </bs-form>\n\n      <!-- Passkeys are independent of withLocalLogin()/withExternalLogin(), so the button has to be\n           reachable from whichever sign-in page the app mounted. Without it here, an app using only\n           local login could enroll a passkey and never be able to use it. -->\n      @if (passkeysAvailable()) {\n        <div class=\"text-center text-muted my-2\">{{ 'auth.or' | t }}</div>\n        <button type=\"button\" class=\"btn btn-outline-secondary w-100\"\n                [disabled]=\"passkeyBusy()\" (click)=\"signInWithPasskey()\">\n          <i class=\"bi bi-fingerprint me-2\"></i>{{ 'auth.signInWithPasskey' | t }}\n        </button>\n      }\n\n      <!-- Registration is a separate opt-in feature (withRegistration()), so it may not be mounted\n           even though this page is. A [routerLink] bound to undefined navigates to the current\n           route instead of failing, which reads as a dead link. -->\n      @if (routePaths.register) {\n        <div class=\"mt-3 text-center\">\n          <a [routerLink]=\"routePaths.register\">{{ 'auth.createAccount' | t }}</a>\n        </div>\n      }\n      <div class=\"mt-2 text-center\">\n        <a [routerLink]=\"routePaths.forgotPassword\">{{ 'auth.forgotPassword' | t }}</a>\n      </div>\n    </div>\n  </bs-card>\n</div>\n",
+		dependencies: [
+			{
+				kind: "ngmodule",
+				type: ReactiveFormsModule
+			},
+			{
+				kind: "directive",
+				type: i1.ɵNgNoValidate,
+				selector: "form:not([ngNoForm]):not([ngNativeValidate])"
+			},
+			{
+				kind: "directive",
+				type: i1.DefaultValueAccessor,
+				selector: "input:not([type=checkbox]):not([ngNoCva])[formControlName],textarea:not([ngNoCva])[formControlName],input:not([type=checkbox]):not([ngNoCva])[formControl],textarea:not([ngNoCva])[formControl],input:not([type=checkbox]):not([ngNoCva])[ngModel],textarea:not([ngNoCva])[ngModel],[ngDefaultControl]"
+			},
+			{
+				kind: "directive",
+				type: i1.NgControlStatus,
+				selector: "[formControlName],[ngModel],[formControl]"
+			},
+			{
+				kind: "directive",
+				type: i1.NgControlStatusGroup,
+				selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]"
+			},
+			{
+				kind: "directive",
+				type: i1.FormGroupDirective,
+				selector: "[formGroup]",
+				inputs: ["formGroup"],
+				outputs: ["ngSubmit"],
+				exportAs: ["ngForm"]
+			},
+			{
+				kind: "directive",
+				type: i1.FormControlName,
+				selector: "[formControlName]",
+				inputs: [
+					"formControlName",
+					"disabled",
+					"ngModel"
+				],
+				outputs: ["ngModelChange"]
+			},
+			{
+				kind: "directive",
+				type: RouterLink,
+				selector: "[routerLink]",
+				inputs: [
+					"target",
+					"queryParams",
+					"fragment",
+					"queryParamsHandling",
+					"state",
+					"info",
+					"relativeTo",
+					"preserveFragment",
+					"skipLocationChange",
+					"replaceUrl",
+					"browserUrl",
+					"routerLink"
+				]
+			},
+			{
+				kind: "component",
+				type: BsAlertComponent,
+				selector: "bs-alert",
+				inputs: [
+					"type",
+					"announce",
+					"isVisible"
+				],
+				outputs: ["isVisibleChange", "afterOpenedOrClosed"]
+			},
+			{
+				kind: "component",
+				type: BsCardComponent,
+				selector: "bs-card",
+				inputs: ["color", "outline"]
+			},
+			{
+				kind: "component",
+				type: BsCardHeaderComponent,
+				selector: "bs-card-header",
+				inputs: ["color", "navStyle"]
+			},
+			{
+				kind: "component",
+				type: BsFormComponent,
+				selector: "bs-form",
+				inputs: ["action", "method"],
+				outputs: ["submitted"]
+			},
+			{
+				kind: "directive",
+				type: BsFormControlDirective,
+				selector: "bs-form input:not(.no-form-control), bs-form textarea:not(.no-form-control)"
+			},
+			{
+				kind: "component",
+				type: BsCheckboxComponent,
+				selector: "bs-checkbox",
+				inputs: [
+					"type",
+					"isToggled",
+					"indeterminate",
+					"name",
+					"value",
+					"group"
+				],
+				outputs: ["isToggledChange", "indeterminateChange"]
+			},
+			{
+				kind: "component",
+				type: BsSpinnerComponent,
+				selector: "bs-spinner",
+				inputs: ["type", "color"]
+			},
+			{
+				kind: "component",
+				type: SparkExternalLoginButtonsComponent,
+				selector: "spark-external-login-buttons",
+				inputs: ["returnUrl", "providerTemplate"]
+			},
+			{
+				kind: "pipe",
+				type: TranslateKeyPipe,
+				name: "t"
+			}
+		],
+		changeDetection: i0.ChangeDetectionStrategy.OnPush
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: SparkLoginComponent,
+	decorators: [{
+		type: Component,
+		args: [{
+			selector: "spark-login",
+			standalone: true,
+			changeDetection: ChangeDetectionStrategy.OnPush,
+			imports: [
+				ReactiveFormsModule,
+				RouterLink,
+				BsAlertComponent,
+				BsCardComponent,
+				BsCardHeaderComponent,
+				BsFormComponent,
+				BsFormControlDirective,
+				BsCheckboxComponent,
+				BsSpinnerComponent,
+				SparkExternalLoginButtonsComponent,
+				TranslateKeyPipe
+			],
+			template: "<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (errorMessage()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-3\">{{ errorMessage() }}</bs-alert>\n      }\n\n      <!-- The same provider buttons as the sign-in landing page. They render nothing when the server\n           reports no provider, and so does the divider, which only separates them from the form. -->\n      <spark-external-login-buttons #externalLogin />\n      @if (externalLogin.hasProviders()) {\n        <div class=\"text-center text-muted my-2 spark-login-or\">{{ 'auth.or' | t }}</div>\n      }\n\n      <bs-form>\n        <form [formGroup]=\"form\" (ngSubmit)=\"onSubmit()\">\n          <div class=\"mb-3\">\n            <label for=\"email\" class=\"form-label\">{{ identifierField().label | t }}</label>\n            <input\n              [type]=\"identifierField().type\"\n              id=\"email\"\n              formControlName=\"email\"\n              [attr.autocomplete]=\"identifierField().autocomplete\"\n            />\n          </div>\n\n          <div class=\"mb-3\">\n            <label for=\"password\" class=\"form-label\">{{ 'auth.password' | t }}</label>\n            <input\n              type=\"password\"\n              id=\"password\"\n              formControlName=\"password\"\n              autocomplete=\"current-password\"\n            />\n          </div>\n\n          <div class=\"mb-3\">\n            <bs-checkbox [type]=\"'checkbox'\" formControlName=\"rememberMe\" [name]=\"'rememberMe'\">{{ 'auth.rememberMe' | t }}</bs-checkbox>\n          </div>\n\n          <button\n            type=\"submit\"\n            class=\"btn btn-primary w-100\"\n            [disabled]=\"loading()\"\n          >\n            @if (loading()) {\n              <bs-spinner class=\"me-1\" />\n            }\n            {{ 'auth.login' | t }}\n          </button>\n        </form>\n      </bs-form>\n\n      <!-- Passkeys are independent of withLocalLogin()/withExternalLogin(), so the button has to be\n           reachable from whichever sign-in page the app mounted. Without it here, an app using only\n           local login could enroll a passkey and never be able to use it. -->\n      @if (passkeysAvailable()) {\n        <div class=\"text-center text-muted my-2\">{{ 'auth.or' | t }}</div>\n        <button type=\"button\" class=\"btn btn-outline-secondary w-100\"\n                [disabled]=\"passkeyBusy()\" (click)=\"signInWithPasskey()\">\n          <i class=\"bi bi-fingerprint me-2\"></i>{{ 'auth.signInWithPasskey' | t }}\n        </button>\n      }\n\n      <!-- Registration is a separate opt-in feature (withRegistration()), so it may not be mounted\n           even though this page is. A [routerLink] bound to undefined navigates to the current\n           route instead of failing, which reads as a dead link. -->\n      @if (routePaths.register) {\n        <div class=\"mt-3 text-center\">\n          <a [routerLink]=\"routePaths.register\">{{ 'auth.createAccount' | t }}</a>\n        </div>\n      }\n      <div class=\"mt-2 text-center\">\n        <a [routerLink]=\"routePaths.forgotPassword\">{{ 'auth.forgotPassword' | t }}</a>\n      </div>\n    </div>\n  </bs-card>\n</div>\n"
+		}]
+	}],
+	ctorParameters: () => []
+});
+export { SparkLoginComponent };
+
+//# sourceMappingURL=mintplayer-ng-spark-auth-login.mjs.map

package/fesm2022/mintplayer-ng-spark-auth-login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mintplayer-ng-spark-auth-login.mjs","names":[],"sources":["../../auth/login/src/spark-login.component.ts","../../auth/login/src/spark-login.component.html"],"sourcesContent":["import { ChangeDetectionStrategy, Component, computed, inject, signal } from '@angular/core';\nimport { ReactiveFormsModule, FormBuilder, Validators } from '@angular/forms';\nimport { RouterLink, ActivatedRoute, Router } from '@angular/router';\nimport { HttpErrorResponse } from '@angular/common/http';\nimport { Color } from '@mintplayer/ng-bootstrap';\nimport { BsAlertComponent } from '@mintplayer/ng-bootstrap/alert';\nimport { BsCardComponent, BsCardHeaderComponent } from '@mintplayer/ng-bootstrap/card';\nimport { BsFormComponent, BsFormControlDirective } from '@mintplayer/ng-bootstrap/form';\nimport { BsCheckboxComponent } from '@mintplayer/ng-bootstrap/checkbox';\nimport { BsSpinnerComponent } from '@mintplayer/ng-bootstrap/spinner';\nimport { SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, sanitizeReturnUrl, passkeysSupported, SparkSignInIdentifier } from '@mintplayer/ng-spark/auth/models';\nimport { SparkAuthService, SparkAuthTranslationService } from '@mintplayer/ng-spark/auth/core';\nimport { SparkExternalLoginButtonsComponent } from '@mintplayer/ng-spark/auth/external-login';\nimport { TranslateKeyPipe } from '@mintplayer/ng-spark/auth/pipes';\n\n@Component({\n  selector: 'spark-login',\n  standalone: true,\n  changeDetection: ChangeDetectionStrategy.OnPush,\n  imports: [ReactiveFormsModule, RouterLink, BsAlertComponent, BsCardComponent, BsCardHeaderComponent, BsFormComponent, BsFormControlDirective, BsCheckboxComponent, BsSpinnerComponent, SparkExternalLoginButtonsComponent, TranslateKeyPipe],\n  templateUrl: './spark-login.component.html',\n})\nexport class SparkLoginComponent {\n  private readonly fb = inject(FormBuilder);\n  private readonly authService = inject(SparkAuthService);\n  private readonly router = inject(Router);\n  private readonly route = inject(ActivatedRoute);\n  private readonly config = inject(SPARK_AUTH_CONFIG);\n  private readonly translation = inject(SparkAuthTranslationService);\n  readonly routePaths = inject(SPARK_AUTH_ROUTE_PATHS);\n\n  colors = Color;\n  readonly loading = signal(false);\n  readonly errorMessage = signal('');\n\n  /**\n   * The passkey button belongs here as well as on the sign-in landing page.\n   *\n   * ⚠️ Without it an application using `withLocalLogin()` can *enroll* a passkey and then have no way\n   * to use it, because the landing page it would otherwise appear on is only mounted by\n   * `withExternalLogin()`. Passkeys are independent of both features, so the button has to be\n   * reachable from whichever sign-in page the application actually mounted.\n   */\n  readonly passkeysAvailable = signal(false);\n  readonly passkeyBusy = signal(false);\n\n  /**\n   * What the server's `SignInIdentifiers` accepts, which shapes the identifier field's label, input\n   * type and autocomplete. Both until the capabilities arrive, and when the server does not say.\n   */\n  private readonly signInIdentifiers = signal<SparkSignInIdentifier[]>(['email', 'userName']);\n  readonly identifierField = computed(() => {\n    const kinds = this.signInIdentifiers();\n    const email = kinds.includes('email');\n    const userName = kinds.includes('userName');\n    if (email && !userName) return { label: 'auth.email', type: 'email', autocomplete: 'email' };\n    if (userName && !email) return { label: 'auth.userName', type: 'text', autocomplete: 'username' };\n    return { label: 'auth.emailOrUserName', type: 'text', autocomplete: 'username' };\n  });\n\n  constructor() {\n    void this.loadCapabilities();\n  }\n\n  private async loadCapabilities(): Promise<void> {\n    try {\n      // <spark-external-login-buttons> asks at the same moment; the service makes that one request.\n      const capabilities = await this.authService.capabilities();\n      this.passkeysAvailable.set(capabilities.passkeys === true && passkeysSupported());\n      if (capabilities.signInIdentifiers?.length) this.signInIdentifiers.set(capabilities.signInIdentifiers);\n    } catch {\n      // A capability lookup that fails must not break password sign-in, which is this page's job.\n      this.passkeysAvailable.set(false);\n    }\n  }\n\n  /** Same shape as {@link onSubmit}'s success path — sign in, then leave the page. */\n  async signInWithPasskey(): Promise<void> {\n    this.errorMessage.set('');\n    this.passkeyBusy.set(true);\n    try {\n      const returnUrl = sanitizeReturnUrl(\n        this.route.snapshot.queryParamMap.get('returnUrl'), this.config.defaultRedirectUrl);\n      const result = await this.authService.signInWithPasskey();\n\n      if (result.success) {\n        await this.router.navigateByUrl(returnUrl);\n        return;\n      }\n\n      // Dismissing the prompt is \"not now\", not a failure.\n      if (result.error === 'cancelled') return;\n\n      this.errorMessage.set(this.translation.t(\n        result.error === 'locked_out' ? 'auth.lockedOut' : 'auth.passkeyFailed'));\n    } finally {\n      this.passkeyBusy.set(false);\n    }\n  }\n\n  readonly form = this.fb.group({\n    email: ['', Validators.required],\n    password: ['', Validators.required],\n    rememberMe: [false],\n  });\n\n  async onSubmit(): Promise<void> {\n    if (this.form.invalid) return;\n\n    this.loading.set(true);\n    this.errorMessage.set('');\n\n    const { email, password, rememberMe } = this.form.value;\n\n    try {\n      await this.authService.login(email!, password!, rememberMe === true);\n      // R2-H9: validate returnUrl against the local-path rule. navigateByUrl\n      // accepts some external shapes (protocol-relative '//attacker'); reject\n      // and fall back to the default to close the open-redirect.\n      const returnUrl = sanitizeReturnUrl(\n        this.route.snapshot.queryParamMap.get('returnUrl'),\n        this.config.defaultRedirectUrl);\n      this.router.navigateByUrl(returnUrl);\n    } catch (err: any) {\n      if (err instanceof HttpErrorResponse && err.status === 401 && err.error?.detail === 'RequiresTwoFactor') {\n        // Forward the same sanitized returnUrl to the 2FA step so the user\n        // lands on the intended in-app page after completing the challenge.\n        const returnUrl = sanitizeReturnUrl(\n          this.route.snapshot.queryParamMap.get('returnUrl'),\n          this.config.defaultRedirectUrl);\n        this.router.navigate([this.routePaths.twoFactor], {\n          queryParams: { returnUrl },\n        });\n      } else {\n        this.errorMessage.set(this.translation.t('auth.invalidCredentials'));\n      }\n    } finally {\n      this.loading.set(false);\n    }\n  }\n}\n\nexport default SparkLoginComponent;\n","<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (errorMessage()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-3\">{{ errorMessage() }}</bs-alert>\n      }\n\n      <!-- The same provider buttons as the sign-in landing page. They render nothing when the server\n           reports no provider, and so does the divider, which only separates them from the form. -->\n      <spark-external-login-buttons #externalLogin />\n      @if (externalLogin.hasProviders()) {\n        <div class=\"text-center text-muted my-2 spark-login-or\">{{ 'auth.or' | t }}</div>\n      }\n\n      <bs-form>\n        <form [formGroup]=\"form\" (ngSubmit)=\"onSubmit()\">\n          <div class=\"mb-3\">\n            <label for=\"email\" class=\"form-label\">{{ identifierField().label | t }}</label>\n            <input\n              [type]=\"identifierField().type\"\n              id=\"email\"\n              formControlName=\"email\"\n              [attr.autocomplete]=\"identifierField().autocomplete\"\n            />\n          </div>\n\n          <div class=\"mb-3\">\n            <label for=\"password\" class=\"form-label\">{{ 'auth.password' | t }}</label>\n            <input\n              type=\"password\"\n              id=\"password\"\n              formControlName=\"password\"\n              autocomplete=\"current-password\"\n            />\n          </div>\n\n          <div class=\"mb-3\">\n            <bs-checkbox [type]=\"'checkbox'\" formControlName=\"rememberMe\" [name]=\"'rememberMe'\">{{ 'auth.rememberMe' | t }}</bs-checkbox>\n          </div>\n\n          <button\n            type=\"submit\"\n            class=\"btn btn-primary w-100\"\n            [disabled]=\"loading()\"\n          >\n            @if (loading()) {\n              <bs-spinner class=\"me-1\" />\n            }\n            {{ 'auth.login' | t }}\n          </button>\n        </form>\n      </bs-form>\n\n      <!-- Passkeys are independent of withLocalLogin()/withExternalLogin(), so the button has to be\n           reachable from whichever sign-in page the app mounted. Without it here, an app using only\n           local login could enroll a passkey and never be able to use it. -->\n      @if (passkeysAvailable()) {\n        <div class=\"text-center text-muted my-2\">{{ 'auth.or' | t }}</div>\n        <button type=\"button\" class=\"btn btn-outline-secondary w-100\"\n                [disabled]=\"passkeyBusy()\" (click)=\"signInWithPasskey()\">\n          <i class=\"bi bi-fingerprint me-2\"></i>{{ 'auth.signInWithPasskey' | t }}\n        </button>\n      }\n\n      <!-- Registration is a separate opt-in feature (withRegistration()), so it may not be mounted\n           even though this page is. A [routerLink] bound to undefined navigates to the current\n           route instead of failing, which reads as a dead link. -->\n      @if (routePaths.register) {\n        <div class=\"mt-3 text-center\">\n          <a [routerLink]=\"routePaths.register\">{{ 'auth.createAccount' | t }}</a>\n        </div>\n      }\n      <div class=\"mt-2 text-center\">\n        <a [routerLink]=\"routePaths.forgotPassword\">{{ 'auth.forgotPassword' | t }}</a>\n      </div>\n    </div>\n  </bs-card>\n</div>\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAb,MAAa,oBAAmB;CACb,KAAK,OAAO,WAAW;CACvB,cAAc,OAAO,gBAAgB;CACrC,SAAS,OAAO,MAAM;CACtB,QAAQ,OAAO,cAAc;CAC7B,SAAS,OAAO,iBAAiB;CACjC,cAAc,OAAO,2BAA2B;CACxD,aAAa,OAAO,sBAAsB;CAEnD,SAAS;CACA,UAAU,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,UAAA,CAAA,+BAAA,CAAA,CAAA;CACvB,eAAe,OAAO,IAAG,GAAA,YAAA,CAAA,EAAA,WAAA,eAAA,CAAA,+BAAA,CAAA,CAAA;CAUzB,oBAAoB,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,oBAAA,CAAA,+BAAA,CAAA,CAAA;CACjC,cAAc,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,cAAA,CAAA,+BAAA,CAAA,CAAA;CAMnB,oBAAoB,OAAgC,CAAC,SAAS,UAAU,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,oBAAA,CAAA,+BAAA,CAAA,CAAA;CAClF,kBAAkB,eAAc;EACvC,MAAM,QAAQ,KAAK,kBAAiB;EACpC,MAAM,QAAQ,MAAM,SAAS,OAAO;EACpC,MAAM,WAAW,MAAM,SAAS,UAAU;EAC1C,IAAI,SAAS,CAAC,UAAU,OAAO;GAAE,OAAO;GAAc,MAAM;GAAS,cAAc;EAAO;EAC1F,IAAI,YAAY,CAAC,OAAO,OAAO;GAAE,OAAO;GAAiB,MAAM;GAAQ,cAAc;EAAU;EAC/F,OAAO;GAAE,OAAO;GAAwB,MAAM;GAAQ,cAAc;EAAU;CAChF,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,kBAAA,CAAA,+BAAA,CAAA,CAAA;CAEF,cAAA;EACE,AAAK,KAAK,iBAAgB;CAC5B;CAEQ,MAAM,mBAAgB;EAC5B,IAAI;GAEF,MAAM,eAAe,MAAM,KAAK,YAAY,aAAY;GACxD,KAAK,kBAAkB,IAAI,aAAa,aAAa,QAAQ,kBAAiB,CAAE;GAChF,IAAI,aAAa,mBAAmB,QAAQ,KAAK,kBAAkB,IAAI,aAAa,iBAAiB;EACvG,QAAQ;GAEN,KAAK,kBAAkB,IAAI,KAAK;EAClC;CACF;CAGA,MAAM,oBAAiB;EACrB,KAAK,aAAa,IAAI,EAAE;EACxB,KAAK,YAAY,IAAI,IAAI;EACzB,IAAI;GACF,MAAM,YAAY,kBAChB,KAAK,MAAM,SAAS,cAAc,IAAI,WAAW,GAAG,KAAK,OAAO,kBAAkB;GACpF,MAAM,SAAS,MAAM,KAAK,YAAY,kBAAiB;GAEvD,IAAI,OAAO,SAAS;IAClB,MAAM,KAAK,OAAO,cAAc,SAAS;IACzC;GACF;GAGA,IAAI,OAAO,UAAU,aAAa;GAElC,KAAK,aAAa,IAAI,KAAK,YAAY,EACrC,OAAO,UAAU,eAAe,mBAAmB,oBAAoB,CAAC;EAC5E,UAAU;GACR,KAAK,YAAY,IAAI,KAAK;EAC5B;CACF;CAES,OAAO,KAAK,GAAG,MAAM;EAC5B,OAAO,CAAC,IAAI,WAAW,QAAQ;EAC/B,UAAU,CAAC,IAAI,WAAW,QAAQ;EAClC,YAAY,CAAC,KAAK;CACnB,CAAA;CAED,MAAM,WAAQ;EACZ,IAAI,KAAK,KAAK,SAAS;EAEvB,KAAK,QAAQ,IAAI,IAAI;EACrB,KAAK,aAAa,IAAI,EAAE;EAExB,MAAM,EAAE,OAAO,UAAU,eAAe,KAAK,KAAK;EAElD,IAAI;GACF,MAAM,KAAK,YAAY,MAAM,OAAQ,UAAW,eAAe,IAAI;GAInE,MAAM,YAAY,kBAChB,KAAK,MAAM,SAAS,cAAc,IAAI,WAAW,GACjD,KAAK,OAAO,kBAAkB;GAChC,KAAK,OAAO,cAAc,SAAS;EACrC,SAAS,KAAU;GACjB,IAAI,eAAe,qBAAqB,IAAI,WAAW,OAAO,IAAI,OAAO,WAAW,qBAAqB;IAGvG,MAAM,YAAY,kBAChB,KAAK,MAAM,SAAS,cAAc,IAAI,WAAW,GACjD,KAAK,OAAO,kBAAkB;IAChC,KAAK,OAAO,SAAS,CAAC,KAAK,WAAW,SAAS,GAAG,EAChD,aAAa,EAAE,UAAS,EACzB,CAAA;GACH,OACE,KAAK,aAAa,IAAI,KAAK,YAAY,EAAE,yBAAyB,CAAC;EAEvE,UAAU;GACR,KAAK,QAAQ,IAAI,KAAK;EACxB;CACF;CArHW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAmB,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAnB,OAAA,OAAA,GAAA,qBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,MAAA;EAAmB,cAAA;EAAA,UAAA;EAAA,UAAA;EAAA,UCtBhC;EAiFA,cAAA;GAAA;IAAA,MAAA;IAAA,MD9DY;GAAmB;GAAA;IAAA,MAAA;IAAA,MAAA,GAAA;IAAA,UAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAA,GAAA;IAAA,UAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAA,GAAA;IAAA,UAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAA,GAAA;IAAA,UAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAA,GAAA;IAAA,UAAA;IAAA,QAAA,CAAA,WAAA;IAAA,SAAA,CAAA,UAAA;IAAA,UAAA,CAAA,QAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAA,GAAA;IAAA,UAAA;IAAA,QAAA;KAAA;KAAA;KAAA;IAAA;IAAA,SAAA,CAAA,eAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAU,UAAA;IAAA,QAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;IAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAgB,UAAA;IAAA,QAAA;KAAA;KAAA;KAAA;IAAA;IAAA,SAAA,CAAA,mBAAA,qBAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAe,UAAA;IAAA,QAAA,CAAA,SAAA,SAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAqB,UAAA;IAAA,QAAA,CAAA,SAAA,UAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAe,UAAA;IAAA,QAAA,CAAA,UAAA,QAAA;IAAA,SAAA,CAAA,WAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAsB,UAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAmB,UAAA;IAAA,QAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;IAAA;IAAA,SAAA,CAAA,mBAAA,qBAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAkB,UAAA;IAAA,QAAA,CAAA,QAAA,OAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAkC,UAAA;IAAA,QAAA,CAAA,aAAA,kBAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAgB,MAAA;GAAA;EAAA;EAAA,iBAAA,GAAA,wBAAA;CAAA,CAAA;;AAGhO,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAmB,YAAA,CAAA;EAP/B,MAAA;EACW,MAAA,CAAA;GAAA,UAAA;GAAa,YACX;GAAI,iBACC,wBAAwB;GAAM,SACtC;IAAC;IAAqB;IAAY;IAAkB;IAAiB;IAAuB;IAAiB;IAAwB;IAAqB;IAAoB;IAAoC;GAAgB;GAAC,UAAA;EAAA,CAAA"}

package/fesm2022/mintplayer-ng-spark-auth-models.mjs

@@ -0,0 +1,114 @@
+import { InjectionToken, isDevMode } from "@angular/core";
+const SPARK_AUTH_CONFIG = new InjectionToken("SPARK_AUTH_CONFIG");
+const defaultSparkAuthConfig = {
+	apiBasePath: "/spark/auth",
+	defaultRedirectUrl: "/",
+	loginUrl: "/login",
+	externalLoginMode: "auto"
+};
+const SPARK_ACCOUNT_OVERVIEW_LINKS = new InjectionToken("SPARK_ACCOUNT_OVERVIEW_LINKS");
+const SPARK_AUTH_ROUTE_PATHS = new InjectionToken("SPARK_AUTH_ROUTE_PATHS");
+function findSparkAuthRoutePaths(routes) {
+	for (const route of routes ?? []) {
+		for (const provider of route.providers ?? []) {
+			const p = provider;
+			if (p?.provide === SPARK_AUTH_ROUTE_PATHS && p.useValue) return p.useValue;
+		}
+		const nested = findSparkAuthRoutePaths(route.children);
+		if (nested) return nested;
+	}
+	return null;
+}
+const SPARK_EXTERNAL_PROVIDERS = new InjectionToken("SPARK_EXTERNAL_PROVIDERS");
+function isSafeReturnUrl(value) {
+	if (!value) return false;
+	if (/[\r\n]/.test(value)) return false;
+	if (!value.startsWith("/")) return false;
+	if (value.length >= 2 && (value[1] === "/" || value[1] === "\\")) return false;
+	return true;
+}
+function sanitizeReturnUrl(value, defaultUrl) {
+	return isSafeReturnUrl(value) ? value : defaultUrl;
+}
+function sparkIsStandaloneDisplay() {
+	if (typeof window === "undefined") return false;
+	return typeof window.matchMedia === "function" && window.matchMedia("(display-mode: standalone)")?.matches === true || window.navigator?.standalone === true;
+}
+function resolveSparkExternalLoginMode(setting) {
+	if (setting === "popup" || setting === "redirect") return setting;
+	return sparkIsStandaloneDisplay() ? "redirect" : "popup";
+}
+const SPARK_EXTERNAL_LOGIN_ERRORS = [
+	"no_login_info",
+	"email_not_verified",
+	"account_creation_failed",
+	"email_already_registered",
+	"sign_in_to_link",
+	"link_confirmation_sent",
+	"login_already_associated",
+	"link_failed",
+	"remote_failure",
+	"invalid_nonce",
+	"popup_blocked",
+	"popup_closed"
+];
+const SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE = "spark:external-login";
+const SPARK_EXTERNAL_LOGIN_ACK_TYPE = "spark:external-login-ack";
+const SPARK_EXTERNAL_LOGIN_CHANNEL = "spark:external-login";
+const SPARK_EXTERNAL_LOGIN_QUERY_PARAM = "sparkExternalLogin";
+const SPARK_EXTERNAL_LOGIN_TIMEOUT_MS = 6e5;
+function sparkExternalLoginStorageKey(nonce) {
+	return `spark:external-login:${nonce}`;
+}
+function sparkExternalLoginDoneKey(nonce) {
+	return `spark:external-login-done:${nonce}`;
+}
+function sparkExternalLoginNonce() {
+	const bytes = /* @__PURE__ */ new Uint8Array(24);
+	crypto.getRandomValues(bytes);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_");
+}
+function sparkPasskeyError(error) {
+	if (error instanceof DOMException) {
+		if (error.name === "AbortError") return "cancelled";
+		if (error.name === "NotAllowedError") return "no_credential";
+		return "failed";
+	}
+	if (error?.error?.error === "locked_out") return "locked_out";
+	return "failed";
+}
+function passkeysSupported() {
+	return typeof window !== "undefined" && window.isSecureContext === true && typeof PublicKeyCredential !== "undefined" && typeof navigator?.credentials?.create === "function" && typeof navigator?.credentials?.get === "function" && typeof PublicKeyCredential.parseCreationOptionsFromJSON === "function" && typeof PublicKeyCredential.parseRequestOptionsFromJSON === "function";
+}
+function resolveSignInUrl(config, router) {
+	if (isDevMode() && !warned && !routeExists(router, config.loginUrl)) {
+		warned = true;
+		console.warn(`[ng-spark-auth] loginUrl is "${config.loginUrl}", but no route matches it, so redirecting an unauthenticated user will land on a blank page. If this app runs with local credentials disabled, point loginUrl at its sign-in route (for example provideSparkAuth({ loginUrl: '/sign-in' })).`);
+	}
+	return config.loginUrl;
+}
+let warned = false;
+function routeExists(router, url) {
+	const target = url.replace(/^\/+/, "").split("?")[0].split("#")[0];
+	return matches(router.config, target);
+}
+function matches(routes, target, prefix = "") {
+	return routes.some((route) => {
+		const path = [prefix, route.path ?? ""].filter(Boolean).join("/");
+		if (path === target) return true;
+		return route.children ? matches(route.children, target, path) : false;
+	});
+}
+const SPARK_ACCOUNT_PROFILE_FIELDS = new InjectionToken("SPARK_ACCOUNT_PROFILE_FIELDS");
+function provideSparkAccountProfileFields(...fields) {
+	return fields.map((field) => ({
+		provide: SPARK_ACCOUNT_PROFILE_FIELDS,
+		useValue: field,
+		multi: true
+	}));
+}
+export { SPARK_ACCOUNT_OVERVIEW_LINKS, SPARK_ACCOUNT_PROFILE_FIELDS, SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, SPARK_EXTERNAL_LOGIN_ACK_TYPE, SPARK_EXTERNAL_LOGIN_CHANNEL, SPARK_EXTERNAL_LOGIN_ERRORS, SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE, SPARK_EXTERNAL_LOGIN_QUERY_PARAM, SPARK_EXTERNAL_LOGIN_TIMEOUT_MS, SPARK_EXTERNAL_PROVIDERS, defaultSparkAuthConfig, findSparkAuthRoutePaths, isSafeReturnUrl, passkeysSupported, provideSparkAccountProfileFields, resolveSignInUrl, resolveSparkExternalLoginMode, sanitizeReturnUrl, sparkExternalLoginDoneKey, sparkExternalLoginNonce, sparkExternalLoginStorageKey, sparkIsStandaloneDisplay, sparkPasskeyError };
+
+//# sourceMappingURL=mintplayer-ng-spark-auth-models.mjs.map

package/fesm2022/mintplayer-ng-spark-auth-models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mintplayer-ng-spark-auth-models.mjs","names":[],"sources":["../../auth/models/src/auth-config.ts","../../auth/models/src/auth-route-config.ts","../../auth/models/src/return-url.ts","../../auth/models/src/external-login.ts","../../auth/models/src/passkey.ts","../../auth/models/src/sign-in-redirect.ts","../../auth/models/src/account.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\nimport { SparkExternalLoginModeSetting } from './external-login';\n\nexport interface SparkAuthConfig {\n  apiBasePath: string;\n  defaultRedirectUrl: string;\n  loginUrl: string;\n  /**\n   * How external sign-in and linking reach the provider by default. `'auto'` (the default) is a\n   * popup in a browser tab and a full-page redirect inside an installed web app. A call's own\n   * `mode` option overrides it.\n   */\n  externalLoginMode?: SparkExternalLoginModeSetting;\n}\n\nexport const SPARK_AUTH_CONFIG = new InjectionToken<SparkAuthConfig>('SPARK_AUTH_CONFIG');\n\nexport const defaultSparkAuthConfig: SparkAuthConfig = {\n  apiBasePath: '/spark/auth',\n  defaultRedirectUrl: '/',\n  loginUrl: '/login',\n  externalLoginMode: 'auto',\n};\n","import { InjectionToken, Type } from '@angular/core';\n\nexport type SparkAuthRouteEntry = string | { path: string; component?: Type<unknown> };\n\n/** The routable authentication pages. */\nexport interface SparkAuthRouteEntries {\n  /** The provider-button landing page, mounted by `withExternalLogin()`. */\n  signIn?: SparkAuthRouteEntry;\n  login?: SparkAuthRouteEntry;\n  twoFactor?: SparkAuthRouteEntry;\n  register?: SparkAuthRouteEntry;\n  forgotPassword?: SparkAuthRouteEntry;\n  resetPassword?: SparkAuthRouteEntry;\n  /**\n   * Passkey management, mounted by `withPasskeys()`.\n   *\n   * Unlike its siblings this page is for a user who is already signed in, so it belongs behind\n   * whatever guard the application uses for its account area rather than on the public sign-in path.\n   */\n  passkeys?: SparkAuthRouteEntry;\n  /**\n   * The link target of confirmation mails, mounted by `withAccount()`. Public (the link is opened from a\n   * mailbox, possibly signed out); its path must equal the server's `Spark:Auth:Links:ConfirmEmailPath`\n   * (default `/confirm-email`).\n   */\n  confirmEmail?: SparkAuthRouteEntry;\n  /** The account overview (links to every mounted account page), mounted by `withAccount()`. */\n  account?: SparkAuthRouteEntry;\n  /** User name, email change, preferred mail language and app fields (`withAccount()`). */\n  profile?: SparkAuthRouteEntry;\n  /** Change the password, or set a first one on a social-only account (`withAccount()`). */\n  changePassword?: SparkAuthRouteEntry;\n  /** Authenticator enrollment, recovery codes, disabling 2FA (`withAccount()`). */\n  twoFactorSetup?: SparkAuthRouteEntry;\n  /** Connected external logins: link and unlink providers (`withAccount()`). */\n  externalLogins?: SparkAuthRouteEntry;\n  /** Download personal data and delete the account (`withAccount()`). */\n  personalData?: SparkAuthRouteEntry;\n  /**\n   * The applications the user granted access to, with per-scope withdrawal. Mounted by\n   * `withIdentityProvider(withConnectedApplications())` from `@mintplayer/ng-spark/identity-provider`.\n   */\n  connectedApplications?: SparkAuthRouteEntry;\n  /** The developer portal's landing page (`withIdentityProvider(withDeveloperRoutes())`). */\n  developers?: SparkAuthRouteEntry;\n  /** The identity provider's management page (`withIdentityProvider(withManagementRoutes())`). */\n  identityProviderManagement?: SparkAuthRouteEntry;\n}\n\n/**\n * An extra link on the account overview (`SparkAccountOverviewComponent`), contributed by a route\n * feature from another entry point, e.g. `withConnectedApplications()`. The overview lists it after\n * its own pages. The label carries its own translations because the contributing entry point, not\n * the auth translations, owns the text.\n */\nexport interface SparkAccountOverviewLink {\n  /** Identifies the link (`track`), e.g. the {@link SparkAuthRoutePaths} key it points at. */\n  key: string;\n  /** The absolute router path, e.g. `/account/applications`. */\n  path: string;\n  /** The link text per language code; resolved in the app's current language. */\n  label: Record<string, string>;\n}\n\n/**\n * The extra account-overview links of the mounted route features, provided by `sparkAuthRoutes()`\n * on its route. Optional: without it the overview shows only the auth pages.\n */\nexport const SPARK_ACCOUNT_OVERVIEW_LINKS = new InjectionToken<readonly SparkAccountOverviewLink[]>(\n  'SPARK_ACCOUNT_OVERVIEW_LINKS',\n);\n\n/**\n * The paths of the pages that were actually mounted.\n *\n * Partial, and that is the change: pages are opted into individually now, so a template cannot\n * assume its siblings exist. `login` links to `register` only when registration was opted into, and\n * the sign-in landing page links to `login` only when local login was. A `[routerLink]` bound to\n * `undefined` silently navigates to the current route, so every cross-feature link is guarded.\n */\nexport type SparkAuthRoutePaths = Partial<Record<keyof SparkAuthRouteEntries, string>>;\n\nexport const SPARK_AUTH_ROUTE_PATHS = new InjectionToken<SparkAuthRoutePaths>('SPARK_AUTH_ROUTE_PATHS');\n\n/** The slice of an Angular `Route` the lookup below reads — kept structural so `/models` stays router-free. */\ninterface RouteLike {\n  providers?: readonly unknown[];\n  children?: readonly RouteLike[];\n}\n\n/**\n * The paths `sparkAuthRoutes()` mounted, read from the router configuration.\n *\n * For components that live **outside** that route subtree, such as `<spark-auth-bar>` in the\n * application shell: `SPARK_AUTH_ROUTE_PATHS` is provided on the subtree's own route, so it is not\n * injectable from there. Walks the eagerly declared routes only — a `sparkAuthRoutes()` behind a\n * `loadChildren` is not loaded yet and is not found, which reads as \"nothing mounted\".\n */\nexport function findSparkAuthRoutePaths(routes: readonly RouteLike[] | undefined): SparkAuthRoutePaths | null {\n  for (const route of routes ?? []) {\n    for (const provider of route.providers ?? []) {\n      const p = provider as { provide?: unknown; useValue?: SparkAuthRoutePaths };\n      if (p?.provide === SPARK_AUTH_ROUTE_PATHS && p.useValue) return p.useValue;\n    }\n    const nested = findSparkAuthRoutePaths(route.children);\n    if (nested) return nested;\n  }\n  return null;\n}\n\n/**\n * Presentation for one external provider's button — an icon, a label, an ordering.\n *\n * **It decorates; it does not declare.** The server stays authoritative over which providers exist\n * (`GET /spark/auth/capabilities`), because letting the client declare them would reintroduce exactly\n * the string-literal mismatch that endpoint exists to prevent. A scheme the server reports with no\n * matching declaration falls back to the default button, so adding a provider server-side never\n * yields a blank page; a declaration matching no reported scheme is simply unused.\n */\nexport interface SparkExternalProviderPresentation {\n  /** The ASP.NET Core authentication scheme, as the server reports it. Matched case-insensitively. */\n  scheme: string;\n  /** Overrides the server's display name. */\n  displayName?: string;\n  /** A CSS class for an icon element rendered before the label. */\n  iconClass?: string;\n  /** Lower sorts first. Providers with no declared order keep the server's order, after declared ones. */\n  order?: number;\n}\n\nexport const SPARK_EXTERNAL_PROVIDERS = new InjectionToken<SparkExternalProviderPresentation[]>(\n  'SPARK_EXTERNAL_PROVIDERS',\n);\n","/**\n * Shared validator for `returnUrl` query parameters consumed by the auth\n * components and interceptor. The framework-side equivalent in\n * `SparkAuthenticationExtensions.SanitizeReturnUrl` enforces the same rule;\n * keep them in sync.\n *\n * Accepts only local in-app paths:\n * - Must start with a single `/`.\n * - Must not start with `//` or `/\\` (protocol-relative navigation that some\n *   browsers and routers interpret as an external host).\n * - Must not contain CR/LF (defensive — the value flows into Router state and\n *   eventually back into a `router.navigateByUrl` call).\n *\n * Returns the supplied default for anything else, never throws. Per R2-H9.\n */\nexport function isSafeReturnUrl(value: string | null | undefined): boolean {\n  if (!value) return false;\n  if (/[\\r\\n]/.test(value)) return false;\n  if (!value.startsWith('/')) return false;\n  if (value.length >= 2 && (value[1] === '/' || value[1] === '\\\\')) return false;\n  return true;\n}\n\nexport function sanitizeReturnUrl(\n  value: string | null | undefined,\n  defaultUrl: string,\n): string {\n  return isSafeReturnUrl(value) ? (value as string) : defaultUrl;\n}\n","/** How the user is sent to the external provider, and how the result comes back. */\nexport type SparkExternalLoginMode = 'popup' | 'redirect';\n\n/**\n * The app-wide default for {@link SparkExternalLoginMode}, set through\n * `provideSparkAuth({ externalLoginMode })`.\n *\n * `'auto'` (the default) uses `'redirect'` inside an installed web app (`display-mode: standalone`,\n * or iOS's `navigator.standalone`) and `'popup'` in a browser tab. Inside an installed app a popup is\n * captured into the app, or lands in a custom tab with no usable opener, so only a full-page\n * redirect is reliable there.\n */\nexport type SparkExternalLoginModeSetting = 'auto' | SparkExternalLoginMode;\n\nexport interface SparkExternalLoginOptions {\n  /**\n   * Where to land after a successful provider round trip. Server-side sanitized to an in-app path.\n   */\n  returnUrl?: string;\n  /**\n   * `'redirect'` mode only: where a failure lands, with `?sparkExternalLogin=<code>` added.\n   * Server-side sanitized like `returnUrl`. Defaults to the page the attempt started from (the\n   * router URL with any earlier `sparkExternalLogin` removed), which is the page that reads and\n   * shows the code. Ignored in popup mode, where the outcome comes back to the opener instead.\n   */\n  errorUrl?: string;\n  /** Overrides the configured `externalLoginMode` (default `'auto'`) for this one call. */\n  mode?: SparkExternalLoginMode;\n}\n\n/** Whether this document runs as an installed web app rather than in a browser tab. */\nexport function sparkIsStandaloneDisplay(): boolean {\n  if (typeof window === 'undefined') return false;\n  const standaloneQuery = typeof window.matchMedia === 'function'\n    && window.matchMedia('(display-mode: standalone)')?.matches === true;\n  return standaloneQuery || (window.navigator as { standalone?: boolean } | undefined)?.standalone === true;\n}\n\n/**\n * The value of `externalLoginMode` resolved against this document: `'auto'` becomes `'redirect'` in\n * an installed web app and `'popup'` everywhere else.\n */\nexport function resolveSparkExternalLoginMode(setting: SparkExternalLoginModeSetting | undefined): SparkExternalLoginMode {\n  if (setting === 'popup' || setting === 'redirect') return setting;\n  return sparkIsStandaloneDisplay() ? 'redirect' : 'popup';\n}\n\n/**\n * Why an external login did not sign anyone in. Everything but the two `popup_*` codes comes\n * from the server; those two are raised here, because the browser is the only place that can\n * observe them.\n *\n * ⚠️ `link_confirmation_sent` is **not a failure**. It travels on this channel because no session\n * was created, which is what `success: false` means to the opener — but the right response is to\n * tell the user to check their mail, not to show an error.\n *\n * ⚠️ `email_already_registered` admits that an account exists, which the older codes deliberately\n * avoid doing. That trade is made on the server (the alternative was a generic failure that reads\n * as \"this application is broken\"); a client must not widen it by pairing the code with the address\n * it was asked about.\n */\nexport type SparkExternalLoginError =\n  | 'no_login_info'\n  | 'email_not_verified'\n  | 'account_creation_failed'\n  | 'email_already_registered'\n  | 'sign_in_to_link'\n  | 'link_confirmation_sent'\n  | 'login_already_associated'\n  | 'link_failed'\n  /** The provider reported an error, or the correlation of its answer failed. */\n  | 'remote_failure'\n  /** The challenge refused the nonce (HTTP 400). It never travels in a popup payload. */\n  | 'invalid_nonce'\n  | 'popup_blocked'\n  | 'popup_closed';\n\n/** Every {@link SparkExternalLoginError}; a code read from a URL is checked against it. */\nexport const SPARK_EXTERNAL_LOGIN_ERRORS: readonly SparkExternalLoginError[] = [\n  'no_login_info', 'email_not_verified', 'account_creation_failed', 'email_already_registered',\n  'sign_in_to_link', 'link_confirmation_sent', 'login_already_associated', 'link_failed',\n  'remote_failure', 'invalid_nonce', 'popup_blocked', 'popup_closed',\n];\n\nexport interface SparkExternalLoginResult {\n  success: boolean;\n  error?: SparkExternalLoginError;\n}\n\n/**\n * The payload the callback page hands back: posted to the opener, posted on the\n * {@link SPARK_EXTERNAL_LOGIN_CHANNEL} BroadcastChannel, and written to `localStorage` under\n * {@link sparkExternalLoginStorageKey} (with an `at` timestamp). Any of the three may be the one\n * that arrives: COOP on the provider's pages cuts the opener, and a frozen background tab may only\n * see the storage entry once it is shown again.\n */\nexport interface SparkExternalLoginMessage {\n  type: typeof SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE;\n  success: boolean;\n  error?: SparkExternalLoginError | null;\n  /** The nonce the opener sent on the challenge; `null` from a challenge that carried none. */\n  nonce?: string | null;\n}\n\n/** The opener's answer on the BroadcastChannel: the callback page sets its done-marker and closes. */\nexport interface SparkExternalLoginAck {\n  type: typeof SPARK_EXTERNAL_LOGIN_ACK_TYPE;\n  nonce: string;\n}\n\nexport const SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE = 'spark:external-login';\nexport const SPARK_EXTERNAL_LOGIN_ACK_TYPE = 'spark:external-login-ack';\n\n/** The BroadcastChannel the callback page and the opener share. */\nexport const SPARK_EXTERNAL_LOGIN_CHANNEL = 'spark:external-login';\n\n/** The query parameter a redirect-mode failure comes back with. */\nexport const SPARK_EXTERNAL_LOGIN_QUERY_PARAM = 'sparkExternalLogin';\n\n/** How long a popup attempt waits for its result before it settles `popup_closed`. */\nexport const SPARK_EXTERNAL_LOGIN_TIMEOUT_MS = 10 * 60 * 1000;\n\n/** The `localStorage` key the callback page writes its payload to. */\nexport function sparkExternalLoginStorageKey(nonce: string): string {\n  return `spark:external-login:${nonce}`;\n}\n\n/**\n * The `localStorage` done-marker: set once the opener has the result. The callback page reads it to\n * restore itself to the app when an installed web app shows it again.\n */\nexport function sparkExternalLoginDoneKey(nonce: string): string {\n  return `spark:external-login-done:${nonce}`;\n}\n\n/**\n * A fresh nonce for one popup attempt: 32 base64url characters from `crypto.getRandomValues`\n * (24 bytes, so no padding). The server accepts `^[A-Za-z0-9_-]{16,64}$`.\n */\nexport function sparkExternalLoginNonce(): string {\n  const bytes = new Uint8Array(24);\n  crypto.getRandomValues(bytes);\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n\n/** One external login attached to the signed-in account. */\nexport interface SparkLinkedExternalLogin {\n  provider: string;\n  providerKey: string;\n  displayName: string;\n  /**\n   * ⚠️ `false` when removing this login would leave the account with no way to sign in.\n   *\n   * Served by the server so the UI can disable the control rather than offer an action that will\n   * be refused. It is **not** the enforcement — the server refuses the request too — and a client\n   * that treats it as advisory only is behaving correctly.\n   */\n  canUnlink: boolean;\n}\n\n/** A provider that is configured but not yet attached to the signed-in account. */\nexport interface SparkAvailableExternalProvider {\n  provider: string;\n  displayName: string;\n}\n\nexport interface SparkExternalLogins {\n  linked: SparkLinkedExternalLogin[];\n  available: SparkAvailableExternalProvider[];\n}\n\n/** Why a login was not detached. */\nexport type SparkUnlinkError =\n  /** ⚠️ It was the account's last way in, so removing it would have locked the owner out for good. */\n  | 'last_credential'\n  /** Not attached to this account. */\n  | 'login_not_found'\n  /** The store refused, for a reason that is not either of the above. */\n  | 'unlink_failed';\n\nexport interface SparkUnlinkResult {\n  success: boolean;\n  error?: SparkUnlinkError;\n}\n","/**\n * Why a passkey ceremony did not complete.\n *\n * ⚠️ Every server-side sign-in rejection arrives as `failed`, and that is deliberate rather than\n * lossy: distinguishing \"unknown credential\" from \"bad signature\" would tell an anonymous caller\n * whether a credential exists. Do not try to recover the detail — it is not sent.\n *\n * The three codes the server never sends are raised here, because the browser is the only place\n * that can observe them.\n */\nexport type SparkPasskeyError =\n  /** The browser cannot run the ceremony at all. Offer another sign-in method. */\n  | 'unsupported'\n  /** The user dismissed the authenticator prompt. Not an error worth showing. */\n  | 'cancelled'\n  /** The authenticator produced nothing — no matching credential, or the user gave up. */\n  | 'no_credential'\n  /** The account is locked out. The one server-side outcome worth distinguishing. */\n  | 'locked_out'\n  /** Everything else, server or client. */\n  | 'failed';\n\nexport interface SparkPasskeyResult {\n  success: boolean;\n  error?: SparkPasskeyError;\n}\n\n/**\n * Collapses everything that can go wrong in a ceremony into the closed error union.\n *\n * `AbortError` and `NotAllowedError` are how a browser reports \"the user dismissed the prompt\" and\n * \"no credential was produced\" — neither is a fault, and neither should surface as a red banner.\n */\nexport function sparkPasskeyError(error: unknown): SparkPasskeyError {\n  if (error instanceof DOMException) {\n    if (error.name === 'AbortError') return 'cancelled';\n    if (error.name === 'NotAllowedError') return 'no_credential';\n    return 'failed';\n  }\n\n  const code = (error as { error?: { error?: string } })?.error?.error;\n  if (code === 'locked_out') return 'locked_out';\n\n  return 'failed';\n}\n\n/**\n * Whether this browser can run a passkey ceremony.\n *\n * Checks the native JSON helpers as well as `navigator.credentials`, because the ceremony is built\n * on them: the server speaks WebAuthn's JSON encoding, and without\n * `parseCreationOptionsFromJSON` / `parseRequestOptionsFromJSON` the client would have to hand-roll\n * base64url conversion over every field of the options — on the security-critical path, to support\n * browsers that a user holding a passkey is unlikely to be running.\n *\n * ⚠️ `window.isSecureContext` is part of the test rather than an afterthought: WebAuthn is\n * unavailable on an insecure origin, and without this the button would render and then fail at the\n * moment the user clicks it.\n */\nexport function passkeysSupported(): boolean {\n  return (\n    typeof window !== 'undefined' &&\n    window.isSecureContext === true &&\n    typeof PublicKeyCredential !== 'undefined' &&\n    typeof navigator?.credentials?.create === 'function' &&\n    typeof navigator?.credentials?.get === 'function' &&\n    typeof PublicKeyCredential.parseCreationOptionsFromJSON === 'function' &&\n    typeof PublicKeyCredential.parseRequestOptionsFromJSON === 'function'\n  );\n}\n","import { isDevMode } from '@angular/core';\nimport { Route, Router } from '@angular/router';\nimport { SparkAuthConfig } from './auth-config';\n\n/**\n * Where to send someone who is not signed in.\n *\n * `loginUrl` is the single source of truth for this, and the only thing the guard, the interceptor\n * and the auth bar should consult — an application that turns off local credentials points it at\n * its own sign-in landing route.\n *\n * The reason this is a function rather than a property read is the failure mode it closes: nothing\n * connects `loginUrl` to the routes that actually exist, so pointing it at a route that was never\n * registered produces a redirect into a blank page with no type error, no build failure and no\n * runtime error. In development that now warns, once, naming the value and the fix.\n */\nexport function resolveSignInUrl(config: SparkAuthConfig, router: Router): string {\n  if (isDevMode() && !warned && !routeExists(router, config.loginUrl)) {\n    warned = true;\n    console.warn(\n      `[ng-spark-auth] loginUrl is \"${config.loginUrl}\", but no route matches it, so redirecting an `\n      + `unauthenticated user will land on a blank page. If this app runs with local credentials `\n      + `disabled, point loginUrl at its sign-in route (for example provideSparkAuth({ loginUrl: '/sign-in' })).`,\n    );\n  }\n\n  return config.loginUrl;\n}\n\nlet warned = false;\n\nfunction routeExists(router: Router, url: string): boolean {\n  const target = url.replace(/^\\/+/, '').split('?')[0].split('#')[0];\n  return matches(router.config, target);\n}\n\nfunction matches(routes: Route[], target: string, prefix = ''): boolean {\n  return routes.some(route => {\n    const path = [prefix, route.path ?? ''].filter(Boolean).join('/');\n    if (path === target) return true;\n    // A wildcard route would match anything, including a URL nobody registered — treating it as a\n    // match would make this check always pass and warn about nothing.\n    return route.children ? matches(route.children, target, path) : false;\n  });\n}\n","import { InjectionToken, Provider } from '@angular/core';\n\n/** `GET/POST /spark/auth/manage/profile` (#460, D16). */\nexport interface SparkAccountProfile {\n  userName: string | null;\n  email: string | null;\n  /** App-contributed fields (`ISparkProfileContributor<TUser>`), by name. */\n  fields: Record<string, unknown>;\n  /** The culture account mail is written in (`SparkUser.PreferredCulture`); null = the app default. */\n  preferredCulture: string | null;\n}\n\n/** The body of `POST /spark/auth/manage/profile`. Absent keeps a value; `preferredCulture: null` clears it. */\nexport interface SparkAccountProfileUpdate {\n  userName?: string | null;\n  fields?: Record<string, unknown>;\n  preferredCulture?: string | null;\n}\n\n/** `GET /spark/auth/manage/info` / answer of `POST manage/info`. */\nexport interface SparkAccountInfo {\n  email: string;\n  isEmailConfirmed: boolean;\n}\n\n/** Answer of `POST /spark/auth/manage/2fa` (ASP.NET Core Identity's contract). */\nexport interface SparkTwoFactorState {\n  sharedKey: string | null;\n  recoveryCodesLeft: number;\n  /** Only present right after codes were (re)generated — show them once. */\n  recoveryCodes?: string[] | null;\n  isTwoFactorEnabled: boolean;\n  isMachineRemembered: boolean;\n}\n\n/** The body of `POST /spark/auth/manage/2fa`. An empty body reads the state (and creates a key if none). */\nexport interface SparkTwoFactorRequest {\n  enable?: boolean;\n  twoFactorCode?: string;\n  resetSharedKey?: boolean;\n  resetRecoveryCodes?: boolean;\n  forgetMachine?: boolean;\n}\n\n/** `GET /spark/auth/manage/2fa/authenticator-uri`: the key, its otpauth URI and a server-rendered QR SVG. */\n/**\n * `GET`/`POST /manage/external-login-two-factor`: whether a sign-in with an external account skips\n * the second factor for this user, and whether two-factor is enabled at all.\n */\nexport interface SparkExternalLoginTwoFactor {\n  bypass: boolean;\n  twoFactorEnabled: boolean;\n}\n\nexport interface SparkAuthenticatorUri {\n  sharedKey: string;\n  authenticatorUri: string;\n  qrCodeSvg: string;\n}\n\n/**\n * The outcome of an account call that can fail with a message for the user.\n *\n * `errors` flattens an RFC 7807 validation problem (Identity codes, `PreferredCulture`, contributor\n * fields) into `field → messages`; `error` carries a Spark error code (`reauthentication_required`,\n * `no_authenticator_key`, …) when the server sent one.\n */\nexport interface SparkAccountResult<T = void> {\n  success: boolean;\n  value?: T;\n  error?: string;\n  errors?: Record<string, string[]>;\n  status?: number;\n}\n\n/**\n * One application field on the profile page (#460, D16), validated and stored server-side by an\n * `ISparkProfileContributor<TUser>` declaring the same `name`.\n */\nexport interface SparkAccountProfileField {\n  /** The field name, as the contributor declares it (matched case-insensitively by the server). */\n  name: string;\n  /** A translation key (looked up with the `t` pipe) or literal text. */\n  label: string;\n  type?: 'text' | 'textarea' | 'email' | 'url' | 'tel' | 'number' | 'date' | 'checkbox' | 'select';\n  /** For `select`. `label` is a translation key or literal text. */\n  options?: { value: string; label: string }[];\n  required?: boolean;\n  maxLength?: number;\n  /** A translation key or literal text shown under the control. */\n  hint?: string;\n  /** Ascending; unordered fields follow in registration order. */\n  order?: number;\n}\n\n/** Multi-provider: the application's profile fields. Use {@link provideSparkAccountProfileFields}. */\nexport const SPARK_ACCOUNT_PROFILE_FIELDS = new InjectionToken<SparkAccountProfileField[]>('SPARK_ACCOUNT_PROFILE_FIELDS');\n\n/** Registers profile fields; every call adds. */\nexport function provideSparkAccountProfileFields(...fields: SparkAccountProfileField[]): Provider[] {\n  return fields.map(field => ({ provide: SPARK_ACCOUNT_PROFILE_FIELDS, useValue: field, multi: true }));\n}\n"],"mappings":";AAeA,MAAa,oBAAoB,IAAI,eAAgC,mBAAmB;AAExF,MAAa,yBAA0C;CACrD,aAAa;CACb,oBAAoB;CACpB,UAAU;CACV,mBAAmB;AACpB;AC8CD,MAAa,+BAA+B,IAAI,eAC9C,8BAA8B;AAahC,MAAa,yBAAyB,IAAI,eAAoC,wBAAwB;AAgBtG,SAAgB,wBAAwB,QAAwC;CAC9E,KAAK,MAAM,SAAS,UAAU,CAAA,GAAI;EAChC,KAAK,MAAM,YAAY,MAAM,aAAa,CAAA,GAAI;GAC5C,MAAM,IAAI;GACV,IAAI,GAAG,YAAY,0BAA0B,EAAE,UAAU,OAAO,EAAE;EACpE;EACA,MAAM,SAAS,wBAAwB,MAAM,QAAQ;EACrD,IAAI,QAAQ,OAAO;CACrB;CACA,OAAO;AACT;AAsBA,MAAa,2BAA2B,IAAI,eAC1C,0BAA0B;ACpH5B,SAAgB,gBAAgB,OAAgC;CAC9D,IAAI,CAAC,OAAO,OAAO;CACnB,IAAI,SAAS,KAAK,KAAK,GAAG,OAAO;CACjC,IAAI,CAAC,MAAM,WAAW,GAAG,GAAG,OAAO;CACnC,IAAI,MAAM,UAAU,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,OAAO,OAAO;CACzE,OAAO;AACT;AAEA,SAAgB,kBACd,OACA,YAAkB;CAElB,OAAO,gBAAgB,KAAK,IAAK,QAAmB;AACtD;ACGA,SAAgB,2BAAwB;CACtC,IAAI,OAAO,WAAW,aAAa,OAAO;CAG1C,OAFwB,OAAO,OAAO,eAAe,cAChD,OAAO,WAAW,4BAA4B,CAAC,EAAE,YAAY,QACvC,OAAO,WAAoD,eAAe;AACvG;AAMA,SAAgB,8BAA8B,SAAkD;CAC9F,IAAI,YAAY,WAAW,YAAY,YAAY,OAAO;CAC1D,OAAO,yBAAwB,IAAK,aAAa;AACnD;AAiCA,MAAa,8BAAkE;CAC7E;CAAiB;CAAsB;CAA2B;CAClE;CAAmB;CAA0B;CAA4B;CACzE;CAAkB;CAAiB;CAAiB;AACrD;AA4BD,MAAa,oCAAoC;AACjD,MAAa,gCAAgC;AAG7C,MAAa,+BAA+B;AAG5C,MAAa,mCAAmC;AAGhD,MAAa,kCAAkC;AAG/C,SAAgB,6BAA6B,OAAa;CACxD,OAAO,wBAAwB;AACjC;AAMA,SAAgB,0BAA0B,OAAa;CACrD,OAAO,6BAA6B;AACtC;AAMA,SAAgB,0BAAuB;CACrC,MAAM,wBAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG;AAC5D;AChHA,SAAgB,kBAAkB,OAAc;CAC9C,IAAI,iBAAiB,cAAc;EACjC,IAAI,MAAM,SAAS,cAAc,OAAO;EACxC,IAAI,MAAM,SAAS,mBAAmB,OAAO;EAC7C,OAAO;CACT;CAGA,IADc,OAA0C,OAAO,UAClD,cAAc,OAAO;CAElC,OAAO;AACT;AAeA,SAAgB,oBAAiB;CAC/B,OACE,OAAO,WAAW,eAClB,OAAO,oBAAoB,QAC3B,OAAO,wBAAwB,eAC/B,OAAO,WAAW,aAAa,WAAW,cAC1C,OAAO,WAAW,aAAa,QAAQ,cACvC,OAAO,oBAAoB,iCAAiC,cAC5D,OAAO,oBAAoB,gCAAgC;AAE/D;ACrDA,SAAgB,iBAAiB,QAAyB,QAAc;CACtE,IAAI,UAAS,KAAM,CAAC,UAAU,CAAC,YAAY,QAAQ,OAAO,QAAQ,GAAG;EACnE,SAAS;EACT,QAAQ,KACN,gCAAgC,OAAO,SAAQ,8OAE4D;CAE/G;CAEA,OAAO,OAAO;AAChB;AAEA,IAAI,SAAS;AAEb,SAAS,YAAY,QAAgB,KAAW;CAC9C,MAAM,SAAS,IAAI,QAAQ,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;CAChE,OAAO,QAAQ,OAAO,QAAQ,MAAM;AACtC;AAEA,SAAS,QAAQ,QAAiB,QAAgB,SAAS,IAAE;CAC3D,OAAO,OAAO,MAAK,UAAQ;EACzB,MAAM,OAAO,CAAC,QAAQ,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;EAChE,IAAI,SAAS,QAAQ,OAAO;EAG5B,OAAO,MAAM,WAAW,QAAQ,MAAM,UAAU,QAAQ,IAAI,IAAI;CAClE,CAAC;AACH;ACoDA,MAAa,+BAA+B,IAAI,eAA2C,8BAA8B;AAGzH,SAAgB,iCAAiC,GAAG,QAAkC;CACpF,OAAO,OAAO,KAAI,WAAU;EAAE,SAAS;EAA8B,UAAU;EAAO,OAAO;CAAI,EAAG;AACtG"}

package/fesm2022/mintplayer-ng-spark-auth-pipes.mjs

@@ -0,0 +1,43 @@
+import * as i0 from "@angular/core";
+import { Pipe, inject } from "@angular/core";
+import { SparkAuthTranslationService } from "@mintplayer/ng-spark/auth/core";
+var TranslateKeyPipe = class TranslateKeyPipe {
+	translation = inject(SparkAuthTranslationService);
+	transform(key) {
+		return this.translation.t(key);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: TranslateKeyPipe,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Pipe
+	});
+	static ɵpipe = i0.ɵɵngDeclarePipe({
+		minVersion: "14.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: TranslateKeyPipe,
+		isStandalone: true,
+		name: "t",
+		pure: false
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: TranslateKeyPipe,
+	decorators: [{
+		type: Pipe,
+		args: [{
+			name: "t",
+			pure: false,
+			standalone: true
+		}]
+	}]
+});
+export { TranslateKeyPipe };
+
+//# sourceMappingURL=mintplayer-ng-spark-auth-pipes.mjs.map

package/fesm2022/mintplayer-ng-spark-auth-pipes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mintplayer-ng-spark-auth-pipes.mjs","names":[],"sources":["../../auth/pipes/src/translate-key.pipe.ts"],"sourcesContent":["import { Pipe, PipeTransform, inject } from '@angular/core';\nimport { SparkAuthTranslationService } from '@mintplayer/ng-spark/auth/core';\n\n@Pipe({ name: 't', pure: false, standalone: true })\nexport class TranslateKeyPipe implements PipeTransform {\n  private readonly translation = inject(SparkAuthTranslationService);\n\n  transform(key: string): string {\n    return this.translation.t(key);\n  }\n}\n"],"mappings":";;;AAIA,IAAa,mBAAb,MAAa,iBAAgB;CACV,cAAc,OAAO,2BAA2B;CAEjE,UAAU,KAAW;EACnB,OAAO,KAAK,YAAY,EAAE,GAAG;CAC/B;CALW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAgB,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAhB,OAAA,QAAA,GAAA,gBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAgB,cAAA;EAAA,MAAA;EAAA,MAAA;CAAA,CAAA;;AAAhB,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAgB,YAAA,CAAA;EAD5B,MAAA;EAAK,MAAA,CAAA;GAAE,MAAM;GAAK,MAAM;GAAO,YAAY;EAAI,CAAE"}