@mintplayer/ng-spark 22.30.0 → 22.31.0

package/types/mintplayer-ng-spark-identity-provider-management.d.ts

@@ -0,0 +1,33 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import { SparkSigningKey, identityProviderQueryLink } from "@mintplayer/ng-spark/identity-provider/core";
+import * as i0 from "@angular/core";
+/**
+ * The identity provider's management page (`identity-provider/admin`, PRD D9), for its
+ * administrators (`ManageAll/IdentityProvider`): the signing keys with a rotate-now action, and links
+ * to the library's queues (developer requests, scope approvals, go-live reviews) and records (grants,
+ * the audit trail) in the generic query page. The server answers 403 to anyone else, and the page
+ * then says so instead of rendering an empty administration screen.
+ */
+export declare class SparkIdentityProviderManagementComponent {
+  private readonly text;
+  private readonly portal;
+  protected readonly colors: typeof Color;
+  protected readonly queues: {
+    label: string;
+    alias: string;
+  }[];
+  protected readonly queryLink: typeof identityProviderQueryLink;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly busy: import("@angular/core").WritableSignal<boolean>;
+  readonly forbidden: import("@angular/core").WritableSignal<boolean>;
+  readonly keys: import("@angular/core").WritableSignal<SparkSigningKey[]>;
+  readonly changes: import("@angular/core").WritableSignal<string[]>;
+  readonly error: import("@angular/core").WritableSignal<string>;
+  readonly notice: import("@angular/core").WritableSignal<string>;
+  constructor();
+  load(): Promise<void>;
+  rotate(): Promise<void>;
+  protected stateColor(state: string): Color;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkIdentityProviderManagementComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkIdentityProviderManagementComponent, "spark-identity-provider-management", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-identity-provider.d.ts

@@ -0,0 +1,64 @@
+import { CanActivateFn } from "@angular/router";
+import { SparkAccountOverviewLink, SparkAuthRouteEntry, SparkAuthRoutePaths } from "@mintplayer/ng-spark/auth/models";
+import { SparkAuthRoutesFeature } from "@mintplayer/ng-spark/auth/routes";
+export * from "@mintplayer/ng-spark/identity-provider/core";
+type Child = SparkAuthRoutesFeature['children'][number];
+/**
+ * One group of identity-provider pages, passed to {@link withIdentityProvider}. Produced only by
+ * `withConnectedApplications()`, `withDeveloperRoutes()` and `withManagementRoutes()`.
+ */
+export interface SparkIdentityProviderRoutesFeature {
+  readonly children: Child[];
+  readonly paths: SparkAuthRoutePaths;
+  readonly accountLinks?: SparkAccountOverviewLink[];
+}
+/** Every feature's guard option: defaults to `[sparkAuthGuard]`; `[]` under an already guarded parent. */
+export interface SparkIdentityProviderGuardOptions {
+  canActivate?: CanActivateFn[];
+}
+/**
+ * The identity provider's SPA pages (`docs/identity_provider_platform_PRD.md` D7), as one
+ * `sparkAuthRoutes()` feature:
+ *
+ * ```ts
+ * sparkAuthRoutes(
+ *   withLocalLogin(), withAccount(),
+ *   withIdentityProvider(withConnectedApplications(), withDeveloperRoutes(), withManagementRoutes()),
+ * )
+ * ```
+ *
+ * The sub-features merge into one feature, and each page keeps its own `import()` (its own secondary
+ * entry point), so a page nobody opts into is never bundled. The pages popups show (`/connect/*`:
+ * sign-in, consent, device, logout, error) are server-rendered and not part of this.
+ *
+ * Every path has a literal first segment, so the group neither shadows `sparkRoutes()` nor is shadowed
+ * by it. Apps and resources are edited in the generic `po/:type` screens (PRD Q1 = A).
+ */
+export declare function withIdentityProvider(...features: SparkIdentityProviderRoutesFeature[]): SparkAuthRoutesFeature;
+/**
+ * Mounts the connected-applications page (default `account/applications`, PRD D6): the applications
+ * the user granted access to, with whole-grant and per-scope withdrawal. Sets
+ * `SPARK_AUTH_ROUTE_PATHS.connectedApplications` and adds a link to the account overview.
+ */
+export declare function withConnectedApplications(options?: SparkIdentityProviderGuardOptions & {
+  connectedApplications?: SparkAuthRouteEntry;
+}): SparkIdentityProviderRoutesFeature;
+/**
+ * Mounts the developer portal (PRD D2/D3): `developers` (status, terms, request, registration token)
+ * and `developers/invitations/:token?app=<applicationId>` (accept a team invitation; the mailed link's
+ * target, which the server builds from this default path). Both need a signed-in user; the guard sends
+ * anyone else to sign in and back.
+ */
+export declare function withDeveloperRoutes(options?: SparkIdentityProviderGuardOptions & {
+  developers?: SparkAuthRouteEntry;
+  invitation?: SparkAuthRouteEntry;
+}): SparkIdentityProviderRoutesFeature;
+/**
+ * Mounts the management page (default `identity-provider/admin`, PRD D9): signing keys with
+ * rotate-now, and links to the queues (developer requests, scope approvals, go-live reviews) and
+ * records (applications, resources, grants, audit trail). Mount it for everyone signed in: the server
+ * decides who is an administrator, and the page tells anyone else they may not see it.
+ */
+export declare function withManagementRoutes(options?: SparkIdentityProviderGuardOptions & {
+  identityProviderManagement?: SparkAuthRouteEntry;
+}): SparkIdentityProviderRoutesFeature;

package/types/mintplayer-ng-spark-pwa.d.ts

@@ -0,0 +1,89 @@
+import * as i0 from "@angular/core";
+import { EnvironmentProviders, InjectionToken } from "@angular/core";
+import { SwRegistrationOptions } from "@angular/service-worker";
+export interface SparkServiceWorkerOptions {
+  /** Whether the worker registers. Default: `!isDevMode()`, so only production builds register it. */
+  enabled?: boolean;
+  /** The worker script, relative to the base href. Default: `ngsw-worker.js`. */
+  script?: string;
+  /** When the worker registers. Default: `registerWhenStable:30000`. */
+  registrationStrategy?: SwRegistrationOptions['registrationStrategy'];
+}
+/**
+ * Registers Angular's service worker with Spark's update policy (#464, Q1b); see
+ * {@link SparkServiceWorkerUpdates} for what happens when a new version is deployed.
+ *
+ * The application also needs an `ngsw-config.json` with Spark's navigation exclusions and
+ * `serviceWorker` in its production build configuration; see `docs/guide-pwa.md`.
+ */
+export declare function provideSparkServiceWorker(options?: SparkServiceWorkerOptions): EnvironmentProviders;
+/** A service-worker version as `ngsw.json` describes it. `appData` is the config's `appData`. */
+export interface SparkAppVersion {
+  hash: string;
+  appData?: Record<string, unknown>;
+}
+/** The two page loads the update policy performs. Replaceable for tests. */
+export interface SparkPageLoader {
+  assign(url: string): void;
+  reload(): void;
+}
+/** How the update policy loads a page: `window.location` by default. */
+export declare const SPARK_SW_PAGE_LOADER: InjectionToken<SparkPageLoader>;
+/** Update-check timing. Defaults: every 6 h, and on becoming visible at most once a minute. */
+export interface SparkServiceWorkerSchedule {
+  checkIntervalMs: number;
+  visibleCheckThrottleMs: number;
+}
+export declare const SPARK_SW_SCHEDULE: InjectionToken<SparkServiceWorkerSchedule>;
+/**
+ * The update policy of `provideSparkServiceWorker()` (#464, Q1b).
+ *
+ * - `VERSION_READY`: the **next** router navigation becomes a full page load of its target, so the
+ *   user lands on the page they asked for, in the new version, without losing anything on the page
+ *   they are leaving (the navigation was leaving it anyway).
+ * - `unrecoverable`: the running version can no longer be served, so the page reloads at once.
+ * - Checks: once the application is stable, every 6 h, and when the tab becomes visible again
+ *   (at most once a minute).
+ * - **A hidden tab never reloads.** Spark has no unsaved-changes tracking to consult, so a reload
+ *   nobody is looking at could throw away an open edit. An `unrecoverable` in a hidden tab waits
+ *   until the tab is visible; a navigation in a hidden tab stays a normal in-app navigation.
+ *
+ * Nothing happens when the service worker is disabled (development builds, unsupported browsers)
+ * or on the server.
+ */
+export declare class SparkServiceWorkerUpdates {
+  private readonly swUpdate;
+  private readonly router;
+  private readonly location;
+  private readonly appRef;
+  private readonly document;
+  private readonly platformId;
+  private readonly destroyRef;
+  private readonly pageLoader;
+  private readonly schedule;
+  private readonly _updateReady;
+  private readonly _currentVersion;
+  private readonly _latestVersion;
+  /** True once a new version is downloaded and the next navigation will load it. */
+  readonly updateReady: import("@angular/core").Signal<boolean>;
+  /** The running version, known once an update was reported. */
+  readonly currentVersion: import("@angular/core").Signal<SparkAppVersion | null>;
+  /** The version the next navigation loads (`appData.build` is the ng-spark version). */
+  readonly latestVersion: import("@angular/core").Signal<SparkAppVersion | null>;
+  private started;
+  private leaving;
+  private reloadWhenVisible;
+  private lastCheck;
+  /** Starts the policy. Idempotent; called by the app initializer `provideSparkServiceWorker()` adds. */
+  start(): void;
+  private onVersionReady;
+  private onUnrecoverable;
+  private onNavigationStart;
+  private check;
+  private reload;
+  private isHidden;
+  private readReloadedFor;
+  private writeReloadedFor;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkServiceWorkerUpdates, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}

package/types/mintplayer-ng-spark-services.d.ts

@@ -15,6 +15,8 @@ export declare class RetryActionService {
 export declare class SparkLanguageService {
   private readonly http;
   private readonly config;
+  /** Null outside a browser (server-side rendering), where there is no cookie to write. */
+  private readonly document;
   private readonly baseUrl;
   private readonly currentLang;
   private readonly translationsMap;
@@ -22,6 +24,14 @@ export declare class SparkLanguageService {
   readonly languages: import("@angular/core").WritableSignal<Record<string, TranslatedString>>;
   constructor();
   private loadCulture;
+  /**
+   * Mirrors the language into the `spark-lang` cookie, which the server-rendered pages read
+   * (`/connect/*` of the identity provider, `ConnectText.CultureCookie`): they cannot see
+   * localStorage, and without the cookie a sign-in popup would open in the browser's language
+   * rather than the one the user picked in the app. Not `HttpOnly` by nature (script writes it);
+   * it carries only a language code, which the server matches against its supported cultures.
+   */
+  private writeCookie;
   private loadTranslations;
   setLanguage(lang: string): void;
   resolve(ts: TranslatedString | undefined): string;

package/types/mintplayer-ng-spark-shell.d.ts

@@ -43,7 +43,7 @@ export declare class SparkShellTopbarStartDirective {
 /**
  * Topbar, trailing edge. Default: the language selector (which hides itself when the app has
  * one language). This is where an auth bar goes — the shell cannot ship one itself, since
- * `@mintplayer/ng-spark` does not (and must not) depend on `@mintplayer/ng-spark-auth`.
+ * the non-auth entry points of `@mintplayer/ng-spark` do not (and must not) import `@mintplayer/ng-spark/auth/*`.
  */
 export declare class SparkShellTopbarEndDirective {
   readonly templateRef: TemplateRef<unknown>;
@@ -320,7 +320,7 @@ export declare class SparkShellComponent {
  * instead.
  *
  * Because the response is caller-scoped it must be re-fetched when the caller changes: the
- * component tracks the optional `SPARK_AUTH_STATE` signal (supplied by ng-spark-auth's
+ * component tracks the optional `SPARK_AUTH_STATE` signal (supplied by ng-spark/auth's
  * `provideSparkAuth()`, or by the app's own auth stack) and reloads on every change. Without a
  * provider it fetches once. `reloadToken` is the manual escape hatch (any changed value triggers
  * a reload), and `reload()` the imperative one.

package/types/mintplayer-ng-spark.d.ts

@@ -18,16 +18,16 @@ export declare const SPARK_CONFIG: InjectionToken<SparkConfig>;
 export declare const defaultSparkConfig: SparkConfig;
 /**
  * A signal that changes whenever the authenticated user changes — the bridge that lets ng-spark
- * components react to sign-in/out without a dependency on `@mintplayer/ng-spark-auth` (no
- * dependency exists between the two packages, in either direction, on purpose).
+ * components react to sign-in/out without importing `@mintplayer/ng-spark/auth/*` (the non-auth
+ * entry points must not import the auth ones, on purpose, so an app without auth pulls no auth code).
  *
- * `@mintplayer/ng-spark-auth`'s `provideSparkAuth()` supplies it from `SparkAuthService.user`;
+ * `@mintplayer/ng-spark/auth`'s `provideSparkAuth()` supplies it from `SparkAuthService.user`;
  * an app with its own auth stack provides any signal that changes on sign-in/out. Consumers
  * inject it `{ optional: true }` — absent, auth-sensitive data (the program-units menu) is
  * fetched once and never re-fetched.
  *
  * The signal's VALUE is deliberately opaque (`unknown`): consumers only track it for change,
- * never read it — what "the user" looks like belongs to the auth package.
+ * never read it — what "the user" looks like belongs to the auth entry points.
  */
 export declare const SPARK_AUTH_STATE: InjectionToken<Signal<unknown>>;
 export declare function provideSpark(config?: Partial<SparkConfig>): Provider[];