@mintplayer/ng-spark 22.30.0 → 22.31.0

package/fesm2022/mintplayer-ng-spark-auth-routes.mjs

@@ -0,0 +1,194 @@
+import { SPARK_ACCOUNT_OVERVIEW_LINKS, SPARK_AUTH_ROUTE_PATHS, SPARK_EXTERNAL_PROVIDERS } from "@mintplayer/ng-spark/auth/models";
+import { inject } from "@angular/core";
+import { Router } from "@angular/router";
+import { sparkAuthGuard } from "@mintplayer/ng-spark/auth/guards";
+const SPARK_PASSKEYS_PAGE_URL = "/po/passkeys/me";
+const toPasskeysPage = () => inject(Router).parseUrl(SPARK_PASSKEYS_PAGE_URL);
+function passkeysChild(entry, path, guard) {
+	if (typeof entry === "object" && entry.component) {
+		const component = entry.component;
+		return {
+			path,
+			loadComponent: () => Promise.resolve(component),
+			...guard.length ? { canActivate: guard } : {}
+		};
+	}
+	return {
+		path,
+		canActivate: [...guard, toPasskeysPage],
+		children: []
+	};
+}
+function entryPath(entry, defaultPath) {
+	if (entry === void 0) return defaultPath;
+	return typeof entry === "string" ? entry : entry.path;
+}
+function child(entry, path, defaultLoader) {
+	const component = typeof entry === "object" && entry.component ? entry.component : void 0;
+	return {
+		path,
+		loadComponent: component ? () => Promise.resolve(component) : defaultLoader
+	};
+}
+function sparkAuthRoutes(...features) {
+	const children = [];
+	const paths = {};
+	const externalProviders = [];
+	const accountLinks = [];
+	for (const feature of features) {
+		children.push(...feature.children);
+		Object.assign(paths, feature.paths);
+		if (feature.providers) externalProviders.push(...feature.providers);
+		if (feature.accountLinks) accountLinks.push(...feature.accountLinks);
+	}
+	return [{
+		path: "",
+		providers: [
+			{
+				provide: SPARK_AUTH_ROUTE_PATHS,
+				useValue: paths
+			},
+			{
+				provide: SPARK_EXTERNAL_PROVIDERS,
+				useValue: externalProviders
+			},
+			{
+				provide: SPARK_ACCOUNT_OVERVIEW_LINKS,
+				useValue: accountLinks
+			}
+		],
+		children
+	}];
+}
+function withLocalLogin(entries) {
+	const login = entryPath(entries?.login, "login");
+	const twoFactor = entryPath(entries?.twoFactor, "login/two-factor");
+	const forgotPassword = entryPath(entries?.forgotPassword, "forgot-password");
+	const resetPassword = entryPath(entries?.resetPassword, "reset-password");
+	return {
+		paths: {
+			login: "/" + login,
+			twoFactor: "/" + twoFactor,
+			forgotPassword: "/" + forgotPassword,
+			resetPassword: "/" + resetPassword
+		},
+		children: [
+			child(entries?.login, login, () => import("@mintplayer/ng-spark/auth/login").then((m) => m.SparkLoginComponent)),
+			child(entries?.twoFactor, twoFactor, () => import("@mintplayer/ng-spark/auth/two-factor").then((m) => m.SparkTwoFactorComponent)),
+			child(entries?.forgotPassword, forgotPassword, () => import("@mintplayer/ng-spark/auth/forgot-password").then((m) => m.SparkForgotPasswordComponent)),
+			child(entries?.resetPassword, resetPassword, () => import("@mintplayer/ng-spark/auth/reset-password").then((m) => m.SparkResetPasswordComponent))
+		]
+	};
+}
+function withRegistration(entry) {
+	const register = entryPath(entry, "register");
+	return {
+		paths: { register: "/" + register },
+		children: [child(entry, register, () => import("@mintplayer/ng-spark/auth/register").then((m) => m.SparkRegisterComponent))]
+	};
+}
+function withExternalLogin(...providersOrOptions) {
+	const providers = providersOrOptions.filter(isProvider);
+	const options = providersOrOptions.find((p) => !isProvider(p));
+	const signIn = entryPath(options?.signIn, "sign-in");
+	return {
+		paths: { signIn: "/" + signIn },
+		providers,
+		children: [child(options?.signIn, signIn, () => import("@mintplayer/ng-spark/auth/sign-in").then((m) => m.SparkSignInComponent))]
+	};
+}
+function isProvider(value) {
+	return typeof value.scheme === "string";
+}
+function withPasskeys(entry) {
+	const passkeys = entryPath(entry, "passkeys");
+	return {
+		paths: { passkeys: "/" + passkeys },
+		children: [passkeysChild(entry, passkeys, [])]
+	};
+}
+function withAccount(options) {
+	const guard = options?.canActivate ?? [sparkAuthGuard];
+	const excluded = new Set(options?.exclude ?? []);
+	const paths = {};
+	const children = [];
+	const add = (key, defaultPath, loader, guarded = true) => {
+		if (excluded.has(key)) return;
+		const entry = options?.[key];
+		const path = entryPath(entry, defaultPath);
+		paths[key] = "/" + path;
+		const route = child(entry, path, loader);
+		children.push(guarded && guard.length ? {
+			...route,
+			canActivate: guard
+		} : route);
+	};
+	add("confirmEmail", "confirm-email", () => import("@mintplayer/ng-spark/auth/confirm-email").then((m) => m.SparkConfirmEmailComponent), false);
+	add("profile", "account/profile", () => import("@mintplayer/ng-spark/auth/account").then((m) => m.SparkAccountProfileComponent));
+	add("changePassword", "account/password", () => import("@mintplayer/ng-spark/auth/account").then((m) => m.SparkChangePasswordComponent));
+	add("twoFactorSetup", "account/two-factor", () => import("@mintplayer/ng-spark/auth/account").then((m) => m.SparkTwoFactorSetupComponent));
+	add("externalLogins", "account/logins", () => import("@mintplayer/ng-spark/auth/account").then((m) => m.SparkExternalLoginsComponent));
+	if (!excluded.has("passkeys")) {
+		const path = entryPath(options?.passkeys, "account/passkeys");
+		paths.passkeys = "/" + path;
+		children.push(passkeysChild(options?.passkeys, path, guard));
+	}
+	add("personalData", "account/personal-data", () => import("@mintplayer/ng-spark/auth/account").then((m) => m.SparkPersonalDataComponent));
+	add("account", "account", () => import("@mintplayer/ng-spark/auth/account").then((m) => m.SparkAccountOverviewComponent));
+	return {
+		paths,
+		children
+	};
+}
+function externalProvider(scheme, presentation) {
+	return {
+		scheme,
+		...presentation
+	};
+}
+function githubProvider(presentation) {
+	return externalProvider("GitHub", {
+		iconClass: "bi bi-github",
+		...presentation
+	});
+}
+function googleProvider(presentation) {
+	return externalProvider("Google", {
+		iconClass: "bi bi-google",
+		...presentation
+	});
+}
+function facebookProvider(presentation) {
+	return externalProvider("Facebook", {
+		iconClass: "bi bi-facebook",
+		...presentation
+	});
+}
+function microsoftProvider(presentation) {
+	return externalProvider("Microsoft", {
+		iconClass: "bi bi-microsoft",
+		...presentation
+	});
+}
+function twitterProvider(presentation) {
+	return externalProvider("Twitter", {
+		displayName: "X",
+		iconClass: "bi bi-twitter-x",
+		...presentation
+	});
+}
+function linkedInProvider(presentation) {
+	return externalProvider("LinkedIn", {
+		iconClass: "bi bi-linkedin",
+		...presentation
+	});
+}
+function oidcProvider(scheme, displayName, iconClass = "bi bi-person-badge") {
+	return externalProvider(scheme, {
+		displayName,
+		iconClass
+	});
+}
+export { SPARK_PASSKEYS_PAGE_URL, externalProvider, facebookProvider, githubProvider, googleProvider, linkedInProvider, microsoftProvider, oidcProvider, sparkAuthRoutes, twitterProvider, withAccount, withExternalLogin, withLocalLogin, withPasskeys, withRegistration };
+
+//# sourceMappingURL=mintplayer-ng-spark-auth-routes.mjs.map

package/fesm2022/mintplayer-ng-spark-auth-routes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mintplayer-ng-spark-auth-routes.mjs","names":[],"sources":["../../auth/routes/src/spark-auth-routes.ts"],"sourcesContent":["import {\n  SPARK_ACCOUNT_OVERVIEW_LINKS,\n  SPARK_AUTH_ROUTE_PATHS,\n  SPARK_EXTERNAL_PROVIDERS,\n  SparkAccountOverviewLink,\n  SparkAuthRouteEntries,\n  SparkAuthRouteEntry,\n  SparkAuthRoutePaths,\n  SparkExternalProviderPresentation,\n} from '@mintplayer/ng-spark/auth/models';\n\nimport { inject } from '@angular/core';\nimport { Router, type CanActivateFn } from '@angular/router';\nimport { sparkAuthGuard } from '@mintplayer/ng-spark/auth/guards';\n\ntype Loader = () => Promise<any>;\n\ninterface Child {\n  path: string;\n  loadComponent?: Loader;\n  canActivate?: CanActivateFn[];\n  children?: [];\n}\n\n/**\n * The passkeys page: the generic persistent-object page of the Authorization library's virtual\n * `Passkeys` type, one per signed-in user, so the id is the fixed `me` (generic passkeys page PRD D1).\n */\nexport const SPARK_PASSKEYS_PAGE_URL = '/po/passkeys/me';\n\n/** Forwards to {@link SPARK_PASSKEYS_PAGE_URL}. */\nconst toPasskeysPage: CanActivateFn = () => inject(Router).parseUrl(SPARK_PASSKEYS_PAGE_URL);\n\n/**\n * The passkeys path: a redirect into the generic page, kept for bookmarks and the account overview's\n * link (PRD D8). A guard rather than `redirectTo`, because Angular refuses `canActivate` beside\n * `redirectTo` and the sign-in guard must still run first: the router acts on the first guard in\n * array order that does not pass, so an anonymous visitor is sent to sign in, not to a 404. An\n * application that supplies its own component for the entry keeps it.\n */\nfunction passkeysChild(entry: SparkAuthRouteEntry | undefined, path: string, guard: CanActivateFn[]): Child {\n  if (typeof entry === 'object' && entry.component) {\n    const component = entry.component;\n    return { path, loadComponent: () => Promise.resolve(component), ...(guard.length ? { canActivate: guard } : {}) };\n  }\n  return { path, canActivate: [...guard, toPasskeysPage], children: [] };\n}\n\n/** The routed path for an entry, independent of how its component is loaded. */\nfunction entryPath(entry: SparkAuthRouteEntry | undefined, defaultPath: string): string {\n  if (entry === undefined) return defaultPath;\n  return typeof entry === 'string' ? entry : entry.path;\n}\n\n/** An explicitly supplied component wins over the library's lazy import. */\nfunction child(entry: SparkAuthRouteEntry | undefined, path: string, defaultLoader: Loader): Child {\n  const component = typeof entry === 'object' && entry.component ? entry.component : undefined;\n  return { path, loadComponent: component ? () => Promise.resolve(component) : defaultLoader };\n}\n\n/**\n * One opt-in group of authentication pages, passed to {@link sparkAuthRoutes}. Constructed only by\n * ng-spark's entry points: `withLocalLogin()`, `withRegistration()`, `withExternalLogin()`,\n * `withPasskeys()` and `withAccount()` here, and `withIdentityProvider()` from\n * `@mintplayer/ng-spark/identity-provider`. That keeps the set of mountable pages a decision this\n * library makes rather than a shape an application invents.\n */\nexport interface SparkAuthRoutesFeature {\n  readonly children: Child[];\n  readonly paths: SparkAuthRoutePaths;\n  readonly providers?: SparkExternalProviderPresentation[];\n  /** Extra links for the account overview (`SPARK_ACCOUNT_OVERVIEW_LINKS`). */\n  readonly accountLinks?: SparkAccountOverviewLink[];\n}\n\n/** Path override for the sign-in landing page. Named to stay clear of the core package's\n * `SparkExternalLoginOptions`, which is about the sign-in *call* rather than the route. */\nexport type SparkExternalLoginRouteOptions = Pick<SparkAuthRouteEntries, 'signIn'>;\n\n/**\n * The routes for Spark's authentication pages.\n *\n * **Nothing is mounted unless a feature asks for it.** Passing no features emits no pages at all —\n * opt-in enforced by construction rather than by a flag, matching `provideHttpClient(withFetch())`\n * and `provideRouter(withComponentInputBinding())`. Before this the pages mounted by default and an\n * application had to opt *out*, so every app shipped a registration form whether or not it wanted\n * one.\n *\n * ```ts\n * sparkAuthRoutes(\n *   withLocalLogin(),\n *   withRegistration(),\n *   withExternalLogin(githubProvider(), facebookProvider()),\n * )\n * ```\n *\n * The `import()` expressions live *inside* each feature. That placement is the point: a bundler\n * decides whether to emit a lazy chunk from whether the `import()` call site is reachable, not from\n * whether the route object referencing it survives — so filtering a children array after the fact\n * would still ship every page. A page nobody opted into has no reachable `import()` at all.\n */\nexport function sparkAuthRoutes(...features: SparkAuthRoutesFeature[]): any[] {\n  const children: Child[] = [];\n  const paths: SparkAuthRoutePaths = {};\n  const externalProviders: SparkExternalProviderPresentation[] = [];\n  const accountLinks: SparkAccountOverviewLink[] = [];\n\n  for (const feature of features) {\n    children.push(...feature.children);\n    Object.assign(paths, feature.paths);\n    if (feature.providers) externalProviders.push(...feature.providers);\n    if (feature.accountLinks) accountLinks.push(...feature.accountLinks);\n  }\n\n  return [\n    {\n      path: '',\n      providers: [\n        { provide: SPARK_AUTH_ROUTE_PATHS, useValue: paths },\n        { provide: SPARK_EXTERNAL_PROVIDERS, useValue: externalProviders },\n        { provide: SPARK_ACCOUNT_OVERVIEW_LINKS, useValue: accountLinks },\n      ],\n      children,\n    },\n  ];\n}\n\n/**\n * Mounts the email/password family: login, two-factor, forgot-password, reset-password.\n *\n * These four are one feature rather than four because they form a star centred on the login page and\n * every template dereferences its siblings unconditionally — removing any proper subset leaves a\n * dangling link. Registration is genuinely separable, and is its own feature.\n *\n * Two-factor belongs here because it is reachable only from the login page's `RequiresTwoFactor`\n * branch and posts to the same `/login` endpoint: it is part of password sign-in, not of\n * authentication in general.\n */\nexport function withLocalLogin(\n  entries?: Pick<SparkAuthRouteEntries, 'login' | 'twoFactor' | 'forgotPassword' | 'resetPassword'>,\n): SparkAuthRoutesFeature {\n  const login = entryPath(entries?.login, 'login');\n  const twoFactor = entryPath(entries?.twoFactor, 'login/two-factor');\n  const forgotPassword = entryPath(entries?.forgotPassword, 'forgot-password');\n  const resetPassword = entryPath(entries?.resetPassword, 'reset-password');\n\n  return {\n    paths: {\n      login: '/' + login,\n      twoFactor: '/' + twoFactor,\n      forgotPassword: '/' + forgotPassword,\n      resetPassword: '/' + resetPassword,\n    },\n    children: [\n      child(entries?.login, login,\n        () => import('@mintplayer/ng-spark/auth/login').then(m => m.SparkLoginComponent)),\n      child(entries?.twoFactor, twoFactor,\n        () => import('@mintplayer/ng-spark/auth/two-factor').then(m => m.SparkTwoFactorComponent)),\n      child(entries?.forgotPassword, forgotPassword,\n        () => import('@mintplayer/ng-spark/auth/forgot-password').then(m => m.SparkForgotPasswordComponent)),\n      child(entries?.resetPassword, resetPassword,\n        () => import('@mintplayer/ng-spark/auth/reset-password').then(m => m.SparkResetPasswordComponent)),\n    ],\n  };\n}\n\n/**\n * Mounts the self-service registration page.\n *\n * Separate from {@link withLocalLogin} because the two decisions genuinely are separate: an\n * application whose accounts are provisioned by an administrator still needs password sign-in and\n * password reset. Mount it only alongside a server whose `SparkLocalCredentials` is `Full` — with\n * `SignInOnly` the endpoint it posts to is not mapped.\n */\nexport function withRegistration(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature {\n  const register = entryPath(entry, 'register');\n\n  return {\n    paths: { register: '/' + register },\n    children: [\n      child(entry, register,\n        () => import('@mintplayer/ng-spark/auth/register').then(m => m.SparkRegisterComponent)),\n    ],\n  };\n}\n\n/**\n * Mounts the sign-in landing page — a button per external provider the *server* reports.\n *\n * Accepts provider declarations and, in any position, one options object for the page's own path;\n * the two shapes are disjoint, so `withExternalLogin(githubProvider(), facebookProvider())` and\n * `withExternalLogin({ signIn: 'landing' }, githubProvider())` both read naturally.\n *\n * Declaring no providers is valid and useful: the page still renders whatever\n * `GET /spark/auth/capabilities` reports, using default buttons.\n */\nexport function withExternalLogin(\n  ...providersOrOptions: (SparkExternalProviderPresentation | SparkExternalLoginRouteOptions)[]\n): SparkAuthRoutesFeature {\n  const providers = providersOrOptions.filter(isProvider);\n  const options = providersOrOptions.find((p): p is SparkExternalLoginRouteOptions => !isProvider(p));\n  const signIn = entryPath(options?.signIn, 'sign-in');\n\n  return {\n    paths: { signIn: '/' + signIn },\n    providers,\n    children: [\n      child(options?.signIn, signIn,\n        () => import('@mintplayer/ng-spark/auth/sign-in').then(m => m.SparkSignInComponent)),\n    ],\n  };\n}\n\nfunction isProvider(\n  value: SparkExternalProviderPresentation | SparkExternalLoginRouteOptions,\n): value is SparkExternalProviderPresentation {\n  return typeof (value as SparkExternalProviderPresentation).scheme === 'string';\n}\n\n/**\n * Presentation for one provider's button, keyed by the scheme the server reports.\n *\n * The generic form. `githubProvider()` and friends are this with a scheme and an icon filled in —\n * they exist so the common case does not require knowing the scheme string, not because the library\n * has an opinion about which providers exist.\n */\n/**\n * Mounts the passkey management path, which forwards to the generic passkeys page (`/po/passkeys/me`).\n *\n * Independent of every other feature here, and of the server's `SparkLocalCredentials`: a passkey is\n * a passwordless credential, so the applications most likely to want this page are exactly the ones\n * that mount no password pages at all. It pairs with `SparkPasskeys.Enabled` on the server.\n *\n * ⚠️ The page assumes a signed-in user — enrollment adds a credential to an existing account, it\n * cannot create one. Mount it inside the application's authenticated area, or behind\n * `sparkAuthGuard`; the server answers the page with 404 to a visitor who is not signed in.\n */\nexport function withPasskeys(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature {\n  const passkeys = entryPath(entry, 'passkeys');\n\n  return {\n    paths: { passkeys: '/' + passkeys },\n    children: [passkeysChild(entry, passkeys, [])],\n  };\n}\n\n/** Options for {@link withAccount}: a path/component per page, and the guard of the signed-in pages. */\nexport type SparkAccountRouteOptions =\n  Pick<SparkAuthRouteEntries, 'confirmEmail' | 'account' | 'profile' | 'changePassword' | 'twoFactorSetup' | 'externalLogins' | 'passkeys' | 'personalData'>\n  & {\n    /**\n     * Guards the signed-in pages (everything but confirm-email). Defaults to `[sparkAuthGuard]`,\n     * which waits for the session check so a hard reload does not bounce a signed-in user to the\n     * sign-in page. Pass `[]` when the pages sit under a guarded parent route already.\n     */\n    canActivate?: CanActivateFn[];\n    /**\n     * Pages to leave out, e.g. `['externalLogins']` for an app without external providers or\n     * `['changePassword']` under `SparkLocalCredentials.Disabled` (the endpoint is not mapped there).\n     */\n    exclude?: (keyof Omit<SparkAccountRouteOptions, 'canActivate' | 'exclude'>)[];\n  };\n\n/**\n * Mounts the account pages (#460, D16), each also usable as a standalone component:\n *\n * | page | default path | component |\n * |---|---|---|\n * | confirm email (public; the mail link target) | `confirm-email` | `SparkConfirmEmailComponent` |\n * | overview | `account` | `SparkAccountOverviewComponent` |\n * | profile (user name, email change, mail language, app fields) | `account/profile` | `SparkAccountProfileComponent` |\n * | change / set password | `account/password` | `SparkChangePasswordComponent` |\n * | two-factor (authenticator, recovery codes) | `account/two-factor` | `SparkTwoFactorSetupComponent` |\n * | connected logins | `account/logins` | `SparkExternalLoginsComponent` |\n * | passkeys (forwards to the generic page, `/po/passkeys/me`) | `account/passkeys` | — |\n * | personal data + account deletion | `account/personal-data` | `SparkPersonalDataComponent` |\n *\n * `confirm-email` must stay at the server's `Spark:Auth:Links:ConfirmEmailPath` (default\n * `/confirm-email`), which confirmation mails link to. No path has a parameterised first segment, so the\n * group neither shadows `sparkRoutes()` nor is shadowed by it.\n */\nexport function withAccount(options?: SparkAccountRouteOptions): SparkAuthRoutesFeature {\n  const guard = options?.canActivate ?? [sparkAuthGuard];\n  const excluded = new Set(options?.exclude ?? []);\n  const paths: SparkAuthRoutePaths = {};\n  const children: Child[] = [];\n\n  const add = (key: keyof SparkAccountRouteOptions & keyof SparkAuthRouteEntries, defaultPath: string, loader: Loader, guarded = true) => {\n    if (excluded.has(key as never)) return;\n    const entry = options?.[key] as SparkAuthRouteEntry | undefined;\n    const path = entryPath(entry, defaultPath);\n    paths[key] = '/' + path;\n    const route = child(entry, path, loader);\n    children.push(guarded && guard.length ? { ...route, canActivate: guard } : route);\n  };\n\n  add('confirmEmail', 'confirm-email',\n    () => import('@mintplayer/ng-spark/auth/confirm-email').then(m => m.SparkConfirmEmailComponent), false);\n  add('profile', 'account/profile',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkAccountProfileComponent));\n  add('changePassword', 'account/password',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkChangePasswordComponent));\n  add('twoFactorSetup', 'account/two-factor',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkTwoFactorSetupComponent));\n  add('externalLogins', 'account/logins',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkExternalLoginsComponent));\n  if (!excluded.has('passkeys')) {\n    const path = entryPath(options?.passkeys, 'account/passkeys');\n    paths.passkeys = '/' + path;\n    children.push(passkeysChild(options?.passkeys, path, guard));\n  }\n  add('personalData', 'account/personal-data',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkPersonalDataComponent));\n  add('account', 'account',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkAccountOverviewComponent));\n\n  return { paths, children };\n}\n\nexport function externalProvider(\n  scheme: string,\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return { scheme, ...presentation };\n}\n\nexport function githubProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('GitHub', { iconClass: 'bi bi-github', ...presentation });\n}\n\nexport function googleProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Google', { iconClass: 'bi bi-google', ...presentation });\n}\n\nexport function facebookProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Facebook', { iconClass: 'bi bi-facebook', ...presentation });\n}\n\nexport function microsoftProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Microsoft', { iconClass: 'bi bi-microsoft', ...presentation });\n}\n\n/** X (formerly Twitter) — the server's `spark.AddTwitter()` preset (OAuth 2.0), scheme `Twitter`. */\nexport function twitterProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Twitter', { displayName: 'X', iconClass: 'bi bi-twitter-x', ...presentation });\n}\n\n/** LinkedIn — the server's `spark.AddLinkedIn()` preset (OpenID Connect userinfo), scheme `LinkedIn`. */\nexport function linkedInProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('LinkedIn', { iconClass: 'bi bi-linkedin', ...presentation });\n}\n\n/**\n * Any OpenID Connect provider — the client half of the server's OIDC preset\n * (`spark.AddOpenIdConnect(...)`, or a `Spark:Auth:Providers:OpenIdConnect:<scheme>` section). Unlike the named presets the scheme is the\n * application's own choice, so it and the button text are required; `scheme` must equal the server's\n * scheme name exactly.\n */\nexport function oidcProvider(\n  scheme: string,\n  displayName: string,\n  iconClass = 'bi bi-person-badge',\n): SparkExternalProviderPresentation {\n  return externalProvider(scheme, { displayName, iconClass });\n}\n"],"mappings":";;;;AA4BA,MAAa,0BAA0B;AAGvC,MAAM,uBAAsC,OAAO,MAAM,CAAC,CAAC,SAAS,uBAAuB;AAS3F,SAAS,cAAc,OAAwC,MAAc,OAAsB;CACjG,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW;EAChD,MAAM,YAAY,MAAM;EACxB,OAAO;GAAE;GAAM,qBAAqB,QAAQ,QAAQ,SAAS;GAAG,GAAI,MAAM,SAAS,EAAE,aAAa,MAAK,IAAK,CAAA;EAAG;CACjH;CACA,OAAO;EAAE;EAAM,aAAa,CAAC,GAAG,OAAO,cAAc;EAAG,UAAU,CAAA;CAAE;AACtE;AAGA,SAAS,UAAU,OAAwC,aAAmB;CAC5E,IAAI,UAAU,QAAW,OAAO;CAChC,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;AACnD;AAGA,SAAS,MAAM,OAAwC,MAAc,eAAqB;CACxF,MAAM,YAAY,OAAO,UAAU,YAAY,MAAM,YAAY,MAAM,YAAY;CACnF,OAAO;EAAE;EAAM,eAAe,kBAAkB,QAAQ,QAAQ,SAAS,IAAI;CAAa;AAC5F;AA2CA,SAAgB,gBAAgB,GAAG,UAAkC;CACnE,MAAM,WAAoB,CAAA;CAC1B,MAAM,QAA6B,CAAA;CACnC,MAAM,oBAAyD,CAAA;CAC/D,MAAM,eAA2C,CAAA;CAEjD,KAAK,MAAM,WAAW,UAAU;EAC9B,SAAS,KAAK,GAAG,QAAQ,QAAQ;EACjC,OAAO,OAAO,OAAO,QAAQ,KAAK;EAClC,IAAI,QAAQ,WAAW,kBAAkB,KAAK,GAAG,QAAQ,SAAS;EAClE,IAAI,QAAQ,cAAc,aAAa,KAAK,GAAG,QAAQ,YAAY;CACrE;CAEA,OAAO,CACL;EACE,MAAM;EACN,WAAW;GACT;IAAE,SAAS;IAAwB,UAAU;GAAK;GAClD;IAAE,SAAS;IAA0B,UAAU;GAAiB;GAChE;IAAE,SAAS;IAA8B,UAAU;GAAY;EAChE;EACD;CACD,CACF;AACH;AAaA,SAAgB,eACd,SAAiG;CAEjG,MAAM,QAAQ,UAAU,SAAS,OAAO,OAAO;CAC/C,MAAM,YAAY,UAAU,SAAS,WAAW,kBAAkB;CAClE,MAAM,iBAAiB,UAAU,SAAS,gBAAgB,iBAAiB;CAC3E,MAAM,gBAAgB,UAAU,SAAS,eAAe,gBAAgB;CAExE,OAAO;EACL,OAAO;GACL,OAAO,MAAM;GACb,WAAW,MAAM;GACjB,gBAAgB,MAAM;GACtB,eAAe,MAAM;EACtB;EACD,UAAU;GACR,MAAM,SAAS,OAAO,aACd,OAAO,kCAAkC,CAAC,MAAK,MAAK,EAAE,mBAAmB,CAAC;GAClF,MAAM,SAAS,WAAW,iBAClB,OAAO,uCAAuC,CAAC,MAAK,MAAK,EAAE,uBAAuB,CAAC;GAC3F,MAAM,SAAS,gBAAgB,sBACvB,OAAO,4CAA4C,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;GACrG,MAAM,SAAS,eAAe,qBACtB,OAAO,2CAA2C,CAAC,MAAK,MAAK,EAAE,2BAA2B,CAAC;EACpG;CACF;AACH;AAUA,SAAgB,iBAAiB,OAA2B;CAC1D,MAAM,WAAW,UAAU,OAAO,UAAU;CAE5C,OAAO;EACL,OAAO,EAAE,UAAU,MAAM,SAAQ;EACjC,UAAU,CACR,MAAM,OAAO,gBACL,OAAO,qCAAqC,CAAC,MAAK,MAAK,EAAE,sBAAsB,CAAC,CACzF;CACF;AACH;AAYA,SAAgB,kBACd,GAAG,oBAA0F;CAE7F,MAAM,YAAY,mBAAmB,OAAO,UAAU;CACtD,MAAM,UAAU,mBAAmB,MAAM,MAA2C,CAAC,WAAW,CAAC,CAAC;CAClG,MAAM,SAAS,UAAU,SAAS,QAAQ,SAAS;CAEnD,OAAO;EACL,OAAO,EAAE,QAAQ,MAAM,OAAM;EAC7B;EACA,UAAU,CACR,MAAM,SAAS,QAAQ,cACf,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,oBAAoB,CAAC,CACtF;CACF;AACH;AAEA,SAAS,WACP,OAAyE;CAEzE,OAAO,OAAQ,MAA4C,WAAW;AACxE;AAoBA,SAAgB,aAAa,OAA2B;CACtD,MAAM,WAAW,UAAU,OAAO,UAAU;CAE5C,OAAO;EACL,OAAO,EAAE,UAAU,MAAM,SAAQ;EACjC,UAAU,CAAC,cAAc,OAAO,UAAU,CAAA,CAAE,CAAC;CAC9C;AACH;AAqCA,SAAgB,YAAY,SAAkC;CAC5D,MAAM,QAAQ,SAAS,eAAe,CAAC,cAAc;CACrD,MAAM,WAAW,IAAI,IAAI,SAAS,WAAW,CAAA,CAAE;CAC/C,MAAM,QAA6B,CAAA;CACnC,MAAM,WAAoB,CAAA;CAE1B,MAAM,OAAO,KAAmE,aAAqB,QAAgB,UAAU,SAAQ;EACrI,IAAI,SAAS,IAAI,GAAY,GAAG;EAChC,MAAM,QAAQ,UAAU;EACxB,MAAM,OAAO,UAAU,OAAO,WAAW;EACzC,MAAM,OAAO,MAAM;EACnB,MAAM,QAAQ,MAAM,OAAO,MAAM,MAAM;EACvC,SAAS,KAAK,WAAW,MAAM,SAAS;GAAE,GAAG;GAAO,aAAa;EAAK,IAAK,KAAK;CAClF;CAEA,IAAI,gBAAgB,uBACZ,OAAO,0CAA0C,CAAC,MAAK,MAAK,EAAE,0BAA0B,GAAG,KAAK;CACxG,IAAI,WAAW,yBACP,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,0BACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,4BACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,wBACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,CAAC,SAAS,IAAI,UAAU,GAAG;EAC7B,MAAM,OAAO,UAAU,SAAS,UAAU,kBAAkB;EAC5D,MAAM,WAAW,MAAM;EACvB,SAAS,KAAK,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC;CAC7D;CACA,IAAI,gBAAgB,+BACZ,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,0BAA0B,CAAC;CAC3F,IAAI,WAAW,iBACP,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,6BAA6B,CAAC;CAE9F,OAAO;EAAE;EAAO;CAAQ;AAC1B;AAEA,SAAgB,iBACd,QACA,cAAgE;CAEhE,OAAO;EAAE;EAAQ,GAAG;CAAY;AAClC;AAEA,SAAgB,eACd,cAAgE;CAEhE,OAAO,iBAAiB,UAAU;EAAE,WAAW;EAAgB,GAAG;CAAY,CAAE;AAClF;AAEA,SAAgB,eACd,cAAgE;CAEhE,OAAO,iBAAiB,UAAU;EAAE,WAAW;EAAgB,GAAG;CAAY,CAAE;AAClF;AAEA,SAAgB,iBACd,cAAgE;CAEhE,OAAO,iBAAiB,YAAY;EAAE,WAAW;EAAkB,GAAG;CAAY,CAAE;AACtF;AAEA,SAAgB,kBACd,cAAgE;CAEhE,OAAO,iBAAiB,aAAa;EAAE,WAAW;EAAmB,GAAG;CAAY,CAAE;AACxF;AAGA,SAAgB,gBACd,cAAgE;CAEhE,OAAO,iBAAiB,WAAW;EAAE,aAAa;EAAK,WAAW;EAAmB,GAAG;CAAY,CAAE;AACxG;AAGA,SAAgB,iBACd,cAAgE;CAEhE,OAAO,iBAAiB,YAAY;EAAE,WAAW;EAAkB,GAAG;CAAY,CAAE;AACtF;AAQA,SAAgB,aACd,QACA,aACA,YAAY,sBAAoB;CAEhC,OAAO,iBAAiB,QAAQ;EAAE;EAAa;CAAS,CAAE;AAC5D"}

package/fesm2022/mintplayer-ng-spark-auth-sign-in.mjs

@@ -0,0 +1,210 @@
+import * as i0 from "@angular/core";
+import { ChangeDetectionStrategy, Component, inject, input, isDevMode, signal } from "@angular/core";
+import { ActivatedRoute, Router, RouterLink } from "@angular/router";
+import { Color } from "@mintplayer/ng-bootstrap";
+import { BsAlertComponent } from "@mintplayer/ng-bootstrap/alert";
+import { BsCardComponent, BsCardHeaderComponent } from "@mintplayer/ng-bootstrap/card";
+import { BsSpinnerComponent } from "@mintplayer/ng-bootstrap/spinner";
+import { SPARK_AUTH_CONFIG, SPARK_AUTH_ROUTE_PATHS, isSafeReturnUrl, passkeysSupported } from "@mintplayer/ng-spark/auth/models";
+import { SparkAuthService } from "@mintplayer/ng-spark/auth/core";
+import { SparkExternalLoginButtonsComponent } from "@mintplayer/ng-spark/auth/external-login";
+import { TranslateKeyPipe } from "@mintplayer/ng-spark/auth/pipes";
+var SparkSignInComponent = class SparkSignInComponent {
+	authService = inject(SparkAuthService);
+	route = inject(ActivatedRoute, { optional: true });
+	router = inject(Router);
+	config = inject(SPARK_AUTH_CONFIG);
+	routePaths = inject(SPARK_AUTH_ROUTE_PATHS);
+	colors = Color;
+	returnUrl = input(void 0, ...ngDevMode ? [{ debugName: "returnUrl" }] : /* istanbul ignore next */ []);
+	effectiveReturnUrl() {
+		const explicit = this.returnUrl();
+		if (explicit) return explicit;
+		const fromQuery = this.route?.snapshot.queryParamMap.get("returnUrl");
+		return isSafeReturnUrl(fromQuery) ? fromQuery : void 0;
+	}
+	providerTemplate = input(null, ...ngDevMode ? [{ debugName: "providerTemplate" }] : /* istanbul ignore next */ []);
+	hasProviders = signal(false, ...ngDevMode ? [{ debugName: "hasProviders" }] : /* istanbul ignore next */ []);
+	localCredentialsAvailable = signal(false, ...ngDevMode ? [{ debugName: "localCredentialsAvailable" }] : /* istanbul ignore next */ []);
+	loading = signal(true, ...ngDevMode ? [{ debugName: "loading" }] : /* istanbul ignore next */ []);
+	failed = signal(false, ...ngDevMode ? [{ debugName: "failed" }] : /* istanbul ignore next */ []);
+	passkeysAvailable = signal(false, ...ngDevMode ? [{ debugName: "passkeysAvailable" }] : /* istanbul ignore next */ []);
+	passkeyBusy = signal(false, ...ngDevMode ? [{ debugName: "passkeyBusy" }] : /* istanbul ignore next */ []);
+	passkeyError = signal("", ...ngDevMode ? [{ debugName: "passkeyError" }] : /* istanbul ignore next */ []);
+	constructor() {
+		this.load();
+	}
+	async load() {
+		try {
+			const capabilities = await this.authService.capabilities();
+			this.hasProviders.set((capabilities.externalProviders ?? []).length > 0);
+			this.localCredentialsAvailable.set(capabilities.localCredentials !== "Disabled");
+			this.passkeysAvailable.set(capabilities.passkeys === true && passkeysSupported());
+			this.warnOnMismatch(capabilities);
+		} catch {
+			this.failed.set(true);
+		} finally {
+			this.loading.set(false);
+		}
+	}
+	warnOnMismatch(capabilities) {
+		if (isDevMode() && capabilities.localCredentials === "Full") console.warn("[ng-spark-auth] This app routes the sign-in landing page, but the server reports localCredentials = Full. The two are configured independently — check that the features passed to sparkAuthRoutes() match AddAuthentication's LocalCredentials mode.");
+	}
+	async signInWithPasskey() {
+		this.passkeyError.set("");
+		this.passkeyBusy.set(true);
+		try {
+			const returnUrl = this.effectiveReturnUrl() ?? this.config.defaultRedirectUrl;
+			const result = await this.authService.signInWithPasskey();
+			if (result.success) {
+				await this.router.navigateByUrl(returnUrl);
+				return;
+			}
+			if (result.error === "cancelled") return;
+			this.passkeyError.set(result.error === "locked_out" ? "auth.lockedOut" : "auth.passkeyFailed");
+		} finally {
+			this.passkeyBusy.set(false);
+		}
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: SparkSignInComponent,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Component
+	});
+	static ɵcmp = i0.ɵɵngDeclareComponent({
+		minVersion: "17.0.0",
+		version: "22.2.0",
+		type: SparkSignInComponent,
+		isStandalone: true,
+		selector: "spark-sign-in",
+		inputs: {
+			returnUrl: {
+				classPropertyName: "returnUrl",
+				publicName: "returnUrl",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			},
+			providerTemplate: {
+				classPropertyName: "providerTemplate",
+				publicName: "providerTemplate",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			}
+		},
+		ngImport: i0,
+		template: "<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (loading()) {\n        <div class=\"text-center\"><bs-spinner /></div>\n      } @else if (failed()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-0\">{{ 'auth.signInUnavailable' | t }}</bs-alert>\n      }\n\n      <!-- Rendered from the start, not after this page's own load: it asks for the capabilities at\n           the same moment this page does, which the service turns into one request. It shows nothing\n           until they arrive, nor when they fail (the alert above says so). -->\n      <spark-external-login-buttons [providerTemplate]=\"providerTemplate()\" [returnUrl]=\"returnUrl()\" />\n\n      @if (!loading() && !failed()) {\n        @if (!hasProviders() && !passkeysAvailable()) {\n          <bs-alert [type]=\"colors.warning\" class=\"mb-0\">{{ 'auth.noSignInMethods' | t }}</bs-alert>\n        }\n\n        <!-- Guarded on the server's capability *and* browser support, both resolved into\n             passkeysAvailable(). A passkey needs no provider button and no username field: the\n             browser offers whatever discoverable credential it holds for this site. -->\n        @if (passkeysAvailable()) {\n          @if (passkeyError()) {\n            <bs-alert [type]=\"colors.danger\" class=\"mb-2\">{{ passkeyError() | t }}</bs-alert>\n          }\n          <button type=\"button\" class=\"btn btn-outline-secondary w-100 mb-2\"\n                  [disabled]=\"passkeyBusy()\" (click)=\"signInWithPasskey()\">\n            <i class=\"bi bi-fingerprint me-2\"></i>{{ 'auth.signInWithPasskey' | t }}\n          </button>\n        }\n\n        <!-- Two conditions, not one. The server may still accept passwords while this app chose not\n             to mount the page — sparkAuthRoutes is opt-in per feature now — and a [routerLink] bound\n             to undefined silently navigates to the current route rather than failing. -->\n        @if (localCredentialsAvailable() && routePaths.login) {\n          <div class=\"text-center mt-3\">\n            <a [routerLink]=\"routePaths.login\">{{ 'auth.login' | t }}</a>\n          </div>\n        }\n      }\n    </div>\n  </bs-card>\n</div>\n",
+		dependencies: [
+			{
+				kind: "directive",
+				type: RouterLink,
+				selector: "[routerLink]",
+				inputs: [
+					"target",
+					"queryParams",
+					"fragment",
+					"queryParamsHandling",
+					"state",
+					"info",
+					"relativeTo",
+					"preserveFragment",
+					"skipLocationChange",
+					"replaceUrl",
+					"browserUrl",
+					"routerLink"
+				]
+			},
+			{
+				kind: "component",
+				type: BsAlertComponent,
+				selector: "bs-alert",
+				inputs: [
+					"type",
+					"announce",
+					"isVisible"
+				],
+				outputs: ["isVisibleChange", "afterOpenedOrClosed"]
+			},
+			{
+				kind: "component",
+				type: BsCardComponent,
+				selector: "bs-card",
+				inputs: ["color", "outline"]
+			},
+			{
+				kind: "component",
+				type: BsCardHeaderComponent,
+				selector: "bs-card-header",
+				inputs: ["color", "navStyle"]
+			},
+			{
+				kind: "component",
+				type: BsSpinnerComponent,
+				selector: "bs-spinner",
+				inputs: ["type", "color"]
+			},
+			{
+				kind: "component",
+				type: SparkExternalLoginButtonsComponent,
+				selector: "spark-external-login-buttons",
+				inputs: ["returnUrl", "providerTemplate"]
+			},
+			{
+				kind: "pipe",
+				type: TranslateKeyPipe,
+				name: "t"
+			}
+		],
+		changeDetection: i0.ChangeDetectionStrategy.OnPush
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: SparkSignInComponent,
+	decorators: [{
+		type: Component,
+		args: [{
+			selector: "spark-sign-in",
+			standalone: true,
+			changeDetection: ChangeDetectionStrategy.OnPush,
+			imports: [
+				RouterLink,
+				BsAlertComponent,
+				BsCardComponent,
+				BsCardHeaderComponent,
+				BsSpinnerComponent,
+				SparkExternalLoginButtonsComponent,
+				TranslateKeyPipe
+			],
+			template: "<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (loading()) {\n        <div class=\"text-center\"><bs-spinner /></div>\n      } @else if (failed()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-0\">{{ 'auth.signInUnavailable' | t }}</bs-alert>\n      }\n\n      <!-- Rendered from the start, not after this page's own load: it asks for the capabilities at\n           the same moment this page does, which the service turns into one request. It shows nothing\n           until they arrive, nor when they fail (the alert above says so). -->\n      <spark-external-login-buttons [providerTemplate]=\"providerTemplate()\" [returnUrl]=\"returnUrl()\" />\n\n      @if (!loading() && !failed()) {\n        @if (!hasProviders() && !passkeysAvailable()) {\n          <bs-alert [type]=\"colors.warning\" class=\"mb-0\">{{ 'auth.noSignInMethods' | t }}</bs-alert>\n        }\n\n        <!-- Guarded on the server's capability *and* browser support, both resolved into\n             passkeysAvailable(). A passkey needs no provider button and no username field: the\n             browser offers whatever discoverable credential it holds for this site. -->\n        @if (passkeysAvailable()) {\n          @if (passkeyError()) {\n            <bs-alert [type]=\"colors.danger\" class=\"mb-2\">{{ passkeyError() | t }}</bs-alert>\n          }\n          <button type=\"button\" class=\"btn btn-outline-secondary w-100 mb-2\"\n                  [disabled]=\"passkeyBusy()\" (click)=\"signInWithPasskey()\">\n            <i class=\"bi bi-fingerprint me-2\"></i>{{ 'auth.signInWithPasskey' | t }}\n          </button>\n        }\n\n        <!-- Two conditions, not one. The server may still accept passwords while this app chose not\n             to mount the page — sparkAuthRoutes is opt-in per feature now — and a [routerLink] bound\n             to undefined silently navigates to the current route rather than failing. -->\n        @if (localCredentialsAvailable() && routePaths.login) {\n          <div class=\"text-center mt-3\">\n            <a [routerLink]=\"routePaths.login\">{{ 'auth.login' | t }}</a>\n          </div>\n        }\n      }\n    </div>\n  </bs-card>\n</div>\n"
+		}]
+	}],
+	ctorParameters: () => [],
+	propDecorators: {
+		returnUrl: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "returnUrl",
+				required: false
+			}]
+		}],
+		providerTemplate: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "providerTemplate",
+				required: false
+			}]
+		}]
+	}
+});
+export { SparkSignInComponent };
+
+//# sourceMappingURL=mintplayer-ng-spark-auth-sign-in.mjs.map

package/fesm2022/mintplayer-ng-spark-auth-sign-in.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mintplayer-ng-spark-auth-sign-in.mjs","names":[],"sources":["../../auth/sign-in/src/spark-sign-in.component.ts","../../auth/sign-in/src/spark-sign-in.component.html"],"sourcesContent":["import { ChangeDetectionStrategy, Component, TemplateRef, inject, input, isDevMode, signal } from '@angular/core';\nimport { ActivatedRoute, Router, RouterLink } from '@angular/router';\nimport { Color } from '@mintplayer/ng-bootstrap';\nimport { BsAlertComponent } from '@mintplayer/ng-bootstrap/alert';\nimport { BsCardComponent, BsCardHeaderComponent } from '@mintplayer/ng-bootstrap/card';\nimport { BsSpinnerComponent } from '@mintplayer/ng-bootstrap/spinner';\nimport {\n  SPARK_AUTH_ROUTE_PATHS,\n  SparkAuthCapabilities,\n  SPARK_AUTH_CONFIG,\n  isSafeReturnUrl,\n  passkeysSupported,\n} from '@mintplayer/ng-spark/auth/models';\nimport { SparkAuthService } from '@mintplayer/ng-spark/auth/core';\nimport {\n  SparkExternalLoginButtonsComponent,\n  SparkProviderButtonContext,\n} from '@mintplayer/ng-spark/auth/external-login';\nimport { TranslateKeyPipe } from '@mintplayer/ng-spark/auth/pipes';\n\n// Moved to @mintplayer/ng-spark/auth/external-login with the buttons themselves; re-exported so an\n// import from this entry point keeps working.\nexport type { SparkProviderButtonContext, SparkExternalProviderView } from '@mintplayer/ng-spark/auth/external-login';\n\n/**\n * The sign-in landing page: a button per external provider, and a link to the password form when the\n * application mounted one.\n *\n * The provider buttons are `<spark-external-login-buttons>`, which the login page hosts as well; this\n * page adds the passkey button, the link to the password form, and says so when there is no way to\n * sign in at all.\n */\n@Component({\n  selector: 'spark-sign-in',\n  standalone: true,\n  changeDetection: ChangeDetectionStrategy.OnPush,\n  imports: [\n    RouterLink, BsAlertComponent, BsCardComponent, BsCardHeaderComponent,\n    BsSpinnerComponent, SparkExternalLoginButtonsComponent, TranslateKeyPipe,\n  ],\n  templateUrl: './spark-sign-in.component.html',\n})\nexport class SparkSignInComponent {\n  private readonly authService = inject(SparkAuthService);\n  private readonly route = inject(ActivatedRoute, { optional: true });\n  private readonly router = inject(Router);\n  private readonly config = inject(SPARK_AUTH_CONFIG);\n  readonly routePaths = inject(SPARK_AUTH_ROUTE_PATHS);\n  readonly colors = Color;\n\n  /**\n   * Where to land after a successful external sign-in.\n   *\n   * Falls back to a `?returnUrl=` query parameter, matching what the login page already does — so a\n   * plain `<a routerLink=\"/sign-in\" [queryParams]=\"{ returnUrl: '/somewhere' }\">` works with no\n   * wiring, which is what a routed page needs since the router passes it no inputs. The query value\n   * is validated as a local path before use; an off-site one is dropped rather than followed.\n   */\n  readonly returnUrl = input<string | undefined>(undefined);\n\n  private effectiveReturnUrl(): string | undefined {\n    const explicit = this.returnUrl();\n    if (explicit) return explicit;\n\n    const fromQuery = this.route?.snapshot.queryParamMap.get('returnUrl');\n    return isSafeReturnUrl(fromQuery) ? fromQuery! : undefined;\n  }\n\n  /**\n   * Replaces the default provider button. Rendered once per provider with a\n   * {@link SparkProviderButtonContext}.\n   *\n   * Reachable only when the consumer *hosts* this component — the router instantiates it with no\n   * projected content, so on a default `withExternalLogin()` route there is nothing to project into.\n   * Host it via `withExternalLogin({ signIn: { path: 'sign-in', component: MySignIn } })` and pass\n   * the template from there.\n   */\n  readonly providerTemplate = input<TemplateRef<SparkProviderButtonContext> | null>(null);\n\n  /** Whether the server reported any external provider; with none and no passkeys there is no way in. */\n  readonly hasProviders = signal(false);\n  readonly localCredentialsAvailable = signal(false);\n  readonly loading = signal(true);\n  readonly failed = signal(false);\n\n  /**\n   * Two conditions, and both are necessary. The server must have mounted the sign-in endpoint, and\n   * this browser must be able to run the ceremony — offering the button on either half alone\n   * produces a control that fails the moment it is clicked.\n   */\n  readonly passkeysAvailable = signal(false);\n  readonly passkeyBusy = signal(false);\n  readonly passkeyError = signal('');\n\n  constructor() {\n    void this.load();\n  }\n\n  private async load(): Promise<void> {\n    try {\n      // The provider buttons ask at the same time; the service makes that one request.\n      const capabilities = await this.authService.capabilities();\n      this.hasProviders.set((capabilities.externalProviders ?? []).length > 0);\n      this.localCredentialsAvailable.set(capabilities.localCredentials !== 'Disabled');\n      this.passkeysAvailable.set(capabilities.passkeys === true && passkeysSupported());\n      this.warnOnMismatch(capabilities);\n    } catch {\n      // A sign-in page that renders nothing looks identical to one whose providers all failed to\n      // load, so say which happened rather than showing an empty page.\n      this.failed.set(true);\n    } finally {\n      this.loading.set(false);\n    }\n  }\n\n  /**\n   * The routes are a build-time decision and the server's mode a deployment-time one, so they can\n   * disagree without anything failing loudly. Reaching this page at all means the app routed it,\n   * which it only does when local credentials are meant to be limited.\n   */\n  private warnOnMismatch(capabilities: SparkAuthCapabilities): void {\n    if (isDevMode() && capabilities.localCredentials === 'Full') {\n      console.warn(\n        '[ng-spark-auth] This app routes the sign-in landing page, but the server reports '\n        + 'localCredentials = Full. The two are configured independently — check that the features '\n        + \"passed to sparkAuthRoutes() match AddAuthentication's LocalCredentials mode.\",\n      );\n    }\n  }\n\n  /**\n   * Signs in with a passkey, then navigates. The navigation matters for the same reason it does\n   * after an external sign-in: nothing else moves the user off this page.\n   *\n   * No username is collected, and none should be: the server's request-options endpoint refuses to\n   * accept an identity so that its answer cannot reveal whether an account exists. The browser\n   * offers whatever discoverable credential it holds.\n   */\n  async signInWithPasskey(): Promise<void> {\n    this.passkeyError.set('');\n    this.passkeyBusy.set(true);\n    try {\n      const returnUrl = this.effectiveReturnUrl() ?? this.config.defaultRedirectUrl;\n      const result = await this.authService.signInWithPasskey();\n\n      if (result.success) {\n        await this.router.navigateByUrl(returnUrl);\n        return;\n      }\n\n      // Dismissing the authenticator prompt is \"not now\", not a failure — the same reasoning that\n      // leaves popup_closed alone for the provider buttons.\n      if (result.error === 'cancelled') return;\n\n      this.passkeyError.set(result.error === 'locked_out' ? 'auth.lockedOut' : 'auth.passkeyFailed');\n    } finally {\n      this.passkeyBusy.set(false);\n    }\n  }\n}\n\nexport default SparkSignInComponent;\n","<div class=\"d-flex justify-content-center\">\n  <bs-card style=\"width: 100%; max-width: 400px;\">\n    <bs-card-header>\n      <h3 class=\"mb-0 text-center\">{{ 'auth.login' | t }}</h3>\n    </bs-card-header>\n    <div class=\"p-4\">\n      @if (loading()) {\n        <div class=\"text-center\"><bs-spinner /></div>\n      } @else if (failed()) {\n        <bs-alert [type]=\"colors.danger\" class=\"mb-0\">{{ 'auth.signInUnavailable' | t }}</bs-alert>\n      }\n\n      <!-- Rendered from the start, not after this page's own load: it asks for the capabilities at\n           the same moment this page does, which the service turns into one request. It shows nothing\n           until they arrive, nor when they fail (the alert above says so). -->\n      <spark-external-login-buttons [providerTemplate]=\"providerTemplate()\" [returnUrl]=\"returnUrl()\" />\n\n      @if (!loading() && !failed()) {\n        @if (!hasProviders() && !passkeysAvailable()) {\n          <bs-alert [type]=\"colors.warning\" class=\"mb-0\">{{ 'auth.noSignInMethods' | t }}</bs-alert>\n        }\n\n        <!-- Guarded on the server's capability *and* browser support, both resolved into\n             passkeysAvailable(). A passkey needs no provider button and no username field: the\n             browser offers whatever discoverable credential it holds for this site. -->\n        @if (passkeysAvailable()) {\n          @if (passkeyError()) {\n            <bs-alert [type]=\"colors.danger\" class=\"mb-2\">{{ passkeyError() | t }}</bs-alert>\n          }\n          <button type=\"button\" class=\"btn btn-outline-secondary w-100 mb-2\"\n                  [disabled]=\"passkeyBusy()\" (click)=\"signInWithPasskey()\">\n            <i class=\"bi bi-fingerprint me-2\"></i>{{ 'auth.signInWithPasskey' | t }}\n          </button>\n        }\n\n        <!-- Two conditions, not one. The server may still accept passwords while this app chose not\n             to mount the page — sparkAuthRoutes is opt-in per feature now — and a [routerLink] bound\n             to undefined silently navigates to the current route rather than failing. -->\n        @if (localCredentialsAvailable() && routePaths.login) {\n          <div class=\"text-center mt-3\">\n            <a [routerLink]=\"routePaths.login\">{{ 'auth.login' | t }}</a>\n          </div>\n        }\n      }\n    </div>\n  </bs-card>\n</div>\n"],"mappings":";;;;;;;;;;;AA0CA,IAAa,uBAAb,MAAa,qBAAoB;CACd,cAAc,OAAO,gBAAgB;CACrC,QAAQ,OAAO,gBAAgB,EAAE,UAAU,KAAI,CAAE;CACjD,SAAS,OAAO,MAAM;CACtB,SAAS,OAAO,iBAAiB;CACzC,aAAa,OAAO,sBAAsB;CAC1C,SAAS;CAUT,YAAY,MAA0B,QAAU,GAAA,YAAA,CAAA,EAAA,WAAA,YAAA,CAAA,+BAAA,CAAA,CAAA;CAEjD,qBAAkB;EACxB,MAAM,WAAW,KAAK,UAAS;EAC/B,IAAI,UAAU,OAAO;EAErB,MAAM,YAAY,KAAK,OAAO,SAAS,cAAc,IAAI,WAAW;EACpE,OAAO,gBAAgB,SAAS,IAAI,YAAa;CACnD;CAWS,mBAAmB,MAAsD,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,mBAAA,CAAA,+BAAA,CAAA,CAAA;CAG9E,eAAe,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,eAAA,CAAA,+BAAA,CAAA,CAAA;CAC5B,4BAA4B,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,4BAAA,CAAA,+BAAA,CAAA,CAAA;CACzC,UAAU,OAAO,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,UAAA,CAAA,+BAAA,CAAA,CAAA;CACtB,SAAS,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,SAAA,CAAA,+BAAA,CAAA,CAAA;CAOtB,oBAAoB,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,oBAAA,CAAA,+BAAA,CAAA,CAAA;CACjC,cAAc,OAAO,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,cAAA,CAAA,+BAAA,CAAA,CAAA;CAC3B,eAAe,OAAO,IAAG,GAAA,YAAA,CAAA,EAAA,WAAA,eAAA,CAAA,+BAAA,CAAA,CAAA;CAElC,cAAA;EACE,AAAK,KAAK,KAAI;CAChB;CAEQ,MAAM,OAAI;EAChB,IAAI;GAEF,MAAM,eAAe,MAAM,KAAK,YAAY,aAAY;GACxD,KAAK,aAAa,KAAK,aAAa,qBAAqB,CAAA,EAAA,CAAI,SAAS,CAAC;GACvE,KAAK,0BAA0B,IAAI,aAAa,qBAAqB,UAAU;GAC/E,KAAK,kBAAkB,IAAI,aAAa,aAAa,QAAQ,kBAAiB,CAAE;GAChF,KAAK,eAAe,YAAY;EAClC,QAAQ;GAGN,KAAK,OAAO,IAAI,IAAI;EACtB,UAAU;GACR,KAAK,QAAQ,IAAI,KAAK;EACxB;CACF;CAOQ,eAAe,cAAmC;EACxD,IAAI,UAAS,KAAM,aAAa,qBAAqB,QACnD,QAAQ,KACN,uPAEgF;CAGtF;CAUA,MAAM,oBAAiB;EACrB,KAAK,aAAa,IAAI,EAAE;EACxB,KAAK,YAAY,IAAI,IAAI;EACzB,IAAI;GACF,MAAM,YAAY,KAAK,mBAAkB,KAAM,KAAK,OAAO;GAC3D,MAAM,SAAS,MAAM,KAAK,YAAY,kBAAiB;GAEvD,IAAI,OAAO,SAAS;IAClB,MAAM,KAAK,OAAO,cAAc,SAAS;IACzC;GACF;GAIA,IAAI,OAAO,UAAU,aAAa;GAElC,KAAK,aAAa,IAAI,OAAO,UAAU,eAAe,mBAAmB,oBAAoB;EAC/F,UAAU;GACR,KAAK,YAAY,IAAI,KAAK;EAC5B;CACF;CApHW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAoB,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAApB,OAAA,OAAA,GAAA,qBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,MAAA;EAAoB,cAAA;EAAA,UAAA;EAAA,QAAA;GAAA,WAAA;IAAA,mBAAA;IAAA,YAAA;IAAA,UAAA;IAAA,YAAA;IAAA,mBAAA;GAAA;GAAA,kBAAA;IAAA,mBAAA;IAAA,YAAA;IAAA,UAAA;IAAA,YAAA;IAAA,mBAAA;GAAA;EAAA;EAAA,UAAA;EAAA,UC1CjC;EA+CA,cAAA;GAAA;IAAA,MAAA;IAAA,MDVI;IAAU,UAAA;IAAA,QAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;KAAA;IAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAgB,UAAA;IAAA,QAAA;KAAA;KAAA;KAAA;IAAA;IAAA,SAAA,CAAA,mBAAA,qBAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAe,UAAA;IAAA,QAAA,CAAA,SAAA,SAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAqB,UAAA;IAAA,QAAA,CAAA,SAAA,UAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MACpE;IAAkB,UAAA;IAAA,QAAA,CAAA,QAAA,OAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAkC,UAAA;IAAA,QAAA,CAAA,aAAA,kBAAA;GAAA;GAAA;IAAA,MAAA;IAAA,MAAE;IAAgB,MAAA;GAAA;EAAA;EAAA,iBAAA,GAAA,wBAAA;CAAA,CAAA;;AAI/D,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAoB,YAAA,CAAA;EAVhC,MAAA;EACW,MAAA,CAAA;GAAA,UAAA;GAAe,YACb;GAAI,iBACC,wBAAwB;GAAM,SACtC;IACP;IAAY;IAAkB;IAAiB;IAC/C;IAAoB;IAAoC;GACzD;GAAA,UAAA;EAAA,CAAA"}