@mintplayer/ng-spark 22.30.0 → 22.32.0

package/types/mintplayer-ng-spark-auth-models.d.ts

@@ -0,0 +1,489 @@
+import { InjectionToken, Provider, Type } from "@angular/core";
+import { Router } from "@angular/router";
+export interface AuthUser {
+  isAuthenticated: boolean;
+  userName: string;
+  email: string;
+  roles: string[];
+}
+/** How the user is sent to the external provider, and how the result comes back. */
+export type SparkExternalLoginMode = 'popup' | 'redirect';
+/**
+ * The app-wide default for {@link SparkExternalLoginMode}, set through
+ * `provideSparkAuth({ externalLoginMode })`.
+ *
+ * `'auto'` (the default) uses `'redirect'` inside an installed web app (`display-mode: standalone`,
+ * or iOS's `navigator.standalone`) and `'popup'` in a browser tab. Inside an installed app a popup is
+ * captured into the app, or lands in a custom tab with no usable opener, so only a full-page
+ * redirect is reliable there.
+ */
+export type SparkExternalLoginModeSetting = 'auto' | SparkExternalLoginMode;
+export interface SparkExternalLoginOptions {
+  /**
+   * Where to land after a successful provider round trip. Server-side sanitized to an in-app path.
+   */
+  returnUrl?: string;
+  /**
+   * `'redirect'` mode only: where a failure lands, with `?sparkExternalLogin=<code>` added.
+   * Server-side sanitized like `returnUrl`. Defaults to the page the attempt started from (the
+   * router URL with any earlier `sparkExternalLogin` removed), which is the page that reads and
+   * shows the code. Ignored in popup mode, where the outcome comes back to the opener instead.
+   */
+  errorUrl?: string;
+  /** Overrides the configured `externalLoginMode` (default `'auto'`) for this one call. */
+  mode?: SparkExternalLoginMode;
+}
+/** Whether this document runs as an installed web app rather than in a browser tab. */
+export declare function sparkIsStandaloneDisplay(): boolean;
+/**
+ * The value of `externalLoginMode` resolved against this document: `'auto'` becomes `'redirect'` in
+ * an installed web app and `'popup'` everywhere else.
+ */
+export declare function resolveSparkExternalLoginMode(setting: SparkExternalLoginModeSetting | undefined): SparkExternalLoginMode;
+/**
+ * Why an external login did not sign anyone in. Everything but the two `popup_*` codes comes
+ * from the server; those two are raised here, because the browser is the only place that can
+ * observe them.
+ *
+ * ⚠️ `link_confirmation_sent` is **not a failure**. It travels on this channel because no session
+ * was created, which is what `success: false` means to the opener — but the right response is to
+ * tell the user to check their mail, not to show an error.
+ *
+ * ⚠️ `email_already_registered` admits that an account exists, which the older codes deliberately
+ * avoid doing. That trade is made on the server (the alternative was a generic failure that reads
+ * as "this application is broken"); a client must not widen it by pairing the code with the address
+ * it was asked about.
+ */
+export type SparkExternalLoginError = 'no_login_info' | 'email_not_verified' | 'account_creation_failed' | 'email_already_registered' | 'sign_in_to_link' | 'link_confirmation_sent' | 'login_already_associated' | 'link_failed' |
+/** The provider reported an error, or the correlation of its answer failed. */
+'remote_failure' |
+/** The challenge refused the nonce (HTTP 400). It never travels in a popup payload. */
+'invalid_nonce' | 'popup_blocked' | 'popup_closed';
+/** Every {@link SparkExternalLoginError}; a code read from a URL is checked against it. */
+export declare const SPARK_EXTERNAL_LOGIN_ERRORS: readonly SparkExternalLoginError[];
+export interface SparkExternalLoginResult {
+  success: boolean;
+  error?: SparkExternalLoginError;
+}
+/**
+ * The payload the callback page hands back: posted to the opener, posted on the
+ * {@link SPARK_EXTERNAL_LOGIN_CHANNEL} BroadcastChannel, and written to `localStorage` under
+ * {@link sparkExternalLoginStorageKey} (with an `at` timestamp). Any of the three may be the one
+ * that arrives: COOP on the provider's pages cuts the opener, and a frozen background tab may only
+ * see the storage entry once it is shown again.
+ */
+export interface SparkExternalLoginMessage {
+  type: typeof SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE;
+  success: boolean;
+  error?: SparkExternalLoginError | null;
+  /** The nonce the opener sent on the challenge; `null` from a challenge that carried none. */
+  nonce?: string | null;
+}
+/** The opener's answer on the BroadcastChannel: the callback page sets its done-marker and closes. */
+export interface SparkExternalLoginAck {
+  type: typeof SPARK_EXTERNAL_LOGIN_ACK_TYPE;
+  nonce: string;
+}
+export declare const SPARK_EXTERNAL_LOGIN_MESSAGE_TYPE = "spark:external-login";
+export declare const SPARK_EXTERNAL_LOGIN_ACK_TYPE = "spark:external-login-ack";
+/** The BroadcastChannel the callback page and the opener share. */
+export declare const SPARK_EXTERNAL_LOGIN_CHANNEL = "spark:external-login";
+/** The query parameter a redirect-mode failure comes back with. */
+export declare const SPARK_EXTERNAL_LOGIN_QUERY_PARAM = "sparkExternalLogin";
+/** How long a popup attempt waits for its result before it settles `popup_closed`. */
+export declare const SPARK_EXTERNAL_LOGIN_TIMEOUT_MS: number;
+/** The `localStorage` key the callback page writes its payload to. */
+export declare function sparkExternalLoginStorageKey(nonce: string): string;
+/**
+ * The `localStorage` done-marker: set once the opener has the result. The callback page reads it to
+ * restore itself to the app when an installed web app shows it again.
+ */
+export declare function sparkExternalLoginDoneKey(nonce: string): string;
+/**
+ * A fresh nonce for one popup attempt: 32 base64url characters from `crypto.getRandomValues`
+ * (24 bytes, so no padding). The server accepts `^[A-Za-z0-9_-]{16,64}$`.
+ */
+export declare function sparkExternalLoginNonce(): string;
+/** One external login attached to the signed-in account. */
+export interface SparkLinkedExternalLogin {
+  provider: string;
+  providerKey: string;
+  displayName: string;
+  /**
+   * ⚠️ `false` when removing this login would leave the account with no way to sign in.
+   *
+   * Served by the server so the UI can disable the control rather than offer an action that will
+   * be refused. It is **not** the enforcement — the server refuses the request too — and a client
+   * that treats it as advisory only is behaving correctly.
+   */
+  canUnlink: boolean;
+}
+/** A provider that is configured but not yet attached to the signed-in account. */
+export interface SparkAvailableExternalProvider {
+  provider: string;
+  displayName: string;
+}
+export interface SparkExternalLogins {
+  linked: SparkLinkedExternalLogin[];
+  available: SparkAvailableExternalProvider[];
+}
+/** Why a login was not detached. */
+export type SparkUnlinkError =
+/** ⚠️ It was the account's last way in, so removing it would have locked the owner out for good. */
+'last_credential' |
+/** Not attached to this account. */
+'login_not_found' |
+/** The store refused, for a reason that is not either of the above. */
+'unlink_failed';
+export interface SparkUnlinkResult {
+  success: boolean;
+  error?: SparkUnlinkError;
+}
+export interface SparkAuthConfig {
+  apiBasePath: string;
+  defaultRedirectUrl: string;
+  loginUrl: string;
+  /**
+   * How external sign-in and linking reach the provider by default. `'auto'` (the default) is a
+   * popup in a browser tab and a full-page redirect inside an installed web app. A call's own
+   * `mode` option overrides it.
+   */
+  externalLoginMode?: SparkExternalLoginModeSetting;
+}
+export declare const SPARK_AUTH_CONFIG: InjectionToken<SparkAuthConfig>;
+export declare const defaultSparkAuthConfig: SparkAuthConfig;
+/** An external provider a user can actually click, as reported by the server. */
+export interface SparkExternalProvider {
+  scheme: string;
+  displayName: string;
+}
+/** An identifier kind password sign-in can accept. */
+export type SparkSignInIdentifier = 'email' | 'userName';
+/**
+ * What `GET /spark/auth/capabilities` reports: how much of the local-credential surface this
+ * application mounts, and which external providers are registered.
+ *
+ * This exists so the two tiers cannot silently disagree. The route config is a build-time choice
+ * and the server's mode is a deployment-time one; without a channel between them, a mismatch shows
+ * up as a form that posts into a 404, or a sign-in page with no way to sign in.
+ */
+export interface SparkAuthCapabilities {
+  localCredentials: 'Full' | 'SignInOnly' | 'Disabled';
+  externalProviders: SparkExternalProvider[];
+  /**
+   * What password sign-in accepts as the identifier — the server's `SignInIdentifiers`. Empty when
+   * `localCredentials` is `Disabled`. Optional: a server older than this client omits it, and absent
+   * reads as both, which is what such a server accepts.
+   */
+  signInIdentifiers?: SparkSignInIdentifier[];
+  /**
+   * Whether an anonymous visitor can sign in with a passkey — i.e. whether the server mounted the
+   * passkey sign-in endpoint.
+   *
+   * Necessary but not sufficient for showing the button: the browser must also support the
+   * ceremony. Check `passkeysSupported()` too, or the page offers a flow that cannot start.
+   *
+   * Optional because a server older than this client omits the field entirely, and an absent
+   * capability must read as "no" rather than as `undefined` leaking into a template.
+   */
+  passkeys?: boolean;
+  /**
+   * Whether the two-factor setup page is served — the server mapped `manage/2fa` and the
+   * authenticator-URI endpoint. Optional: absent reads as "no".
+   */
+  twoFactor?: boolean;
+  /**
+   * Whether a signed-in user may change their email address — the server's opt-in
+   * `SparkEmailChange.Enabled`, and a local-credential mode that maps `POST manage/info`. Optional for
+   * the same reason as `passkeys`: absent reads as "no".
+   */
+  emailChange?: boolean;
+  /**
+   * Whether the connected-logins page is served — the server's `ExternalLoginLinking` is not
+   * `Disabled`. External SIGN-IN can be on while this is off. Optional: absent reads as "no".
+   */
+  externalLogins?: boolean;
+  /**
+   * Whether a user with two-factor enabled may choose to skip the code when signing in with an
+   * external account (`manage/external-login-two-factor`). Optional: absent reads as "no".
+   */
+  externalLoginTwoFactorBypass?: boolean;
+}
+export type SparkAuthRouteEntry = string | {
+  path: string;
+  component?: Type<unknown>;
+};
+/** The routable authentication pages. */
+export interface SparkAuthRouteEntries {
+  /** The provider-button landing page, mounted by `withExternalLogin()`. */
+  signIn?: SparkAuthRouteEntry;
+  login?: SparkAuthRouteEntry;
+  twoFactor?: SparkAuthRouteEntry;
+  register?: SparkAuthRouteEntry;
+  forgotPassword?: SparkAuthRouteEntry;
+  resetPassword?: SparkAuthRouteEntry;
+  /**
+   * Passkey management, mounted by `withPasskeys()`.
+   *
+   * Unlike its siblings this page is for a user who is already signed in, so it belongs behind
+   * whatever guard the application uses for its account area rather than on the public sign-in path.
+   */
+  passkeys?: SparkAuthRouteEntry;
+  /**
+   * The link target of confirmation mails, mounted by `withAccount()`. Public (the link is opened from a
+   * mailbox, possibly signed out); its path must equal the server's `Spark:Auth:Links:ConfirmEmailPath`
+   * (default `/confirm-email`).
+   */
+  confirmEmail?: SparkAuthRouteEntry;
+  /** The account overview (links to every mounted account page), mounted by `withAccount()`. */
+  account?: SparkAuthRouteEntry;
+  /** User name, email change, preferred mail language and app fields (`withAccount()`). */
+  profile?: SparkAuthRouteEntry;
+  /** Change the password, or set a first one on a social-only account (`withAccount()`). */
+  changePassword?: SparkAuthRouteEntry;
+  /** Authenticator enrollment, recovery codes, disabling 2FA (`withAccount()`). */
+  twoFactorSetup?: SparkAuthRouteEntry;
+  /** Connected external logins: link and unlink providers (`withAccount()`). */
+  externalLogins?: SparkAuthRouteEntry;
+  /** Download personal data and delete the account (`withAccount()`). */
+  personalData?: SparkAuthRouteEntry;
+  /**
+   * The applications the user granted access to, with per-scope withdrawal. Mounted by
+   * `withIdentityProvider(withConnectedApplications())` from `@mintplayer/ng-spark/identity-provider`.
+   */
+  connectedApplications?: SparkAuthRouteEntry;
+  /** The developer portal's landing page (`withIdentityProvider(withDeveloperRoutes())`). */
+  developers?: SparkAuthRouteEntry;
+  /** The identity provider's management page (`withIdentityProvider(withManagementRoutes())`). */
+  identityProviderManagement?: SparkAuthRouteEntry;
+}
+/**
+ * An extra link on the account overview (`SparkAccountOverviewComponent`), contributed by a route
+ * feature from another entry point, e.g. `withConnectedApplications()`. The overview lists it after
+ * its own pages. The label carries its own translations because the contributing entry point, not
+ * the auth translations, owns the text.
+ */
+export interface SparkAccountOverviewLink {
+  /** Identifies the link (`track`), e.g. the {@link SparkAuthRoutePaths} key it points at. */
+  key: string;
+  /** The absolute router path, e.g. `/account/applications`. */
+  path: string;
+  /** The link text per language code; resolved in the app's current language. */
+  label: Record<string, string>;
+}
+/**
+ * The extra account-overview links of the mounted route features, provided by `sparkAuthRoutes()`
+ * on its route. Optional: without it the overview shows only the auth pages.
+ */
+export declare const SPARK_ACCOUNT_OVERVIEW_LINKS: InjectionToken<readonly SparkAccountOverviewLink[]>;
+/**
+ * The paths of the pages that were actually mounted.
+ *
+ * Partial, and that is the change: pages are opted into individually now, so a template cannot
+ * assume its siblings exist. `login` links to `register` only when registration was opted into, and
+ * the sign-in landing page links to `login` only when local login was. A `[routerLink]` bound to
+ * `undefined` silently navigates to the current route, so every cross-feature link is guarded.
+ */
+export type SparkAuthRoutePaths = Partial<Record<keyof SparkAuthRouteEntries, string>>;
+export declare const SPARK_AUTH_ROUTE_PATHS: InjectionToken<Partial<Record<keyof SparkAuthRouteEntries, string>>>;
+/** The slice of an Angular `Route` the lookup below reads — kept structural so `/models` stays router-free. */
+interface RouteLike {
+  providers?: readonly unknown[];
+  children?: readonly RouteLike[];
+}
+/**
+ * The paths `sparkAuthRoutes()` mounted, read from the router configuration.
+ *
+ * For components that live **outside** that route subtree, such as `<spark-auth-bar>` in the
+ * application shell: `SPARK_AUTH_ROUTE_PATHS` is provided on the subtree's own route, so it is not
+ * injectable from there. Walks the eagerly declared routes only — a `sparkAuthRoutes()` behind a
+ * `loadChildren` is not loaded yet and is not found, which reads as "nothing mounted".
+ */
+export declare function findSparkAuthRoutePaths(routes: readonly RouteLike[] | undefined): SparkAuthRoutePaths | null;
+/**
+ * Presentation for one external provider's button — an icon, a label, an ordering.
+ *
+ * **It decorates; it does not declare.** The server stays authoritative over which providers exist
+ * (`GET /spark/auth/capabilities`), because letting the client declare them would reintroduce exactly
+ * the string-literal mismatch that endpoint exists to prevent. A scheme the server reports with no
+ * matching declaration falls back to the default button, so adding a provider server-side never
+ * yields a blank page; a declaration matching no reported scheme is simply unused.
+ */
+export interface SparkExternalProviderPresentation {
+  /** The ASP.NET Core authentication scheme, as the server reports it. Matched case-insensitively. */
+  scheme: string;
+  /** Overrides the server's display name. */
+  displayName?: string;
+  /** A CSS class for an icon element rendered before the label. */
+  iconClass?: string;
+  /** Lower sorts first. Providers with no declared order keep the server's order, after declared ones. */
+  order?: number;
+}
+export declare const SPARK_EXTERNAL_PROVIDERS: InjectionToken<SparkExternalProviderPresentation[]>;
+/**
+ * Shared validator for `returnUrl` query parameters consumed by the auth
+ * components and interceptor. The framework-side equivalent in
+ * `SparkAuthenticationExtensions.SanitizeReturnUrl` enforces the same rule;
+ * keep them in sync.
+ *
+ * Accepts only local in-app paths:
+ * - Must start with a single `/`.
+ * - Must not start with `//` or `/\` (protocol-relative navigation that some
+ *   browsers and routers interpret as an external host).
+ * - Must not contain CR/LF (defensive — the value flows into Router state and
+ *   eventually back into a `router.navigateByUrl` call).
+ *
+ * Returns the supplied default for anything else, never throws. Per R2-H9.
+ */
+export declare function isSafeReturnUrl(value: string | null | undefined): boolean;
+export declare function sanitizeReturnUrl(value: string | null | undefined, defaultUrl: string): string;
+/**
+ * Why a passkey ceremony did not complete.
+ *
+ * ⚠️ Every server-side sign-in rejection arrives as `failed`, and that is deliberate rather than
+ * lossy: distinguishing "unknown credential" from "bad signature" would tell an anonymous caller
+ * whether a credential exists. Do not try to recover the detail — it is not sent.
+ *
+ * The three codes the server never sends are raised here, because the browser is the only place
+ * that can observe them.
+ */
+export type SparkPasskeyError =
+/** The browser cannot run the ceremony at all. Offer another sign-in method. */
+'unsupported' |
+/** The user dismissed the authenticator prompt. Not an error worth showing. */
+'cancelled' |
+/** The authenticator produced nothing — no matching credential, or the user gave up. */
+'no_credential' |
+/** The account is locked out. The one server-side outcome worth distinguishing. */
+'locked_out' |
+/** Everything else, server or client. */
+'failed';
+export interface SparkPasskeyResult {
+  success: boolean;
+  error?: SparkPasskeyError;
+}
+/**
+ * Collapses everything that can go wrong in a ceremony into the closed error union.
+ *
+ * `AbortError` and `NotAllowedError` are how a browser reports "the user dismissed the prompt" and
+ * "no credential was produced" — neither is a fault, and neither should surface as a red banner.
+ */
+export declare function sparkPasskeyError(error: unknown): SparkPasskeyError;
+/**
+ * Whether this browser can run a passkey ceremony.
+ *
+ * Checks the native JSON helpers as well as `navigator.credentials`, because the ceremony is built
+ * on them: the server speaks WebAuthn's JSON encoding, and without
+ * `parseCreationOptionsFromJSON` / `parseRequestOptionsFromJSON` the client would have to hand-roll
+ * base64url conversion over every field of the options — on the security-critical path, to support
+ * browsers that a user holding a passkey is unlikely to be running.
+ *
+ * ⚠️ `window.isSecureContext` is part of the test rather than an afterthought: WebAuthn is
+ * unavailable on an insecure origin, and without this the button would render and then fail at the
+ * moment the user clicks it.
+ */
+export declare function passkeysSupported(): boolean;
+/**
+ * Where to send someone who is not signed in.
+ *
+ * `loginUrl` is the single source of truth for this, and the only thing the guard, the interceptor
+ * and the auth bar should consult — an application that turns off local credentials points it at
+ * its own sign-in landing route.
+ *
+ * The reason this is a function rather than a property read is the failure mode it closes: nothing
+ * connects `loginUrl` to the routes that actually exist, so pointing it at a route that was never
+ * registered produces a redirect into a blank page with no type error, no build failure and no
+ * runtime error. In development that now warns, once, naming the value and the fix.
+ */
+export declare function resolveSignInUrl(config: SparkAuthConfig, router: Router): string;
+/** `GET/POST /spark/auth/manage/profile` (#460, D16). */
+export interface SparkAccountProfile {
+  userName: string | null;
+  email: string | null;
+  /** App-contributed fields (`ISparkProfileContributor<TUser>`), by name. */
+  fields: Record<string, unknown>;
+  /** The culture account mail is written in (`SparkUser.PreferredCulture`); null = the app default. */
+  preferredCulture: string | null;
+}
+/** The body of `POST /spark/auth/manage/profile`. Absent keeps a value; `preferredCulture: null` clears it. */
+export interface SparkAccountProfileUpdate {
+  userName?: string | null;
+  fields?: Record<string, unknown>;
+  preferredCulture?: string | null;
+}
+/** `GET /spark/auth/manage/info` / answer of `POST manage/info`. */
+export interface SparkAccountInfo {
+  email: string;
+  isEmailConfirmed: boolean;
+}
+/** Answer of `POST /spark/auth/manage/2fa` (ASP.NET Core Identity's contract). */
+export interface SparkTwoFactorState {
+  sharedKey: string | null;
+  recoveryCodesLeft: number;
+  /** Only present right after codes were (re)generated — show them once. */
+  recoveryCodes?: string[] | null;
+  isTwoFactorEnabled: boolean;
+  isMachineRemembered: boolean;
+}
+/** The body of `POST /spark/auth/manage/2fa`. An empty body reads the state (and creates a key if none). */
+export interface SparkTwoFactorRequest {
+  enable?: boolean;
+  twoFactorCode?: string;
+  resetSharedKey?: boolean;
+  resetRecoveryCodes?: boolean;
+  forgetMachine?: boolean;
+}
+/** `GET /spark/auth/manage/2fa/authenticator-uri`: the key, its otpauth URI and a server-rendered QR SVG. */
+/**
+ * `GET`/`POST /manage/external-login-two-factor`: whether a sign-in with an external account skips
+ * the second factor for this user, and whether two-factor is enabled at all.
+ */
+export interface SparkExternalLoginTwoFactor {
+  bypass: boolean;
+  twoFactorEnabled: boolean;
+}
+export interface SparkAuthenticatorUri {
+  sharedKey: string;
+  authenticatorUri: string;
+  qrCodeSvg: string;
+}
+/**
+ * The outcome of an account call that can fail with a message for the user.
+ *
+ * `errors` flattens an RFC 7807 validation problem (Identity codes, `PreferredCulture`, contributor
+ * fields) into `field → messages`; `error` carries a Spark error code (`reauthentication_required`,
+ * `no_authenticator_key`, …) when the server sent one.
+ */
+export interface SparkAccountResult<T = void> {
+  success: boolean;
+  value?: T;
+  error?: string;
+  errors?: Record<string, string[]>;
+  status?: number;
+}
+/**
+ * One application field on the profile page (#460, D16), validated and stored server-side by an
+ * `ISparkProfileContributor<TUser>` declaring the same `name`.
+ */
+export interface SparkAccountProfileField {
+  /** The field name, as the contributor declares it (matched case-insensitively by the server). */
+  name: string;
+  /** A translation key (looked up with the `t` pipe) or literal text. */
+  label: string;
+  type?: 'text' | 'textarea' | 'email' | 'url' | 'tel' | 'number' | 'date' | 'checkbox' | 'select';
+  /** For `select`. `label` is a translation key or literal text. */
+  options?: {
+    value: string;
+    label: string;
+  }[];
+  required?: boolean;
+  maxLength?: number;
+  /** A translation key or literal text shown under the control. */
+  hint?: string;
+  /** Ascending; unordered fields follow in registration order. */
+  order?: number;
+}
+/** Multi-provider: the application's profile fields. Use {@link provideSparkAccountProfileFields}. */
+export declare const SPARK_ACCOUNT_PROFILE_FIELDS: InjectionToken<SparkAccountProfileField[]>;
+/** Registers profile fields; every call adds. */
+export declare function provideSparkAccountProfileFields(...fields: SparkAccountProfileField[]): Provider[];

package/types/mintplayer-ng-spark-auth-pipes.d.ts

@@ -0,0 +1,8 @@
+import * as i0 from "@angular/core";
+import { PipeTransform } from "@angular/core";
+export declare class TranslateKeyPipe implements PipeTransform {
+  private readonly translation;
+  transform(key: string): string;
+  static ɵfac: i0.ɵɵFactoryDeclaration<TranslateKeyPipe, never>;
+  static ɵpipe: i0.ɵɵPipeDeclaration<TranslateKeyPipe, "t", true>;
+}

package/types/mintplayer-ng-spark-auth-register.d.ts

@@ -0,0 +1,21 @@
+import { Color } from "@mintplayer/ng-bootstrap";
+import * as i0 from "@angular/core";
+export declare class SparkRegisterComponent {
+  private readonly fb;
+  private readonly authService;
+  private readonly router;
+  private readonly translation;
+  readonly routePaths: Partial<Record<keyof import("@mintplayer/ng-spark/auth/models").SparkAuthRouteEntries, string>>;
+  colors: typeof Color;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly errorMessage: import("@angular/core").WritableSignal<string>;
+  readonly form: import("@angular/forms").FormGroup<{
+    email: import("@angular/forms").FormControl<string | null>;
+    userName: import("@angular/forms").FormControl<string | null>;
+    password: import("@angular/forms").FormControl<string | null>;
+    confirmPassword: import("@angular/forms").FormControl<string | null>;
+  }>;
+  onSubmit(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkRegisterComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkRegisterComponent, "spark-register", never, {}, {}, never, never, true, never>;
+}

package/types/mintplayer-ng-spark-auth-reset-password.d.ts

@@ -0,0 +1,25 @@
+import * as i0 from "@angular/core";
+import { OnInit } from "@angular/core";
+import { Color } from "@mintplayer/ng-bootstrap";
+export declare class SparkResetPasswordComponent implements OnInit {
+  private readonly fb;
+  private readonly authService;
+  private readonly router;
+  private readonly route;
+  private readonly translation;
+  readonly routePaths: Partial<Record<keyof import("@mintplayer/ng-spark/auth/models").SparkAuthRouteEntries, string>>;
+  colors: typeof Color;
+  readonly loading: import("@angular/core").WritableSignal<boolean>;
+  readonly errorMessage: import("@angular/core").WritableSignal<string>;
+  readonly successMessage: import("@angular/core").WritableSignal<string>;
+  private email;
+  private code;
+  readonly form: import("@angular/forms").FormGroup<{
+    newPassword: import("@angular/forms").FormControl<string | null>;
+    confirmPassword: import("@angular/forms").FormControl<string | null>;
+  }>;
+  ngOnInit(): void;
+  onSubmit(): Promise<void>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<SparkResetPasswordComponent, never>;
+  static ɵcmp: i0.ɵɵComponentDeclaration<SparkResetPasswordComponent, "spark-reset-password", never, {}, {}, never, never, true, never>;
+}