@nauticana/sail 0.5.0

package/src/index.ts

@@ -0,0 +1,41 @@
+export * from './config';
+export * from './model/appdata';
+export * from './model/auth';
+export * from './model/common';
+export * from './model/decorator';
+export * from './component/abstract/base_table';
+export * from './component/abstract/base_form';
+export * from './component/abstract/base_view';
+export * from './component/abstract/base_async';
+export * from './component/form/form_field';
+export * from './component/form/form_record';
+export * from './component/form/form_table';
+export * from './component/table/table_list';
+export * from './component/table/table_search';
+export * from './component/table/table_edit';
+export * from './component/table/table_detail';
+export * from './component/table/table_lookup';
+export * from './component/navigation/navigation';
+export * from './component/login/login_component';
+export * from './component/login/register_component';
+export * from './component/login/chpass_component';
+export * from './component/login/confirm_register_component';
+export * from './component/login/confirm_chpass_component';
+export * from './component/login/consent_gate';
+export * from './component/login/otp_input';
+export * from './component/login/social_login';
+export * from './component/login/account_deletion';
+export * from './component/security/twofactor_setup';
+export * from './component/security/twofactor_verify';
+export * from './component/security/trusted_devices';
+export * from './component/billing/plan_selector';
+export * from './component/billing/checkout_button';
+export * from './component/billing/payment_methods';
+export * from './service/auth.service';
+export * from './service/billing.service';
+export * from './service/script_loader';
+export * from './service/auth.interceptor';
+export * from './service/api-response.interceptor';
+export * from './service/rest_service';
+export * from './service/rest_url';
+export * from './service/label.service';

package/src/model/appdata.ts

@@ -0,0 +1,266 @@
+import { AbstractControlOptions } from '@angular/forms';
+import { ApplicationMenu, AuthorizationRolePermission } from './common';
+
+export const DataType = {
+  STRING:    'string',
+  INTEGER:   'integer',
+  FLOAT:     'float',
+  BOOLEAN:   'boolean',
+  TIMESTAMP: 'timestamp',
+} as const;
+
+export interface LoginRequest {
+  Username: string;
+  Password: string;
+}
+
+export interface LoginResponse {
+  token: string;
+}
+
+export interface AuthSummary {
+    Obj: string;
+    Act: string;
+    Val: string;
+    Reg: string;
+}
+
+export interface ApplicationData {
+    MainMenu: ApplicationMenu[];
+    Permissions: AuthorizationRolePermission[];
+    ConstantCache: {[key: string]: {[key: string]: string}};
+    TableCache: {[key: string]: {[key: string]: string}};
+    TableDefinitions: {[key: string]: TableDefinition};
+    Apis: {[key: string]: DictionaryPath};
+    [key: string]: unknown;
+}
+
+export interface TableColumn {
+  ColumnName:   string;
+  PascalName:   string;
+  Caption:      string;
+  DataType:     string;
+  InputType:    'text' | 'password' | 'number' | 'date' | 'datetime' | 'datetime-local' | 'textarea' | 'select' | 'checkbox';
+  Size:         number;
+  Scale:        number;
+  Step:         string;
+  Order:        number;
+  Required:     boolean;
+  IsKey:        boolean;
+  SequenceName: string;
+  LookupDomain: string;
+  LookupTable:  string;
+  LookupStyle:  string;
+  HasDefault:   boolean;
+  DefaultValue: string;
+  Validators?:  AbstractControlOptions['validators'];
+}
+
+export interface TableAction {
+  action:         string;
+  caption:        string;
+  method:         string;
+  enable:         string;
+  authorityCheck: string;
+  recordSpecific: string;
+}
+
+export interface ForeignKey {
+  ParentTable:    string;
+  ChildTable:     string;
+  PascalName:     string;
+  ConstraintName: string;
+  LookupStyle:    string;
+  Columns:        TableColumn[];
+}
+
+export interface TableDefinition {
+  TableName:             string;
+  PascalName:            string;
+  PartnerSpecific:       boolean;
+  Keys:                  TableColumn[];
+  Columns:               TableColumn[];
+  Actions:               TableAction[];
+  LookupStyle:           string;
+  LookupColumns:         TableColumn[];
+  Details:               string[];
+  Parents:               ForeignKey[];
+  Children:              ForeignKey[];
+}
+
+export interface DictionaryPath {
+  RestAPI:     string;
+  Version:     string;
+  Table:       TableDefinition;
+  Caption:     string;
+  PascalName:  string;
+  PathType:    string;
+  ParentKeys:   TableColumn[];
+  ChildKeys:    TableColumn[];
+  Children:     DictionaryPath[];
+}
+
+export interface ReportParam {
+  Name:     string;
+  DataType: string;
+}
+
+export interface RestReport {
+  Id:        string;
+  Version:   string;
+  QueryName: string;
+  Params:    ReportParam[];
+}
+
+// 2FA / Trusted device types
+
+export interface LoginResponse2FA {
+  token: string;
+  twoFactorRequired: boolean;
+  loginToken?: string;
+  userId?: number;
+  partnerId?: number;
+  // Populated for users with the single-device session policy enabled.
+  // UI surfaces an info banner / can enforce "signed out elsewhere" notices.
+  singleDeviceSession?: boolean;
+  previousDeviceRevoked?: boolean;
+}
+
+export interface TwoFactorSetupResponse {
+  secret:      string;
+  qrUri:       string;
+  backupCodes: string[];
+}
+
+export interface TwoFactorVerifyRequest {
+  code:             string;
+  loginToken?:      string;
+  trustDevice?:     boolean;
+  deviceFingerprint?: string;
+  deviceName?:      string;
+}
+
+export interface TwoFactorVerifyResponse {
+  valid: boolean;
+  token?: string;
+}
+
+export interface TrustedDevice {
+  id:         number;
+  name:       string;
+  fingerprint: string;
+  last_used_at: string;
+  created_at:   string;
+}
+
+export interface PartnerRegistration {
+	FirstName:            string;
+	LastName:             string;
+	UserName:             string;
+	Email:                string;
+	Password:             string;
+	PartnerCaption:       string;
+	Address:              string;
+	City:                 string;
+	State:                string;
+	Zipcode:              string;
+	Country:              string;
+	Phone:                string;
+	Latitude:             number;
+	Longitude:            number;
+	DomainURL:            string;
+	PlanID:               string;
+}
+
+// PublicPlan — shape returned by GET /public/plans. Used on the registration
+// page to render the plan picker and to drive `<app-checkout-button>` flows.
+export interface PublicPlan {
+	id:          string;
+	caption:     string;
+	monthlyCost: number;
+	annualCost:  number;
+	// Stripe price ID (or provider-equivalent). Optional because keel only
+	// populates it when a plan is wired to a billing provider; FREE plans and
+	// not-yet-priced tiers leave it empty. Pass straight to
+	// `<app-checkout-button [priceId]>` / `BillingService.createCheckout({ priceId })`.
+	priceId?:    string;
+}
+
+// ConfirmRegisterResponse — shape returned by POST /public/confirm/register.
+// When paymentRequired is true the UI should redirect the user to paymentUrl
+// before letting them log in.
+export interface ConfirmRegisterResponse {
+	status:          string;
+	partnerId:       number;
+	planId:          string;
+	paymentRequired: boolean;
+	paymentUrl?:     string;
+}
+
+// ── Billing / Payment types ──
+// See keel/SHARED_PAYMENT.md for the backend contract.
+
+export interface PaymentMethod {
+	id:         string;
+	provider:   string;  // 'stripe' | 'lemonsqueezy' | ...
+	methodType: string;  // 'card' | 'bank' | ...
+	last4?:     string;
+	isDefault:  boolean;
+}
+
+// CreateCheckout is JWT-gated and validates `priceId`, `successUrl`,
+// `cancelUrl` against server-side allowlists. Empty allowlists cause every
+// checkout to be rejected with 400.
+export type CheckoutMode = 'subscription' | 'payment' | 'setup';
+
+export interface CheckoutRequest {
+	mode?:       CheckoutMode;        // default 'subscription'
+	// Required for 'subscription' / 'payment'; must be empty for 'setup'.
+	// Pass `PublicPlan.priceId` straight through.
+	priceId?:    string;
+	quantity?:   number;
+	email?:      string;
+	// Hostname must match keel's `AllowedRedirectHosts`. Default port matching
+	// is hostname-only; include the port (e.g. `host:8443`) only if the
+	// operator deliberately wants port-strict matching.
+	successUrl:  string;
+	cancelUrl:   string;
+	// Provider metadata — values must be strings. keel stringifies any
+	// numeric / boolean values in its server-side metadata adapter, so when
+	// reading back metadata in webhook handlers, expect the stringified form
+	// (e.g. `partner_id` arrives as `"42"`, not `42`).
+	metadata?:   { [key: string]: string };
+}
+
+export interface CheckoutResponse {
+	checkoutUrl: string;
+}
+
+// REST list endpoints return paginated wrappers. `BackendService.list<T>()`
+// unwraps to the array; use `listPaginated<T>()` to get the metadata.
+export interface PaginatedList<T> {
+	items:  T[];
+	limit:  number;
+	offset: number;
+	total:  number;
+}
+
+export interface Subscription {
+	planId:      string;
+	status:      string;  // 'A' active, 'P' pending-payment, 'C' cancelled, ...
+	begda:       string;
+	endda?:      string;
+	monthlyCost: number;
+	currency:    string;
+	autoRenew:   boolean;
+}
+
+export interface Invoice {
+	id:       string;
+	number:   string;
+	status:   string;  // 'paid' | 'open' | 'void' | ...
+	total:    number;
+	currency: string;
+	issuedAt: string;
+	paidAt?:  string;
+}

package/src/model/auth.ts

@@ -0,0 +1,134 @@
+// Auth / consent / OTP / social / push / re-auth types — mirror keel's port types
+// (see keel/README.md and keel/handler/*).
+
+// ── Canonical consent type labels (match keel's port.ConsentType*) ──
+export const ConsentType = {
+  PRIVACY_POLICY: 'privacy_policy',
+  TERMS:          'terms',
+  CROSS_BORDER:   'cross_border',
+  VIDEO_OPT_IN:   'video_opt_in',
+  VIDEO_SESSION:  'video_session',
+  MARKETING:      'marketing',
+} as const;
+export type ConsentTypeValue = typeof ConsentType[keyof typeof ConsentType];
+
+// Declarative config for an optional consent checkbox rendered by ConsentGate.
+export interface ConsentOption {
+  id:        string;    // ConsentType value, e.g. 'video_opt_in'
+  label:     string;    // Checkbox label
+  required?: boolean;   // If true, state.valid stays false until checked
+  hint?:     string;    // Small explanatory text below the label
+  linkUrl?:  string;    // Optional inline link in the label
+  linkText?: string;
+}
+
+// Emitted by ConsentGateComponent on every change. Mirrors keel's
+// port.SignupConsent.Consents map directly.
+export interface ConsentState {
+  consents:       Record<string, boolean>;
+  policyVersion:  string;
+  policyLanguage: string;
+  valid:          boolean;
+}
+
+// Sent to the backend alongside OTP / social / register requests.
+// Matches keel's user.SignupConsent.
+export interface SignupConsent {
+  policyType?:    string;  // e.g. 'default' | 'custom'
+  policyVersion:  string;
+  policyRegion?:  string;  // ISO country code
+  policyLanguage: string;
+  region?:        string;
+  consents:       Record<string, boolean>;
+}
+
+// ── Phone / email OTP ──
+// `contactType` is a frontend-only convenience field used to drive UI
+// navigation (phone-confirm vs email-confirm). It is NOT sent to the
+// backend — keel detects phone-vs-email from the `contact` value itself.
+// `BaseAuthService.sendOtp` strips this field before posting, since keel
+// rejects unknown JSON fields with 400.
+export type OtpContactType = 'phone' | 'email';
+export type OtpPurpose     = 'login' | 'register' | 'verify';
+
+export interface OtpRequest {
+  contact:        string;
+  contactType?:   OtpContactType;  // frontend-only, stripped before POST
+  purpose?:       OtpPurpose;
+  defaultRegion?: string;          // ISO country hint for phone normalization
+  policyType?:    string;
+  policyVersion?: string;
+  policyRegion?:  string;
+  policyLanguage?: string;
+  region?:        string;
+  consents?:      Record<string, boolean>;
+}
+
+// keel issues a 32-byte base64-URL opaque token bound to the user_id in
+// the cache for ~5 minutes. Verify and Resend echo this back; an attacker
+// guessing arbitrary user ids cannot reach Verify because the cache lookup
+// fails. The login fall-through on unknown contacts also returns a token
+// (resolving to user_id 0) so 200 responses don't leak which contacts are
+// registered. Verify on a "fake" token returns the same generic 401 as a
+// wrong code.
+export interface OtpResponse {
+  otpToken: string;
+}
+
+export interface OtpVerifyRequest {
+  otpToken: string;
+  code:     string;
+}
+
+export interface OtpVerifyResponse {
+  token:      string;
+  userId?:    number;
+  partnerId?: number;
+}
+
+export interface OtpResendRequest {
+  otpToken: string;
+  purpose?: OtpPurpose;
+}
+
+// ── Re-authentication credentials ──
+// Required by Setup2FA, Disable2FA, DeleteAccount, LogoutEverywhere — server
+// rejects with 401 if neither `password` nor `twoFactorCode` is supplied.
+// Disable2FA additionally requires the current TOTP `code` alongside password.
+export interface ReauthCredentials {
+  password?:      string;
+  twoFactorCode?: string;
+}
+
+// ── Social login (ID token flow) ──
+export type SocialProvider = 'google' | 'apple';
+
+export interface SocialLoginRequest {
+  provider:        SocialProvider;
+  token:           string;   // ID token from provider SDK
+  policyType?:     string;
+  policyVersion?:  string;
+  policyRegion?:   string;
+  policyLanguage?: string;
+  region?:         string;
+  consents?:       Record<string, boolean>;
+}
+
+export interface LoginResponseSocial {
+  token:                   string;
+  userId?:                 number;
+  partnerId?:              number;
+  isNewUser:               boolean;
+  singleDeviceSession?:    boolean;
+  previousDeviceRevoked?:  boolean;
+}
+
+// ── Push notification tokens ──
+export type PushPlatform = 'I' | 'A' | 'W';  // iOS / Android / Web
+
+export interface PushRegisterRequest {
+  platform:      PushPlatform;
+  token:         string;
+  appVersion?:   string;
+  deviceModel?:  string;
+}

package/src/model/common.ts

@@ -0,0 +1,115 @@
+import { IsString, IsNumeric } from './decorator';
+
+export class SiudAction {
+  op_code = 'S';
+}
+
+export class UserAccountPolicy extends SiudAction {
+  @IsString(30)
+  Id?:                           string;
+
+  @IsNumeric(9, 0)
+  PolicyValue?:                  number;
+
+}
+
+
+export class ApplicationMenuItem extends SiudAction {
+  @IsString(30)
+  MenuId?:                       string;
+
+  @IsString(30)
+  ItemId?:                       string;
+
+  @IsString(80)
+  Caption?:                      string;
+
+  @IsNumeric(9, 0)
+  DisplayOrder?:                 number;
+
+  @IsString(255)
+  RestUri?:                      string;
+
+  @IsString(80)
+  Icon?:                         string;
+
+  IsActive?:                     boolean;
+
+  FilterOnList?:                 boolean;
+
+}
+
+
+export class ApplicationMenu extends SiudAction {
+  @IsString(30)
+  Id?:                           string;
+
+  @IsString(80)
+  Caption?:                      string;
+
+  @IsNumeric(9, 0)
+  DisplayOrder?:                 number;
+
+  @IsString(80)
+  Icon?:                         string;
+
+  IsActive?:                     boolean;
+
+  ApplicationMenuItems?:         ApplicationMenuItem[];
+}
+
+
+export class AuthorizationRolePermission extends SiudAction {
+  @IsString(30)
+  RoleId?:                       string;
+
+  @IsString(30)
+  AuthorizationObjectId?:        string;
+
+  @IsString(30)
+  Action?:                       string;
+
+  @IsString(80)
+  LowLimit?:                     string;
+
+  @IsString(80)
+  HighLimit?:                    string;
+
+  IsActive?:                     boolean;
+
+}
+
+
+export class ConstantValue extends SiudAction {
+  @IsString(60)
+  ConstantId?:                   string;
+
+  @IsString(80)
+  Value?:                        string;
+
+  @IsString(80)
+  Caption?:                      string;
+
+}
+
+
+export class UserAccount extends SiudAction {
+  @IsNumeric(9, 0)
+  Id?:                           number;
+
+  @IsString(80)
+  FirstName?:                    string;
+
+  @IsString(80)
+  LastName?:                     string;
+
+  @IsString(80)
+  UserName?:                     string;
+
+  @IsString(255)
+  UserEmail?:                    string;
+
+  @IsString(1)
+  Status?:                       string;
+
+}

package/src/model/decorator.ts

@@ -0,0 +1,74 @@
+import {
+  ValidatorConstraint,
+  ValidatorConstraintInterface,
+  ValidationArguments,
+} from 'class-validator';
+
+@ValidatorConstraint({ name: 'isNumeric', async: false })
+export class IsNumericConstraint implements ValidatorConstraintInterface {
+  validate(value: any, args: ValidationArguments) {
+    if (typeof value !== 'number') {
+      return false;
+    }
+
+    const [precision, scale] = args.constraints;
+    const valueString = value.toString();
+    const parts = valueString.split('.');
+    const integerPart = parts[0].startsWith('-') ? parts[0].substring(1) : parts[0];
+    const decimalPart = parts[1] || '';
+
+    // Check total digits vs precision and decimal digits vs scale
+    if (integerPart.length + decimalPart.length > precision || decimalPart.length > scale) {
+      return false;
+    }
+
+    return true;
+  }
+
+  defaultMessage(_args: ValidationArguments) {
+    return `\$property must be a numeric value with a total precision of \$constraint1 digits and maximum of \$constraint2 decimal places.`;
+  }
+}
+
+@ValidatorConstraint({ name: 'IsString', async: false })
+export class IsStringConstraint implements ValidatorConstraintInterface {
+  validate(value: any, args: ValidationArguments) {
+    const [maxLength] = args.constraints;
+
+    if (typeof value !== 'string') {
+      return false;
+    }
+
+    return value.length <= maxLength;
+  }
+
+  defaultMessage(_args: ValidationArguments) {
+    return `\$property must be shorter than or equal to \$constraint1 characters.`;
+  }
+}
+
+import { registerDecorator, ValidationOptions } from 'class-validator';
+
+export function IsNumeric(precision: number, scale: number, validationOptions?: ValidationOptions) {
+  return function (object: Record<string, any>, propertyName: string) {
+    registerDecorator({
+      target: object.constructor,
+      propertyName: propertyName,
+      options: validationOptions,
+      constraints: [precision, scale],
+      validator: IsNumericConstraint,
+    });
+  };
+}
+
+export function IsString(maxLength: number, validationOptions?: ValidationOptions) {
+  return function (object: Record<string, any>, propertyName: string) {
+    registerDecorator({
+      target: object.constructor,
+      propertyName: propertyName,
+      options: validationOptions,
+      constraints: [maxLength],
+      validator: IsStringConstraint,
+    });
+  };
+}

package/src/service/api-response.interceptor.ts

@@ -0,0 +1,26 @@
+import { HttpErrorResponse, HttpInterceptorFn, HttpResponse } from '@angular/common/http';
+import { catchError, map, throwError } from 'rxjs';
+
+export const apiResponseInterceptor: HttpInterceptorFn = (req, next) => {
+  return next(req).pipe(
+    map(event => {
+      if (event instanceof HttpResponse) {
+        const body = event.body as Record<string, unknown> | null;
+        if (body && 'data' in body) {
+          return event.clone({ body: body['data'] });
+        }
+      }
+      return event;
+    }),
+    catchError((error: HttpErrorResponse) => {
+      const detail = error.error?.detail || error.error?.title || error.message;
+      return throwError(() => new HttpErrorResponse({
+        error: detail,
+        headers: error.headers,
+        status: error.status,
+        statusText: error.statusText,
+        url: error.url ?? undefined,
+      }));
+    }),
+  );
+};

package/src/service/auth.interceptor.ts

@@ -0,0 +1,11 @@
+import { HttpInterceptorFn } from '@angular/common/http';
+
+export const authInterceptor: HttpInterceptorFn = (req, next) => {
+  const token = localStorage.getItem('jwt');
+  if (token && req.url.includes('/api/')) {
+    req = req.clone({
+      setHeaders: { Authorization: `Bearer ${token}` },
+    });
+  }
+  return next(req);
+};