@nauticana/sail 1.1.11 → 1.1.12

package/README.md

@@ -4,7 +4,7 @@ A shared Angular component library for building CRUD-based admin frontends. Prov
 
 > **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x** (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
 
-**Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows.
+**Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows. `passwordPolicyValidator` + `BaseAuthService.ensurePasswordPolicy()` — validate passwords against keel's policy (via `SailGuiConfig.passwordPolicyUrl`); see Configuration reference.
 
 > **v1.1.10 is a breaking release.** The base classes migrated to signals (`records()`, `editableRecord()`, `isNew()` …), `login()`/`loginWithGoogle()` now return Observables, CRUD errors are typed `SailApiError`, `BaseView` split into read-only `BaseView` + `AbstractEditableView`, the decorators are renamed `IsSailString`/`IsSailNumeric`, and `configureRestUrls()` is finally safe to call from a subclass constructor. The complete old→new mapping is machine-readable in [`migration_guide.json`](migration_guide.json). Consumers must fully migrate before pushing to test or prod.
 
@@ -277,9 +277,19 @@ interface SailGuiConfig {
   defaultPolicyVersion?: string;      // Content hash of the deployed policy
   defaultPolicyLanguage?: string;     // ISO 639-1 fallback language
   accountDeletedRoute?: string;       // Route after account deletion (default '/login/local')
+  passwordPolicyUrl?: string;         // Public route serving keel's password policy (see below)
 }
 ```
 
+### Password-policy validation
+
+Set `passwordPolicyUrl` to the app's public route for keel's `PublicHandler.GetPasswordPolicy`
+(e.g. `'/public/v1/auth/password/policy'`). `BaseAuthService.ensurePasswordPolicy()` fetches it
+once into the `passwordRules` signal, and `passwordPolicyValidator(() => auth.passwordRules())`
+validates new-password inputs against the real policy before submit (`passwordPolicyHint(rules)`
+builds the matching hint text). Built into `chpass` / `confirm-chpass`; reuse in app signup forms.
+Omit the URL to skip client-side policy checks. The server stays the authoritative gate.
+
 ## Backend endpoints (keel v1.0)
 
 | Endpoint | Purpose |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.11",
+  "version": "1.1.12",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "scripts": {

package/src/component/login/chpass_component.html

@@ -21,6 +21,10 @@
         <mat-form-field appearance="outline">
           <mat-label>New Password</mat-label>
           <input matInput type="password" formControlName="new_password" autocomplete="new-password" required>
+          @if (passwordHint(); as hint) { <mat-hint>{{ hint }}</mat-hint> }
+          @if (chpassForm.controls.new_password.hasError('passwordPolicy')) {
+            <mat-error>{{ chpassForm.controls.new_password.getError('passwordPolicy').message }}</mat-error>
+          }
         </mat-form-field>
 
         <mat-form-field appearance="outline">

package/src/component/login/chpass_component.ts

@@ -1,4 +1,4 @@
-import { ChangeDetectionStrategy, Component, inject, signal, ViewEncapsulation } from '@angular/core';
+import { ChangeDetectionStrategy, Component, computed, effect, inject, signal, ViewEncapsulation } from '@angular/core';
 import { FormBuilder, ReactiveFormsModule, Validators } from '@angular/forms';
 import { BaseAuthService } from '../../service/auth.service';
 import { Router, RouterLink } from '@angular/router';
@@ -8,6 +8,7 @@ import { MatInputModule } from '@angular/material/input';
 import { MatCheckboxModule } from '@angular/material/checkbox';
 import { SAIL_GUI_CONFIG, SailGuiConfig, DEFAULT_CONFIG } from '../../config';
 import { BaseAsync } from '../abstract/base_async';
+import { passwordPolicyValidator, passwordPolicyHint } from '../../util/password_policy';
 
 @Component({
   selector: 'sail-chpass',
@@ -34,10 +35,21 @@ export class ChpassComponent extends BaseAsync {
   chpassForm = this.fb.group({
     username: ['', Validators.required],
     old_password: ['', Validators.required],
-    new_password: ['', [Validators.required, Validators.minLength(6)]],
+    new_password: ['', [Validators.required, passwordPolicyValidator(() => this.auth.passwordRules())]],
     confirm_password: ['', Validators.required],
   });
 
+  protected readonly passwordHint = computed(() => passwordPolicyHint(this.auth.passwordRules()));
+
+  constructor() {
+    super();
+    this.auth.ensurePasswordPolicy();
+    effect(() => {
+      this.auth.passwordRules();
+      this.chpassForm.controls.new_password.updateValueAndValidity({ emitEvent: false });
+    });
+  }
+
   toggleForgotPassword(checked: boolean) {
     this.forgotPassword.set(checked);
     const oldPw = this.chpassForm.get('old_password')!;
@@ -52,7 +64,7 @@ export class ChpassComponent extends BaseAsync {
       confirmPw.setValue('');
     } else {
       oldPw.setValidators(Validators.required);
-      newPw.setValidators([Validators.required, Validators.minLength(6)]);
+      newPw.setValidators([Validators.required, passwordPolicyValidator(() => this.auth.passwordRules())]);
       confirmPw.setValidators(Validators.required);
     }
     oldPw.updateValueAndValidity();

package/src/component/login/confirm_chpass_component.html

@@ -21,6 +21,10 @@
       <mat-form-field appearance="outline">
         <mat-label>New Password</mat-label>
         <input matInput type="password" formControlName="new_password" autocomplete="new-password" required>
+        @if (passwordHint(); as hint) { <mat-hint>{{ hint }}</mat-hint> }
+        @if (confirmForm.controls.new_password.hasError('passwordPolicy')) {
+          <mat-error>{{ confirmForm.controls.new_password.getError('passwordPolicy').message }}</mat-error>
+        }
       </mat-form-field>
 
       <mat-form-field appearance="outline">

package/src/component/login/confirm_chpass_component.ts

@@ -1,4 +1,4 @@
-import { ChangeDetectionStrategy, Component, inject, OnInit, ViewEncapsulation } from '@angular/core';
+import { ChangeDetectionStrategy, Component, computed, effect, inject, OnInit, ViewEncapsulation } from '@angular/core';
 import { FormBuilder, ReactiveFormsModule, Validators } from '@angular/forms';
 import { BaseAuthService } from '../../service/auth.service';
 import { ActivatedRoute, Router, RouterLink } from '@angular/router';
@@ -7,6 +7,7 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
 import { SAIL_GUI_CONFIG, SailGuiConfig, DEFAULT_CONFIG } from '../../config';
 import { BaseAsync } from '../abstract/base_async';
+import { passwordPolicyValidator, passwordPolicyHint } from '../../util/password_policy';
 
 @Component({
   selector: 'sail-confirm-chpass',
@@ -31,11 +32,23 @@ export class ConfirmChpassComponent extends BaseAsync implements OnInit {
   confirmForm = this.fb.group({
     username: ['', Validators.required],
     code: ['', Validators.required],
-    new_password: ['', [Validators.required, Validators.minLength(6)]],
+    new_password: ['', [Validators.required, passwordPolicyValidator(() => this.auth.passwordRules())]],
     confirm_password: ['', Validators.required],
   });
 
+  protected readonly passwordHint = computed(() => passwordPolicyHint(this.auth.passwordRules()));
+
+  constructor() {
+    super();
+    // Re-validate the new-password field once the policy arrives.
+    effect(() => {
+      this.auth.passwordRules();
+      this.confirmForm.controls.new_password.updateValueAndValidity({ emitEvent: false });
+    });
+  }
+
   ngOnInit() {
+    this.auth.ensurePasswordPolicy();
     const username = this.route.snapshot.queryParamMap.get('username');
     if (username) {
       this.confirmForm.patchValue({ username });

package/src/config.ts

@@ -74,6 +74,11 @@ export interface SailGuiConfig {
   /** Hostnames a post-login `?return=` may redirect to (open-redirect allowlist),
    * e.g. ['mcp.example.com']. Anything not listed is ignored. */
   allowedReturnHosts?: string[];
+
+  /** Public route serving the password policy (keel PublicHandler.GetPasswordPolicy),
+   * e.g. '/public/v1/auth/password/policy'. When set, sail fetches it once and
+   * password inputs validate against it. Omitted → policy validation is skipped. */
+  passwordPolicyUrl?: string;
 }
 
 export const SAIL_GUI_CONFIG = new InjectionToken<SailGuiConfig>('SailGuiConfig');

package/src/index.ts

@@ -71,3 +71,4 @@ export * from './service/base_rest.service';
 export * from './util/text';
 export * from './util/money';
 export * from './util/errors';
+export * from './util/password_policy';

package/src/service/auth.service.ts

@@ -1,6 +1,7 @@
 import { Injectable, WritableSignal, inject, signal } from '@angular/core';
 import { HttpErrorResponse, HttpParams } from '@angular/common/http';
 import { filter, map, mergeMap, take, tap } from 'rxjs/operators';
+import { PasswordRules } from '../util/password_policy';
 import { ApplicationData, ConfirmRegisterResponse, DictionaryPath, LoginResponse2FA, PartnerRegistration, RestReport, TableDefinition, TrustedDevice, TwoFactorSetupResponse, TwoFactorVerifyRequest, TwoFactorVerifyResponse } from '../model/appdata';
 import {
   LoginResponseSocial,
@@ -94,6 +95,22 @@ export abstract class BaseAuthService extends BaseRestService {
   token: string | null = null;
   readonly isLoggedIn = signal(false);
 
+  /** keel password policy for pre-submit validation; undefined until loaded
+   *  (or when guiConfig.passwordPolicyUrl is unset). Fed via ensurePasswordPolicy(). */
+  readonly passwordRules = signal<PasswordRules | undefined>(undefined);
+  private passwordPolicyLoading = false;
+
+  /** Fetch the policy once (public route, safe pre-login). No-op if already
+   *  loaded/loading or no URL configured. */
+  ensurePasswordPolicy(): void {
+    if (this.passwordRules() || this.passwordPolicyLoading || !this.guiConfig.passwordPolicyUrl) return;
+    this.passwordPolicyLoading = true;
+    this.http.get<PasswordRules>(this.url(this.guiConfig.passwordPolicyUrl)).subscribe({
+      next: (rules) => this.passwordRules.set(rules),
+      error: () => { this.passwordPolicyLoading = false; },
+    });
+  }
+
   /** Last appdata load failure (null when none). */
   readonly appDataError = signal<unknown>(null);
 

package/src/util/password_policy.ts

@@ -0,0 +1,43 @@
+import { AbstractControl, ValidationErrors, ValidatorFn } from '@angular/forms';
+
+// keel PasswordPolicyView — the composition rules for pre-submit validation.
+export interface PasswordRules {
+  minLength: number;
+  minUpper: number;
+  minLower: number;
+  minDigit: number;
+}
+
+type RulesSource = PasswordRules | (() => PasswordRules | undefined);
+
+// Validator for keel's password policy. Empty is left to Validators.required;
+// undefined rules (not loaded) skip the check. Char classes match keel's ASCII rules.
+export function passwordPolicyValidator(source: RulesSource): ValidatorFn {
+  return (control: AbstractControl): ValidationErrors | null => {
+    const rules = typeof source === 'function' ? source() : source;
+    const value: string = control.value ?? '';
+    if (!rules || !value) return null;
+    let upper = 0, lower = 0, digit = 0;
+    for (const ch of value) {
+      if (ch >= 'A' && ch <= 'Z') upper++;
+      else if (ch >= 'a' && ch <= 'z') lower++;
+      else if (ch >= '0' && ch <= '9') digit++;
+    }
+    const unmet: string[] = [];
+    if (value.length < rules.minLength) unmet.push(`${rules.minLength} characters`);
+    if (upper < rules.minUpper) unmet.push('an uppercase letter');
+    if (lower < rules.minLower) unmet.push('a lowercase letter');
+    if (digit < rules.minDigit) unmet.push('a number');
+    return unmet.length ? { passwordPolicy: { message: `Password needs ${unmet.join(', ')}.` } } : null;
+  };
+}
+
+// Human-readable requirement string built from the loaded rules ('' when unknown).
+export function passwordPolicyHint(rules?: PasswordRules): string {
+  if (!rules) return '';
+  const parts = [`at least ${rules.minLength} characters`];
+  if (rules.minUpper > 0) parts.push('an uppercase letter');
+  if (rules.minLower > 0) parts.push('a lowercase letter');
+  if (rules.minDigit > 0) parts.push('a number');
+  return `Use ${parts.join(', ')}.`;
+}