@nauticana/sail 1.1.28 → 1.1.30

package/README.md

@@ -2,7 +2,7 @@
 
 A shared Angular component library for building CRUD-based admin frontends. Provides table management, form handling, navigation, authentication, two-factor authentication, and trusted device management — all driven by metadata from a [keel](https://github.com/nauticana/keel) Go backend.
 
-> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.28 adopts keel v1.2.93 (absolute `return` for the OAuth hand-off), sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
+> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.30 adopts keel v1.2.99 (password routes; a password change signs out), sail v1.1.29 adopts keel v1.2.94 (signup: confirmation signs in, partner setup, sign-in hand-off code), sail v1.1.28 adopts keel v1.2.93 (absolute `return` for the OAuth hand-off), sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
 
 **Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows. `passwordPolicyValidator` + `BaseAuthService.ensurePasswordPolicy()` — validate passwords against keel's policy (via `SailGuiConfig.passwordPolicyUrl`); see Configuration reference.
 
@@ -346,6 +346,13 @@ Omit the URL to skip client-side policy checks. The server stays the authoritati
 | `POST /public/otp/resend` | Re-issue OTP for an existing `otpToken` |
 | `POST /public/2fa/verify` | Login-time TOTP verification (uses `loginToken`) |
 | `POST /public/2fa/backup-verify` | Login-time backup-code verification |
+| `POST /public/register` | Start a signup from a `PartnerRegistration`; emails the confirmation code |
+| `POST /public/register/confirm` | Confirm `?email=&code=`; answers session tokens and the partner result (`confirmRegister`) |
+| `POST /public/register/exchange` | Trade a single-use hand-off `{code}` for a session (`exchangeHandoff`) |
+| `POST /api/register/partner` | Create the signed-in user's partner from a `PartnerSetup` (`createPartner`) |
+| `POST /public/password/change` | Change `{username, old_password, new_password}` (`chpass`); keel revokes every refresh token |
+| `POST /public/password/forgot` | Email a reset code for `{username}` (`forgotPassword`) |
+| `POST /public/password/reset` | Set the new password from `{username, code, new_password}` (`confirmChpass`); revokes every refresh token |
 | `POST /public/token/refresh` | Rotate `{refreshToken}` → new `{token, refreshToken}`; 401 ends the session |
 | `POST /public/logout` | Revoke `{refreshToken}` (called by `BaseAuthService.logout()`) |
 | `GET /public/ws` | keel realtime hub handshake (`RealtimeService`; JWT via `?token=`) |
@@ -413,6 +420,8 @@ The session JWT, the refresh token, and the short-lived `loginToken` are kept in
 
 Every keel login response (keel v1.2.57+) carries `refreshToken` beside `token`; `completeLogin` stores both. When an authenticated call answers 401, `authInterceptor` calls `BaseAuthService.refreshSession()` — one shared `POST /public/token/refresh` per burst — stores the rotated pair and replays the request with the new JWT. A 401 from the refresh itself (revoked, expired, already rotated) clears the session and lands on `login?sessionExpired=true`; any other refresh failure keeps the session and lets the 401 count toward the circuit breaker. `logout()` posts the refresh token to `/public/logout` before clearing local state. `acceptToken(token, refreshToken?)` accepts the pair for handoff flows. No wiring beyond registering `authInterceptor`.
 
+A successful `chpass()` or `confirmChpass()` clears any current session and lands on `login?passwordChanged=true`, where `<sail-login>` asks the user to sign in with the new password.
+
 ### Realtime
 
 `RealtimeService` (root-provided) is the client for keel's `realtime.Hub`. `connect()` opens `RestURL.realtimeURL` (`/public/ws`) on the configured backend host with the stored JWT, reconnects with backoff, and re-subscribes every channel after a reconnect. `channel<T>(name)` returns the payloads keel broadcasts on that channel; `userFrames<T>()` returns payloads addressed to the user, including keel's `{op: "notification"}` frames; `send(frame)` forwards an application frame to the hub's `OnMessage`. A subscription keel's `CanSubscribe` rejects is logged and exposed on `lastError`. Channel names and payload shapes are app-owned.
@@ -512,7 +521,9 @@ metadata: {
 
 ### Registration → checkout flow
 
-The registration confirmation (`ConfirmRegisterComponent`) already handles the payment redirect. When the backend returns `paymentRequired: true`, the user is sent to `resp.paymentUrl` (Stripe Checkout) automatically. No extra wiring needed — just select a paid plan during registration.
+`BaseAuthService.confirmRegister(email, code)` signs the user in from the tokens keel answers (keel v1.2.94), so no separate login follows. `ConfirmRegisterComponent` then sends the user to `resp.paymentUrl` when the backend returns `paymentRequired: true` with one; otherwise the post-login navigation applies.
+
+A two-step signup registers the account alone (a `PartnerRegistration` without partner fields), then calls `createPartner(setup)` once signed in. It posts keel's `PartnerSetup` — application fields ride in `extra` — rotates the refresh token so the session carries the new partner, reloads appdata and routes, and emits `PartnerCreated`. When `paymentRequired` comes without a `paymentUrl`, the application's billing page opens the checkout. `exchangeHandoff(code)` completes a sign-in that arrived by redirect with keel's single-use code, including the 2FA step.
 
 ### `BaseAsync`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.28",
+  "version": "1.1.30",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "exports": {

package/src/component/login/chpass_component.html

@@ -43,10 +43,6 @@
         <div class="auth-error" role="alert">{{ errorMessage() }}</div>
       }
 
-      @if (successMessage()) {
-        <div class="auth-success" role="status">{{ successMessage() }}</div>
-      }
-
       <button matButton="elevated" class="primary" type="submit" [disabled]="!chpassForm.valid">
         @if (forgotPassword()) {
           Send Confirmation Code

package/src/component/login/chpass_component.ts

@@ -90,11 +90,7 @@ export class ChpassComponent extends BaseAsync {
     this.run(
       request,
       () => {
-        if (isForgot) {
-          this.router.navigate(['/confirm/password'], { queryParams: { username } });
-        } else {
-          this.successMessage.set('Password changed successfully.');
-        }
+        if (isForgot) this.router.navigate(['/confirm/password'], { queryParams: { username } });
       },
       'Password change failed. Please try again.',
     );

package/src/component/login/confirm_chpass_component.html

@@ -36,10 +36,6 @@
         <div class="auth-error" role="alert">{{ errorMessage() }}</div>
       }
 
-      @if (successMessage()) {
-        <div class="auth-success" role="status">{{ successMessage() }}</div>
-      }
-
       <button matButton="elevated" class="primary" type="submit" [disabled]="!confirmForm.valid">
         Confirm Password Change
       </button>

package/src/component/login/confirm_chpass_component.ts

@@ -1,7 +1,7 @@
 import { ChangeDetectionStrategy, Component, computed, effect, inject, OnInit, ViewEncapsulation } from '@angular/core';
 import { FormBuilder, ReactiveFormsModule, Validators } from '@angular/forms';
 import { BaseAuthService } from '../../service/auth.service';
-import { ActivatedRoute, Router, RouterLink } from '@angular/router';
+import { ActivatedRoute, RouterLink } from '@angular/router';
 import { MatButtonModule } from '@angular/material/button';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
@@ -25,7 +25,6 @@ import { passwordPolicyValidator, passwordPolicyHint } from '../../util/password
 export class ConfirmChpassComponent extends BaseAsync implements OnInit {
   private auth = inject(BaseAuthService);
   private fb = inject(FormBuilder);
-  private router = inject(Router);
   private route = inject(ActivatedRoute);
   protected readonly guiConfig: SailGuiConfig = inject(SAIL_GUI_CONFIG, {optional: true}) ?? DEFAULT_CONFIG;
 
@@ -67,7 +66,7 @@ export class ConfirmChpassComponent extends BaseAsync implements OnInit {
 
     this.run(
       this.auth.confirmChpass(username!, code!, new_password!),
-      () => this.router.navigate(['/login/local']),
+      () => {},
       'Confirmation failed. Please try again.',
     );
   }

package/src/component/login/confirm_register_component.ts

@@ -1,7 +1,7 @@
 import { ChangeDetectionStrategy, Component, inject, OnInit, ViewEncapsulation } from '@angular/core';
 import { FormBuilder, ReactiveFormsModule, Validators } from '@angular/forms';
 import { BaseAuthService } from '../../service/auth.service';
-import { ActivatedRoute, Router, RouterLink } from '@angular/router';
+import { ActivatedRoute, RouterLink } from '@angular/router';
 import { MatButtonModule } from '@angular/material/button';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
@@ -24,7 +24,6 @@ import { BaseAsync } from '../abstract/base_async';
 export class ConfirmRegisterComponent extends BaseAsync implements OnInit {
   private auth = inject(BaseAuthService);
   private fb = inject(FormBuilder);
-  private router = inject(Router);
   private route = inject(ActivatedRoute);
   protected readonly guiConfig: SailGuiConfig = inject(SAIL_GUI_CONFIG, {optional: true}) ?? DEFAULT_CONFIG;
 
@@ -49,15 +48,11 @@ export class ConfirmRegisterComponent extends BaseAsync implements OnInit {
       this.auth.confirmRegister(email!, code!),
       (resp) => {
         this.successMessage.set('Registration confirmed.');
+        // confirmRegister signed the user in and owns navigation; only a paid
+        // plan's checkout leaves the SPA (window.location: it is cross-origin).
         if (resp?.paymentRequired && resp.paymentUrl) {
-          // Paid plan: go straight to payment. Subscription is 'P' until paid.
-          // Using window.location (not router) so absolute / cross-origin
-          // payment URLs also work.
           window.location.href = resp.paymentUrl;
-          return;
         }
-        // Free plan: land on login.
-        this.router.navigate(['/login/local']);
       },
       'Confirmation failed. Please try again.',
     );

package/src/component/login/login_component.html

@@ -9,6 +9,9 @@
     @if (loggedOut) {
       <p class="auth-message" role="status" aria-live="polite">You have been logged out successfully.</p>
     }
+    @if (passwordChanged) {
+      <p class="auth-message" role="status" aria-live="polite">Your password was changed. Sign in again with the new password.</p>
+    }
     @if (sessionHandoffError()) {
       <p class="auth-error" role="alert">{{ sessionHandoffError() }}</p>
     }

package/src/component/login/login_component.ts

@@ -28,7 +28,9 @@ export class LoginComponent extends BaseAsync {
   private auth = inject(BaseAuthService);
   protected fb = inject(FormBuilder);
   protected readonly guiConfig: SailGuiConfig = inject(SAIL_GUI_CONFIG, {optional: true}) ?? DEFAULT_CONFIG;
-  protected readonly loggedOut = inject(ActivatedRoute).snapshot.queryParamMap.get('loggedOut') === 'true';
+  private readonly queryParams = inject(ActivatedRoute).snapshot.queryParamMap;
+  protected readonly loggedOut = this.queryParams.get('loggedOut') === 'true';
+  protected readonly passwordChanged = this.queryParams.get('passwordChanged') === 'true';
   /** OAuth session hand-off failure from BaseAuthService, shown below. */
   protected readonly sessionHandoffError = this.auth.sessionHandoffError;
 

package/src/component/login/register_component.ts

@@ -159,22 +159,22 @@ export class RegisterComponent implements OnInit {
     this.registerError.set('');
     const formValue = this.registerForm.getRawValue();
     const partnerReg: PartnerRegistration = {
-      FirstName: formValue.FirstName!,
-      LastName: formValue.LastName!,
-      UserName: formValue.UserName!,
-      Email: formValue.Email!,
-      Password: formValue.Password!,
-      PartnerCaption: formValue.PartnerCaption!,
-      Address: formValue.Address!,
-      City: formValue.City!,
-      State: formValue.State!,
-      Zipcode: formValue.Zipcode!,
-      Country: formValue.Country!,
-      Phone: formValue.Phone!,
-      DomainURL: formValue.DomainURL!,
-      Latitude: formValue.Latitude,
-      Longitude: formValue.Longitude,
-      PlanID: formValue.PlanID!,
+      firstName: formValue.FirstName!,
+      lastName: formValue.LastName!,
+      userName: formValue.UserName!,
+      email: formValue.Email!,
+      password: formValue.Password!,
+      partnerCaption: formValue.PartnerCaption!,
+      address: formValue.Address!,
+      city: formValue.City!,
+      state: formValue.State!,
+      zipcode: formValue.Zipcode!,
+      country: formValue.Country!,
+      phone: formValue.Phone!,
+      domainUrl: formValue.DomainURL!,
+      latitude: formValue.Latitude ?? undefined,
+      longitude: formValue.Longitude ?? undefined,
+      planId: formValue.PlanID!,
     };
     this.auth.register(partnerReg).subscribe({
       // Pass the email along so the confirm page pre-fills it.

package/src/model/appdata.ts

@@ -198,24 +198,46 @@ export interface TrustedDevice {
   created_at:   string;
 }
 
-export interface PartnerRegistration {
-	FirstName:            string;
-	LastName:             string;
-	UserName:             string;
-	Email:                string;
-	Password:             string;
-	PartnerCaption:       string;
-	Address:              string;
-	City:                 string;
-	State:                string;
-	Zipcode:              string;
-	Country:              string;
-	Phone:                string;
-	// null when geocoding is disabled or the address wasn't verified.
-	Latitude:             number | null;
-	Longitude:            number | null;
-	DomainURL:            string;
-	PlanID:               string;
+// Mirrors keel `user.AccountRegistration`.
+export interface AccountRegistration {
+	firstName: string;
+	lastName:  string;
+	userName:  string;
+	email:     string;
+	password:  string;
+}
+
+// Mirrors keel `user.PartnerSetup`. `extra` carries the application's own fields.
+export interface PartnerSetup<TExtra = unknown> {
+	partnerCaption: string;
+	address:        string;
+	city:           string;
+	state:          string;
+	zipcode:        string;
+	country:        string;
+	phone:          string;
+	latitude?:      number;
+	longitude?:     number;
+	domainUrl:      string;
+	planId:         string;
+	// Chosen offer (PERIOD_TYPE codes); none selects the plan's cheapest.
+	billingCycle?:  string;
+	termType?:      string;
+	termCount?:     number;
+	extra?:         TExtra;
+}
+
+// Mirrors keel `user.PartnerRegistration`. Without partner fields only the
+// account is created and the partner follows through `createPartner`.
+export type PartnerRegistration<TExtra = unknown> = AccountRegistration & Partial<PartnerSetup<TExtra>>;
+
+// Mirrors keel `user.PartnerCreated`. `paymentRequired` without a `paymentUrl`
+// means the application's billing page opens the checkout.
+export interface PartnerCreated {
+	partnerId:       number;
+	planId:          string;
+	paymentRequired: boolean;
+	paymentUrl?:     string;
 }
 
 // One purchasable offer for a plan — a (billing cycle × commitment term) row of
@@ -261,15 +283,13 @@ export interface PublicPlan {
 	trialDays?:      number;
 }
 
-// ConfirmRegisterResponse — shape returned by POST /public/confirm/register.
-// When paymentRequired is true the UI should redirect the user to paymentUrl
-// before letting them log in.
-export interface ConfirmRegisterResponse {
-	status:          string;
-	partnerId:       number;
-	planId:          string;
-	paymentRequired: boolean;
-	paymentUrl?:     string;
+// ConfirmRegisterResponse — shape returned by POST /public/register/confirm:
+// the new session's tokens, plus the partner result when the registration had one.
+export interface ConfirmRegisterResponse extends TokenPair {
+	status:           string;
+	planId?:          string;
+	paymentRequired?: boolean;
+	paymentUrl?:      string;
 }
 
 // ── Billing / Payment types ──

package/src/service/auth.service.ts

@@ -2,7 +2,7 @@ import { Injectable, WritableSignal, inject, signal } from '@angular/core';
 import { HttpErrorResponse, HttpParams } from '@angular/common/http';
 import { filter, finalize, map, mergeMap, shareReplay, take, tap } from 'rxjs/operators';
 import { PasswordRules } from '../util/password_policy';
-import { ApplicationData, ConfirmRegisterResponse, DictionaryPath, LoginResponse2FA, PartnerRegistration, RestReport, TableDefinition, TokenPair, TrustedDevice, TwoFactorSetupResponse, TwoFactorVerifyRequest, TwoFactorVerifyResponse } from '../model/appdata';
+import { ApplicationData, ConfirmRegisterResponse, DictionaryPath, LoginResponse2FA, PartnerCreated, PartnerRegistration, PartnerSetup, RestReport, TableDefinition, TokenPair, TrustedDevice, TwoFactorSetupResponse, TwoFactorVerifyRequest, TwoFactorVerifyResponse } from '../model/appdata';
 import {
   LoginResponseSocial,
   OtpRequest, OtpResendRequest, OtpResponse, OtpVerifyRequest, OtpVerifyResponse,
@@ -89,7 +89,10 @@ export abstract class BaseAuthService extends BaseRestService {
   protected get logoutUrl()                { return this.url(RestURL.logoutURL); }
   protected get registerUrl()              { return this.url(RestURL.registerURL); }
   protected get chpassUrl()                { return this.url(RestURL.chpassURL); }
+  protected get forgotPasswordUrl()        { return this.url(RestURL.forgotPasswordURL); }
   protected get confirmRegisterUrl()       { return this.url(RestURL.confirmRegisterURL); }
+  protected get registerExchangeUrl()      { return this.url(RestURL.registerExchangeURL); }
+  protected get registerPartnerUrl()       { return this.url(RestURL.registerPartnerURL); }
   protected get confirmChpassUrl()         { return this.url(RestURL.confirmChpassURL); }
   protected get loginGoogleUrl()           { return this.url(RestURL.loginGoogleURL); }
   protected get twoFactorSetupUrl()        { return this.url(RestURL.twoFactorSetupURL); }
@@ -414,11 +417,12 @@ export abstract class BaseAuthService extends BaseRestService {
   }
 
   chpass(username: string, new_password: string, old_password: string) {
-    return this.http.post<{ message: string }>(this.chpassUrl, { username, old_password, new_password });
+    return this.http.post<{ status: string }>(this.chpassUrl, { username, old_password, new_password })
+      .pipe(tap(() => this.passwordChanged()));
   }
 
   forgotPassword(username: string) {
-    return this.http.post<{ message: string }>(this.chpassUrl, { username });
+    return this.http.post<{ status: string }>(this.forgotPasswordUrl, { username });
   }
 
   // ── Self-service profile (keel ProfileHandler) ──
@@ -449,13 +453,37 @@ export abstract class BaseAuthService extends BaseRestService {
     return this.http.post<{ message: string }>(this.profilePhoneConfirmUrl, { value, code });
   }
 
-  confirmRegister(email: string, code: string) {
+  /** Confirm a registration; success completes the login from the tokens keel
+   *  answers. A registration without partner fields leaves `partnerId` 0. */
+  confirmRegister(email: string, code: string): Observable<ConfirmRegisterResponse> {
     const params = new HttpParams().set('email', email).set('code', code);
-    return this.http.post<ConfirmRegisterResponse>(this.confirmRegisterUrl, null, { params });
+    return this.http.post<ConfirmRegisterResponse>(this.confirmRegisterUrl, null, { params }).pipe(
+        tap((res) => this.completeLogin(res.token, res.refreshToken)),
+    );
+  }
+
+  /** Create the partner of a signed-in user who has none, then rotate the
+   *  refresh token so the session carries the partner. An error after keel
+   *  created the partner means only the rotation failed; do not post again. */
+  createPartner(setup: PartnerSetup): Observable<PartnerCreated> {
+    return this.http.post<PartnerCreated>(this.registerPartnerUrl, setup).pipe(
+        mergeMap((created) => this.refreshSession().pipe(
+            tap((token) => this.completeLogin(token, localStorage.getItem('refreshToken') ?? undefined)),
+            map(() => created),
+        )),
+    );
+  }
+
+  /** Trade keel's single-use hand-off code for a session; same contract as login(). */
+  exchangeHandoff(code: string): Observable<LoginResponse2FA> {
+    return this.http.post<LoginResponse2FA>(this.registerExchangeUrl, { code }, { withCredentials: true }).pipe(
+        tap((res) => this.handleLoginResponse(res)),
+    );
   }
 
   confirmChpass(username: string, code: string, new_password: string) {
-    return this.http.post<{ message: string }>(this.confirmChpassUrl, { username, code, new_password });
+    return this.http.post<{ status: string }>(this.confirmChpassUrl, { username, code, new_password })
+      .pipe(tap(() => this.passwordChanged()));
   }
 
   loadStoredSession() {
@@ -485,7 +513,7 @@ export abstract class BaseAuthService extends BaseRestService {
   }
 
   register(reg: PartnerRegistration) {
-    return this.http.post<PartnerRegistration>(this.registerUrl, reg);
+    return this.http.post<{ status: string }>(this.registerUrl, reg);
   }
 
   // ── Phone / email OTP ──
@@ -628,6 +656,11 @@ export abstract class BaseAuthService extends BaseRestService {
     this.router.navigate(['/login/local'], { queryParams: { sessionExpired: 'true' } });
   }
 
+  private passwordChanged(): void {
+    this.clearSession();
+    this.router.navigate(['/login/local'], { queryParams: { passwordChanged: 'true' } });
+  }
+
   private buildAuthIndex() {
     this.authIndex.clear();
     if (!this.cache?.Permissions) return;

package/src/service/rest_url.ts

@@ -8,10 +8,13 @@ export const RestURL = {
   realtimeURL: '/public/ws',                  // keel realtime.Hub handshake; JWT via ?token=
   loginGoogleURL: '/public/login/google',
   registerURL: '/public/register',
-  chpassURL: '/public/login/chpass',
-  confirmRegisterURL: '/public/confirm/register',
+  chpassURL: '/public/password/change',       // keel revokes every refresh token on success
+  forgotPasswordURL: '/public/password/forgot',
+  confirmRegisterURL: '/public/register/confirm',
+  registerExchangeURL: '/public/register/exchange',
+  registerPartnerURL: '/api/register/partner',
   plansURL: '/public/plans',
-  confirmChpassURL: '/public/confirm/password',
+  confirmChpassURL: '/public/password/reset',
   twoFactorSetupURL: '/api/user/2fa/setup',
   twoFactorVerifyURL: '/api/user/2fa/verify',          // authenticated — confirms setup
   twoFactorDisableURL: '/api/user/2fa/disable',