@nauticana/sail 1.1.29 → 1.1.30

package/README.md

@@ -2,7 +2,7 @@
 
 A shared Angular component library for building CRUD-based admin frontends. Provides table management, form handling, navigation, authentication, two-factor authentication, and trusted device management — all driven by metadata from a [keel](https://github.com/nauticana/keel) Go backend.
 
-> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.29 adopts keel v1.2.94 (signup: confirmation signs in, partner setup, sign-in hand-off code), sail v1.1.28 adopts keel v1.2.93 (absolute `return` for the OAuth hand-off), sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
+> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.30 adopts keel v1.2.99 (password routes; a password change signs out), sail v1.1.29 adopts keel v1.2.94 (signup: confirmation signs in, partner setup, sign-in hand-off code), sail v1.1.28 adopts keel v1.2.93 (absolute `return` for the OAuth hand-off), sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
 
 **Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows. `passwordPolicyValidator` + `BaseAuthService.ensurePasswordPolicy()` — validate passwords against keel's policy (via `SailGuiConfig.passwordPolicyUrl`); see Configuration reference.
 
@@ -350,6 +350,9 @@ Omit the URL to skip client-side policy checks. The server stays the authoritati
 | `POST /public/register/confirm` | Confirm `?email=&code=`; answers session tokens and the partner result (`confirmRegister`) |
 | `POST /public/register/exchange` | Trade a single-use hand-off `{code}` for a session (`exchangeHandoff`) |
 | `POST /api/register/partner` | Create the signed-in user's partner from a `PartnerSetup` (`createPartner`) |
+| `POST /public/password/change` | Change `{username, old_password, new_password}` (`chpass`); keel revokes every refresh token |
+| `POST /public/password/forgot` | Email a reset code for `{username}` (`forgotPassword`) |
+| `POST /public/password/reset` | Set the new password from `{username, code, new_password}` (`confirmChpass`); revokes every refresh token |
 | `POST /public/token/refresh` | Rotate `{refreshToken}` → new `{token, refreshToken}`; 401 ends the session |
 | `POST /public/logout` | Revoke `{refreshToken}` (called by `BaseAuthService.logout()`) |
 | `GET /public/ws` | keel realtime hub handshake (`RealtimeService`; JWT via `?token=`) |
@@ -417,6 +420,8 @@ The session JWT, the refresh token, and the short-lived `loginToken` are kept in
 
 Every keel login response (keel v1.2.57+) carries `refreshToken` beside `token`; `completeLogin` stores both. When an authenticated call answers 401, `authInterceptor` calls `BaseAuthService.refreshSession()` — one shared `POST /public/token/refresh` per burst — stores the rotated pair and replays the request with the new JWT. A 401 from the refresh itself (revoked, expired, already rotated) clears the session and lands on `login?sessionExpired=true`; any other refresh failure keeps the session and lets the 401 count toward the circuit breaker. `logout()` posts the refresh token to `/public/logout` before clearing local state. `acceptToken(token, refreshToken?)` accepts the pair for handoff flows. No wiring beyond registering `authInterceptor`.
 
+A successful `chpass()` or `confirmChpass()` clears any current session and lands on `login?passwordChanged=true`, where `<sail-login>` asks the user to sign in with the new password.
+
 ### Realtime
 
 `RealtimeService` (root-provided) is the client for keel's `realtime.Hub`. `connect()` opens `RestURL.realtimeURL` (`/public/ws`) on the configured backend host with the stored JWT, reconnects with backoff, and re-subscribes every channel after a reconnect. `channel<T>(name)` returns the payloads keel broadcasts on that channel; `userFrames<T>()` returns payloads addressed to the user, including keel's `{op: "notification"}` frames; `send(frame)` forwards an application frame to the hub's `OnMessage`. A subscription keel's `CanSubscribe` rejects is logged and exposed on `lastError`. Channel names and payload shapes are app-owned.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.29",
+  "version": "1.1.30",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "exports": {

package/src/component/login/chpass_component.html

@@ -43,10 +43,6 @@
         <div class="auth-error" role="alert">{{ errorMessage() }}</div>
       }
 
-      @if (successMessage()) {
-        <div class="auth-success" role="status">{{ successMessage() }}</div>
-      }
-
       <button matButton="elevated" class="primary" type="submit" [disabled]="!chpassForm.valid">
         @if (forgotPassword()) {
           Send Confirmation Code

package/src/component/login/chpass_component.ts

@@ -90,11 +90,7 @@ export class ChpassComponent extends BaseAsync {
     this.run(
       request,
       () => {
-        if (isForgot) {
-          this.router.navigate(['/confirm/password'], { queryParams: { username } });
-        } else {
-          this.successMessage.set('Password changed successfully.');
-        }
+        if (isForgot) this.router.navigate(['/confirm/password'], { queryParams: { username } });
       },
       'Password change failed. Please try again.',
     );

package/src/component/login/confirm_chpass_component.html

@@ -36,10 +36,6 @@
         <div class="auth-error" role="alert">{{ errorMessage() }}</div>
       }
 
-      @if (successMessage()) {
-        <div class="auth-success" role="status">{{ successMessage() }}</div>
-      }
-
       <button matButton="elevated" class="primary" type="submit" [disabled]="!confirmForm.valid">
         Confirm Password Change
       </button>

package/src/component/login/confirm_chpass_component.ts

@@ -1,7 +1,7 @@
 import { ChangeDetectionStrategy, Component, computed, effect, inject, OnInit, ViewEncapsulation } from '@angular/core';
 import { FormBuilder, ReactiveFormsModule, Validators } from '@angular/forms';
 import { BaseAuthService } from '../../service/auth.service';
-import { ActivatedRoute, Router, RouterLink } from '@angular/router';
+import { ActivatedRoute, RouterLink } from '@angular/router';
 import { MatButtonModule } from '@angular/material/button';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
@@ -25,7 +25,6 @@ import { passwordPolicyValidator, passwordPolicyHint } from '../../util/password
 export class ConfirmChpassComponent extends BaseAsync implements OnInit {
   private auth = inject(BaseAuthService);
   private fb = inject(FormBuilder);
-  private router = inject(Router);
   private route = inject(ActivatedRoute);
   protected readonly guiConfig: SailGuiConfig = inject(SAIL_GUI_CONFIG, {optional: true}) ?? DEFAULT_CONFIG;
 
@@ -67,7 +66,7 @@ export class ConfirmChpassComponent extends BaseAsync implements OnInit {
 
     this.run(
       this.auth.confirmChpass(username!, code!, new_password!),
-      () => this.router.navigate(['/login/local']),
+      () => {},
       'Confirmation failed. Please try again.',
     );
   }

package/src/component/login/login_component.html

@@ -9,6 +9,9 @@
     @if (loggedOut) {
       <p class="auth-message" role="status" aria-live="polite">You have been logged out successfully.</p>
     }
+    @if (passwordChanged) {
+      <p class="auth-message" role="status" aria-live="polite">Your password was changed. Sign in again with the new password.</p>
+    }
     @if (sessionHandoffError()) {
       <p class="auth-error" role="alert">{{ sessionHandoffError() }}</p>
     }

package/src/component/login/login_component.ts

@@ -28,7 +28,9 @@ export class LoginComponent extends BaseAsync {
   private auth = inject(BaseAuthService);
   protected fb = inject(FormBuilder);
   protected readonly guiConfig: SailGuiConfig = inject(SAIL_GUI_CONFIG, {optional: true}) ?? DEFAULT_CONFIG;
-  protected readonly loggedOut = inject(ActivatedRoute).snapshot.queryParamMap.get('loggedOut') === 'true';
+  private readonly queryParams = inject(ActivatedRoute).snapshot.queryParamMap;
+  protected readonly loggedOut = this.queryParams.get('loggedOut') === 'true';
+  protected readonly passwordChanged = this.queryParams.get('passwordChanged') === 'true';
   /** OAuth session hand-off failure from BaseAuthService, shown below. */
   protected readonly sessionHandoffError = this.auth.sessionHandoffError;
 

package/src/service/auth.service.ts

@@ -89,6 +89,7 @@ export abstract class BaseAuthService extends BaseRestService {
   protected get logoutUrl()                { return this.url(RestURL.logoutURL); }
   protected get registerUrl()              { return this.url(RestURL.registerURL); }
   protected get chpassUrl()                { return this.url(RestURL.chpassURL); }
+  protected get forgotPasswordUrl()        { return this.url(RestURL.forgotPasswordURL); }
   protected get confirmRegisterUrl()       { return this.url(RestURL.confirmRegisterURL); }
   protected get registerExchangeUrl()      { return this.url(RestURL.registerExchangeURL); }
   protected get registerPartnerUrl()       { return this.url(RestURL.registerPartnerURL); }
@@ -416,11 +417,12 @@ export abstract class BaseAuthService extends BaseRestService {
   }
 
   chpass(username: string, new_password: string, old_password: string) {
-    return this.http.post<{ message: string }>(this.chpassUrl, { username, old_password, new_password });
+    return this.http.post<{ status: string }>(this.chpassUrl, { username, old_password, new_password })
+      .pipe(tap(() => this.passwordChanged()));
   }
 
   forgotPassword(username: string) {
-    return this.http.post<{ message: string }>(this.chpassUrl, { username });
+    return this.http.post<{ status: string }>(this.forgotPasswordUrl, { username });
   }
 
   // ── Self-service profile (keel ProfileHandler) ──
@@ -480,7 +482,8 @@ export abstract class BaseAuthService extends BaseRestService {
   }
 
   confirmChpass(username: string, code: string, new_password: string) {
-    return this.http.post<{ message: string }>(this.confirmChpassUrl, { username, code, new_password });
+    return this.http.post<{ status: string }>(this.confirmChpassUrl, { username, code, new_password })
+      .pipe(tap(() => this.passwordChanged()));
   }
 
   loadStoredSession() {
@@ -653,6 +656,11 @@ export abstract class BaseAuthService extends BaseRestService {
     this.router.navigate(['/login/local'], { queryParams: { sessionExpired: 'true' } });
   }
 
+  private passwordChanged(): void {
+    this.clearSession();
+    this.router.navigate(['/login/local'], { queryParams: { passwordChanged: 'true' } });
+  }
+
   private buildAuthIndex() {
     this.authIndex.clear();
     if (!this.cache?.Permissions) return;

package/src/service/rest_url.ts

@@ -8,12 +8,13 @@ export const RestURL = {
   realtimeURL: '/public/ws',                  // keel realtime.Hub handshake; JWT via ?token=
   loginGoogleURL: '/public/login/google',
   registerURL: '/public/register',
-  chpassURL: '/public/login/chpass',
+  chpassURL: '/public/password/change',       // keel revokes every refresh token on success
+  forgotPasswordURL: '/public/password/forgot',
   confirmRegisterURL: '/public/register/confirm',
   registerExchangeURL: '/public/register/exchange',
   registerPartnerURL: '/api/register/partner',
   plansURL: '/public/plans',
-  confirmChpassURL: '/public/confirm/password',
+  confirmChpassURL: '/public/password/reset',
   twoFactorSetupURL: '/api/user/2fa/setup',
   twoFactorVerifyURL: '/api/user/2fa/verify',          // authenticated — confirms setup
   twoFactorDisableURL: '/api/user/2fa/disable',