@nauticana/sail 1.1.3 → 1.1.5

package/README.md

@@ -4,6 +4,8 @@ A shared Angular component library for building CRUD-based admin frontends. Prov
 
 > **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.0.x ↔ keel v1.0.x**. Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
 
+**Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows.
+
 ## What it provides
 
 | Category | Exports |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "scripts": {

package/src/component/login/social_login.ts

@@ -9,6 +9,7 @@ import { SAIL_GUI_CONFIG, SailGuiConfig, DEFAULT_CONFIG } from '../../config';
 import {
   ConsentState, LoginResponseSocial, SignupConsent, SocialProvider,
 } from '../../model/auth';
+import { firstValueFrom } from 'rxjs';
 
 declare const google: any;
 declare const AppleID: any;
@@ -66,9 +67,11 @@ export class SocialLoginComponent extends BaseAsync implements OnInit {
 
   private async initGoogle() {
     await loadScript(GSI_URL);
+    const nonce = await firstValueFrom(this.auth.getSocialNonce());
     google.accounts.id.initialize({
       client_id: this.guiConfig.googleClientId,
       callback: (res: { credential: string }) => this.onIdToken('google', res.credential),
+      ...(nonce ? { nonce } : {}),
     });
     // Render into the template anchor once the view is ready.
     queueMicrotask(() => {
@@ -80,11 +83,13 @@ export class SocialLoginComponent extends BaseAsync implements OnInit {
 
   private async initApple() {
     await loadScript(APPLE_URL);
+    const nonce = await firstValueFrom(this.auth.getSocialNonce());
     AppleID.auth.init({
       clientId: this.guiConfig.appleServiceId,
       scope: 'name email',
       redirectURI: this.guiConfig.appleRedirectUri ?? window.location.origin,
       usePopup: true,
+      ...(nonce ? { nonce } : {}),
     });
   }
 

package/src/config.ts

@@ -66,7 +66,7 @@ export interface SailGuiConfig {
    * When set, login POSTs here before handing off to an allowed ?return= host. */
   sessionCookieUrl?: string;
   /** Hostnames a post-login `?return=` may redirect to (open-redirect allowlist),
-   * e.g. ['mcp.daxoom.com']. Anything not listed is ignored. */
+   * e.g. ['mcp.example.com']. Anything not listed is ignored. */
   allowedReturnHosts?: string[];
 }
 

package/src/service/auth.service.ts

@@ -11,7 +11,7 @@ import {
   UserProfile,
 } from '../model/auth';
 import { RestURL } from './rest_url';
-import { Observable, ReplaySubject } from 'rxjs';
+import { Observable, ReplaySubject, catchError, of } from 'rxjs';
 import { ApplicationMenu, ConstantValue } from '../model/common';
 import { CanActivateFn, CanDeactivateFn, Router, Routes } from '@angular/router';
 import { SAIL_GUI_CONFIG, SailGuiConfig, DEFAULT_CONFIG } from '../config';
@@ -106,6 +106,13 @@ export abstract class BaseAuthService extends BaseRestService {
     ).subscribe((data: ApplicationData) => this.appData$.next(data));
   }
 
+  /** Adopt an externally-minted JWT (registration/SSO handoff flows) and run the
+   * full post-login sequence — store under the canonical key, load appdata, init
+   * routes. Apps must use this instead of writing localStorage directly. */
+  acceptToken(token: string) {
+    this.completeLogin(token);
+  }
+
   private completeLogin(token: string) {
     this.token = token;
     this.isLoggedIn.set(true);
@@ -374,6 +381,16 @@ export abstract class BaseAuthService extends BaseRestService {
     );
   }
 
+  // Single-use nonce for the social id_token flow (replay protection): GET on
+  // the same social-login route. Empty when the backend hasn't enabled it —
+  // callers then sign in without one.
+  getSocialNonce(): Observable<string> {
+    return this.http.get<{ nonce: string }>(this.loginSocialUrl).pipe(
+      map((res) => res?.nonce ?? ''),
+      catchError(() => of('')),
+    );
+  }
+
   // ── Account lifecycle ──
 
   /**

package/src/service/base_rest.service.ts

@@ -1,5 +1,6 @@
-import { HttpClient } from '@angular/common/http';
+import { HttpClient, HttpParams } from '@angular/common/http';
 import { inject } from '@angular/core';
+import { Observable } from 'rxjs';
 import { RestURL } from './rest_url';
 
 /**
@@ -17,4 +18,14 @@ export abstract class BaseRestService {
   protected url(path: string): string {
     return RestURL.httpHost + path;
   }
+
+  /** GET an analytic endpoint (`{host}{api_prefix}analytic/<endpoint>`), returning
+   * its rows. Optional flat string params become the query string. */
+  protected analytic<T>(endpoint: string, params?: Record<string, string>): Observable<T[]> {
+    let p = new HttpParams();
+    for (const k in params) {
+      if (Object.prototype.hasOwnProperty.call(params, k)) p = p.set(k, params[k]);
+    }
+    return this.http.get<T[]>(this.url(RestURL.api_prefix + 'analytic/' + endpoint), { params: p });
+  }
 }