@nauticana/sail 1.1.33 → 1.1.34

package/src/model/auth.ts

@@ -115,11 +115,19 @@ export interface UserProfile {
 
 // ── Re-authentication credentials ──
 // Required by Setup2FA, Disable2FA, DeleteAccount, LogoutEverywhere — server
-// rejects with 401 if neither `password` nor `twoFactorCode` is supplied.
-// Disable2FA additionally requires the current TOTP `code` alongside password.
+// rejects with 401 unless one is supplied. `reauthCode` comes from
+// sendReauthCode(). Disable2FA additionally requires the current TOTP `code`.
 export interface ReauthCredentials {
   password?:      string;
   twoFactorCode?: string;
+  reauthCode?:    string;
+}
+
+export type ReauthChannel = 'email' | 'phone';
+
+export interface ReauthSendResponse {
+  channel:            ReauthChannel;
+  resendCountdownSec: number;
 }
 
 // ── Social login (ID token flow) ──
@@ -144,6 +152,13 @@ export interface LoginResponseSocial {
   isNewUser:               boolean;
   singleDeviceSession?:    boolean;
   previousDeviceRevoked?:  boolean;
+  // Client-side: the name Apple returns only on first authorization, never in the ID token.
+  socialName?:             SocialName;
+}
+
+export interface SocialName {
+  firstName?: string;
+  lastName?:  string;
 }
 
 // ── Push notification tokens ──

package/src/service/auth.service.ts

@@ -7,7 +7,7 @@ import {
   LoginResponseSocial,
   OtpRequest, OtpResendRequest, OtpResponse, OtpVerifyRequest, OtpVerifyResponse,
   PushPlatform, PushRegisterRequest,
-  ReauthCredentials,
+  ReauthChannel, ReauthCredentials, ReauthSendResponse,
   SignupConsent, SocialLoginRequest, SocialProvider,
   UserProfile,
 } from '../model/auth';
@@ -112,6 +112,7 @@ export abstract class BaseAuthService extends BaseRestService {
   protected get loginSocialUrl()           { return this.url(RestURL.loginSocialURL); }
   protected get logoutEverywhereUrl()      { return this.url(RestURL.logoutEverywhereURL); }
   protected get deleteAccountUrl()         { return this.url(RestURL.deleteAccountURL); }
+  protected get reauthSendUrl()            { return this.url(RestURL.reauthSendURL); }
   protected get pushRegisterUrl()          { return this.url(RestURL.pushRegisterURL); }
   protected get pushRevokeUrl()            { return this.url(RestURL.pushRevokeURL); }
   protected get profileUrl()               { return this.url(RestURL.profileURL); }
@@ -625,9 +626,14 @@ export abstract class BaseAuthService extends BaseRestService {
 
   // ── Account lifecycle ──
 
+  /** Send a one-time code for ReauthCredentials.reauthCode; no channel prefers email. */
+  sendReauthCode(channel?: ReauthChannel): Observable<ReauthSendResponse> {
+    return this.http.post<ReauthSendResponse>(this.reauthSendUrl, { channel });
+  }
+
   /**
    * Soft-delete the caller's account. Requires recent re-authentication —
-   * pass current `password` and/or `twoFactorCode`. Server anonymizes
+   * pass `password`, `twoFactorCode` or `reauthCode`. Server anonymizes
    * user_account, revokes all tokens / trusted devices / social links.
    * Clears local session on success.
    */
@@ -640,8 +646,8 @@ export abstract class BaseAuthService extends BaseRestService {
 
   /**
    * Revoke every active refresh token for this user (sign out everywhere).
-   * Requires recent re-authentication — pass current `password` and/or
-   * `twoFactorCode`.
+   * Requires recent re-authentication — pass `password`, `twoFactorCode`
+   * or `reauthCode`.
    */
   logoutEverywhere(reauth: ReauthCredentials): Observable<void> {
     return this.http.post<void>(this.logoutEverywhereUrl, reauth);

package/src/service/caption_pipe.ts

@@ -0,0 +1,26 @@
+import { DestroyRef, Pipe, PipeTransform, inject, signal } from '@angular/core';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+import { LabelService } from './label.service';
+
+/**
+ * `{{ code | sailCaption:'constant_id' }}` — the backend caption of a constant code, the code
+ * itself until its domain loads or when the domain lacks it. Impure so it re-renders on load.
+ */
+@Pipe({ name: 'sailCaption', pure: false })
+export class CaptionPipe implements PipeTransform {
+  private readonly labels = inject(LabelService);
+  private readonly destroyRef = inject(DestroyRef);
+  private readonly requested = new Set<string>();
+  private readonly loaded = signal(0);
+
+  transform(code: string | null | undefined, constantId: string): string {
+    if (!code) return '';
+    this.loaded();
+    if (!this.requested.has(constantId)) {
+      this.requested.add(constantId);
+      this.labels.loadLabels(constantId).pipe(takeUntilDestroyed(this.destroyRef))
+        .subscribe({ next: () => this.loaded.update((n) => n + 1), error: () => this.requested.delete(constantId) });
+    }
+    return this.labels.getLabel(constantId, code);
+  }
+}

package/src/service/label.service.ts

@@ -36,9 +36,10 @@ export class LabelService {
     }
 
     /**
-     * Load one backend-provided `constant_value` domain from ApplicationData.
-     * Completed and concurrent requests are cached; a failed application-data
-     * load is evicted so a later call can retry.
+     * Load one caption map from ApplicationData: a `constant_value` domain by its
+     * constant id, or a catalog table registered in `foreign_key_lookup` by its
+     * table name. Completed and concurrent requests are cached; a failed
+     * application-data load is evicted so a later call can retry.
      */
     loadLabels(constantId: string): Observable<void> {
         const domain = constantId.trim();
@@ -53,7 +54,7 @@ export class LabelService {
             tap({
                 next: (data) => this.labels.set(
                     domain,
-                    new Map(Object.entries(data.ConstantCache?.[domain] ?? {})),
+                    new Map(Object.entries(data.ConstantCache?.[domain] ?? data.TableCache?.[domain] ?? {})),
                 ),
                 error: () => this.pendingLoads.delete(domain),
             }),

package/src/service/rest_url.ts

@@ -45,6 +45,7 @@ export const RestURL = {
   ssoSamlMetadataURL:  '/public/sso/saml/metadata',
   logoutEverywhereURL: '/api/user/logout-everywhere',
   deleteAccountURL:    '/api/user/account',
+  reauthSendURL:       '/api/user/reauth/send',
   // Self-service profile (keel ProfileHandler). GET profileURL reads the
   // current profile; POST updates name/locale. Email/phone are verify-before-
   // apply (request → confirm). A consumer whose backend mounts these under a