@newheap/platform-common 1.3.1 → 1.4.0

package/index.d.ts

@@ -29,6 +29,32 @@ declare class EndpointsAuthenticationNhCommonModuleConfig {
     impersonate: string;
     revertImpersonate: string;
     accountInformation: string;
+    twoFactorVerify: string;
+    twoFactorStatus: string;
+    twoFactorAuthenticator: string;
+    twoFactorAuthenticatorConfirm: string;
+    twoFactorRecoveryCodes: string;
+    twoFactorDisable: string;
+    twoFactorForgetDevices: string;
+    twoFactorEmailSetup: string;
+    twoFactorEmailConfirm: string;
+    twoFactorEmail: string;
+    twoFactorPasskeyOptions: string;
+    twoFactorPasskey: string;
+    twoFactorEnrollmentAuthenticator: string;
+    twoFactorEnrollmentAuthenticatorConfirm: string;
+    twoFactorEnrollmentEmail: string;
+    twoFactorEnrollmentEmailConfirm: string;
+    twoFactorEnrollmentPasskeyOptions: string;
+    twoFactorEnrollmentPasskey: string;
+    /** Administration route; `{userId}` is replaced with the user ID. */
+    twoFactorUserReset: string;
+    twoFactorEnrollmentReminders: string;
+    twoFactorSessionRevocation: string;
+    passkeySignInOptions: string;
+    passkeySignIn: string;
+    passkeys: string;
+    passkeyRegistrationOptions: string;
     constructor(init?: Partial<EndpointsAuthenticationNhCommonModuleConfig>);
 }
 declare class AuthenticationNhCommonModuleConfig {
@@ -475,6 +501,8 @@ declare class AuthenticateModel {
     realm: string;
     username: string;
     password: string | undefined;
+    /** Remember-device token for header authentication; cookie clients send it as a cookie. */
+    rememberDeviceToken?: string;
     constructor(init?: Partial<AuthenticateModel>);
 }
 declare class ImpersonateAuthenticateModel {
@@ -485,6 +513,178 @@ declare class RevertImpersonateAuthenticateModel {
     constructor(init?: Partial<RevertImpersonateAuthenticateModel>);
 }
 type AuthenticationFlow = 'password' | 'microsoft-oauth' | string;
+/**
+ * Second-factor methods a user can present after the first factor succeeded.
+ */
+declare const NhTwoFactorMethods: {
+    readonly authenticator: "authenticator";
+    readonly recoveryCode: "recovery-code";
+    readonly email: "email";
+    readonly passkey: "passkey";
+};
+type NhTwoFactorMethod = typeof NhTwoFactorMethods[keyof typeof NhTwoFactorMethods] | string;
+/**
+ * Safe failure codes returned by the two-factor endpoints. Each error item uses the code as
+ * its name and `nh-two-factor.<suffix>` as its translation key.
+ */
+declare enum NhTwoFactorFailureCodes {
+    Required = "two-factor-required",
+    EnrollmentRequired = "two-factor-enrollment-required",
+    InvalidCode = "two-factor-invalid-code",
+    ChallengeExpired = "two-factor-challenge-expired",
+    LockedOut = "two-factor-locked-out",
+    MethodNotAllowed = "two-factor-method-not-allowed",
+    NotEnabled = "two-factor-not-enabled",
+    AlreadyEnabled = "two-factor-already-enabled",
+    SetupNotStarted = "two-factor-setup-not-started",
+    ReauthenticationRequired = "two-factor-reauthentication-required",
+    ReauthenticationFailed = "two-factor-reauthentication-failed",
+    RequiredByPolicy = "two-factor-required-by-policy",
+    NotAllowedWhileImpersonating = "two-factor-not-allowed-while-impersonating",
+    ConfigurationInvalid = "two-factor-configuration-invalid",
+    EmailCooldown = "two-factor-email-cooldown",
+    EmailUnavailable = "two-factor-email-unavailable",
+    UserNotFound = "two-factor-user-not-found",
+    PasskeyInvalid = "two-factor-passkey-invalid",
+    PasskeyNotFound = "two-factor-passkey-not-found",
+    /** The browser does not support passkeys or the user cancelled the passkey prompt. */
+    PasskeyUnavailable = "two-factor-passkey-unavailable"
+}
+/**
+ * Status values of a pending authentication step.
+ */
+declare const NhAuthenticationStepStatuses: {
+    readonly twoFactorRequired: "two-factor-required";
+    readonly enrollmentRequired: "enrollment-required";
+};
+/**
+ * A pending sign-in step. With status `two-factor-required` the user presents a second
+ * factor; with `enrollment-required` the policy requires the user to enroll one first, and
+ * `challengeToken` is the enrollment token.
+ */
+declare class NhTwoFactorChallenge {
+    status: string;
+    challengeToken: string;
+    expiresAt: string;
+    methods: NhTwoFactorMethod[];
+    /** Whether completing the challenge can remember this device for later sign-ins. */
+    rememberDeviceAvailable: boolean;
+    constructor(init?: Partial<NhTwoFactorChallenge>);
+}
+/**
+ * Login response when two-factor authentication is enabled on the server. A complete
+ * session has the token fields; a pending sign-in only has `twoFactor`.
+ */
+interface NhLoginResponse {
+    token?: string | null;
+    validTo?: string | null;
+    refreshToken?: string | null;
+    refreshValidTo?: string | null;
+    issuer?: string | null;
+    twoFactor?: NhTwoFactorChallenge | null;
+    /** Remember-device token for header authentication, returned when the user chose to remember the device. */
+    rememberDeviceToken?: string | null;
+}
+type NhAuthenticationStepStatus = 'authenticated' | 'two-factor-required' | 'enrollment-required';
+/**
+ * Outcome of an interactive sign-in step: the stored authorization, a second-factor
+ * challenge or a required enrollment.
+ */
+declare class NhAuthenticationStep<TAuthorization extends INhAuthorization = INhAuthorization> {
+    status: NhAuthenticationStepStatus;
+    authorization?: TAuthorization;
+    challenge?: NhTwoFactorChallenge;
+    constructor(init?: Partial<NhAuthenticationStep<TAuthorization>>);
+}
+declare class NhTwoFactorVerifyModel {
+    challengeToken: string;
+    method: NhTwoFactorMethod;
+    code: string;
+    /** Skip the second factor on this device for later sign-ins, when the server allows it. */
+    rememberDevice?: boolean;
+    constructor(init?: Partial<NhTwoFactorVerifyModel>);
+}
+/**
+ * Proof that the signed-in user is present before a sensitive change: the current password
+ * or a valid second-factor code.
+ */
+declare class NhTwoFactorReauthentication {
+    password?: string;
+    method?: NhTwoFactorMethod;
+    code?: string;
+    constructor(init?: Partial<NhTwoFactorReauthentication>);
+}
+declare class NhTwoFactorStatus {
+    enabled: boolean;
+    required: boolean;
+    methods: NhTwoFactorMethod[];
+    availableMethods: NhTwoFactorMethod[];
+    recoveryCodesLeft: number;
+    authenticatorSetupPending: boolean;
+    emailSetupPending: boolean;
+    rememberDeviceAvailable: boolean;
+    passkeyCount: number;
+    constructor(init?: Partial<NhTwoFactorStatus>);
+}
+/**
+ * Pending authenticator enrollment. `qrCodeDataUri` is a PNG data URI rendered by the server.
+ */
+declare class NhAuthenticatorSetup {
+    sharedKey: string;
+    authenticatorUri: string;
+    qrCodeDataUri?: string;
+    constructor(init?: Partial<NhAuthenticatorSetup>);
+}
+/**
+ * Result of a two-factor change. Recovery codes are returned once. When the change ended
+ * every session, the service has already stored the renewed session for this device.
+ */
+declare class NhTwoFactorChange {
+    recoveryCodes?: string[];
+    sessionRenewed: boolean;
+    constructor(init?: Partial<NhTwoFactorChange>);
+}
+/**
+ * Confirmation that the server e-mailed a code.
+ */
+declare class NhTwoFactorEmailCodeSent {
+    expiresAt: string;
+    /** When another code can be requested. */
+    resendAvailableAt: string;
+    constructor(init?: Partial<NhTwoFactorEmailCodeSent>);
+}
+/**
+ * Result of an enrollment that the policy required during sign-in. The session is already
+ * stored; the recovery codes are returned once.
+ */
+declare class NhTwoFactorEnrollmentResult<TAuthorization extends INhAuthorization = INhAuthorization> {
+    authorization?: TAuthorization;
+    recoveryCodes?: string[];
+    constructor(init?: Partial<NhTwoFactorEnrollmentResult<TAuthorization>>);
+}
+/**
+ * WebAuthn options from the server for one passkey ceremony. `options` is the JSON form of
+ * the creation or request options; `ceremonyToken` goes back with the credential.
+ */
+declare class NhPasskeyOptions {
+    options: any;
+    ceremonyToken: string;
+    expiresAt: string;
+    constructor(init?: Partial<NhPasskeyOptions>);
+}
+/**
+ * A registered passkey. The public key is never returned.
+ */
+declare class NhPasskey {
+    /** Credential ID, base64url encoded. */
+    id: string;
+    name: string;
+    createdAt: string;
+    /** Whether a passkey provider, such as a password manager, syncs the passkey. */
+    isBackedUp: boolean;
+    transports: string[];
+    constructor(init?: Partial<NhPasskey>);
+}
 
 declare class NhUserNotificationCollectionHttpRequestOptions extends CollectionHttpRequestOptions {
     constructor(init?: Partial<NhUserNotificationCollectionHttpRequestOptions>);
@@ -1072,20 +1272,57 @@ declare class NhCookieService {
     static ɵprov: i0.ɵɵInjectableDeclaration<NhCookieService>;
 }
 
+/**
+ * Runs WebAuthn ceremonies in the browser. The server returns the options in their JSON form
+ * and expects the credential in its JSON form; this client converts both, with a fallback for
+ * browsers without `PublicKeyCredential.parseCreationOptionsFromJSON` and `toJSON()`.
+ */
+declare class NhPasskeyClient {
+    private readonly platformId;
+    /**
+     * Whether the browser supports passkeys. Always false during server-side rendering.
+     */
+    isSupported(): boolean;
+    /**
+     * Creates a passkey for WebAuthn creation options and returns the credential JSON.
+     * Rejects when the user cancels the prompt or the browser refuses the request.
+     */
+    create(options: any): Promise<object>;
+    /**
+     * Signs WebAuthn request options with a passkey and returns the credential JSON.
+     * Rejects when the user cancels the prompt or the browser refuses the request.
+     */
+    get(options: any): Promise<object>;
+    private ensureSupported;
+    private requireCredential;
+    private creationOptionsFromJSON;
+    private requestOptionsFromJSON;
+    private credentialToJSON;
+    private static fromBase64Url;
+    private static toBase64Url;
+    static ɵfac: i0.ɵɵFactoryDeclaration<NhPasskeyClient, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<NhPasskeyClient>;
+}
+
 declare abstract class BaseNhAuthService<TAuthorization extends INhAuthorization> implements OnDestroy {
+    protected static readonly pendingTwoFactorChallengeStorageKey = "nh-two-factor-challenge";
+    protected static readonly externalTwoFactorChallengePrefix = "nh-two-factor=";
+    protected static readonly rememberDeviceStorageKey = "nh-two-factor-device";
     protected authorization: TAuthorization | undefined;
+    protected pendingTwoFactorChallenge: NhTwoFactorChallenge | undefined;
     protected authSession: AuthenticationSessionCreateResponse | undefined;
     readonly authSubject: BehaviorSubject<TAuthorization | undefined>;
     protected onReady: ((value: (PromiseLike<unknown> | unknown)) => void) | undefined;
     readonly authReady: Promise<unknown>;
     protected _sessionExpirationInformation: BehaviorSubject<AuthSessionExpirationInformation>;
-    sessionExpirationInformationChanged: rxjs.Observable<AuthSessionExpirationInformation>;
+    sessionExpirationInformationChanged: Observable<AuthSessionExpirationInformation>;
     protected intervalHandle: any;
     protected zone: NgZone;
     protected moduleConfig: NhCommonModuleConfig;
     protected httpClient: HttpClient;
     protected platformId: Object;
     protected requestContext: any;
+    protected passkeyClient: NhPasskeyClient;
     constructor();
     dispatchSessionExpirationInformationChanged(): void;
     ngOnDestroy(): void;
@@ -1117,7 +1354,168 @@ declare abstract class BaseNhAuthService<TAuthorization extends INhAuthorization
     getAuthenticationFlow(username: string): Promise<TaskResult<AuthenticationFlow>>;
     getMicrosoftRedirectUrl(callbackUrl: string, username: string): Promise<TaskResult<string>>;
     authorizeMicrosoft(code: string, state: string): Promise<TaskResult<TAuthorization>>;
+    /**
+     * Signs in with username and password and stores the complete session.
+     *
+     * When the server requires a second factor this method fails with
+     * `NhTwoFactorFailureCodes.Required` and stores nothing. Use `authenticateInteractive`
+     * to receive the challenge, or read it with `getPendingTwoFactorChallenge()`.
+     */
     authenticate(model: AuthenticateModel, loginAsUser?: boolean): Promise<TaskResult<TAuthorization>>;
+    /**
+     * Signs in with username and password. Returns the stored authorization, the
+     * second-factor challenge or the required enrollment. A pending step is never stored as
+     * an authorization.
+     */
+    authenticateInteractive(model: AuthenticateModel): Promise<TaskResult<NhAuthenticationStep<TAuthorization>>>;
+    /**
+     * Completes a second-factor challenge and stores the session.
+     */
+    verifyTwoFactor(model: NhTwoFactorVerifyModel): Promise<TaskResult<TAuthorization>>;
+    /**
+     * E-mails a sign-in code for the pending challenge when the user enrolled the e-mail factor.
+     */
+    sendTwoFactorEmailCode(challengeToken: string): Promise<TaskResult<NhTwoFactorEmailCodeSent>>;
+    /**
+     * Whether this browser can use passkeys.
+     */
+    isPasskeySupported(): boolean;
+    /**
+     * Completes the pending challenge with a passkey and stores the session.
+     */
+    verifyTwoFactorWithPasskey(challengeToken: string, rememberDevice?: boolean): Promise<TaskResult<TAuthorization>>;
+    /**
+     * Signs in with a discoverable passkey, without a username or password. Returns the
+     * stored authorization, or a pending step when the server's policy asks for more.
+     */
+    signInWithPasskey(): Promise<TaskResult<NhAuthenticationStep<TAuthorization>>>;
+    /**
+     * Starts authenticator enrollment for a user whom the policy requires to enroll during
+     * sign-in. `enrollmentToken` is the `challengeToken` of the enrollment step.
+     */
+    beginEnrollmentAuthenticatorSetup(enrollmentToken: string): Promise<TaskResult<NhAuthenticatorSetup>>;
+    /**
+     * Confirms the authenticator during a required enrollment and stores the session.
+     */
+    confirmEnrollmentAuthenticator(enrollmentToken: string, code: string): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    /**
+     * E-mails a confirmation code during a required enrollment.
+     */
+    sendEnrollmentEmailCode(enrollmentToken: string): Promise<TaskResult<NhTwoFactorEmailCodeSent>>;
+    /**
+     * Confirms the e-mail factor during a required enrollment and stores the session.
+     */
+    confirmEnrollmentEmail(enrollmentToken: string, code: string): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    /**
+     * Registers a passkey during a required enrollment and stores the session.
+     */
+    enrollPasskey(enrollmentToken: string, name?: string): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    /**
+     * Returns the pending second-factor challenge of this browser tab, if it has not expired.
+     */
+    getPendingTwoFactorChallenge(): NhTwoFactorChallenge | undefined;
+    clearPendingTwoFactorChallenge(): void;
+    /**
+     * Reads a challenge that an external sign-in (Microsoft OAuth) passed back in the URL
+     * fragment, stores it as the pending challenge and removes it from the address bar.
+     */
+    consumeExternalTwoFactorChallenge(fragment?: string): NhTwoFactorChallenge | undefined;
+    getTwoFactorStatus(): Promise<TaskResult<NhTwoFactorStatus>>;
+    /**
+     * Starts authenticator enrollment. Restarting enrollment while two-factor authentication
+     * is enabled requires reauthentication.
+     */
+    beginAuthenticatorSetup(reauthentication?: NhTwoFactorReauthentication): Promise<TaskResult<NhAuthenticatorSetup>>;
+    /**
+     * Confirms authenticator enrollment. The server ends every other session; the renewed
+     * session for this device is stored before the promise resolves.
+     */
+    confirmAuthenticator(code: string): Promise<TaskResult<NhTwoFactorChange>>;
+    regenerateRecoveryCodes(reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    disableTwoFactor(reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * E-mails a code that confirms the user's e-mail address as a second factor. Requires
+     * reauthentication while two-factor authentication is enabled.
+     */
+    beginEmailSetup(reauthentication?: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorEmailCodeSent>>;
+    confirmEmailSetup(code: string): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * Forgets every remembered device, including this one, and ends every other session.
+     */
+    forgetTwoFactorDevices(reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    getPasskeys(): Promise<TaskResult<NhPasskey[]>>;
+    /**
+     * Registers a passkey on this device. Adding a passkey while two-factor authentication is
+     * enabled requires reauthentication. The server ends every other session; the renewed
+     * session for this device is stored before the promise resolves.
+     */
+    registerPasskey(name?: string, reauthentication?: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    renamePasskey(passkeyId: string, name: string): Promise<TaskResult<void>>;
+    /**
+     * Removes a passkey. Removing the last second factor disables two-factor authentication,
+     * which fails when the policy requires it.
+     */
+    removePasskey(passkeyId: string, reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * Removes every second factor of another user who lost access to them. Requires the
+     * server's two-factor administration policy.
+     */
+    resetUserTwoFactor(userId: string): Promise<TaskResult<void>>;
+    /**
+     * Starts a background operation that reminds every user whom the policy requires to
+     * enroll. A repeated idempotency key returns the operation that was already started.
+     */
+    startTwoFactorEnrollmentReminders(idempotencyKey: string): Promise<TaskResult<NhBackgroundOperation>>;
+    /**
+     * Starts a background operation that ends the sessions of every user whom the policy
+     * requires to enroll, so their next sign-in enrolls them.
+     */
+    startTwoFactorSessionRevocation(idempotencyKey: string): Promise<TaskResult<NhBackgroundOperation>>;
+    protected sendTwoFactorChange(endpoint: string, body: object): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * Stores the session that the server issued for this device after a change that ended
+     * every session. The user, claims and divisions of the current authorization are kept.
+     */
+    protected applyRenewedSession(session: NhLoginResponse | null | undefined): boolean;
+    protected toAuthorization(response: NhLoginResponse): TAuthorization;
+    /**
+     * Stores a complete session, or keeps a second-factor challenge or enrollment as the
+     * pending step of this browser tab.
+     */
+    protected completeAuthenticationStep(response: NhLoginResponse): NhAuthenticationStep<TAuthorization>;
+    /**
+     * Converts a failed challenge or enrollment request and forgets the pending step when the
+     * server ended it.
+     */
+    protected pendingStepFailed(ex: unknown): TaskResult<unknown>;
+    protected sendEnrollmentCompletion(endpoint: string, body: object): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    protected sendTwoFactorRequest<TResponse, TResult>(request$: Observable<TResponse>, map: (response: TResponse) => TResult): Promise<TaskResult<TResult>>;
+    /**
+     * Runs a WebAuthn prompt. A cancelled prompt or an unsupported browser becomes a failed
+     * result with `NhTwoFactorFailureCodes.PasskeyUnavailable`.
+     */
+    protected runPasskeyCeremony(ceremony: () => Promise<object>): Promise<TaskResult<object>>;
+    /**
+     * Returns the remember-device token of header clients. Cookie clients receive it as an
+     * HttpOnly cookie, so nothing is stored in the browser.
+     */
+    protected getRememberDeviceToken(): string | undefined;
+    protected storeRememberDeviceToken(token: string | undefined): void;
+    protected rememberDeviceStorageKey(): string;
+    protected setPendingTwoFactorChallenge(challenge: NhTwoFactorChallenge): void;
+    protected readStoredTwoFactorChallenge(): NhTwoFactorChallenge | undefined;
+    protected twoFactorEndpoints(): EndpointsAuthenticationNhCommonModuleConfig;
+    protected twoFactorUrl(endpoint: string): string;
+    protected twoFactorStepRequestOptions(): {
+        params: HttpParams;
+        withCredentials: boolean;
+    };
+    protected twoFactorAccountRequestOptions(): {
+        params: HttpParams;
+        headers: HttpHeaders;
+        withCredentials: boolean;
+    };
+    protected languageParams(): HttpParams;
     reloadAuthorizationProfile(): Promise<TaskResult<TAuthorization>>;
     logout(): Promise<TaskResult<void>>;
     authenticateRefreshToken(model: RefreshTokenLoginAccountMutateModel): Promise<TaskResult<TAuthorization>>;
@@ -2635,5 +3033,5 @@ declare class NhTranslateBrowserLoader implements TranslateLoader {
 }
 declare function nhTranslateBrowserLoaderFactory(httpClient: HttpClient, transferState: TransferState): NhTranslateBrowserLoader;
 
-export { AbstractValueAccessor, AspMvcFormServerSideFormValidator, AuthSessionExpirationInformation, AuthenticateModel, AuthenticationNhCommonModuleConfig, AuthenticationSessionCreateResponse, BackgroundOperationsNhCommonModuleConfig, BaseNhAuthService, CheckAuthenticateSessionModel, Claim, ClaimAuthenticateSessionAccountMutateModel, ClaimAuthenticateSessionAccountViewModel, ClaimTypes, CollectionHttpRequestOptions, CollectionHttpResponse, DefaultMultiSelectSettings, DefaultMultiSelectTexts, EndpointsAuthenticationNhCommonModuleConfig, FilterRequestOptions, FormError, FormValidationResult, HttpDownloadRequestOptions, HttpRequestOptions, HttpRequestOptionsArrayBuffer, HttpRequestOptionsText, ImpersonateAuthenticateModel, IsAllPermissionsGrantedPipe, IsAuthenticatedPipe, IsClaimGrantedPipe, IsDefined, IsGrantedRolePipe, IsOneActiveDivisionPermissionGrantedGuard, IsOneActiveDivisionPermissionGrantedPipe, IsOneActiveDivisionRoleGrantedGuard, IsOneActiveDivisionRoleGrantedPipe, IsOneClaimGrantedPipe, IsOneDivisionPermissionGrantedPipe, IsOneDivisionRoleGrantedPipe, IsOnePermissionGrantedPipe, IsOneRoleGrantedPipe, JsonLdDataChanged, ListSortDirection, MakeProvider, MutationType, NH_ERROR_HANDLERS, NH_ROUTER_LANGUAGE_CHANGE_METHOD, NH_ROUTER_ROOT_ROUTES, NhAccountInformationResponse, NhAngularUtil, NhApiService, NhApiUtil, NhAppService, NhAsyncLock, NhAuthService, NhAuthorization, NhBackgroundOperationAdministrationCollectionHttpRequestOptions, NhBackgroundOperationAdministrationService, NhBackgroundOperationCollectionHttpRequestOptions, NhBackgroundOperationLiveUpdateService, NhBackgroundOperationProgressComponent, NhBackgroundOperationService, NhBackgroundOperationStore, NhBaseApiService, NhBooleanToStringPipe, NhBreadCrumb, NhBreadCrumbItem, NhButtonDebounceDirective, NhCanCancelNavigationGuard, NhCollectionBaseComponent, NhCollectionTypeBaseComponent, NhCommonConfig, NhCommonConfigChanged, NhCommonModule, NhCommonModuleConfig, NhConfigCommonService, NhContextMenu, NhContextMenuItem, NhContextMenuService, NhContextMenuServiceConfig, NhCookieService, NhDatePipe, NhDateTimePipe, NhDateUtcPipe, NhDebounceDirective, NhDeduplicateGetRequestsInterceptor, NhDivision, NhDivisionRole, NhDivisionUser, NhEncodeHttpParamsInterceptor, NhEncodingUtil, NhErrorComponent, NhErrorHandlerService, NhFormDropDownComponent, NhFormDropDownNhCommonModuleConfig, NhFormDropDownSettings, NhFormErrorMessageComponent, NhFormHelper, NhHeadService, NhHttpNhCommonModuleConfig, NhHttpUtil, NhInternetConnectionService, NhIsAllPermissionsGrantedGuard, NhIsAuthenticatedGuard, NhIsOneClaimGrantedGuard, NhIsOnePermissionGrantedGuard, NhIsOneRoleGrantedGuard, NhJsonLdComponent, NhJsonLdData, NhJsonLdDataItem, NhJsonLdService, NhLoaderComponent, NhMetaService, NhModalComponent, NhModalComponentClosed, NhModalComponentImpl, NhModalComponentRef, NhModalConfirmComponent, NhModalContentDirective, NhModalLoadingComponent, NhModalMutateBaseComponent, NhModalMutateBaseTypeComponent, NhModalOptions, NhModalService, NhMutateBaseComponent, NhMutateBaseTypeComponent, NhMutex, NhPageBaseComponent, NhPageService, NhPageSettings, NhPageSizeComponent, NhPageTypeBaseComponent, NhRegisterRoute, NhRequestScopedServerHttpInterceptorService, NhRoute, NhRouteInfo, NhRouteNavigationItem, NhRouterLinkDirective, NhRouterService, NhRouterSetupService, NhSearchInputComponent, NhServerHttpInterceptor, NhServerService, NhServerSideFormValidationService, NhSitemap, NhSitemapEntry, NhSitemapEntryItem, NhStringUtil, NhTaskResultFormValidationService, NhTitleService, NhToHeadDirective, NhTranslateBrowserLoader, NhTranslationNhCommonModuleConfig, NhTypedPageBaseComponent, NhTypedPageTypeBaseComponent, NhUrlEncodePipe, NhUser, NhUserNotification, NhUserNotificationCollectionHttpRequestOptions, NhUserNotificationData, NhUserNotificationMessage, NhUserNotificationOverview, NhUserNotificationService, NhUserNotificationState, NhUserNotificationsAbstractComponent, OrderByRequestOptions, PreConnectUrlItem, PreLoadUrlItem, REVIEW_AGGREGATE_RATING_KEY, REVIEW_KEY, RefreshTokenLoginAccountMutateModel, RevertImpersonateAuthenticateModel, SafeHtmlPipe, SafeResourceUrlPipe, SafeUrlPipe, SearchableCollectionHttpRequestOptions, SimpleCollectionHttpRequestOptions, SimpleCollectionHttpResponse, TaskResult, TaskResultItem, TypedNhPageSettings, UserNotificationNhCommonModuleConfig, enumIntValuesToArray, enumKeysToArray, enumStringValuesToArray, enumValuesToArray, getEmptyGuid, getRandomIdentifier, groupBy, languageToCultureMap, nameof, nhBackgroundOperationStatusName, nhBackgroundOperationStepStatusName, nhBackgroundOperationTranslationSegment, nhTranslateBrowserLoaderFactory, nhUserNotificationSeverityName, uppercaseFirst };
-export type { AuthenticationFlow, ErrorResult, ICancelNavigationComponent, IClaimAuthenticateSessionAccountViewModel, ICollectionHttpRequestOptions, ICollectionHttpResponse, IFormError, IFormValidationResult, IHttpDownloadRequestOptions, IHttpRequestOptions, INhAccountInformationResponse, INhAuthorization, INhDivision, INhDivisionRole, INhDivisionUser, INhModalComponent, INhUser, ISearchableCollectionHttpRequestOptions, IServerSideFormValidationService, IServerSideFormValidator, ISimpleCollectionHttpRequestOptions, ISimpleCollectionHttpResponse, NhBackgroundOperation, NhBackgroundOperationAdministration, NhBackgroundOperationAggregationMode, NhBackgroundOperationAttempt, NhBackgroundOperationAttemptStatus, NhBackgroundOperationChanged, NhBackgroundOperationChild, NhBackgroundOperationConnectionState, NhBackgroundOperationEvent, NhBackgroundOperationEventType, NhBackgroundOperationMessageSeverity, NhBackgroundOperationStatus, NhBackgroundOperationStep, NhBackgroundOperationStepStatus, NhContextEventWithCoordinates, NhEnumDropDownItem, NhRouterLink, NhUserNotificationSeverity, SuccessResult, TypedResult };
+export { AbstractValueAccessor, AspMvcFormServerSideFormValidator, AuthSessionExpirationInformation, AuthenticateModel, AuthenticationNhCommonModuleConfig, AuthenticationSessionCreateResponse, BackgroundOperationsNhCommonModuleConfig, BaseNhAuthService, CheckAuthenticateSessionModel, Claim, ClaimAuthenticateSessionAccountMutateModel, ClaimAuthenticateSessionAccountViewModel, ClaimTypes, CollectionHttpRequestOptions, CollectionHttpResponse, DefaultMultiSelectSettings, DefaultMultiSelectTexts, EndpointsAuthenticationNhCommonModuleConfig, FilterRequestOptions, FormError, FormValidationResult, HttpDownloadRequestOptions, HttpRequestOptions, HttpRequestOptionsArrayBuffer, HttpRequestOptionsText, ImpersonateAuthenticateModel, IsAllPermissionsGrantedPipe, IsAuthenticatedPipe, IsClaimGrantedPipe, IsDefined, IsGrantedRolePipe, IsOneActiveDivisionPermissionGrantedGuard, IsOneActiveDivisionPermissionGrantedPipe, IsOneActiveDivisionRoleGrantedGuard, IsOneActiveDivisionRoleGrantedPipe, IsOneClaimGrantedPipe, IsOneDivisionPermissionGrantedPipe, IsOneDivisionRoleGrantedPipe, IsOnePermissionGrantedPipe, IsOneRoleGrantedPipe, JsonLdDataChanged, ListSortDirection, MakeProvider, MutationType, NH_ERROR_HANDLERS, NH_ROUTER_LANGUAGE_CHANGE_METHOD, NH_ROUTER_ROOT_ROUTES, NhAccountInformationResponse, NhAngularUtil, NhApiService, NhApiUtil, NhAppService, NhAsyncLock, NhAuthService, NhAuthenticationStep, NhAuthenticationStepStatuses, NhAuthenticatorSetup, NhAuthorization, NhBackgroundOperationAdministrationCollectionHttpRequestOptions, NhBackgroundOperationAdministrationService, NhBackgroundOperationCollectionHttpRequestOptions, NhBackgroundOperationLiveUpdateService, NhBackgroundOperationProgressComponent, NhBackgroundOperationService, NhBackgroundOperationStore, NhBaseApiService, NhBooleanToStringPipe, NhBreadCrumb, NhBreadCrumbItem, NhButtonDebounceDirective, NhCanCancelNavigationGuard, NhCollectionBaseComponent, NhCollectionTypeBaseComponent, NhCommonConfig, NhCommonConfigChanged, NhCommonModule, NhCommonModuleConfig, NhConfigCommonService, NhContextMenu, NhContextMenuItem, NhContextMenuService, NhContextMenuServiceConfig, NhCookieService, NhDatePipe, NhDateTimePipe, NhDateUtcPipe, NhDebounceDirective, NhDeduplicateGetRequestsInterceptor, NhDivision, NhDivisionRole, NhDivisionUser, NhEncodeHttpParamsInterceptor, NhEncodingUtil, NhErrorComponent, NhErrorHandlerService, NhFormDropDownComponent, NhFormDropDownNhCommonModuleConfig, NhFormDropDownSettings, NhFormErrorMessageComponent, NhFormHelper, NhHeadService, NhHttpNhCommonModuleConfig, NhHttpUtil, NhInternetConnectionService, NhIsAllPermissionsGrantedGuard, NhIsAuthenticatedGuard, NhIsOneClaimGrantedGuard, NhIsOnePermissionGrantedGuard, NhIsOneRoleGrantedGuard, NhJsonLdComponent, NhJsonLdData, NhJsonLdDataItem, NhJsonLdService, NhLoaderComponent, NhMetaService, NhModalComponent, NhModalComponentClosed, NhModalComponentImpl, NhModalComponentRef, NhModalConfirmComponent, NhModalContentDirective, NhModalLoadingComponent, NhModalMutateBaseComponent, NhModalMutateBaseTypeComponent, NhModalOptions, NhModalService, NhMutateBaseComponent, NhMutateBaseTypeComponent, NhMutex, NhPageBaseComponent, NhPageService, NhPageSettings, NhPageSizeComponent, NhPageTypeBaseComponent, NhPasskey, NhPasskeyClient, NhPasskeyOptions, NhRegisterRoute, NhRequestScopedServerHttpInterceptorService, NhRoute, NhRouteInfo, NhRouteNavigationItem, NhRouterLinkDirective, NhRouterService, NhRouterSetupService, NhSearchInputComponent, NhServerHttpInterceptor, NhServerService, NhServerSideFormValidationService, NhSitemap, NhSitemapEntry, NhSitemapEntryItem, NhStringUtil, NhTaskResultFormValidationService, NhTitleService, NhToHeadDirective, NhTranslateBrowserLoader, NhTranslationNhCommonModuleConfig, NhTwoFactorChallenge, NhTwoFactorChange, NhTwoFactorEmailCodeSent, NhTwoFactorEnrollmentResult, NhTwoFactorFailureCodes, NhTwoFactorMethods, NhTwoFactorReauthentication, NhTwoFactorStatus, NhTwoFactorVerifyModel, NhTypedPageBaseComponent, NhTypedPageTypeBaseComponent, NhUrlEncodePipe, NhUser, NhUserNotification, NhUserNotificationCollectionHttpRequestOptions, NhUserNotificationData, NhUserNotificationMessage, NhUserNotificationOverview, NhUserNotificationService, NhUserNotificationState, NhUserNotificationsAbstractComponent, OrderByRequestOptions, PreConnectUrlItem, PreLoadUrlItem, REVIEW_AGGREGATE_RATING_KEY, REVIEW_KEY, RefreshTokenLoginAccountMutateModel, RevertImpersonateAuthenticateModel, SafeHtmlPipe, SafeResourceUrlPipe, SafeUrlPipe, SearchableCollectionHttpRequestOptions, SimpleCollectionHttpRequestOptions, SimpleCollectionHttpResponse, TaskResult, TaskResultItem, TypedNhPageSettings, UserNotificationNhCommonModuleConfig, enumIntValuesToArray, enumKeysToArray, enumStringValuesToArray, enumValuesToArray, getEmptyGuid, getRandomIdentifier, groupBy, languageToCultureMap, nameof, nhBackgroundOperationStatusName, nhBackgroundOperationStepStatusName, nhBackgroundOperationTranslationSegment, nhTranslateBrowserLoaderFactory, nhUserNotificationSeverityName, uppercaseFirst };
+export type { AuthenticationFlow, ErrorResult, ICancelNavigationComponent, IClaimAuthenticateSessionAccountViewModel, ICollectionHttpRequestOptions, ICollectionHttpResponse, IFormError, IFormValidationResult, IHttpDownloadRequestOptions, IHttpRequestOptions, INhAccountInformationResponse, INhAuthorization, INhDivision, INhDivisionRole, INhDivisionUser, INhModalComponent, INhUser, ISearchableCollectionHttpRequestOptions, IServerSideFormValidationService, IServerSideFormValidator, ISimpleCollectionHttpRequestOptions, ISimpleCollectionHttpResponse, NhAuthenticationStepStatus, NhBackgroundOperation, NhBackgroundOperationAdministration, NhBackgroundOperationAggregationMode, NhBackgroundOperationAttempt, NhBackgroundOperationAttemptStatus, NhBackgroundOperationChanged, NhBackgroundOperationChild, NhBackgroundOperationConnectionState, NhBackgroundOperationEvent, NhBackgroundOperationEventType, NhBackgroundOperationMessageSeverity, NhBackgroundOperationStatus, NhBackgroundOperationStep, NhBackgroundOperationStepStatus, NhContextEventWithCoordinates, NhEnumDropDownItem, NhLoginResponse, NhRouterLink, NhTwoFactorMethod, NhUserNotificationSeverity, SuccessResult, TypedResult };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newheap/platform-common",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "peerDependencies": {
     "@angular/common": "^20.3.28",
     "@angular/core": "^20.3.28",
@@ -22,6 +22,22 @@
     "tslib": "^2.3.0"
   },
   "sideEffects": true,
+  "exports": {
+    "./two-factor/i18n/*.json": {
+      "default": "./two-factor/i18n/*.json"
+    },
+    "./package.json": {
+      "default": "./package.json"
+    },
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./fesm2022/newheap-platform-common.mjs"
+    },
+    "./two-factor": {
+      "types": "./two-factor/index.d.ts",
+      "default": "./fesm2022/newheap-platform-common-two-factor.mjs"
+    }
+  },
   "license": "Apache-2.0",
   "description": "Shared Angular components, services and application infrastructure for NewHeap applications.",
   "repository": {
@@ -37,14 +53,5 @@
     "access": "public"
   },
   "module": "fesm2022/newheap-platform-common.mjs",
-  "typings": "index.d.ts",
-  "exports": {
-    "./package.json": {
-      "default": "./package.json"
-    },
-    ".": {
-      "types": "./index.d.ts",
-      "default": "./fesm2022/newheap-platform-common.mjs"
-    }
-  }
+  "typings": "index.d.ts"
 }

package/two-factor/i18n/en.json

@@ -0,0 +1,93 @@
+{
+  "nh-two-factor": {
+    "required": "Enter a code to finish signing in.",
+    "enrollment-required": "Set up two-step verification to continue.",
+    "invalid-code": "The code is not valid. Try the next code.",
+    "challenge-expired": "The sign-in expired. Sign in again.",
+    "locked-out": "Too many attempts. The account is temporarily locked.",
+    "method-not-allowed": "This method cannot be used for this account.",
+    "not-enabled": "Two-step verification is not turned on.",
+    "already-enabled": "Two-step verification is already turned on.",
+    "setup-not-started": "Start the setup first.",
+    "reauthentication-required": "Confirm your password or a code to continue.",
+    "reauthentication-failed": "The password or code is not correct.",
+    "required-by-policy": "Your organization requires two-step verification.",
+    "not-allowed-while-impersonating": "Two-step verification cannot be changed while impersonating.",
+    "configuration-invalid": "Two-step verification is not configured correctly.",
+    "email-cooldown": "Wait a moment before you request another code.",
+    "email-unavailable": "No confirmed e-mail address is available.",
+    "user-not-found": "The user was not found.",
+    "passkey-invalid": "The passkey could not be verified.",
+    "passkey-not-found": "The passkey was not found.",
+    "passkey-unavailable": "The passkey prompt was cancelled, or this browser does not support passkeys.",
+    "ui": {
+      "error": "Something went wrong. Try again.",
+      "challenge-title": "Two-step verification",
+      "settings-title": "Two-step verification",
+      "enrollment-title": "Set up two-step verification",
+      "enrollment-instructions": "Your organization requires a second step when you sign in. Choose how you want to confirm it is you.",
+      "method-label": "Verification method",
+      "method": {
+        "authenticator": "Authenticator app",
+        "recovery-code": "Recovery code",
+        "email": "E-mail code",
+        "passkey": "Passkey"
+      },
+      "code-label": {
+        "authenticator": "Code from your authenticator app",
+        "recovery-code": "Recovery code",
+        "email": "Code from the e-mail"
+      },
+      "verify": "Verify",
+      "verifying": "Verifying…",
+      "cancel": "Cancel",
+      "remember-device": "Remember this device",
+      "send-email-code": "E-mail me a code",
+      "resend-email-code": "Send a new code",
+      "email-code-sent": "We e-mailed a code. It expires at {{time}}.",
+      "use-passkey": "Use a passkey",
+      "passkey-verify-instructions": "Your browser asks you to confirm with a passkey on this device, your phone or a security key.",
+      "sign-in-with-passkey": "Sign in with a passkey",
+      "authenticator-instructions": "Scan the QR code with your authenticator app, or enter the key by hand. Then enter the code the app shows.",
+      "shared-key": "Key",
+      "qr-code-alt": "QR code for your authenticator app",
+      "confirm": "Confirm",
+      "email-instructions": "We send a code to your confirmed e-mail address.",
+      "passkey-instructions": "Create a passkey with the screen lock of this device, a password manager or a security key.",
+      "passkey-name": "Passkey name",
+      "create-passkey": "Create passkey",
+      "recovery-codes-title": "Recovery codes",
+      "recovery-codes-instructions": "Store these codes somewhere safe. Each code signs you in once when you cannot use your other methods. They are only shown now.",
+      "copy": "Copy",
+      "copied": "Copied",
+      "download": "Download",
+      "recovery-codes-saved": "I saved these codes",
+      "continue": "Continue",
+      "loading": "Loading…",
+      "status-enabled": "On",
+      "status-disabled": "Off",
+      "status-required": "Required by your organization",
+      "recovery-codes-left": "{{count}} recovery codes left",
+      "set-up-authenticator": "Set up authenticator app",
+      "change-authenticator": "Change authenticator app",
+      "set-up-email": "Use e-mail codes",
+      "passkeys-title": "Passkeys",
+      "no-passkeys": "No passkeys yet.",
+      "add-passkey": "Add passkey",
+      "rename": "Rename",
+      "save": "Save",
+      "remove": "Remove",
+      "passkey-created": "Added on {{date}}",
+      "passkey-synced": "Synced",
+      "regenerate-recovery-codes": "Create new recovery codes",
+      "forget-devices": "Forget remembered devices",
+      "disable": "Turn off two-step verification",
+      "reauthentication-title": "Confirm it is you",
+      "reauthentication-method": "Confirm with",
+      "password": "Password",
+      "devices-forgotten": "Every device asks for the second step again.",
+      "session-renewed": "Your other sessions were signed out.",
+      "change-saved": "Your change was saved."
+    }
+  }
+}