@newheap/platform-common 1.3.1 → 1.5.0

package/index.d.ts

@@ -1,6 +1,6 @@
 import * as i20 from '@angular/common';
 import { KeyValue } from '@angular/common';
-import { HttpHeaders, HttpParams, HttpInterceptor, HttpRequest, HttpHandler, HttpEvent, HttpClient, HttpResponse } from '@angular/common/http';
+import { HttpHeaders, HttpParams, HttpInterceptor, HttpRequest, HttpHandler, HttpEvent, HttpClient, HttpContextToken, HttpResponse } from '@angular/common/http';
 import * as i21 from '@ngx-translate/core';
 import { TranslateService, TranslateLoader } from '@ngx-translate/core';
 import * as rxjs from 'rxjs';
@@ -29,6 +29,32 @@ declare class EndpointsAuthenticationNhCommonModuleConfig {
     impersonate: string;
     revertImpersonate: string;
     accountInformation: string;
+    twoFactorVerify: string;
+    twoFactorStatus: string;
+    twoFactorAuthenticator: string;
+    twoFactorAuthenticatorConfirm: string;
+    twoFactorRecoveryCodes: string;
+    twoFactorDisable: string;
+    twoFactorForgetDevices: string;
+    twoFactorEmailSetup: string;
+    twoFactorEmailConfirm: string;
+    twoFactorEmail: string;
+    twoFactorPasskeyOptions: string;
+    twoFactorPasskey: string;
+    twoFactorEnrollmentAuthenticator: string;
+    twoFactorEnrollmentAuthenticatorConfirm: string;
+    twoFactorEnrollmentEmail: string;
+    twoFactorEnrollmentEmailConfirm: string;
+    twoFactorEnrollmentPasskeyOptions: string;
+    twoFactorEnrollmentPasskey: string;
+    /** Administration route; `{userId}` is replaced with the user ID. */
+    twoFactorUserReset: string;
+    twoFactorEnrollmentReminders: string;
+    twoFactorSessionRevocation: string;
+    passkeySignInOptions: string;
+    passkeySignIn: string;
+    passkeys: string;
+    passkeyRegistrationOptions: string;
     constructor(init?: Partial<EndpointsAuthenticationNhCommonModuleConfig>);
 }
 declare class AuthenticationNhCommonModuleConfig {
@@ -37,6 +63,11 @@ declare class AuthenticationNhCommonModuleConfig {
     additionalDivisionClaimPermissionTypes: string[];
     endpoints: EndpointsAuthenticationNhCommonModuleConfig;
     loginPath: string;
+    /**
+     * Ends the local session when the API answers 401 and the account endpoint confirms that the
+     * server no longer accepts the session, for example after a password change on another device.
+     */
+    endSessionRejectedByServer: boolean;
     constructor(init?: Partial<AuthenticationNhCommonModuleConfig>);
 }
 declare class UserNotificationNhCommonModuleConfig {
@@ -419,6 +450,8 @@ declare class AuthSessionExpirationInformation {
     isAuthenticated: boolean;
     expiresWithin15MinutesOrExpired: boolean;
     displayMinutesSecondsUntilExpiration: string;
+    /** The server rejected the session before it expired; it stays set until the next sign-in. */
+    rejectedByServer: boolean;
     constructor(init?: Partial<AuthSessionExpirationInformation>);
 }
 declare class RefreshTokenLoginAccountMutateModel {
@@ -475,6 +508,8 @@ declare class AuthenticateModel {
     realm: string;
     username: string;
     password: string | undefined;
+    /** Remember-device token for header authentication; cookie clients send it as a cookie. */
+    rememberDeviceToken?: string;
     constructor(init?: Partial<AuthenticateModel>);
 }
 declare class ImpersonateAuthenticateModel {
@@ -485,6 +520,178 @@ declare class RevertImpersonateAuthenticateModel {
     constructor(init?: Partial<RevertImpersonateAuthenticateModel>);
 }
 type AuthenticationFlow = 'password' | 'microsoft-oauth' | string;
+/**
+ * Second-factor methods a user can present after the first factor succeeded.
+ */
+declare const NhTwoFactorMethods: {
+    readonly authenticator: "authenticator";
+    readonly recoveryCode: "recovery-code";
+    readonly email: "email";
+    readonly passkey: "passkey";
+};
+type NhTwoFactorMethod = typeof NhTwoFactorMethods[keyof typeof NhTwoFactorMethods] | string;
+/**
+ * Safe failure codes returned by the two-factor endpoints. Each error item uses the code as
+ * its name and `nh-two-factor.<suffix>` as its translation key.
+ */
+declare enum NhTwoFactorFailureCodes {
+    Required = "two-factor-required",
+    EnrollmentRequired = "two-factor-enrollment-required",
+    InvalidCode = "two-factor-invalid-code",
+    ChallengeExpired = "two-factor-challenge-expired",
+    LockedOut = "two-factor-locked-out",
+    MethodNotAllowed = "two-factor-method-not-allowed",
+    NotEnabled = "two-factor-not-enabled",
+    AlreadyEnabled = "two-factor-already-enabled",
+    SetupNotStarted = "two-factor-setup-not-started",
+    ReauthenticationRequired = "two-factor-reauthentication-required",
+    ReauthenticationFailed = "two-factor-reauthentication-failed",
+    RequiredByPolicy = "two-factor-required-by-policy",
+    NotAllowedWhileImpersonating = "two-factor-not-allowed-while-impersonating",
+    ConfigurationInvalid = "two-factor-configuration-invalid",
+    EmailCooldown = "two-factor-email-cooldown",
+    EmailUnavailable = "two-factor-email-unavailable",
+    UserNotFound = "two-factor-user-not-found",
+    PasskeyInvalid = "two-factor-passkey-invalid",
+    PasskeyNotFound = "two-factor-passkey-not-found",
+    /** The browser does not support passkeys or the user cancelled the passkey prompt. */
+    PasskeyUnavailable = "two-factor-passkey-unavailable"
+}
+/**
+ * Status values of a pending authentication step.
+ */
+declare const NhAuthenticationStepStatuses: {
+    readonly twoFactorRequired: "two-factor-required";
+    readonly enrollmentRequired: "enrollment-required";
+};
+/**
+ * A pending sign-in step. With status `two-factor-required` the user presents a second
+ * factor; with `enrollment-required` the policy requires the user to enroll one first, and
+ * `challengeToken` is the enrollment token.
+ */
+declare class NhTwoFactorChallenge {
+    status: string;
+    challengeToken: string;
+    expiresAt: string;
+    methods: NhTwoFactorMethod[];
+    /** Whether completing the challenge can remember this device for later sign-ins. */
+    rememberDeviceAvailable: boolean;
+    constructor(init?: Partial<NhTwoFactorChallenge>);
+}
+/**
+ * Login response when two-factor authentication is enabled on the server. A complete
+ * session has the token fields; a pending sign-in only has `twoFactor`.
+ */
+interface NhLoginResponse {
+    token?: string | null;
+    validTo?: string | null;
+    refreshToken?: string | null;
+    refreshValidTo?: string | null;
+    issuer?: string | null;
+    twoFactor?: NhTwoFactorChallenge | null;
+    /** Remember-device token for header authentication, returned when the user chose to remember the device. */
+    rememberDeviceToken?: string | null;
+}
+type NhAuthenticationStepStatus = 'authenticated' | 'two-factor-required' | 'enrollment-required';
+/**
+ * Outcome of an interactive sign-in step: the stored authorization, a second-factor
+ * challenge or a required enrollment.
+ */
+declare class NhAuthenticationStep<TAuthorization extends INhAuthorization = INhAuthorization> {
+    status: NhAuthenticationStepStatus;
+    authorization?: TAuthorization;
+    challenge?: NhTwoFactorChallenge;
+    constructor(init?: Partial<NhAuthenticationStep<TAuthorization>>);
+}
+declare class NhTwoFactorVerifyModel {
+    challengeToken: string;
+    method: NhTwoFactorMethod;
+    code: string;
+    /** Skip the second factor on this device for later sign-ins, when the server allows it. */
+    rememberDevice?: boolean;
+    constructor(init?: Partial<NhTwoFactorVerifyModel>);
+}
+/**
+ * Proof that the signed-in user is present before a sensitive change: the current password
+ * or a valid second-factor code.
+ */
+declare class NhTwoFactorReauthentication {
+    password?: string;
+    method?: NhTwoFactorMethod;
+    code?: string;
+    constructor(init?: Partial<NhTwoFactorReauthentication>);
+}
+declare class NhTwoFactorStatus {
+    enabled: boolean;
+    required: boolean;
+    methods: NhTwoFactorMethod[];
+    availableMethods: NhTwoFactorMethod[];
+    recoveryCodesLeft: number;
+    authenticatorSetupPending: boolean;
+    emailSetupPending: boolean;
+    rememberDeviceAvailable: boolean;
+    passkeyCount: number;
+    constructor(init?: Partial<NhTwoFactorStatus>);
+}
+/**
+ * Pending authenticator enrollment. `qrCodeDataUri` is a PNG data URI rendered by the server.
+ */
+declare class NhAuthenticatorSetup {
+    sharedKey: string;
+    authenticatorUri: string;
+    qrCodeDataUri?: string;
+    constructor(init?: Partial<NhAuthenticatorSetup>);
+}
+/**
+ * Result of a two-factor change. Recovery codes are returned once. When the change ended
+ * every session, the service has already stored the renewed session for this device.
+ */
+declare class NhTwoFactorChange {
+    recoveryCodes?: string[];
+    sessionRenewed: boolean;
+    constructor(init?: Partial<NhTwoFactorChange>);
+}
+/**
+ * Confirmation that the server e-mailed a code.
+ */
+declare class NhTwoFactorEmailCodeSent {
+    expiresAt: string;
+    /** When another code can be requested. */
+    resendAvailableAt: string;
+    constructor(init?: Partial<NhTwoFactorEmailCodeSent>);
+}
+/**
+ * Result of an enrollment that the policy required during sign-in. The session is already
+ * stored; the recovery codes are returned once.
+ */
+declare class NhTwoFactorEnrollmentResult<TAuthorization extends INhAuthorization = INhAuthorization> {
+    authorization?: TAuthorization;
+    recoveryCodes?: string[];
+    constructor(init?: Partial<NhTwoFactorEnrollmentResult<TAuthorization>>);
+}
+/**
+ * WebAuthn options from the server for one passkey ceremony. `options` is the JSON form of
+ * the creation or request options; `ceremonyToken` goes back with the credential.
+ */
+declare class NhPasskeyOptions {
+    options: any;
+    ceremonyToken: string;
+    expiresAt: string;
+    constructor(init?: Partial<NhPasskeyOptions>);
+}
+/**
+ * A registered passkey. The public key is never returned.
+ */
+declare class NhPasskey {
+    /** Credential ID, base64url encoded. */
+    id: string;
+    name: string;
+    createdAt: string;
+    /** Whether a passkey provider, such as a password manager, syncs the passkey. */
+    isBackedUp: boolean;
+    transports: string[];
+    constructor(init?: Partial<NhPasskey>);
+}
 
 declare class NhUserNotificationCollectionHttpRequestOptions extends CollectionHttpRequestOptions {
     constructor(init?: Partial<NhUserNotificationCollectionHttpRequestOptions>);
@@ -1072,20 +1279,63 @@ declare class NhCookieService {
     static ɵprov: i0.ɵɵInjectableDeclaration<NhCookieService>;
 }
 
+/**
+ * Runs WebAuthn ceremonies in the browser. The server returns the options in their JSON form
+ * and expects the credential in its JSON form; this client converts both, with a fallback for
+ * browsers without `PublicKeyCredential.parseCreationOptionsFromJSON` and `toJSON()`.
+ */
+declare class NhPasskeyClient {
+    private readonly platformId;
+    /**
+     * Whether the browser supports passkeys. Always false during server-side rendering.
+     */
+    isSupported(): boolean;
+    /**
+     * Creates a passkey for WebAuthn creation options and returns the credential JSON.
+     * Rejects when the user cancels the prompt or the browser refuses the request.
+     */
+    create(options: any): Promise<object>;
+    /**
+     * Signs WebAuthn request options with a passkey and returns the credential JSON.
+     * Rejects when the user cancels the prompt or the browser refuses the request.
+     */
+    get(options: any): Promise<object>;
+    private ensureSupported;
+    private requireCredential;
+    private creationOptionsFromJSON;
+    private requestOptionsFromJSON;
+    private credentialToJSON;
+    private static fromBase64Url;
+    private static toBase64Url;
+    static ɵfac: i0.ɵɵFactoryDeclaration<NhPasskeyClient, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<NhPasskeyClient>;
+}
+
+/** Marks a request whose 401 must not start a server session check, such as the check itself. */
+declare const NH_SKIP_SERVER_SESSION_CHECK: HttpContextToken<boolean>;
 declare abstract class BaseNhAuthService<TAuthorization extends INhAuthorization> implements OnDestroy {
+    protected static readonly pendingTwoFactorChallengeStorageKey = "nh-two-factor-challenge";
+    protected static readonly externalTwoFactorChallengePrefix = "nh-two-factor=";
+    protected static readonly rememberDeviceStorageKey = "nh-two-factor-device";
+    protected static readonly serverSessionConfirmationMilliseconds = 30000;
     protected authorization: TAuthorization | undefined;
+    protected pendingTwoFactorChallenge: NhTwoFactorChallenge | undefined;
     protected authSession: AuthenticationSessionCreateResponse | undefined;
     readonly authSubject: BehaviorSubject<TAuthorization | undefined>;
     protected onReady: ((value: (PromiseLike<unknown> | unknown)) => void) | undefined;
     readonly authReady: Promise<unknown>;
     protected _sessionExpirationInformation: BehaviorSubject<AuthSessionExpirationInformation>;
-    sessionExpirationInformationChanged: rxjs.Observable<AuthSessionExpirationInformation>;
+    sessionExpirationInformationChanged: Observable<AuthSessionExpirationInformation>;
     protected intervalHandle: any;
+    private serverSessionCheck;
+    private serverSessionConfirmedAt;
+    private sessionRejectedByServer;
     protected zone: NgZone;
     protected moduleConfig: NhCommonModuleConfig;
     protected httpClient: HttpClient;
     protected platformId: Object;
     protected requestContext: any;
+    protected passkeyClient: NhPasskeyClient;
     constructor();
     dispatchSessionExpirationInformationChanged(): void;
     ngOnDestroy(): void;
@@ -1117,8 +1367,178 @@ declare abstract class BaseNhAuthService<TAuthorization extends INhAuthorization
     getAuthenticationFlow(username: string): Promise<TaskResult<AuthenticationFlow>>;
     getMicrosoftRedirectUrl(callbackUrl: string, username: string): Promise<TaskResult<string>>;
     authorizeMicrosoft(code: string, state: string): Promise<TaskResult<TAuthorization>>;
+    /**
+     * Signs in with username and password and stores the complete session.
+     *
+     * When the server requires a second factor this method fails with
+     * `NhTwoFactorFailureCodes.Required` and stores nothing. Use `authenticateInteractive`
+     * to receive the challenge, or read it with `getPendingTwoFactorChallenge()`.
+     */
     authenticate(model: AuthenticateModel, loginAsUser?: boolean): Promise<TaskResult<TAuthorization>>;
+    /**
+     * Signs in with username and password. Returns the stored authorization, the
+     * second-factor challenge or the required enrollment. A pending step is never stored as
+     * an authorization.
+     */
+    authenticateInteractive(model: AuthenticateModel): Promise<TaskResult<NhAuthenticationStep<TAuthorization>>>;
+    /**
+     * Completes a second-factor challenge and stores the session.
+     */
+    verifyTwoFactor(model: NhTwoFactorVerifyModel): Promise<TaskResult<TAuthorization>>;
+    /**
+     * E-mails a sign-in code for the pending challenge when the user enrolled the e-mail factor.
+     */
+    sendTwoFactorEmailCode(challengeToken: string): Promise<TaskResult<NhTwoFactorEmailCodeSent>>;
+    /**
+     * Whether this browser can use passkeys.
+     */
+    isPasskeySupported(): boolean;
+    /**
+     * Completes the pending challenge with a passkey and stores the session.
+     */
+    verifyTwoFactorWithPasskey(challengeToken: string, rememberDevice?: boolean): Promise<TaskResult<TAuthorization>>;
+    /**
+     * Signs in with a discoverable passkey, without a username or password. Returns the
+     * stored authorization, or a pending step when the server's policy asks for more.
+     */
+    signInWithPasskey(): Promise<TaskResult<NhAuthenticationStep<TAuthorization>>>;
+    /**
+     * Starts authenticator enrollment for a user whom the policy requires to enroll during
+     * sign-in. `enrollmentToken` is the `challengeToken` of the enrollment step.
+     */
+    beginEnrollmentAuthenticatorSetup(enrollmentToken: string): Promise<TaskResult<NhAuthenticatorSetup>>;
+    /**
+     * Confirms the authenticator during a required enrollment and stores the session.
+     */
+    confirmEnrollmentAuthenticator(enrollmentToken: string, code: string): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    /**
+     * E-mails a confirmation code during a required enrollment.
+     */
+    sendEnrollmentEmailCode(enrollmentToken: string): Promise<TaskResult<NhTwoFactorEmailCodeSent>>;
+    /**
+     * Confirms the e-mail factor during a required enrollment and stores the session.
+     */
+    confirmEnrollmentEmail(enrollmentToken: string, code: string): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    /**
+     * Registers a passkey during a required enrollment and stores the session.
+     */
+    enrollPasskey(enrollmentToken: string, name?: string): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    /**
+     * Returns the pending second-factor challenge of this browser tab, if it has not expired.
+     */
+    getPendingTwoFactorChallenge(): NhTwoFactorChallenge | undefined;
+    clearPendingTwoFactorChallenge(): void;
+    /**
+     * Reads a challenge that an external sign-in (Microsoft OAuth) passed back in the URL
+     * fragment, stores it as the pending challenge and removes it from the address bar.
+     */
+    consumeExternalTwoFactorChallenge(fragment?: string): NhTwoFactorChallenge | undefined;
+    getTwoFactorStatus(): Promise<TaskResult<NhTwoFactorStatus>>;
+    /**
+     * Starts authenticator enrollment. Restarting enrollment while two-factor authentication
+     * is enabled requires reauthentication.
+     */
+    beginAuthenticatorSetup(reauthentication?: NhTwoFactorReauthentication): Promise<TaskResult<NhAuthenticatorSetup>>;
+    /**
+     * Confirms authenticator enrollment. The server ends every other session; the renewed
+     * session for this device is stored before the promise resolves.
+     */
+    confirmAuthenticator(code: string): Promise<TaskResult<NhTwoFactorChange>>;
+    regenerateRecoveryCodes(reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    disableTwoFactor(reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * E-mails a code that confirms the user's e-mail address as a second factor. Requires
+     * reauthentication while two-factor authentication is enabled.
+     */
+    beginEmailSetup(reauthentication?: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorEmailCodeSent>>;
+    confirmEmailSetup(code: string): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * Forgets every remembered device, including this one, and ends every other session.
+     */
+    forgetTwoFactorDevices(reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    getPasskeys(): Promise<TaskResult<NhPasskey[]>>;
+    /**
+     * Registers a passkey on this device. Adding a passkey while two-factor authentication is
+     * enabled requires reauthentication. The server ends every other session; the renewed
+     * session for this device is stored before the promise resolves.
+     */
+    registerPasskey(name?: string, reauthentication?: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    renamePasskey(passkeyId: string, name: string): Promise<TaskResult<void>>;
+    /**
+     * Removes a passkey. Removing the last second factor disables two-factor authentication,
+     * which fails when the policy requires it.
+     */
+    removePasskey(passkeyId: string, reauthentication: NhTwoFactorReauthentication): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * Removes every second factor of another user who lost access to them. Requires the
+     * server's two-factor administration policy.
+     */
+    resetUserTwoFactor(userId: string): Promise<TaskResult<void>>;
+    /**
+     * Starts a background operation that reminds every user whom the policy requires to
+     * enroll. A repeated idempotency key returns the operation that was already started.
+     */
+    startTwoFactorEnrollmentReminders(idempotencyKey: string): Promise<TaskResult<NhBackgroundOperation>>;
+    /**
+     * Starts a background operation that ends the sessions of every user whom the policy
+     * requires to enroll, so their next sign-in enrolls them.
+     */
+    startTwoFactorSessionRevocation(idempotencyKey: string): Promise<TaskResult<NhBackgroundOperation>>;
+    protected sendTwoFactorChange(endpoint: string, body: object): Promise<TaskResult<NhTwoFactorChange>>;
+    /**
+     * Stores the session that the server issued for this device after a change that ended
+     * every session. The user, claims and divisions of the current authorization are kept.
+     */
+    protected applyRenewedSession(session: NhLoginResponse | null | undefined): boolean;
+    protected toAuthorization(response: NhLoginResponse): TAuthorization;
+    /**
+     * Stores a complete session, or keeps a second-factor challenge or enrollment as the
+     * pending step of this browser tab.
+     */
+    protected completeAuthenticationStep(response: NhLoginResponse): NhAuthenticationStep<TAuthorization>;
+    /**
+     * Converts a failed challenge or enrollment request and forgets the pending step when the
+     * server ended it.
+     */
+    protected pendingStepFailed(ex: unknown): TaskResult<unknown>;
+    protected sendEnrollmentCompletion(endpoint: string, body: object): Promise<TaskResult<NhTwoFactorEnrollmentResult<TAuthorization>>>;
+    protected sendTwoFactorRequest<TResponse, TResult>(request$: Observable<TResponse>, map: (response: TResponse) => TResult): Promise<TaskResult<TResult>>;
+    /**
+     * Runs a WebAuthn prompt. A cancelled prompt or an unsupported browser becomes a failed
+     * result with `NhTwoFactorFailureCodes.PasskeyUnavailable`.
+     */
+    protected runPasskeyCeremony(ceremony: () => Promise<object>): Promise<TaskResult<object>>;
+    /**
+     * Returns the remember-device token of header clients. Cookie clients receive it as an
+     * HttpOnly cookie, so nothing is stored in the browser.
+     */
+    protected getRememberDeviceToken(): string | undefined;
+    protected storeRememberDeviceToken(token: string | undefined): void;
+    protected rememberDeviceStorageKey(): string;
+    protected setPendingTwoFactorChallenge(challenge: NhTwoFactorChallenge): void;
+    protected readStoredTwoFactorChallenge(): NhTwoFactorChallenge | undefined;
+    protected twoFactorEndpoints(): EndpointsAuthenticationNhCommonModuleConfig;
+    protected twoFactorUrl(endpoint: string): string;
+    protected twoFactorStepRequestOptions(): {
+        params: HttpParams;
+        withCredentials: boolean;
+    };
+    protected twoFactorAccountRequestOptions(): {
+        params: HttpParams;
+        headers: HttpHeaders;
+        withCredentials: boolean;
+    };
+    protected languageParams(): HttpParams;
     reloadAuthorizationProfile(): Promise<TaskResult<TAuthorization>>;
+    /**
+     * Asks the account information endpoint whether the server still accepts the current session.
+     * When the server answers 401, for example after a password change on another device, the local
+     * session ends and the session expiration information reports `rejectedByServer`. Concurrent
+     * checks share one request, and a confirmed session is not checked again for 30 seconds.
+     * @returns `false` only when there is no session or the server rejected it.
+     */
+    verifyServerSession(): Promise<boolean>;
+    protected checkServerSession(): Promise<boolean>;
     logout(): Promise<TaskResult<void>>;
     authenticateRefreshToken(model: RefreshTokenLoginAccountMutateModel): Promise<TaskResult<TAuthorization>>;
     impersonate(model: ImpersonateAuthenticateModel): Promise<TaskResult<TAuthorization>>;
@@ -1165,6 +1585,23 @@ declare class NhDeduplicateGetRequestsInterceptor implements HttpInterceptor {
     static ɵprov: i0.ɵɵInjectableDeclaration<NhDeduplicateGetRequestsInterceptor>;
 }
 
+/**
+ * Ends a session that the NewHeap API no longer accepts. A 401 from the API while the browser
+ * still holds a session asks the auth service to check that session with the server. Only a 401
+ * from the account endpoint ends it, so an endpoint that answers 401 for another reason never
+ * signs the user out. The original error still reaches the caller.
+ */
+declare class NhSessionRejectionInterceptor implements HttpInterceptor {
+    private moduleConfig;
+    private authService;
+    constructor(moduleConfig: NhCommonModuleConfig, authService: NhAuthService);
+    intercept(req: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>>;
+    private appliesTo;
+    private isUnder;
+    static ɵfac: i0.ɵɵFactoryDeclaration<NhSessionRejectionInterceptor, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<NhSessionRejectionInterceptor>;
+}
+
 declare abstract class AbstractValueAccessor implements ControlValueAccessor {
     _value: any;
     get value(): any;
@@ -2635,5 +3072,5 @@ declare class NhTranslateBrowserLoader implements TranslateLoader {
 }
 declare function nhTranslateBrowserLoaderFactory(httpClient: HttpClient, transferState: TransferState): NhTranslateBrowserLoader;
 
-export { AbstractValueAccessor, AspMvcFormServerSideFormValidator, AuthSessionExpirationInformation, AuthenticateModel, AuthenticationNhCommonModuleConfig, AuthenticationSessionCreateResponse, BackgroundOperationsNhCommonModuleConfig, BaseNhAuthService, CheckAuthenticateSessionModel, Claim, ClaimAuthenticateSessionAccountMutateModel, ClaimAuthenticateSessionAccountViewModel, ClaimTypes, CollectionHttpRequestOptions, CollectionHttpResponse, DefaultMultiSelectSettings, DefaultMultiSelectTexts, EndpointsAuthenticationNhCommonModuleConfig, FilterRequestOptions, FormError, FormValidationResult, HttpDownloadRequestOptions, HttpRequestOptions, HttpRequestOptionsArrayBuffer, HttpRequestOptionsText, ImpersonateAuthenticateModel, IsAllPermissionsGrantedPipe, IsAuthenticatedPipe, IsClaimGrantedPipe, IsDefined, IsGrantedRolePipe, IsOneActiveDivisionPermissionGrantedGuard, IsOneActiveDivisionPermissionGrantedPipe, IsOneActiveDivisionRoleGrantedGuard, IsOneActiveDivisionRoleGrantedPipe, IsOneClaimGrantedPipe, IsOneDivisionPermissionGrantedPipe, IsOneDivisionRoleGrantedPipe, IsOnePermissionGrantedPipe, IsOneRoleGrantedPipe, JsonLdDataChanged, ListSortDirection, MakeProvider, MutationType, NH_ERROR_HANDLERS, NH_ROUTER_LANGUAGE_CHANGE_METHOD, NH_ROUTER_ROOT_ROUTES, NhAccountInformationResponse, NhAngularUtil, NhApiService, NhApiUtil, NhAppService, NhAsyncLock, NhAuthService, NhAuthorization, NhBackgroundOperationAdministrationCollectionHttpRequestOptions, NhBackgroundOperationAdministrationService, NhBackgroundOperationCollectionHttpRequestOptions, NhBackgroundOperationLiveUpdateService, NhBackgroundOperationProgressComponent, NhBackgroundOperationService, NhBackgroundOperationStore, NhBaseApiService, NhBooleanToStringPipe, NhBreadCrumb, NhBreadCrumbItem, NhButtonDebounceDirective, NhCanCancelNavigationGuard, NhCollectionBaseComponent, NhCollectionTypeBaseComponent, NhCommonConfig, NhCommonConfigChanged, NhCommonModule, NhCommonModuleConfig, NhConfigCommonService, NhContextMenu, NhContextMenuItem, NhContextMenuService, NhContextMenuServiceConfig, NhCookieService, NhDatePipe, NhDateTimePipe, NhDateUtcPipe, NhDebounceDirective, NhDeduplicateGetRequestsInterceptor, NhDivision, NhDivisionRole, NhDivisionUser, NhEncodeHttpParamsInterceptor, NhEncodingUtil, NhErrorComponent, NhErrorHandlerService, NhFormDropDownComponent, NhFormDropDownNhCommonModuleConfig, NhFormDropDownSettings, NhFormErrorMessageComponent, NhFormHelper, NhHeadService, NhHttpNhCommonModuleConfig, NhHttpUtil, NhInternetConnectionService, NhIsAllPermissionsGrantedGuard, NhIsAuthenticatedGuard, NhIsOneClaimGrantedGuard, NhIsOnePermissionGrantedGuard, NhIsOneRoleGrantedGuard, NhJsonLdComponent, NhJsonLdData, NhJsonLdDataItem, NhJsonLdService, NhLoaderComponent, NhMetaService, NhModalComponent, NhModalComponentClosed, NhModalComponentImpl, NhModalComponentRef, NhModalConfirmComponent, NhModalContentDirective, NhModalLoadingComponent, NhModalMutateBaseComponent, NhModalMutateBaseTypeComponent, NhModalOptions, NhModalService, NhMutateBaseComponent, NhMutateBaseTypeComponent, NhMutex, NhPageBaseComponent, NhPageService, NhPageSettings, NhPageSizeComponent, NhPageTypeBaseComponent, NhRegisterRoute, NhRequestScopedServerHttpInterceptorService, NhRoute, NhRouteInfo, NhRouteNavigationItem, NhRouterLinkDirective, NhRouterService, NhRouterSetupService, NhSearchInputComponent, NhServerHttpInterceptor, NhServerService, NhServerSideFormValidationService, NhSitemap, NhSitemapEntry, NhSitemapEntryItem, NhStringUtil, NhTaskResultFormValidationService, NhTitleService, NhToHeadDirective, NhTranslateBrowserLoader, NhTranslationNhCommonModuleConfig, NhTypedPageBaseComponent, NhTypedPageTypeBaseComponent, NhUrlEncodePipe, NhUser, NhUserNotification, NhUserNotificationCollectionHttpRequestOptions, NhUserNotificationData, NhUserNotificationMessage, NhUserNotificationOverview, NhUserNotificationService, NhUserNotificationState, NhUserNotificationsAbstractComponent, OrderByRequestOptions, PreConnectUrlItem, PreLoadUrlItem, REVIEW_AGGREGATE_RATING_KEY, REVIEW_KEY, RefreshTokenLoginAccountMutateModel, RevertImpersonateAuthenticateModel, SafeHtmlPipe, SafeResourceUrlPipe, SafeUrlPipe, SearchableCollectionHttpRequestOptions, SimpleCollectionHttpRequestOptions, SimpleCollectionHttpResponse, TaskResult, TaskResultItem, TypedNhPageSettings, UserNotificationNhCommonModuleConfig, enumIntValuesToArray, enumKeysToArray, enumStringValuesToArray, enumValuesToArray, getEmptyGuid, getRandomIdentifier, groupBy, languageToCultureMap, nameof, nhBackgroundOperationStatusName, nhBackgroundOperationStepStatusName, nhBackgroundOperationTranslationSegment, nhTranslateBrowserLoaderFactory, nhUserNotificationSeverityName, uppercaseFirst };
-export type { AuthenticationFlow, ErrorResult, ICancelNavigationComponent, IClaimAuthenticateSessionAccountViewModel, ICollectionHttpRequestOptions, ICollectionHttpResponse, IFormError, IFormValidationResult, IHttpDownloadRequestOptions, IHttpRequestOptions, INhAccountInformationResponse, INhAuthorization, INhDivision, INhDivisionRole, INhDivisionUser, INhModalComponent, INhUser, ISearchableCollectionHttpRequestOptions, IServerSideFormValidationService, IServerSideFormValidator, ISimpleCollectionHttpRequestOptions, ISimpleCollectionHttpResponse, NhBackgroundOperation, NhBackgroundOperationAdministration, NhBackgroundOperationAggregationMode, NhBackgroundOperationAttempt, NhBackgroundOperationAttemptStatus, NhBackgroundOperationChanged, NhBackgroundOperationChild, NhBackgroundOperationConnectionState, NhBackgroundOperationEvent, NhBackgroundOperationEventType, NhBackgroundOperationMessageSeverity, NhBackgroundOperationStatus, NhBackgroundOperationStep, NhBackgroundOperationStepStatus, NhContextEventWithCoordinates, NhEnumDropDownItem, NhRouterLink, NhUserNotificationSeverity, SuccessResult, TypedResult };
+export { AbstractValueAccessor, AspMvcFormServerSideFormValidator, AuthSessionExpirationInformation, AuthenticateModel, AuthenticationNhCommonModuleConfig, AuthenticationSessionCreateResponse, BackgroundOperationsNhCommonModuleConfig, BaseNhAuthService, CheckAuthenticateSessionModel, Claim, ClaimAuthenticateSessionAccountMutateModel, ClaimAuthenticateSessionAccountViewModel, ClaimTypes, CollectionHttpRequestOptions, CollectionHttpResponse, DefaultMultiSelectSettings, DefaultMultiSelectTexts, EndpointsAuthenticationNhCommonModuleConfig, FilterRequestOptions, FormError, FormValidationResult, HttpDownloadRequestOptions, HttpRequestOptions, HttpRequestOptionsArrayBuffer, HttpRequestOptionsText, ImpersonateAuthenticateModel, IsAllPermissionsGrantedPipe, IsAuthenticatedPipe, IsClaimGrantedPipe, IsDefined, IsGrantedRolePipe, IsOneActiveDivisionPermissionGrantedGuard, IsOneActiveDivisionPermissionGrantedPipe, IsOneActiveDivisionRoleGrantedGuard, IsOneActiveDivisionRoleGrantedPipe, IsOneClaimGrantedPipe, IsOneDivisionPermissionGrantedPipe, IsOneDivisionRoleGrantedPipe, IsOnePermissionGrantedPipe, IsOneRoleGrantedPipe, JsonLdDataChanged, ListSortDirection, MakeProvider, MutationType, NH_ERROR_HANDLERS, NH_ROUTER_LANGUAGE_CHANGE_METHOD, NH_ROUTER_ROOT_ROUTES, NH_SKIP_SERVER_SESSION_CHECK, NhAccountInformationResponse, NhAngularUtil, NhApiService, NhApiUtil, NhAppService, NhAsyncLock, NhAuthService, NhAuthenticationStep, NhAuthenticationStepStatuses, NhAuthenticatorSetup, NhAuthorization, NhBackgroundOperationAdministrationCollectionHttpRequestOptions, NhBackgroundOperationAdministrationService, NhBackgroundOperationCollectionHttpRequestOptions, NhBackgroundOperationLiveUpdateService, NhBackgroundOperationProgressComponent, NhBackgroundOperationService, NhBackgroundOperationStore, NhBaseApiService, NhBooleanToStringPipe, NhBreadCrumb, NhBreadCrumbItem, NhButtonDebounceDirective, NhCanCancelNavigationGuard, NhCollectionBaseComponent, NhCollectionTypeBaseComponent, NhCommonConfig, NhCommonConfigChanged, NhCommonModule, NhCommonModuleConfig, NhConfigCommonService, NhContextMenu, NhContextMenuItem, NhContextMenuService, NhContextMenuServiceConfig, NhCookieService, NhDatePipe, NhDateTimePipe, NhDateUtcPipe, NhDebounceDirective, NhDeduplicateGetRequestsInterceptor, NhDivision, NhDivisionRole, NhDivisionUser, NhEncodeHttpParamsInterceptor, NhEncodingUtil, NhErrorComponent, NhErrorHandlerService, NhFormDropDownComponent, NhFormDropDownNhCommonModuleConfig, NhFormDropDownSettings, NhFormErrorMessageComponent, NhFormHelper, NhHeadService, NhHttpNhCommonModuleConfig, NhHttpUtil, NhInternetConnectionService, NhIsAllPermissionsGrantedGuard, NhIsAuthenticatedGuard, NhIsOneClaimGrantedGuard, NhIsOnePermissionGrantedGuard, NhIsOneRoleGrantedGuard, NhJsonLdComponent, NhJsonLdData, NhJsonLdDataItem, NhJsonLdService, NhLoaderComponent, NhMetaService, NhModalComponent, NhModalComponentClosed, NhModalComponentImpl, NhModalComponentRef, NhModalConfirmComponent, NhModalContentDirective, NhModalLoadingComponent, NhModalMutateBaseComponent, NhModalMutateBaseTypeComponent, NhModalOptions, NhModalService, NhMutateBaseComponent, NhMutateBaseTypeComponent, NhMutex, NhPageBaseComponent, NhPageService, NhPageSettings, NhPageSizeComponent, NhPageTypeBaseComponent, NhPasskey, NhPasskeyClient, NhPasskeyOptions, NhRegisterRoute, NhRequestScopedServerHttpInterceptorService, NhRoute, NhRouteInfo, NhRouteNavigationItem, NhRouterLinkDirective, NhRouterService, NhRouterSetupService, NhSearchInputComponent, NhServerHttpInterceptor, NhServerService, NhServerSideFormValidationService, NhSessionRejectionInterceptor, NhSitemap, NhSitemapEntry, NhSitemapEntryItem, NhStringUtil, NhTaskResultFormValidationService, NhTitleService, NhToHeadDirective, NhTranslateBrowserLoader, NhTranslationNhCommonModuleConfig, NhTwoFactorChallenge, NhTwoFactorChange, NhTwoFactorEmailCodeSent, NhTwoFactorEnrollmentResult, NhTwoFactorFailureCodes, NhTwoFactorMethods, NhTwoFactorReauthentication, NhTwoFactorStatus, NhTwoFactorVerifyModel, NhTypedPageBaseComponent, NhTypedPageTypeBaseComponent, NhUrlEncodePipe, NhUser, NhUserNotification, NhUserNotificationCollectionHttpRequestOptions, NhUserNotificationData, NhUserNotificationMessage, NhUserNotificationOverview, NhUserNotificationService, NhUserNotificationState, NhUserNotificationsAbstractComponent, OrderByRequestOptions, PreConnectUrlItem, PreLoadUrlItem, REVIEW_AGGREGATE_RATING_KEY, REVIEW_KEY, RefreshTokenLoginAccountMutateModel, RevertImpersonateAuthenticateModel, SafeHtmlPipe, SafeResourceUrlPipe, SafeUrlPipe, SearchableCollectionHttpRequestOptions, SimpleCollectionHttpRequestOptions, SimpleCollectionHttpResponse, TaskResult, TaskResultItem, TypedNhPageSettings, UserNotificationNhCommonModuleConfig, enumIntValuesToArray, enumKeysToArray, enumStringValuesToArray, enumValuesToArray, getEmptyGuid, getRandomIdentifier, groupBy, languageToCultureMap, nameof, nhBackgroundOperationStatusName, nhBackgroundOperationStepStatusName, nhBackgroundOperationTranslationSegment, nhTranslateBrowserLoaderFactory, nhUserNotificationSeverityName, uppercaseFirst };
+export type { AuthenticationFlow, ErrorResult, ICancelNavigationComponent, IClaimAuthenticateSessionAccountViewModel, ICollectionHttpRequestOptions, ICollectionHttpResponse, IFormError, IFormValidationResult, IHttpDownloadRequestOptions, IHttpRequestOptions, INhAccountInformationResponse, INhAuthorization, INhDivision, INhDivisionRole, INhDivisionUser, INhModalComponent, INhUser, ISearchableCollectionHttpRequestOptions, IServerSideFormValidationService, IServerSideFormValidator, ISimpleCollectionHttpRequestOptions, ISimpleCollectionHttpResponse, NhAuthenticationStepStatus, NhBackgroundOperation, NhBackgroundOperationAdministration, NhBackgroundOperationAggregationMode, NhBackgroundOperationAttempt, NhBackgroundOperationAttemptStatus, NhBackgroundOperationChanged, NhBackgroundOperationChild, NhBackgroundOperationConnectionState, NhBackgroundOperationEvent, NhBackgroundOperationEventType, NhBackgroundOperationMessageSeverity, NhBackgroundOperationStatus, NhBackgroundOperationStep, NhBackgroundOperationStepStatus, NhContextEventWithCoordinates, NhEnumDropDownItem, NhLoginResponse, NhRouterLink, NhTwoFactorMethod, NhUserNotificationSeverity, SuccessResult, TypedResult };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newheap/platform-common",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "peerDependencies": {
     "@angular/common": "^20.3.28",
     "@angular/core": "^20.3.28",
@@ -22,6 +22,22 @@
     "tslib": "^2.3.0"
   },
   "sideEffects": true,
+  "exports": {
+    "./two-factor/i18n/*.json": {
+      "default": "./two-factor/i18n/*.json"
+    },
+    "./package.json": {
+      "default": "./package.json"
+    },
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./fesm2022/newheap-platform-common.mjs"
+    },
+    "./two-factor": {
+      "types": "./two-factor/index.d.ts",
+      "default": "./fesm2022/newheap-platform-common-two-factor.mjs"
+    }
+  },
   "license": "Apache-2.0",
   "description": "Shared Angular components, services and application infrastructure for NewHeap applications.",
   "repository": {
@@ -37,14 +53,5 @@
     "access": "public"
   },
   "module": "fesm2022/newheap-platform-common.mjs",
-  "typings": "index.d.ts",
-  "exports": {
-    "./package.json": {
-      "default": "./package.json"
-    },
-    ".": {
-      "types": "./index.d.ts",
-      "default": "./fesm2022/newheap-platform-common.mjs"
-    }
-  }
+  "typings": "index.d.ts"
 }