@openziti/ziti-console-lib 1.2.0 → 1.3.0

package/index.d.ts

@@ -1,6 +1,6 @@
 import * as lottie_web from 'lottie-web';
 import * as i0 from '@angular/core';
-import { PipeTransform, EventEmitter, InjectionToken, ViewContainerRef, ElementRef, OnInit, DoCheck, OnDestroy, AfterViewInit, ChangeDetectorRef, OnChanges, SimpleChanges, TemplateRef } from '@angular/core';
+import { PipeTransform, EventEmitter, InjectionToken, ViewContainerRef, ElementRef, OnInit, DoCheck, OnDestroy, AfterViewInit, ChangeDetectorRef, OnChanges, SimpleChanges, TemplateRef, Injector } from '@angular/core';
 import * as _angular_platform_browser from '@angular/platform-browser';
 import { DomSanitizer } from '@angular/platform-browser';
 import * as rxjs from 'rxjs';
@@ -66,6 +66,7 @@ interface ExtensionService {
     listActions?: any[];
     consoleActionTriggered?: EventEmitter<any>;
     disabledComponents?: any[];
+    showApiCalls?: boolean;
     emitEvent?<TData, TResult>(event: ExtensionEvent<TData, TResult>): Promise<TResult | undefined>;
     extendOnInit(): void;
     extendAfterViewInits(extentionPoints: any): void;
@@ -254,7 +255,7 @@ declare class ChipsInputComponent implements ControlValueAccessor {
     onModelChange: EventEmitter<string[]>;
     onBlur: EventEmitter<FocusEvent>;
     keyup: EventEmitter<KeyboardEvent>;
-    chipInput: ElementRef<HTMLInputElement>;
+    chipInput?: ElementRef<HTMLInputElement>;
     value: string[];
     disabled: boolean;
     focused: boolean;
@@ -505,6 +506,8 @@ declare abstract class SettingsServiceClass {
     port: number;
     portTLS: number;
     apiVersions: any[];
+    capabilities: string[];
+    edgeOidcPath: string | null;
     protocol: string;
     host: string;
     httpClient: HttpClient;
@@ -517,6 +520,9 @@ declare abstract class SettingsServiceClass {
     abstract initApiVersions(url: any): any;
     abstract loadSettings(): any;
     abstract hasSession(): any;
+    oidcAvailable(): boolean;
+    setOidcCapabilities(versionData: any): void;
+    clearOidcCapabilities(): void;
     abstract isHAEnabled(): boolean;
     abstract getHAControllers(): any[];
     abstract getActiveSessions(): Map<string, string>;
@@ -558,11 +564,18 @@ declare abstract class ZitiDataService {
         total: number;
     };
     constructor(logger: LoggerService, growler: GrowlerService, settingsService: SettingsServiceClass, httpClient: HttpClient, router: Router);
+    private readonly injector;
+    /** Resolved lazily to break the circular dependency: ManagementPermissionsService → ZITI_DATA_SERVICE → ManagementPermissionsService. */
+    private get managementPermissions();
+    /** Empty list response returned when the user lacks read permission for the requested resource. */
+    private static readonly EMPTY_READ_RESULT;
     abstract post(type: any, model: any, chained?: any, contentType?: any): Promise<any>;
     abstract put(type: any, model: any, id: any, chained?: any): Promise<any>;
     abstract patch(type: any, model: any, id: any, chained?: any): Promise<any>;
-    abstract get(type: string, paging: any, filters: FilterObj[], url?: any, useClient?: any): Promise<any>;
-    abstract getSubdata(entityType: string, id: any, dataType: string, paging?: any, contentType?: any, filters?: any): Promise<any>;
+    abstract doGet(type: string, paging: any, filters: FilterObj[], url?: any, useClient?: any): Promise<any>;
+    abstract doGetSubdata(entityType: string, id: any, dataType: string, paging?: any, contentType?: any, filters?: any): Promise<any>;
+    get(type: string, paging: any, filters: FilterObj[], url?: any, useClient?: any): Promise<any>;
+    getSubdata(entityType: string, id: any, dataType: string, paging?: any, contentType?: any, filters?: any): Promise<any>;
     abstract saveSubdata(entityType: string, id: any, dataType: string, params: any): Promise<any>;
     abstract deleteSubdata(entityType: string, id: any, dataType: string, params: any): Promise<any>;
     abstract delete(type: string, id: string): Promise<any>;
@@ -739,6 +752,49 @@ declare class SettingsService extends SettingsServiceClass {
     static ɵprov: i0.ɵɵInjectableDeclaration<SettingsService>;
 }
 
+declare const SAVE_DENIED_BY_PERMISSION_TOOLTIP = "You do not have permission to save changes.";
+/** Maps ZAC entityType strings to controller permission entity keys. */
+declare const API_RESOURCE_TO_ENTITY_PERMISSION: Record<string, string>;
+declare class ManagementPermissionsService {
+    private readonly settings;
+    private readonly zitiData;
+    readonly saveDeniedTooltip = "You do not have permission to save changes.";
+    private readonly permissionSet;
+    private identityIsAdmin;
+    /** Legacy controller, failed refresh, or empty permissions — keep prior UX (no gating). */
+    private unrestricted;
+    private readonly versionSubject;
+    readonly stateVersion$: rxjs.Observable<number>;
+    /** Coalesce overlapping current-identity HTTP calls (debounce + rapid settings churn). */
+    private identityLoadPromise;
+    constructor(settings: SettingsServiceClass, zitiData: ZitiDataService);
+    private bumpVersion;
+    clear(): void;
+    refresh(): Promise<void>;
+    private loadCurrentIdentity;
+    private fetchCurrentIdentity;
+    private applyLegacyMode;
+    isUnrestricted(): boolean;
+    private isAdmin;
+    isAdminReadonly(): boolean;
+    /** True once fetchCurrentIdentity() (or clear()) has run at least once — version > 0. */
+    get permissionsLoaded(): boolean;
+    private resolveEntityKey;
+    private hasEntityGrant;
+    private hasActionGrant;
+    canRead(apiResource: string): boolean;
+    canCreate(apiResource: string): boolean;
+    canUpdate(apiResource: string): boolean;
+    canDelete(apiResource: string): boolean;
+    /** Strict read-only form UI: no write permission for this resource (covers admin_readonly and missing entity grant). */
+    useStrictReadonlyFormUi(apiResource: string, isEdit: boolean): boolean;
+    isSaveDisabled(apiResource: string, isEdit: boolean): boolean;
+    isMenuActionAllowed(apiResource: string, action: string): boolean;
+    isTableHeaderActionAllowed(apiResource: string, action: string): boolean;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ManagementPermissionsService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ManagementPermissionsService>;
+}
+
 declare class Entity {
     name: '';
 }
@@ -795,10 +851,19 @@ declare abstract class ProjectableForm extends ExtendableComponent implements Do
     ignoreDataChange: boolean;
     isScrolled: boolean;
     subscription: Subscription;
+    protected readonly managementPermissions: ManagementPermissionsService;
     formInit: boolean;
     formContainer: ElementRef;
+    get showApiCalls(): boolean;
     protected constructor(growlerService: GrowlerService, extService: ExtensionService, zitiService: ZitiDataService, router?: Router, route?: ActivatedRoute, location?: Location, settingsService?: SettingsService, dialogForm?: MatDialog);
     get isEdit(): boolean;
+    get formPermissionSaveDisabled(): boolean;
+    get formPermissionSaveTooltip(): string;
+    canReadRelated(apiResource: string): boolean;
+    get useStrictReadonlyForm(): boolean;
+    /** Blocks save from shortcuts/callbacks when the controller denies create/update for this resource. */
+    protected canSaveByPermissions(): boolean;
+    get zacManagementReadonlyHostClass(): boolean;
     ngAfterViewInit(skipFocus?: boolean): void;
     ngOnInit(): void;
     initBaseHref(): void;
@@ -975,6 +1040,7 @@ declare abstract class ListPageServiceClass {
     DEFAULT_PAGING: any;
     totalCount: number;
     dataService: ZitiDataService;
+    protected readonly managementPermissions: ManagementPermissionsService;
     refreshData: (sort?: {
         sortBy: string;
         ordering: string;
@@ -982,6 +1048,11 @@ declare abstract class ListPageServiceClass {
     selectedEntityId: String;
     menuItems: any;
     tableHeaderActions: any;
+    /** Original menus/header actions before permission filtering (for singleton page services). */
+    private menuItemsBaseline;
+    private tableHeaderActionsBaseline;
+    private menuTemplateSnapshot;
+    private tableHeaderActionsSnapshot;
     currentSettings: any;
     dialogRef: any;
     sideModalOpen: boolean;
@@ -1009,6 +1080,11 @@ declare abstract class ListPageServiceClass {
         };
     }) => string;
     constructor(settings: SettingsServiceClass, filterService: DataTableFilterService, csvDownloadService: CsvDownloadService, extensionService: ExtensionService, router?: Router);
+    /**
+     * Root-provided page services survive route changes; restore baseline menus before each table init
+     * so permission filtering does not stack on already-filtered items.
+     */
+    resetMenusForInit(): void;
     initMenuActions(): void;
     addListItemExtensionActions(row: {
         actionList: any[];
@@ -1023,6 +1099,8 @@ declare abstract class ListPageServiceClass {
     getNetworkJwt(): Promise<any>;
     openEditForm(itemId?: string, basePath?: undefined): void;
     remToPx(remValue: number): number;
+    capturePermissionSnapshots(): void;
+    rebuildMenusAndHeaders(perm: ManagementPermissionsService): void;
 }
 
 type CallbackResults = {
@@ -1186,10 +1264,15 @@ declare abstract class ListPageComponent {
     gridObj: any;
     subscription: Subscription;
     private growlerSvc;
+    protected readonly managementPermissions: ManagementPermissionsService;
+    get headerBlockCreate(): boolean;
+    get headerBlockDelete(): boolean;
+    get headerBlockRead(): boolean;
     constructor(filterService: DataTableFilterService, svc: ListPageServiceClass, consoleEvents: ConsoleEventsService, dialogForm: MatDialog, extensionService?: ExtensionService);
     ngOnInit(): void;
     ngOnDestroy(): void;
     itemToggled(item: any): void;
+    protected syncBulkDownloadHeaderAction(): void;
     updateSelectedItems(toggledItem?: any): void;
     refreshData(sort?: {
         sortBy: string;
@@ -1309,6 +1392,8 @@ declare class ConfigEditorComponent implements OnInit, AfterViewInit {
     lColorArray: string[];
     bColorArray: string[];
     hideConfigJSON: boolean;
+    /** When true, block edits to embedded config form and JSON editor (e.g. global admin_readonly). */
+    readOnly: boolean;
     configErrors: any;
     configErrorsChange: EventEmitter<any>;
     _configData: any;
@@ -1344,7 +1429,7 @@ declare class ConfigEditorComponent implements OnInit, AfterViewInit {
     jsonDataChanged(event: any): void;
     removeUndefinedProperties(data: any): any;
     static ɵfac: i0.ɵɵFactoryDeclaration<ConfigEditorComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<ConfigEditorComponent, "lib-config-editor", never, { "configErrors": { "alias": "configErrors"; "required": false; }; "configData": { "alias": "configData"; "required": false; }; "showJsonView": { "alias": "showJsonView"; "required": false; }; "schema": { "alias": "schema"; "required": false; }; }, { "configErrorsChange": "configErrorsChange"; "configDataChange": "configDataChange"; }, never, never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<ConfigEditorComponent, "lib-config-editor", never, { "readOnly": { "alias": "readOnly"; "required": false; }; "configErrors": { "alias": "configErrors"; "required": false; }; "configData": { "alias": "configData"; "required": false; }; "showJsonView": { "alias": "showJsonView"; "required": false; }; "schema": { "alias": "schema"; "required": false; }; }, { "configErrorsChange": "configErrorsChange"; "configDataChange": "configDataChange"; }, never, never, false, never>;
 }
 
 declare class ConfigTypeFormComponent extends ProjectableForm implements OnInit, OnDestroy {
@@ -1401,11 +1486,15 @@ declare class ListPageHeaderComponent {
     tabs: any[];
     showAdd: boolean;
     hideAction: boolean;
+    /** When true, hide the create (+) control even if showAdd is true. */
+    blockCreate: boolean;
+    /** When true, hide the bulk delete (-) control when rows are selected. */
+    blockDelete: boolean;
     actionClicked: EventEmitter<string>;
     clickAction(value: string): void;
     tabSelected(tab: any): boolean;
     static ɵfac: i0.ɵɵFactoryDeclaration<ListPageHeaderComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<ListPageHeaderComponent, "lib-list-page-header", never, { "title": { "alias": "title"; "required": false; }; "tabs": { "alias": "tabs"; "required": false; }; "showAdd": { "alias": "showAdd"; "required": false; }; "hideAction": { "alias": "hideAction"; "required": false; }; }, { "actionClicked": "actionClicked"; }, never, never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<ListPageHeaderComponent, "lib-list-page-header", never, { "title": { "alias": "title"; "required": false; }; "tabs": { "alias": "tabs"; "required": false; }; "showAdd": { "alias": "showAdd"; "required": false; }; "hideAction": { "alias": "hideAction"; "required": false; }; "blockCreate": { "alias": "blockCreate"; "required": false; }; "blockDelete": { "alias": "blockDelete"; "required": false; }; }, { "actionClicked": "actionClicked"; }, never, never, false, never>;
 }
 
 declare class FilterBarComponent {
@@ -1748,6 +1837,10 @@ declare class DataTableComponent implements OnChanges, OnInit {
     noItemsClass: any;
     entityTypeName: string;
     showNoItemsAdd: boolean;
+    /** When true, empty-state copy does not prompt to add (e.g. admin_readonly / no create permission). */
+    noItemsReadonly: boolean;
+    /** When true, shows "no permission to view" message instead of the table. */
+    accessDenied: boolean;
     currentPage: number;
     noItemsImage: string;
     rowHeight: number;
@@ -1882,7 +1975,7 @@ declare class DataTableComponent implements OnChanges, OnInit {
     _handleTableScroll(scroller: any): void;
     remToPx(remValue: any): number;
     static ɵfac: i0.ɵɵFactoryDeclaration<DataTableComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<DataTableComponent, "lib-data-table", never, { "rowData": { "alias": "rowData"; "required": false; }; "expandRowData": { "alias": "expandRowData"; "required": false; }; "collapseRowData": { "alias": "collapseRowData"; "required": false; }; "rowValidation": { "alias": "rowValidation"; "required": false; }; "isTimeSearchAvailable": { "alias": "isTimeSearchAvailable"; "required": false; }; "isLoading": { "alias": "isLoading"; "required": false; }; "tableId": { "alias": "tableId"; "required": false; }; "options": { "alias": "options"; "required": false; }; "validateService": { "alias": "validateService"; "required": false; }; "rowsToggled": { "alias": "rowsToggled"; "required": false; }; "tableRefreshCount": { "alias": "tableRefreshCount"; "required": false; }; "view": { "alias": "view"; "required": false; }; "serverSideDataSource": { "alias": "serverSideDataSource"; "required": false; }; "allowDownload": { "alias": "allowDownload"; "required": false; }; "startCount": { "alias": "startCount"; "required": false; }; "endCount": { "alias": "endCount"; "required": false; }; "totalCount": { "alias": "totalCount"; "required": false; }; "emptyMsg": { "alias": "emptyMsg"; "required": false; }; "filterApplied": { "alias": "filterApplied"; "required": false; }; "menuItems": { "alias": "menuItems"; "required": false; }; "headerActions": { "alias": "headerActions"; "required": false; }; "noItemsClass": { "alias": "noItemsClass"; "required": false; }; "entityTypeName": { "alias": "entityTypeName"; "required": false; }; "showNoItemsAdd": { "alias": "showNoItemsAdd"; "required": false; }; "currentPage": { "alias": "currentPage"; "required": false; }; "noItemsImage": { "alias": "noItemsImage"; "required": false; }; "rowHeight": { "alias": "rowHeight"; "required": false; }; "filterName": { "alias": "filterName"; "required": false; }; "filterColumn": { "alias": "filterColumn"; "required": false; }; "columnDefinitions": { "alias": "columnDefinitions"; "required": false; }; "refreshCount": { "alias": "refreshCount"; "required": false; }; }, { "actionRequested": "actionRequested"; "gridReady": "gridReady"; "dragStart": "dragStart"; "dragLeave": "dragLeave"; "pageChanged": "pageChanged"; }, never, never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<DataTableComponent, "lib-data-table", never, { "rowData": { "alias": "rowData"; "required": false; }; "expandRowData": { "alias": "expandRowData"; "required": false; }; "collapseRowData": { "alias": "collapseRowData"; "required": false; }; "rowValidation": { "alias": "rowValidation"; "required": false; }; "isTimeSearchAvailable": { "alias": "isTimeSearchAvailable"; "required": false; }; "isLoading": { "alias": "isLoading"; "required": false; }; "tableId": { "alias": "tableId"; "required": false; }; "options": { "alias": "options"; "required": false; }; "validateService": { "alias": "validateService"; "required": false; }; "rowsToggled": { "alias": "rowsToggled"; "required": false; }; "tableRefreshCount": { "alias": "tableRefreshCount"; "required": false; }; "view": { "alias": "view"; "required": false; }; "serverSideDataSource": { "alias": "serverSideDataSource"; "required": false; }; "allowDownload": { "alias": "allowDownload"; "required": false; }; "startCount": { "alias": "startCount"; "required": false; }; "endCount": { "alias": "endCount"; "required": false; }; "totalCount": { "alias": "totalCount"; "required": false; }; "emptyMsg": { "alias": "emptyMsg"; "required": false; }; "filterApplied": { "alias": "filterApplied"; "required": false; }; "menuItems": { "alias": "menuItems"; "required": false; }; "headerActions": { "alias": "headerActions"; "required": false; }; "noItemsClass": { "alias": "noItemsClass"; "required": false; }; "entityTypeName": { "alias": "entityTypeName"; "required": false; }; "showNoItemsAdd": { "alias": "showNoItemsAdd"; "required": false; }; "noItemsReadonly": { "alias": "noItemsReadonly"; "required": false; }; "accessDenied": { "alias": "accessDenied"; "required": false; }; "currentPage": { "alias": "currentPage"; "required": false; }; "noItemsImage": { "alias": "noItemsImage"; "required": false; }; "rowHeight": { "alias": "rowHeight"; "required": false; }; "filterName": { "alias": "filterName"; "required": false; }; "filterColumn": { "alias": "filterColumn"; "required": false; }; "columnDefinitions": { "alias": "columnDefinitions"; "required": false; }; "refreshCount": { "alias": "refreshCount"; "required": false; }; }, { "actionRequested": "actionRequested"; "gridReady": "gridReady"; "dragStart": "dragStart"; "dragLeave": "dragLeave"; "pageChanged": "pageChanged"; }, never, never, false, never>;
 }
 
 declare class TableCellSelectComponent implements ICellRendererAngularComp {
@@ -2239,6 +2332,8 @@ declare class NoItemsComponent implements OnChanges {
     hasAdd: boolean;
     hiddenResults: boolean;
     isLoading: boolean;
+    readonly: boolean;
+    accessDenied: boolean;
     background: any;
     clickEmit: EventEmitter<any>;
     refresh: EventEmitter<any>;
@@ -2246,7 +2341,7 @@ declare class NoItemsComponent implements OnChanges {
     ngOnChanges(): void;
     iconClick(): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<NoItemsComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<NoItemsComponent, "lib-no-items", never, { "image": { "alias": "image"; "required": false; }; "typeName": { "alias": "typeName"; "required": false; }; "isEmpty": { "alias": "isEmpty"; "required": false; }; "hasAdd": { "alias": "hasAdd"; "required": false; }; "hiddenResults": { "alias": "hiddenResults"; "required": false; }; "isLoading": { "alias": "isLoading"; "required": false; }; }, { "clickEmit": "clickEmit"; "refresh": "refresh"; }, never, never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<NoItemsComponent, "lib-no-items", never, { "image": { "alias": "image"; "required": false; }; "typeName": { "alias": "typeName"; "required": false; }; "isEmpty": { "alias": "isEmpty"; "required": false; }; "hasAdd": { "alias": "hasAdd"; "required": false; }; "hiddenResults": { "alias": "hiddenResults"; "required": false; }; "isLoading": { "alias": "isLoading"; "required": false; }; "readonly": { "alias": "readonly"; "required": false; }; "accessDenied": { "alias": "accessDenied"; "required": false; }; }, { "clickEmit": "clickEmit"; "refresh": "refresh"; }, never, never, false, never>;
 }
 
 declare class SideModalComponent implements OnInit {
@@ -2273,6 +2368,8 @@ declare class FormHeaderComponent implements OnChanges {
     moreActionsText: string;
     showHeaderToggle: boolean;
     showHeaderButton: boolean;
+    /** Hide save / more-actions / multi-save and retitle Edit→View for global admin_readonly without write grants. */
+    strictReadonlyUi: boolean;
     multiActions: any[];
     formViewChange: EventEmitter<string>;
     actionRequested: EventEmitter<any>;
@@ -2286,6 +2383,7 @@ declare class FormHeaderComponent implements OnChanges {
     showActionsDropDown: boolean;
     constructor();
     ngOnChanges(changes: SimpleChanges): void;
+    get displayTitle(): string;
     get hasMoreActions(): boolean;
     actionClicked(event: any): void;
     requestAction(action: any): void;
@@ -2294,7 +2392,7 @@ declare class FormHeaderComponent implements OnChanges {
     get hasMultiActions(): boolean;
     get headerBadges(): any;
     static ɵfac: i0.ɵɵFactoryDeclaration<FormHeaderComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<FormHeaderComponent, "lib-form-header", never, { "data": { "alias": "data"; "required": false; }; "badges": { "alias": "badges"; "required": false; }; "title": { "alias": "title"; "required": false; }; "moreActions": { "alias": "moreActions"; "required": false; }; "formView": { "alias": "formView"; "required": false; }; "saveDisabled": { "alias": "saveDisabled"; "required": false; }; "saveTooltip": { "alias": "saveTooltip"; "required": false; }; "actionButtonText": { "alias": "actionButtonText"; "required": false; }; "moreActionsText": { "alias": "moreActionsText"; "required": false; }; "showHeaderToggle": { "alias": "showHeaderToggle"; "required": false; }; "showHeaderButton": { "alias": "showHeaderButton"; "required": false; }; "multiActions": { "alias": "multiActions"; "required": false; }; }, { "formViewChange": "formViewChange"; "actionRequested": "actionRequested"; "multiActionRequested": "multiActionRequested"; }, never, never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<FormHeaderComponent, "lib-form-header", never, { "data": { "alias": "data"; "required": false; }; "badges": { "alias": "badges"; "required": false; }; "title": { "alias": "title"; "required": false; }; "moreActions": { "alias": "moreActions"; "required": false; }; "formView": { "alias": "formView"; "required": false; }; "saveDisabled": { "alias": "saveDisabled"; "required": false; }; "saveTooltip": { "alias": "saveTooltip"; "required": false; }; "actionButtonText": { "alias": "actionButtonText"; "required": false; }; "moreActionsText": { "alias": "moreActionsText"; "required": false; }; "showHeaderToggle": { "alias": "showHeaderToggle"; "required": false; }; "showHeaderButton": { "alias": "showHeaderButton"; "required": false; }; "strictReadonlyUi": { "alias": "strictReadonlyUi"; "required": false; }; "multiActions": { "alias": "multiActions"; "required": false; }; }, { "formViewChange": "formViewChange"; "actionRequested": "actionRequested"; "multiActionRequested": "multiActionRequested"; }, never, never, false, never>;
 }
 
 declare class FormFieldContainerComponent {
@@ -2615,6 +2713,8 @@ declare class FilterSelectComponent implements ControlValueAccessor, OnDestroy {
     matSelect?: MatSelect;
     optionTemplate?: FilterSelectOptionTemplateDirective;
     triggerTemplate?: FilterSelectTriggerTemplateDirective;
+    /** Combined with ControlValueAccessor disabled state (e.g. disable mat-select when parent form is read-only). */
+    disableControl: boolean;
     value: any;
     disabled: boolean;
     filterText: string;
@@ -2646,9 +2746,10 @@ declare class FilterSelectComponent implements ControlValueAccessor, OnDestroy {
     get isValueEmpty(): boolean;
     getOptionLabel(option: any): any;
     getOptionValue(option: any): any;
+    get selectDisabled(): boolean;
     trackByOption: (_: number, option: any) => any;
     static ɵfac: i0.ɵɵFactoryDeclaration<FilterSelectComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<FilterSelectComponent, "lib-filter-select", never, { "id": { "alias": "id"; "required": false; }; "placeholder": { "alias": "placeholder"; "required": false; }; "panelClass": { "alias": "panelClass"; "required": false; }; "options": { "alias": "options"; "required": false; }; "optionLabel": { "alias": "optionLabel"; "required": false; }; "optionValue": { "alias": "optionValue"; "required": false; }; "searchable": { "alias": "searchable"; "required": false; }; "searchPlaceholder": { "alias": "searchPlaceholder"; "required": false; }; "localFilter": { "alias": "localFilter"; "required": false; }; "openOnFocus": { "alias": "openOnFocus"; "required": false; }; "showClear": { "alias": "showClear"; "required": false; }; }, { "selectionChange": "selectionChange"; "filterChange": "filterChange"; }, ["optionTemplate", "triggerTemplate"], never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<FilterSelectComponent, "lib-filter-select", never, { "id": { "alias": "id"; "required": false; }; "placeholder": { "alias": "placeholder"; "required": false; }; "panelClass": { "alias": "panelClass"; "required": false; }; "options": { "alias": "options"; "required": false; }; "optionLabel": { "alias": "optionLabel"; "required": false; }; "optionValue": { "alias": "optionValue"; "required": false; }; "searchable": { "alias": "searchable"; "required": false; }; "searchPlaceholder": { "alias": "searchPlaceholder"; "required": false; }; "localFilter": { "alias": "localFilter"; "required": false; }; "openOnFocus": { "alias": "openOnFocus"; "required": false; }; "showClear": { "alias": "showClear"; "required": false; }; "disableControl": { "alias": "disableControl"; "required": false; }; }, { "selectionChange": "selectionChange"; "filterChange": "filterChange"; }, ["optionTemplate", "triggerTemplate"], never, false, never>;
 }
 
 declare class OverridesComponent implements OnInit {
@@ -3129,6 +3230,8 @@ declare class NetworkVisualizerComponent extends VisualizerServiceClass implemen
 
 declare class CustomTagsComponent implements OnInit, OnChanges {
     tags: any;
+    /** View-only: no add/remove/edit; show name/value as text (e.g. global admin_readonly). */
+    readOnly: boolean;
     tagsChange: EventEmitter<any>;
     tagsArray: any;
     newTagName: string;
@@ -3159,7 +3262,7 @@ declare class CustomTagsComponent implements OnInit, OnChanges {
     tagValueChanged(tag: any, event?: any): void;
     validate(event?: any): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<CustomTagsComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<CustomTagsComponent, "lib-custom-tags", never, { "tags": { "alias": "tags"; "required": false; }; }, { "tagsChange": "tagsChange"; }, never, never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<CustomTagsComponent, "lib-custom-tags", never, { "tags": { "alias": "tags"; "required": false; }; "readOnly": { "alias": "readOnly"; "required": false; }; }, { "tagsChange": "tagsChange"; }, never, never, false, never>;
 }
 
 declare class ServicePolicy {
@@ -3466,6 +3569,7 @@ declare class ServiceFormComponent extends ProjectableForm implements OnInit, On
     configFilterChanged(filterText: string): void;
     configTypeChanged($event: any): void;
     get showConfigData(): boolean;
+    get canCreateConfig(): boolean;
     attachConfig(): void;
     captureConfigEnterEvent(event: any): void;
     protected deleteServiceWithOrphans(): Promise<any>;
@@ -3683,6 +3787,8 @@ declare class SimpleServiceComponent extends ProjectableForm {
     entityIdInit: boolean;
     set entityId(id: String);
     get entityId(): String;
+    get formPermissionSaveDisabled(): boolean;
+    get formPermissionSaveTooltip(): string;
     ngOnInit(): void;
     formDataSet: boolean;
     initFormData(): Promise<[void, void]>;
@@ -3708,6 +3814,7 @@ declare class SimpleServiceComponent extends ProjectableForm {
     interceptPortChanged($event: any): void;
     hostProtocolsChanged($event: any): void;
     save(refresh?: any): Promise<void>;
+    markEntityError(summaryData: any, type: string, subtype?: string): void;
     showSummary(): any;
     checkNameConflicts(): Promise<boolean>;
     showConflictWarning(conflictData: any): void;
@@ -4490,6 +4597,10 @@ declare abstract class LoginServiceClass {
     serviceUrl: string;
     loginInProgress: boolean;
     callbackRoute: string;
+    pendingMfa: boolean;
+    mfaAuthQueries: any[];
+    completeMfaAuth(code: string): Promise<any>;
+    cancelMfaAuth(): void;
     abstract init(): any;
     abstract login(prefix: string, url: string, username: string, password: string, doNav?: any, type?: any, token?: any, isTest?: any): any;
     abstract observeLogin(serviceUrl: string, username: string, password: string, doNav?: any, type?: any, token?: any, isTest?: any): any;
@@ -7608,8 +7719,8 @@ declare class NodeDataService extends ZitiDataService {
     post(type: any, model: any, chained?: boolean): Promise<any>;
     put(type: any, model: any, id: any, chained?: boolean): Promise<any>;
     patch(type: any, model: any, id: any, chained?: boolean): Promise<any>;
-    get(type: string, paging: any, filters?: FilterObj[], url?: any): Promise<any>;
-    getSubdata(entityType: string, id: any, dataType: string): Promise<any>;
+    doGet(type: string, paging: any, filters?: FilterObj[], url?: any): Promise<any>;
+    doGetSubdata(entityType: string, id: any, dataType: string): Promise<any>;
     saveSubdata(entityType: string, id: any, dataType: string, data: any): Promise<any>;
     resetEnrollment(id: string, date: any): Promise<any>;
     deleteEnrollment(enrollmentId: string): Promise<any>;
@@ -7640,8 +7751,8 @@ declare class ZitiControllerDataService extends ZitiDataService {
     post(type: any, model: any, chained?: boolean, contentType?: any): Promise<any>;
     put(type: any, model: any, id: any, chained?: boolean): Promise<any>;
     patch(type: any, model: any, id: any, chained?: boolean): Promise<any>;
-    get(type: string, paging: any, filters?: FilterObj[], url?: any, useClient?: any): Promise<any>;
-    getSubdata(entityType: string, id: any, dataType: string, paging?: any, contentType?: any, filters?: any[]): Promise<any>;
+    doGet(type: string, paging: any, filters?: FilterObj[], url?: any, useClient?: any): Promise<any>;
+    doGetSubdata(entityType: string, id: any, dataType: string, paging?: any, contentType?: any, filters?: any[]): Promise<any>;
     saveSubdata(entityType: string, id: any, dataType: string, params: any): Promise<any>;
     deleteSubdata(entityType: string, id: any, dataType: string, params: any): Promise<any>;
     resetEnrollment(id: string, date: any): Promise<any>;
@@ -7693,6 +7804,115 @@ declare class DeactivateGuardService implements CanDeactivate<CanComponentDeacti
     static ɵprov: i0.ɵɵInjectableDeclaration<DeactivateGuardService>;
 }
 
+declare class InsecureContextError extends Error {
+    constructor();
+}
+declare function randomUrlSafeString(byteLen?: number): string;
+declare function pkceChallengeS256(verifier: string): Promise<string>;
+declare function decodeJwtPayload(token: string): any | null;
+declare function jwtExpMs(token: string): number | undefined;
+declare function jwtIatMs(token: string): number | undefined;
+
+declare const OIDC_CLIENT_ID = "openziti";
+declare const OIDC_CLIENT_ID_LEGACY = "native";
+interface OidcTokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    expiresAt: number;
+    refreshExpiresAt?: number;
+    clientId: string;
+}
+interface OidcAuthContext {
+    controllerUrl: string;
+    oidcBase: string;
+    authRequestId: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+}
+type OidcLoginStep = {
+    status: 'code';
+    code: string;
+} | {
+    status: 'totpRequired';
+    authQueries: any[];
+} | {
+    status: 'error';
+    error: any;
+};
+declare class OidcEnvironmentalError extends Error {
+    causedBy?: any;
+    constructor(message: string, causedBy?: any);
+}
+declare class OidcSessionUnrecoverableError extends Error {
+    reason?: string;
+    constructor(message: string, reason?: string);
+}
+/**
+ * Drives the ziti controller's native OIDC provider (auth code + PKCE) programmatically,
+ * the same way the ziti SDKs do, so the console keeps its own login UI.
+ *
+ * Uses fetch rather than HttpClient: the auth request id and authorization code must be
+ * parsed from Response.url after redirect-following (the controller's CORS config does not
+ * expose the auth-request-id/totp-required headers cross-origin), and these requests must
+ * bypass the app's HTTP interceptors.
+ */
+declare class ZitiOidcService {
+    private inflightRefresh;
+    buildRedirectUri(): string;
+    startAuthRequest(controllerUrl: string, options?: {
+        redirectUri?: string;
+        oidcPath?: string;
+    }): Promise<OidcAuthContext>;
+    private authorize;
+    loginWithPassword(ctx: OidcAuthContext, username: string, password: string): Promise<OidcLoginStep>;
+    loginWithExtJwt(ctx: OidcAuthContext, extToken: string): Promise<OidcLoginStep>;
+    loginWithCert(ctx: OidcAuthContext): Promise<OidcLoginStep>;
+    submitTotp(ctx: OidcAuthContext, code: string): Promise<OidcLoginStep>;
+    private submitLogin;
+    exchangeCode(ctx: OidcAuthContext, code: string): Promise<OidcTokenSet>;
+    refreshTokens(controllerUrl: string, refreshToken: string, clientId?: string, oidcPath?: string): Promise<OidcTokenSet>;
+    private doRefresh;
+    revokeToken(controllerUrl: string, token: string, hint: 'refresh_token' | 'access_token', clientId?: string, oidcPath?: string): Promise<void>;
+    private toTokenSet;
+    private normalizeUrl;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ZitiOidcService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ZitiOidcService>;
+}
+
+/**
+ * Keeps OIDC sessions alive by refreshing the access token before it expires, and
+ * self-monitors for sessions that can no longer be renewed (refresh token expired or
+ * revoked), logging the user out and returning them to the login page.
+ */
+declare class SessionRefreshService {
+    private settingsService;
+    private oidcService;
+    private growlerService;
+    private injector;
+    private refreshTimer;
+    private monitorInterval;
+    private retryDelayMs;
+    private running;
+    private readonly onWake;
+    private readonly onStorage;
+    constructor(settingsService: SettingsServiceClass, oidcService: ZitiOidcService, growlerService: GrowlerService, injector: Injector);
+    start(): void;
+    stop(): void;
+    refreshNow(): Promise<boolean>;
+    private persistTokens;
+    private scheduleNextRefresh;
+    private scheduleRetry;
+    private checkSessionState;
+    private hasOidcSession;
+    private handleUnrecoverable;
+    static ɵfac: i0.ɵɵFactoryDeclaration<SessionRefreshService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<SessionRefreshService>;
+}
+
 declare const ZITI_URLS: InjectionToken<string>;
 declare const ZITI_NAVIGATOR: InjectionToken<string>;
 declare const DEFAULT_APP_CONFIG: InjectionToken<string>;
@@ -7701,6 +7921,6 @@ declare const ZAC_VERSION: {
     version: string;
 };
 
-export { APISessionFormComponent, APISessionsPageComponent, ApiSessionsPageService, AttributesComponent, AuthPoliciesPageComponent, AuthPoliciesPageService, AuthPolicyFormComponent, AuthPolicyFormService, AuthService, BooleanToggleInputComponent, CallbackComponent, CardListComponent, CertificateAuthoritiesPageComponent, CertificateAuthoritiesPageService, CertificateAuthorityFormComponent, CertificateAuthorityFormService, CheckboxListInputComponent, ChipsInputComponent, ConfigEditorComponent, ConfigTypeFormComponent, ConfigTypesPageComponent, ConfigurationFormComponent, ConfigurationService, ConfigurationsPageComponent, CsvDownloadService, DEACTIVATE_GUARD, DEFAULT_APP_CONFIG, DataTableFilterService, DeactivateGuardService, EDGE_ROUTER_EXTENSION_SERVICE, EDGE_ROUTER_POLICY_EXTENSION_SERVICE, EdgeRouter, EdgeRouterFormComponent, EdgeRouterFormService, EdgeRouterPoliciesPageComponent, EdgeRouterPoliciesPageService, EdgeRouterPolicyFormComponent, EdgeRouterPolicyFormService, EdgeRoutersPageComponent, EdgeRoutersPageService, Entity, ExtendableComponent, ExtensionsNoopService, FilterSelectComponent, FilterSelectOptionTemplateDirective, FilterSelectTriggerTemplateDirective, FormFieldContainerComponent, FormFieldToggleComponent, FormHeaderComponent, GeolocateComponent, GrowlerComponent, GrowlerModel, GrowlerModule, GrowlerService, HAControllerService, HaStatusIndicatorComponent, HeaderBarComponent, IDENTITY_EXTENSION_SERVICE, IdentitiesPageComponent, IdentitiesPageService, Identity$1 as Identity, IdentityFormComponent, IdentityFormService, IdentityServicePathComponent, JsonViewComponent, JwtSignerFormComponent, JwtSignerFormService, JwtSignersPageComponent, JwtSignersPageService, KEY_CODES, ListPageComponent, ListPageServiceClass, LoadingIndicatorComponent, LoggerService, LoginDialogComponent, LoginServiceClass, NetworkVisualizerComponent, NodeDataService, NoopLoginService, NoopTabInterceptorService, NumberInputComponent, ObjectComponent, OpenZitiConsoleLibModule, PasswordInputComponent, PostureCheckFormComponent, PostureChecksPageComponent, PostureChecksPageService, PreviewListComponent, ProfileComponent, ProgressMeterComponent, ProgressMeterStep, ProgressWizardComponent, ProgressWizardStep, ProjectableForm, ProtocolAddressPortInputComponent, QuickAddComponent, ResetEnrollmentService, SERVICE_EDGE_ROUTER_POLICY_EXTENSION_SERVICE, SERVICE_EXTENSION_SERVICE, SERVICE_POLICY_EXTENSION_SERVICE, SETTINGS_SERVICE, SHAREDZ_EXTENSION, SelectorInputComponent, ServiceEdgeRouterPoliciesPageComponent, ServiceEdgeRouterPoliciesPageService, ServiceEdgeRouterPolicyFormComponent, ServiceEdgeRouterPolicyFormService, ServiceFormComponent, ServiceFormService, ServicePoliciesPageComponent, ServicePoliciesPageService, ServicePolicyFormComponent, ServicePolicyFormService, ServicesPageComponent, ServicesPageService, Session, SessionFormComponent, SessionsPageComponent, SessionsPageService, SettingsComponent, SettingsService, SettingsServiceClass, SideModalComponent, SideNavbarComponent, SideNavigatorComponent, SimpleServiceComponent, StringInputComponent, TabNameService, TagSelectorComponent, TerminatorFormComponent, TerminatorFormService, TerminatorsPageComponent, TerminatorsPageService, TextListInputComponent, TransitRouterFormComponent, TransitRouterFormService, TransitRoutersPageComponent, TransitRoutersPageService, ValidationService, VerifyCertificateComponent, VisualizerServiceClass, ZAC_LOGIN_SERVICE, ZAC_VERSION, ZITI_DATA_SERVICE, ZITI_DOMAIN_CONTROLLER, ZITI_NAVIGATOR, ZITI_TAB_OVERRIDES, ZITI_URLS, ZacRoutingModule, ZitiControllerDataService, ZitiDataService, playerFactory };
-export type { CanComponentDeactivate, ExtensionEvent, ExtensionEventType, ExtensionService, FilterObj, HAClusterStatus, HAController, TabInterceptorService, ZitiDomainControllerService, ZitiSessionData };
+export { APISessionFormComponent, APISessionsPageComponent, API_RESOURCE_TO_ENTITY_PERMISSION, ApiSessionsPageService, AttributesComponent, AuthPoliciesPageComponent, AuthPoliciesPageService, AuthPolicyFormComponent, AuthPolicyFormService, AuthService, BooleanToggleInputComponent, CallbackComponent, CardListComponent, CertificateAuthoritiesPageComponent, CertificateAuthoritiesPageService, CertificateAuthorityFormComponent, CertificateAuthorityFormService, CheckboxListInputComponent, ChipsInputComponent, ConfigEditorComponent, ConfigTypeFormComponent, ConfigTypesPageComponent, ConfigurationFormComponent, ConfigurationService, ConfigurationsPageComponent, CsvDownloadService, DEACTIVATE_GUARD, DEFAULT_APP_CONFIG, DataTableFilterService, DeactivateGuardService, EDGE_ROUTER_EXTENSION_SERVICE, EDGE_ROUTER_POLICY_EXTENSION_SERVICE, EdgeRouter, EdgeRouterFormComponent, EdgeRouterFormService, EdgeRouterPoliciesPageComponent, EdgeRouterPoliciesPageService, EdgeRouterPolicyFormComponent, EdgeRouterPolicyFormService, EdgeRoutersPageComponent, EdgeRoutersPageService, Entity, ExtendableComponent, ExtensionsNoopService, FilterSelectComponent, FilterSelectOptionTemplateDirective, FilterSelectTriggerTemplateDirective, FormFieldContainerComponent, FormFieldToggleComponent, FormHeaderComponent, GeolocateComponent, GrowlerComponent, GrowlerModel, GrowlerModule, GrowlerService, HAControllerService, HaStatusIndicatorComponent, HeaderBarComponent, IDENTITY_EXTENSION_SERVICE, IdentitiesPageComponent, IdentitiesPageService, Identity$1 as Identity, IdentityFormComponent, IdentityFormService, IdentityServicePathComponent, InsecureContextError, JsonViewComponent, JwtSignerFormComponent, JwtSignerFormService, JwtSignersPageComponent, JwtSignersPageService, KEY_CODES, ListPageComponent, ListPageServiceClass, LoadingIndicatorComponent, LoggerService, LoginDialogComponent, LoginServiceClass, ManagementPermissionsService, NetworkVisualizerComponent, NodeDataService, NoopLoginService, NoopTabInterceptorService, NumberInputComponent, OIDC_CLIENT_ID, OIDC_CLIENT_ID_LEGACY, ObjectComponent, OidcEnvironmentalError, OidcSessionUnrecoverableError, OpenZitiConsoleLibModule, PasswordInputComponent, PostureCheckFormComponent, PostureChecksPageComponent, PostureChecksPageService, PreviewListComponent, ProfileComponent, ProgressMeterComponent, ProgressMeterStep, ProgressWizardComponent, ProgressWizardStep, ProjectableForm, ProtocolAddressPortInputComponent, QuickAddComponent, ResetEnrollmentService, SAVE_DENIED_BY_PERMISSION_TOOLTIP, SERVICE_EDGE_ROUTER_POLICY_EXTENSION_SERVICE, SERVICE_EXTENSION_SERVICE, SERVICE_POLICY_EXTENSION_SERVICE, SETTINGS_SERVICE, SHAREDZ_EXTENSION, SelectorInputComponent, ServiceEdgeRouterPoliciesPageComponent, ServiceEdgeRouterPoliciesPageService, ServiceEdgeRouterPolicyFormComponent, ServiceEdgeRouterPolicyFormService, ServiceFormComponent, ServiceFormService, ServicePoliciesPageComponent, ServicePoliciesPageService, ServicePolicyFormComponent, ServicePolicyFormService, ServicesPageComponent, ServicesPageService, Session, SessionFormComponent, SessionRefreshService, SessionsPageComponent, SessionsPageService, SettingsComponent, SettingsService, SettingsServiceClass, SideModalComponent, SideNavbarComponent, SideNavigatorComponent, SimpleServiceComponent, StringInputComponent, TabNameService, TagSelectorComponent, TerminatorFormComponent, TerminatorFormService, TerminatorsPageComponent, TerminatorsPageService, TextListInputComponent, TransitRouterFormComponent, TransitRouterFormService, TransitRoutersPageComponent, TransitRoutersPageService, ValidationService, VerifyCertificateComponent, VisualizerServiceClass, ZAC_LOGIN_SERVICE, ZAC_VERSION, ZITI_DATA_SERVICE, ZITI_DOMAIN_CONTROLLER, ZITI_NAVIGATOR, ZITI_TAB_OVERRIDES, ZITI_URLS, ZacRoutingModule, ZitiControllerDataService, ZitiDataService, ZitiOidcService, decodeJwtPayload, jwtExpMs, jwtIatMs, pkceChallengeS256, playerFactory, randomUrlSafeString };
+export type { CanComponentDeactivate, ExtensionEvent, ExtensionEventType, ExtensionService, FilterObj, HAClusterStatus, HAController, OidcAuthContext, OidcLoginStep, OidcTokenSet, TabInterceptorService, ZitiDomainControllerService, ZitiSessionData };
 //# sourceMappingURL=index.d.ts.map