@rolatech/angular-auth 20.2.9-beta.7 → 20.3.0-beta.2

package/fesm2022/rolatech-angular-auth.mjs

@@ -1,35 +1,35 @@
 import * as i0 from '@angular/core';
-import { Component, signal, computed, Injectable, inject, output, model, PLATFORM_ID, InjectionToken, makeEnvironmentProviders } from '@angular/core';
+import { Component, signal, computed, Injectable, inject, output, model, PLATFORM_ID, InjectionToken, APP_INITIALIZER, makeEnvironmentProviders } from '@angular/core';
 import { MatDialogRef, MAT_DIALOG_DATA, MatDialogModule, MatDialog } from '@angular/material/dialog';
 import { APP_CONFIG, AngularCommonModule } from '@rolatech/angular-common';
 import { SnackBarService } from '@rolatech/angular-services';
 import QRCode from 'qrcode';
 import { MatButtonModule } from '@angular/material/button';
 import { HttpClient, HttpErrorResponse, HTTP_INTERCEPTORS } from '@angular/common/http';
-import { map, tap, filter, catchError as catchError$1 } from 'rxjs/operators';
-import { ActivatedRoute, Router } from '@angular/router';
+import { of, forkJoin, throwError, map as map$1, BehaviorSubject, catchError as catchError$1, NEVER, firstValueFrom } from 'rxjs';
+import { switchMap, catchError, map, finalize, shareReplay, tap, filter } from 'rxjs/operators';
 import { SpinnerComponent, AngularComponentsModule } from '@rolatech/angular-components';
 import * as i1 from '@angular/forms';
 import * as i2 from '@angular/material/form-field';
 import * as i3 from '@angular/material/input';
 import { isPlatformBrowser, CommonModule } from '@angular/common';
-import { of, map as map$1, BehaviorSubject, catchError, throwError, NEVER } from 'rxjs';
+import { Router, provideRouter, ROUTES } from '@angular/router';
 import { MatSnackBar } from '@angular/material/snack-bar';
 
 class ForbiddenComponent {
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: ForbiddenComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.1.1", type: ForbiddenComponent, isStandalone: true, selector: "rolatech-forbidden", ngImport: i0, template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>403.</b>\n    <p>Forbidden page.</p>\n  </div>\n</div>\n", styles: [""] });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ForbiddenComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.1", type: ForbiddenComponent, isStandalone: true, selector: "rolatech-forbidden", ngImport: i0, template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>403.</b>\n    <p>Forbidden page.</p>\n  </div>\n</div>\n", styles: [""] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: ForbiddenComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ForbiddenComponent, decorators: [{
             type: Component,
             args: [{ selector: 'rolatech-forbidden', template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>403.</b>\n    <p>Forbidden page.</p>\n  </div>\n</div>\n" }]
         }] });
 
 class UnauthorizedComponent {
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: UnauthorizedComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.1.1", type: UnauthorizedComponent, isStandalone: true, selector: "rolatech-unauthorized", ngImport: i0, template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>401.</b>\n    <p>Unauthorized page.</p>\n  </div>\n</div>\n", styles: [""] });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: UnauthorizedComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.1", type: UnauthorizedComponent, isStandalone: true, selector: "rolatech-unauthorized", ngImport: i0, template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>401.</b>\n    <p>Unauthorized page.</p>\n  </div>\n</div>\n", styles: [""] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: UnauthorizedComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: UnauthorizedComponent, decorators: [{
             type: Component,
             args: [{ selector: 'rolatech-unauthorized', template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>401.</b>\n    <p>Unauthorized page.</p>\n  </div>\n</div>\n" }]
         }] });
@@ -39,24 +39,71 @@ class AuthStore {
         userId: '',
         user: null,
         roles: [],
+        username: null,
+        platformRoles: [],
+        applications: [],
+        organizations: [],
+        permissions: [],
         authenticated: false,
         loaded: false,
     }, ...(ngDevMode ? [{ debugName: "_state" }] : []));
     userId = computed(() => this._state().userId, ...(ngDevMode ? [{ debugName: "userId" }] : []));
     user = computed(() => this._state().user, ...(ngDevMode ? [{ debugName: "user" }] : []));
     roles = computed(() => this._state().roles, ...(ngDevMode ? [{ debugName: "roles" }] : []));
+    username = computed(() => this._state().username, ...(ngDevMode ? [{ debugName: "username" }] : []));
+    platformRoles = computed(() => this._state().platformRoles, ...(ngDevMode ? [{ debugName: "platformRoles" }] : []));
+    applications = computed(() => this._state().applications, ...(ngDevMode ? [{ debugName: "applications" }] : []));
+    organizations = computed(() => this._state().organizations, ...(ngDevMode ? [{ debugName: "organizations" }] : []));
+    permissions = computed(() => this._state().permissions, ...(ngDevMode ? [{ debugName: "permissions" }] : []));
     authenticated = computed(() => this._state().authenticated, ...(ngDevMode ? [{ debugName: "authenticated" }] : []));
     loaded = computed(() => this._state().loaded, ...(ngDevMode ? [{ debugName: "loaded" }] : []));
+    me = computed(() => {
+        if (!this.loaded() || !this.authenticated()) {
+            return null;
+        }
+        return {
+            userId: this.userId(),
+            username: this.username() ?? this.user()?.username ?? '',
+            platformRoles: this.platformRoles(),
+            applications: this.applications(),
+            organizations: this.organizations(),
+            permissions: this.permissions(),
+        };
+    }, ...(ngDevMode ? [{ debugName: "me" }] : []));
+    primaryApplication = computed(() => this.applications()[0] ?? null, ...(ngDevMode ? [{ debugName: "primaryApplication" }] : []));
+    primaryOrganization = computed(() => this.organizations()[0] ?? null, ...(ngDevMode ? [{ debugName: "primaryOrganization" }] : []));
     update(data) {
         this._state.update((state) => {
             state.authenticated = data.authenticated;
-            state.userId = data.userId;
-            state.roles = data.roles;
-            state.loaded = data.loaded;
-            state.user = data.user;
+            state.userId = data.userId ?? state.userId;
+            state.roles = data.roles ?? state.roles;
+            state.loaded = data.loaded ?? state.loaded;
+            state.user = data.user ?? state.user;
+            state.username = data.username ?? state.username;
+            state.platformRoles = data.platformRoles ?? state.platformRoles;
+            state.applications = data.applications ?? state.applications;
+            state.organizations = data.organizations ?? state.organizations;
+            state.permissions = data.permissions ?? state.permissions;
             return { ...state };
         });
     }
+    clear() {
+        this._state.set({
+            userId: '',
+            user: null,
+            roles: [],
+            username: null,
+            platformRoles: [],
+            applications: [],
+            organizations: [],
+            permissions: [],
+            authenticated: false,
+            loaded: true,
+        });
+    }
+    resetLoading() {
+        this._state.update((state) => ({ ...state, loaded: false }));
+    }
     updateAuthenticated(authenticated) {
         this._state.update((state) => {
             state.authenticated = authenticated;
@@ -66,9 +113,21 @@ class AuthStore {
     updateUser(user) {
         this._state.update((state) => {
             state.user = user;
+            state.username = user.username;
             return { ...state };
         });
     }
+    updateContext(context) {
+        this._state.update((state) => ({
+            ...state,
+            userId: context.userId,
+            username: context.username,
+            platformRoles: context.platformRoles ?? [],
+            applications: context.applications ?? [],
+            organizations: context.organizations ?? [],
+            permissions: context.permissions ?? [],
+        }));
+    }
     updateEmail(email) {
         this._state.update((state) => {
             if (state.user) {
@@ -77,10 +136,81 @@ class AuthStore {
             return { ...state };
         });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthStore, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthStore, providedIn: 'root' });
+    hasAnyRole(...roles) {
+        if (!roles.length) {
+            return false;
+        }
+        const roleSet = new Set(this.roles());
+        return roles.some((role) => roleSet.has(role));
+    }
+    hasPlatformRole(...roles) {
+        if (!roles.length) {
+            return false;
+        }
+        const roleSet = new Set(this.platformRoles().length ? this.platformRoles() : this.roles());
+        return roles.some((role) => roleSet.has(role));
+    }
+    hasApplicationRole(appId, ...roles) {
+        if (!roles.length) {
+            return false;
+        }
+        return this.applications().some((membership) => {
+            if (appId && membership.appId !== appId) {
+                return false;
+            }
+            const roleSet = new Set(membership.roles);
+            return roles.some((role) => roleSet.has(role));
+        });
+    }
+    hasOrganizationRole(appId, orgId, ...roles) {
+        if (!roles.length) {
+            return false;
+        }
+        return this.organizations().some((membership) => {
+            if (appId && membership.appId !== appId) {
+                return false;
+            }
+            if (orgId && membership.orgId !== orgId) {
+                return false;
+            }
+            const roleSet = new Set(membership.roles);
+            return roles.some((role) => roleSet.has(role));
+        });
+    }
+    hasPermission(permission) {
+        return this.permissions().includes(permission);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthStore, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthStore, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthStore, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthStore, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+class AuthContextStore {
+    state = signal({
+        appId: null,
+        orgId: null,
+    }, ...(ngDevMode ? [{ debugName: "state" }] : []));
+    appId = computed(() => this.state().appId, ...(ngDevMode ? [{ debugName: "appId" }] : []));
+    orgId = computed(() => this.state().orgId, ...(ngDevMode ? [{ debugName: "orgId" }] : []));
+    setContext(appId, orgId) {
+        this.state.set({ appId, orgId });
+    }
+    setAppId(appId) {
+        this.state.update((state) => ({ ...state, appId }));
+    }
+    setOrgId(orgId) {
+        this.state.update((state) => ({ ...state, orgId }));
+    }
+    clear() {
+        this.state.set({ appId: null, orgId: null });
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthContextStore, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthContextStore, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthContextStore, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -88,39 +218,81 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImpor
 class AuthService {
     environment = inject(APP_CONFIG);
     http = inject(HttpClient);
-    route = inject(ActivatedRoute);
     authStore = inject(AuthStore);
+    authContextStore = inject(AuthContextStore);
     authenticated = this.authStore.authenticated;
     userId = this.authStore.userId;
     user = this.authStore.user;
     roles = this.authStore.roles;
+    meContext = this.authStore.me;
+    platformRoles = this.authStore.platformRoles;
+    applications = this.authStore.applications;
+    organizations = this.authStore.organizations;
+    permissions = this.authStore.permissions;
     loaded = this.authStore.loaded;
-    introspect() {
-        return this.http
+    pendingIntrospect$;
+    introspect(force = false) {
+        if (!force && this.authStore.loaded()) {
+            return of(this.currentSession());
+        }
+        if (!force && this.pendingIntrospect$) {
+            return this.pendingIntrospect$;
+        }
+        const request$ = this.http
             .get(`${this.environment.baseUrl}/auth/introspect`, {
             withCredentials: true,
         })
-            .pipe(map((res) => {
-            this.authStore.update({
-                authenticated: res.authenticated,
-                userId: res.userId,
-                roles: res.roles,
-                loaded: true,
-            });
-            if (res.authenticated) {
-                this.me().subscribe();
+            .pipe(switchMap((res) => {
+            if (!res.authenticated) {
+                this.authStore.clear();
+                this.authContextStore.clear();
+                return of(res);
             }
-            return res;
-        }));
+            return forkJoin({
+                user: this.me().pipe(catchError(() => of(null))),
+                context: this.getMeContext().pipe(catchError(() => of(this.emptyContext(res)))),
+            }).pipe(map(({ user, context }) => {
+                this.authStore.update({
+                    authenticated: true,
+                    userId: res.userId,
+                    roles: res.roles ?? [],
+                    loaded: true,
+                    user,
+                    username: context.username ?? res.username ?? user?.username ?? null,
+                    platformRoles: context.platformRoles?.length ? context.platformRoles : (res.roles ?? []),
+                    applications: context.applications ?? [],
+                    organizations: context.organizations ?? [],
+                    permissions: context.permissions ?? [],
+                });
+                this.syncContext(context);
+                return res;
+            }));
+        }), catchError((error) => {
+            this.authStore.clear();
+            this.authContextStore.clear();
+            return throwError(() => error);
+        }), finalize(() => {
+            this.pendingIntrospect$ = undefined;
+        }), shareReplay(1));
+        this.pendingIntrospect$ = request$;
+        return request$;
+    }
+    ensureLoaded(force = false) {
+        return this.introspect(force);
+    }
+    getMeContext() {
+        return this.http
+            .get(`${this.environment.baseUrl}/auth/me/context`)
+            .pipe(map((res) => res.data));
     }
     me() {
         return this.http
-            .get(`${this.environment.baseUrl}/auth/users/me`, {
+            .get(`${this.environment.baseUrl}/auth/me`, {
             withCredentials: true,
         })
             .pipe(map((res) => {
             this.authStore.updateUser(res.data);
-            return res;
+            return res.data;
         }));
     }
     wechatLogin(code, state) {
@@ -161,7 +333,7 @@ class AuthService {
             withCredentials: true,
         })
             .pipe(map((res) => {
-            this.authStore.updateAuthenticated(true);
+            this.authStore.resetLoading();
             return res.data;
         }));
     }
@@ -171,7 +343,7 @@ class AuthService {
             withCredentials: true,
         })
             .pipe(map((res) => {
-            this.authStore.updateAuthenticated(true);
+            this.authStore.resetLoading();
             return res;
         }));
     }
@@ -181,7 +353,8 @@ class AuthService {
             withCredentials: true,
         })
             .pipe(map((res) => {
-            this.authStore.updateAuthenticated(false);
+            this.authStore.clear();
+            this.authContextStore.clear();
             return res;
         }));
     }
@@ -202,7 +375,7 @@ class AuthService {
             .pipe(map((user) => {
             return user;
         }), tap((_) => {
-            this.authStore.updateAuthenticated(true);
+            this.authStore.resetLoading();
         }));
     }
     lookup(account, next) {
@@ -225,13 +398,60 @@ class AuthService {
             .pipe(map((user) => {
             return user;
         }), tap((_) => {
-            this.authStore.updateAuthenticated(true);
+            this.authStore.resetLoading();
         }));
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthService, providedIn: 'root' });
+    hasAnyRole(...roles) {
+        return this.authStore.hasAnyRole(...roles);
+    }
+    hasPlatformRole(...roles) {
+        return this.authStore.hasPlatformRole(...roles);
+    }
+    hasApplicationRole(appId, ...roles) {
+        return this.authStore.hasApplicationRole(appId, ...roles);
+    }
+    hasOrganizationRole(appId, orgId, ...roles) {
+        return this.authStore.hasOrganizationRole(appId, orgId, ...roles);
+    }
+    hasPermission(permission) {
+        return this.authStore.hasPermission(permission);
+    }
+    emptyContext(res) {
+        return {
+            userId: res.userId,
+            username: res.username ?? '',
+            platformRoles: [],
+            applications: [],
+            organizations: [],
+            permissions: [],
+        };
+    }
+    syncContext(context) {
+        if (this.authContextStore.appId() || this.authContextStore.orgId()) {
+            return;
+        }
+        const primaryOrganization = context.organizations[0] ?? null;
+        if (primaryOrganization) {
+            this.authContextStore.setContext(primaryOrganization.appId, primaryOrganization.orgId);
+            return;
+        }
+        const primaryApplication = context.applications[0] ?? null;
+        if (primaryApplication) {
+            this.authContextStore.setAppId(primaryApplication.appId);
+        }
+    }
+    currentSession() {
+        return {
+            authenticated: !!this.authStore.authenticated(),
+            userId: this.authStore.userId(),
+            roles: this.authStore.roles(),
+            username: this.authStore.username() ?? this.authStore.user()?.username,
+        };
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -290,10 +510,10 @@ class FaceidDetectDialogComponent {
             console.error(err);
         }
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: FaceidDetectDialogComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.1.1", type: FaceidDetectDialogComponent, isStandalone: true, selector: "rolatech-faceid-detect-dialog", outputs: { output: "output" }, ngImport: i0, template: "<div class=\"flex flex-col p-3 max-w-[500px] mx-auto\">\n  <div class=\"w-[256px] h-[256px] mx-auto flex justify-center items-center\">\n    @if (loading) {\n      <div>\n        <rolatech-spinner></rolatech-spinner>\n      </div>\n    }\n    <img [src]=\"qrcodeUrl\" alt />\n  </div>\n</div>\n", styles: ["*{margin:0;padding:0}.normalPanel .panelContent{width:188px;height:188px}.normalPanel .wrp_code{position:relative;width:188px;height:188px;margin:0}.impowerBox .title,.normalPanel .info{display:none}.impowerBox .qrcode{margin-top:0;border:0;width:188px;height:188px}#MAXIM{content:\"veg20170418191511\"}mat-mdc-dialog-content mdc-dialog__content{padding:0}\n"], dependencies: [{ kind: "component", type: SpinnerComponent, selector: "rolatech-spinner", inputs: ["title"] }, { kind: "ngmodule", type: MatButtonModule }] });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: FaceidDetectDialogComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.1", type: FaceidDetectDialogComponent, isStandalone: true, selector: "rolatech-faceid-detect-dialog", outputs: { output: "output" }, ngImport: i0, template: "<div class=\"flex flex-col p-3 max-w-[500px] mx-auto\">\n  <div class=\"w-[256px] h-[256px] mx-auto flex justify-center items-center\">\n    @if (loading) {\n      <div>\n        <rolatech-spinner></rolatech-spinner>\n      </div>\n    }\n    <img [src]=\"qrcodeUrl\" alt />\n  </div>\n</div>\n", styles: ["*{margin:0;padding:0}.normalPanel .panelContent{width:188px;height:188px}.normalPanel .wrp_code{position:relative;width:188px;height:188px;margin:0}.impowerBox .title,.normalPanel .info{display:none}.impowerBox .qrcode{margin-top:0;border:0;width:188px;height:188px}#MAXIM{content:\"veg20170418191511\"}mat-mdc-dialog-content mdc-dialog__content{padding:0}\n"], dependencies: [{ kind: "component", type: SpinnerComponent, selector: "rolatech-spinner", inputs: ["title"] }, { kind: "ngmodule", type: MatButtonModule }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: FaceidDetectDialogComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: FaceidDetectDialogComponent, decorators: [{
             type: Component,
             args: [{ selector: 'rolatech-faceid-detect-dialog', imports: [SpinnerComponent, MatButtonModule], template: "<div class=\"flex flex-col p-3 max-w-[500px] mx-auto\">\n  <div class=\"w-[256px] h-[256px] mx-auto flex justify-center items-center\">\n    @if (loading) {\n      <div>\n        <rolatech-spinner></rolatech-spinner>\n      </div>\n    }\n    <img [src]=\"qrcodeUrl\" alt />\n  </div>\n</div>\n", styles: ["*{margin:0;padding:0}.normalPanel .panelContent{width:188px;height:188px}.normalPanel .wrp_code{position:relative;width:188px;height:188px;margin:0}.impowerBox .title,.normalPanel .info{display:none}.impowerBox .qrcode{margin-top:0;border:0;width:188px;height:188px}#MAXIM{content:\"veg20170418191511\"}mat-mdc-dialog-content mdc-dialog__content{padding:0}\n"] }]
         }], ctorParameters: () => [], propDecorators: { output: [{ type: i0.Output, args: ["output"] }] } });
@@ -322,10 +542,10 @@ class AddressComponent {
     ngDoCheck() {
         this.output.emit(this.address());
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AddressComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.1.1", type: AddressComponent, isStandalone: true, selector: "rolatech-address", inputs: { address: { classPropertyName: "address", publicName: "address", isSignal: true, isRequired: false, transformFunction: null } }, outputs: { address: "addressChange", output: "output" }, ngImport: i0, template: "<div>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Name </mat-label>\n    <input matInput [(ngModel)]=\"address().name\" />\n  </mat-form-field>\n  @if (address().type === addressType.BILLING) {\n    <mat-form-field appearance=\"fill\">\n      <mat-label i18n> Email </mat-label>\n      <input matInput [(ngModel)]=\"address().email\" />\n    </mat-form-field>\n  }\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Phone </mat-label>\n    <input matInput [(ngModel)]=\"address().phone\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> province </mat-label>\n    <input matInput [(ngModel)]=\"address().province\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> City </mat-label>\n    <input matInput [(ngModel)]=\"address().city\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> District </mat-label>\n    <input matInput [(ngModel)]=\"address().district\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Street </mat-label>\n    <input matInput [(ngModel)]=\"address().street\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Detail </mat-label>\n    <input matInput [(ngModel)]=\"address().detail\" />\n  </mat-form-field>\n</div>\n", styles: ["mat-form-field{width:100%}\n"], dependencies: [{ kind: "ngmodule", type: AngularCommonModule }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "ngmodule", type: AngularComponentsModule }, { kind: "component", type: i2.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i2.MatLabel, selector: "mat-label" }, { kind: "directive", type: i3.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }] });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AddressComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.1", type: AddressComponent, isStandalone: true, selector: "rolatech-address", inputs: { address: { classPropertyName: "address", publicName: "address", isSignal: true, isRequired: false, transformFunction: null } }, outputs: { address: "addressChange", output: "output" }, ngImport: i0, template: "<div>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Name </mat-label>\n    <input matInput [(ngModel)]=\"address().name\" />\n  </mat-form-field>\n  @if (address().type === addressType.BILLING) {\n    <mat-form-field appearance=\"fill\">\n      <mat-label i18n> Email </mat-label>\n      <input matInput [(ngModel)]=\"address().email\" />\n    </mat-form-field>\n  }\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Phone </mat-label>\n    <input matInput [(ngModel)]=\"address().phone\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> province </mat-label>\n    <input matInput [(ngModel)]=\"address().province\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> City </mat-label>\n    <input matInput [(ngModel)]=\"address().city\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> District </mat-label>\n    <input matInput [(ngModel)]=\"address().district\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Street </mat-label>\n    <input matInput [(ngModel)]=\"address().street\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Detail </mat-label>\n    <input matInput [(ngModel)]=\"address().detail\" />\n  </mat-form-field>\n</div>\n", styles: ["mat-form-field{width:100%}\n"], dependencies: [{ kind: "ngmodule", type: AngularCommonModule }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "ngmodule", type: AngularComponentsModule }, { kind: "component", type: i2.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i2.MatLabel, selector: "mat-label" }, { kind: "directive", type: i3.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AddressComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AddressComponent, decorators: [{
             type: Component,
             args: [{ selector: 'rolatech-address', imports: [AngularCommonModule, AngularComponentsModule], template: "<div>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Name </mat-label>\n    <input matInput [(ngModel)]=\"address().name\" />\n  </mat-form-field>\n  @if (address().type === addressType.BILLING) {\n    <mat-form-field appearance=\"fill\">\n      <mat-label i18n> Email </mat-label>\n      <input matInput [(ngModel)]=\"address().email\" />\n    </mat-form-field>\n  }\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Phone </mat-label>\n    <input matInput [(ngModel)]=\"address().phone\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> province </mat-label>\n    <input matInput [(ngModel)]=\"address().province\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> City </mat-label>\n    <input matInput [(ngModel)]=\"address().city\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> District </mat-label>\n    <input matInput [(ngModel)]=\"address().district\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Street </mat-label>\n    <input matInput [(ngModel)]=\"address().street\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Detail </mat-label>\n    <input matInput [(ngModel)]=\"address().detail\" />\n  </mat-form-field>\n</div>\n", styles: ["mat-form-field{width:100%}\n"] }]
         }], propDecorators: { address: [{ type: i0.Input, args: [{ isSignal: true, alias: "address", required: false }] }, { type: i0.Output, args: ["addressChange"] }], output: [{ type: i0.Output, args: ["output"] }] } });
@@ -341,7 +561,7 @@ const AuthGuard = (route, state) => {
     const isContinue = state.url.includes('continue');
     const continueUrl = route.queryParams['continue'];
     const isSignInPage = state.url.includes('/signin');
-    return authService.introspect().pipe(map$1(({ roles, authenticated }) => {
+    return authService.ensureLoaded().pipe(map$1(({ roles, authenticated }) => {
         const routeRoles = route.data['roles'];
         const passRoled = routeRoles ? roles?.some((r) => routeRoles.indexOf(r) >= 0) : true;
         if (authenticated && !passRoled) {
@@ -381,10 +601,10 @@ const AuthGuard = (route, state) => {
 
 class AuthDialogComponent {
     dialogRef = inject(MatDialogRef);
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthDialogComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.1.1", type: AuthDialogComponent, isStandalone: true, selector: "rolatech-auth-dialog", ngImport: i0, template: "<p>auth-dialog works!</p>\n", styles: [""], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "ngmodule", type: MatDialogModule }] });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthDialogComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.1", type: AuthDialogComponent, isStandalone: true, selector: "rolatech-auth-dialog", ngImport: i0, template: "<p>auth-dialog works!</p>\n", styles: [""], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "ngmodule", type: MatDialogModule }] });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthDialogComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthDialogComponent, decorators: [{
             type: Component,
             args: [{ selector: 'rolatech-auth-dialog', imports: [CommonModule, MatDialogModule], template: "<p>auth-dialog works!</p>\n" }]
         }] });
@@ -419,6 +639,93 @@ const AuthDialogGuard = (route, state) => {
     }));
 };
 
+function matchesRouteAccessPolicy(authStore, authContextStore, policy) {
+    if (!policy) {
+        return true;
+    }
+    if (policy.authenticated !== undefined && authStore.authenticated() !== policy.authenticated) {
+        return false;
+    }
+    const appId = authContextStore.appId() ?? authStore.primaryApplication()?.appId ?? authStore.primaryOrganization()?.appId ?? null;
+    const orgId = authContextStore.orgId() ?? authStore.primaryOrganization()?.orgId ?? null;
+    const groupMatches = [];
+    if (policy.anyRole?.length) {
+        groupMatches.push(authStore.hasAnyRole(...policy.anyRole));
+    }
+    if (policy.anyPlatformRole?.length) {
+        groupMatches.push(authStore.hasPlatformRole(...policy.anyPlatformRole));
+    }
+    if (policy.anyApplicationRole?.length) {
+        groupMatches.push(authStore.hasApplicationRole(appId, ...policy.anyApplicationRole));
+    }
+    if (policy.anyOrganizationRole?.length) {
+        groupMatches.push(authStore.hasOrganizationRole(appId, orgId, ...policy.anyOrganizationRole));
+    }
+    if (policy.anyPermission?.length) {
+        groupMatches.push(policy.anyPermission.some((permission) => authStore.hasPermission(permission)));
+    }
+    if (!groupMatches.length) {
+        return true;
+    }
+    return groupMatches.some(Boolean);
+}
+
+function accessGuard(policy, fallbackUrl = '/forbidden') {
+    return () => {
+        const router = inject(Router);
+        const authService = inject(AuthService);
+        const authStore = inject(AuthStore);
+        const authContextStore = inject(AuthContextStore);
+        return authService.ensureLoaded().pipe(map(() => (matchesRouteAccessPolicy(authStore, authContextStore, policy) ? true : router.parseUrl(fallbackUrl))));
+    };
+}
+function accessMatchGuard(policy, fallbackUrl = '/forbidden') {
+    return () => {
+        const router = inject(Router);
+        const authService = inject(AuthService);
+        const authStore = inject(AuthStore);
+        const authContextStore = inject(AuthContextStore);
+        return authService.ensureLoaded().pipe(map(() => (matchesRouteAccessPolicy(authStore, authContextStore, policy) ? true : router.parseUrl(fallbackUrl))));
+    };
+}
+
+const PLATFORM_ADMIN_ROLES = ['PLATFORM_ADMIN', 'ROLE_PLATFORM_ADMIN'];
+const APPLICATION_OWNER_ROLES = ['APPLICATION_OWNER', 'APP_OWNER', 'ROLE_APPLICATION_OWNER', 'ROLE_APP_OWNER'];
+const APPLICATION_ADMIN_ROLES = ['APPLICATION_ADMIN', 'APP_ADMIN', 'ROLE_APPLICATION_ADMIN', 'ROLE_APP_ADMIN'];
+const ORGANIZATION_OWNER_ROLES = ['ORGANIZATION_OWNER', 'ORG_OWNER', 'ROLE_ORGANIZATION_OWNER', 'ROLE_ORG_OWNER'];
+const ORGANIZATION_ADMIN_ROLES = ['ORGANIZATION_ADMIN', 'ORG_ADMIN', 'ROLE_ORGANIZATION_ADMIN', 'ROLE_ORG_ADMIN'];
+const ORGANIZATION_MEMBER_ROLES = ['ORGANIZATION_MEMBER', 'ORG_MEMBER', 'ROLE_ORGANIZATION_MEMBER', 'ROLE_ORG_MEMBER'];
+const ORGANIZATION_STAFF_ROLES = ['ORGANIZATION_STAFF', 'ORG_STAFF', 'ROLE_ORGANIZATION_STAFF', 'ROLE_ORG_STAFF'];
+
+function landingRedirectGuard(targets = {}) {
+    const resolvedTargets = {
+        platform: targets.platform ?? '/platform',
+        application: targets.application ?? '/app',
+        organization: targets.organization ?? '/organization',
+        forbidden: targets.forbidden ?? '/forbidden',
+    };
+    return () => {
+        const router = inject(Router);
+        const authService = inject(AuthService);
+        const authStore = inject(AuthStore);
+        const authContextStore = inject(AuthContextStore);
+        return authService.ensureLoaded().pipe(map(() => {
+            const appId = authContextStore.appId() ?? authStore.primaryApplication()?.appId ?? authStore.primaryOrganization()?.appId ?? null;
+            const orgId = authContextStore.orgId() ?? authStore.primaryOrganization()?.orgId ?? null;
+            if (authStore.hasPlatformRole(...PLATFORM_ADMIN_ROLES)) {
+                return router.parseUrl(resolvedTargets.platform);
+            }
+            if (authStore.hasApplicationRole(appId, ...APPLICATION_OWNER_ROLES, ...APPLICATION_ADMIN_ROLES)) {
+                return router.parseUrl(resolvedTargets.application);
+            }
+            if (authStore.hasOrganizationRole(appId, orgId, ...ORGANIZATION_OWNER_ROLES, ...ORGANIZATION_ADMIN_ROLES, ...ORGANIZATION_MEMBER_ROLES, ...ORGANIZATION_STAFF_ROLES)) {
+                return router.parseUrl(resolvedTargets.organization);
+            }
+            return router.parseUrl(resolvedTargets.forbidden);
+        }));
+    };
+}
+
 const RoleGuard = (route, state) => {
     const authService = inject(AuthService);
     const environment = inject(APP_CONFIG);
@@ -434,7 +741,7 @@ const RoleGuard = (route, state) => {
     // if (!routeRoles) {
     //   return of(false);
     // }
-    return authService.introspect().pipe(filter((res) => res.roles !== null && res.roles.length > 0), map$1(({ roles }) => {
+    return authService.ensureLoaded().pipe(filter((res) => res.roles !== null && res.roles.length > 0), map$1(({ roles }) => {
         const authed = roles.some((r) => routeRoles?.indexOf(r) >= 0);
         if (!authed) {
             router.navigate(['/forbidden']);
@@ -481,7 +788,7 @@ class AuthUserService {
     }
     me() {
         return this.http
-            .get(`${this.environment.baseUrl}/auth/users/me`, {
+            .get(`${this.environment.baseUrl}/auth/me`, {
             withCredentials: true,
         })
             .pipe(map$1((res) => {
@@ -530,7 +837,7 @@ class AuthUserService {
         });
     }
     changeName(name) {
-        return this.http.put(`${this.environment.baseUrl}/auth/users/me`, { name }, {
+        return this.http.put(`${this.environment.baseUrl}/auth/me`, { name }, {
             withCredentials: true,
         });
     }
@@ -540,7 +847,7 @@ class AuthUserService {
         });
     }
     update(data) {
-        return this.http.put(`${this.environment.baseUrl}/auth/users/me`, data, {
+        return this.http.put(`${this.environment.baseUrl}/auth/me`, data, {
             withCredentials: true,
         });
     }
@@ -598,10 +905,10 @@ class AuthUserService {
     deleteAddressById(id) {
         return this.http.delete(`${this.environment.baseUrl}/auth/users/addresses/${id}`, { withCredentials: true });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthUserService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthUserService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthUserService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthUserService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthUserService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthUserService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root',
@@ -648,10 +955,10 @@ class AuthAgentService {
             withCredentials: true,
         });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthAgentService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthAgentService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthAgentService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthAgentService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthAgentService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthAgentService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root',
@@ -695,10 +1002,10 @@ class LocalStorageService {
     setItem(key, value) {
         return this.storage.setItem(key, value);
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: LocalStorageService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: LocalStorageService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: LocalStorageService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: LocalStorageService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: LocalStorageService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: LocalStorageService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root',
@@ -710,7 +1017,7 @@ class ErrorInterceptor {
     isRefreshingToken = false;
     authService = inject(AuthService);
     intercept(request, next) {
-        return next.handle(request).pipe(catchError((error) => {
+        return next.handle(request).pipe(catchError$1((error) => {
             if (error instanceof HttpErrorResponse) {
                 switch (error.status) {
                     case 400:
@@ -756,10 +1063,10 @@ class ErrorInterceptor {
         return throwError(() => new Error('系统错误'));
         // return throwError(() => error.error);
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: ErrorInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: ErrorInterceptor });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ErrorInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ErrorInterceptor });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: ErrorInterceptor, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ErrorInterceptor, decorators: [{
             type: Injectable
         }] });
 
@@ -777,7 +1084,7 @@ class AuthInterceptor {
             //   // window.location.href = res.headers.get('Location') as string;
             // }
             return res;
-        }), catchError$1((error) => {
+        }), catchError((error) => {
             if (isPlatformBrowser(this.platformId)) {
                 if (error.url?.includes('auth/introspect')) {
                     // if (window.location.origin !== `${this.environment.accountsUrl}`) {
@@ -808,10 +1115,10 @@ class AuthInterceptor {
             },
         });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthInterceptor });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthInterceptor });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.1.1", ngImport: i0, type: AuthInterceptor, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AuthInterceptor, decorators: [{
             type: Injectable
         }], ctorParameters: () => [] });
 
@@ -835,6 +1142,20 @@ function provideAngularAuth(config) {
             useClass: AuthInterceptor,
             multi: true,
         },
+        {
+            provide: APP_INITIALIZER,
+            multi: true,
+            useFactory: () => {
+                const authService = inject(AuthService);
+                const platformId = inject(PLATFORM_ID);
+                return () => {
+                    if (config?.autoLoadSession === false || !isPlatformBrowser(platformId)) {
+                        return Promise.resolve();
+                    }
+                    return firstValueFrom(authService.ensureLoaded().pipe(catchError(() => of(null))));
+                };
+            },
+        },
     ];
     return makeEnvironmentProviders(providers);
 }
@@ -850,9 +1171,116 @@ const authRoutes = [
     },
 ];
 
+const ROLE_NAVIGATION_LINKS = new InjectionToken('ROLE_NAVIGATION_LINKS');
+function provideRoleNavigation(links) {
+    const providers = [
+        {
+            provide: ROLE_NAVIGATION_LINKS,
+            useValue: links,
+            multi: true,
+        },
+    ];
+    return makeEnvironmentProviders(providers);
+}
+
+class AppNavigationService {
+    authStore = inject(AuthStore);
+    authContextStore = inject(AuthContextStore);
+    linkGroups = inject(ROLE_NAVIGATION_LINKS, { optional: true }) ?? [];
+    links = computed(() => {
+        this.authStore.authenticated();
+        this.authStore.loaded();
+        this.authContextStore.appId();
+        this.authContextStore.orgId();
+        return this.linkGroups
+            .flat()
+            .sort((left, right) => (left.order ?? 0) - (right.order ?? 0))
+            .map((link) => this.toNavLink(link))
+            .filter((link) => link !== null);
+    }, ...(ngDevMode ? [{ debugName: "links" }] : []));
+    toNavLink(link) {
+        if (link.visible === false || !matchesRouteAccessPolicy(this.authStore, this.authContextStore, link.access)) {
+            return null;
+        }
+        const children = link.children
+            ?.map((child) => this.toNavLink(child))
+            .filter((child) => child !== null);
+        if (link.children?.length && !children?.length) {
+            return null;
+        }
+        return {
+            ...link,
+            children,
+        };
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AppNavigationService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AppNavigationService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AppNavigationService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+const ROLE_SHELL_CHILD_ROUTES = new InjectionToken('ROLE_SHELL_CHILD_ROUTES');
+function provideRoleShellRoutes(routes) {
+    const providers = [
+        {
+            provide: ROLE_SHELL_CHILD_ROUTES,
+            useValue: routes,
+            multi: true,
+        },
+    ];
+    return makeEnvironmentProviders(providers);
+}
+function provideRoleAwareFeature(config) {
+    const providers = [];
+    if (config.routes?.length) {
+        providers.push(provideRoleShellRoutes(config.routes));
+    }
+    if (config.navigation?.length) {
+        providers.push(provideRoleNavigation(config.navigation));
+    }
+    return makeEnvironmentProviders(providers);
+}
+function provideRoleAwareShellRouter(config, ...features) {
+    const providers = [
+        provideRouter([], ...features),
+        {
+            provide: ROUTES,
+            multi: true,
+            useFactory: () => {
+                const contributedRoutes = inject(ROLE_SHELL_CHILD_ROUTES, { optional: true }) ?? [];
+                return [
+                    ...(config.topLevelRoutes ?? []),
+                    {
+                        path: '',
+                        component: config.shellComponent,
+                        canActivate: config.shellCanActivate,
+                        canActivateChild: config.shellCanActivateChild,
+                        data: config.shellData,
+                        children: [...(config.shellChildren ?? []), ...contributedRoutes.flat()],
+                    },
+                    ...(config.fallbackRoute ? [config.fallbackRoute] : []),
+                ];
+            },
+        },
+    ];
+    return makeEnvironmentProviders(providers);
+}
+function provideRoleAwareConsoleShell(config, ...features) {
+    return makeEnvironmentProviders([
+        provideRoleAwareShellRouter({
+            ...config,
+            shellCanActivate: config.shellCanActivate ?? [AuthGuard],
+            shellCanActivateChild: config.shellCanActivateChild ?? [AuthGuard],
+        }, ...features),
+        ...(config.navigation?.length ? [provideRoleNavigation(config.navigation)] : []),
+    ]);
+}
+
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_METHODS, AddressComponent, AddressType, AuthAgentService, AuthDialogGuard, AuthGuard, AuthInterceptor, AuthMethod, AuthService, AuthStore, AuthUserService, ErrorInterceptor, FaceidDetectDialogComponent, ForbiddenComponent, LocalStorageService, PermissionGuard, RoleGuard, UnauthorizedComponent, UserStatus, authRoutes, provideAngularAuth };
+export { APPLICATION_ADMIN_ROLES, APPLICATION_OWNER_ROLES, AUTH_METHODS, AddressComponent, AddressType, AppNavigationService, AuthAgentService, AuthContextStore, AuthDialogGuard, AuthGuard, AuthInterceptor, AuthMethod, AuthService, AuthStore, AuthUserService, ErrorInterceptor, FaceidDetectDialogComponent, ForbiddenComponent, LocalStorageService, ORGANIZATION_ADMIN_ROLES, ORGANIZATION_MEMBER_ROLES, ORGANIZATION_OWNER_ROLES, ORGANIZATION_STAFF_ROLES, PLATFORM_ADMIN_ROLES, PermissionGuard, ROLE_NAVIGATION_LINKS, ROLE_SHELL_CHILD_ROUTES, RoleGuard, UnauthorizedComponent, UserStatus, accessGuard, accessMatchGuard, authRoutes, landingRedirectGuard, provideAngularAuth, provideRoleAwareConsoleShell, provideRoleAwareFeature, provideRoleAwareShellRouter, provideRoleNavigation, provideRoleShellRoutes };
 //# sourceMappingURL=rolatech-angular-auth.mjs.map