@rolatech/angular-auth 20.3.0-beta.4 → 20.3.1-beta.2

package/fesm2022/rolatech-angular-auth.mjs

@@ -1,43 +1,27 @@
+import { Location, isPlatformBrowser, CommonModule } from '@angular/common';
 import * as i0 from '@angular/core';
-import { Component, signal, computed, Injectable, input, inject, ChangeDetectionStrategy, output, model, PLATFORM_ID, InjectionToken, APP_INITIALIZER, makeEnvironmentProviders } from '@angular/core';
+import { signal, computed, Injectable, inject, Component, input, ChangeDetectionStrategy, output, model, PLATFORM_ID, InjectionToken, APP_INITIALIZER, makeEnvironmentProviders } from '@angular/core';
+import * as i1 from '@angular/material/button';
+import { MatButtonModule } from '@angular/material/button';
+import * as i2 from '@angular/material/progress-spinner';
+import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
+import { ActivatedRoute, Router, RouterLink, provideRouter, ROUTES } from '@angular/router';
+import { APP_CONFIG, AngularCommonModule } from '@rolatech/angular-common';
+import { of, forkJoin, throwError, catchError as catchError$1, switchMap as switchMap$1, map as map$1, BehaviorSubject, NEVER, firstValueFrom } from 'rxjs';
+import { HttpClient, HttpErrorResponse, HTTP_INTERCEPTORS } from '@angular/common/http';
+import { switchMap, catchError, map, finalize, shareReplay, tap } from 'rxjs/operators';
 import { toSignal, toObservable } from '@angular/core/rxjs-interop';
-import * as i2 from '@angular/material/icon';
+import * as i2$1 from '@angular/material/icon';
 import { MatIconModule } from '@angular/material/icon';
-import * as i1 from '@angular/material/menu';
+import * as i1$1 from '@angular/material/menu';
 import { MatMenuModule } from '@angular/material/menu';
-import { RouterLink, Router, provideRouter, ROUTES } from '@angular/router';
 import { OnboardingApplicantService, SnackBarService } from '@rolatech/angular-services';
-import { switchMap, of, catchError, forkJoin, throwError, map as map$1, BehaviorSubject, NEVER, firstValueFrom } from 'rxjs';
 import { MatDialogRef, MAT_DIALOG_DATA, MatDialogModule, MatDialog } from '@angular/material/dialog';
-import { APP_CONFIG, AngularCommonModule } from '@rolatech/angular-common';
 import QRCode from 'qrcode';
-import { MatButtonModule } from '@angular/material/button';
-import { HttpClient, HttpErrorResponse, HTTP_INTERCEPTORS } from '@angular/common/http';
-import { switchMap as switchMap$1, catchError as catchError$1, map, finalize, shareReplay, tap, filter } from 'rxjs/operators';
 import { SpinnerComponent, AngularComponentsModule } from '@rolatech/angular-components';
-import * as i1$1 from '@angular/forms';
-import * as i2$1 from '@angular/material/form-field';
+import * as i1$2 from '@angular/forms';
+import * as i2$2 from '@angular/material/form-field';
 import * as i3 from '@angular/material/input';
-import { isPlatformBrowser, CommonModule } from '@angular/common';
-import { MatSnackBar } from '@angular/material/snack-bar';
-
-class ForbiddenComponent {
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ForbiddenComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.1", type: ForbiddenComponent, isStandalone: true, selector: "rolatech-forbidden", ngImport: i0, template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>403.</b>\n    <p>Forbidden page.</p>\n  </div>\n</div>\n", styles: [""] });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ForbiddenComponent, decorators: [{
-            type: Component,
-            args: [{ selector: 'rolatech-forbidden', template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>403.</b>\n    <p>Forbidden page.</p>\n  </div>\n</div>\n" }]
-        }] });
-
-class UnauthorizedComponent {
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: UnauthorizedComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.1", type: UnauthorizedComponent, isStandalone: true, selector: "rolatech-unauthorized", ngImport: i0, template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>401.</b>\n    <p>Unauthorized page.</p>\n  </div>\n</div>\n", styles: [""] });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: UnauthorizedComponent, decorators: [{
-            type: Component,
-            args: [{ selector: 'rolatech-unauthorized', template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>401.</b>\n    <p>Unauthorized page.</p>\n  </div>\n</div>\n" }]
-        }] });
 
 class AuthContextStore {
     state = signal({
@@ -220,128 +204,59 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImpor
             args: [{ providedIn: 'root' }]
         }] });
 
-const PLATFORM_ADMIN_ROLES = ['PLATFORM_ADMIN', 'ROLE_PLATFORM_ADMIN'];
-const APPLICATION_OWNER_ROLES = ['APPLICATION_OWNER', 'APP_OWNER', 'ROLE_APPLICATION_OWNER', 'ROLE_APP_OWNER'];
-const APPLICATION_ADMIN_ROLES = ['APPLICATION_ADMIN', 'APP_ADMIN', 'ROLE_APPLICATION_ADMIN', 'ROLE_APP_ADMIN'];
-const ORGANIZATION_OWNER_ROLES = ['ORGANIZATION_OWNER', 'ORG_OWNER', 'ROLE_ORGANIZATION_OWNER', 'ROLE_ORG_OWNER'];
-const ORGANIZATION_ADMIN_ROLES = ['ORGANIZATION_ADMIN', 'ORG_ADMIN', 'ROLE_ORGANIZATION_ADMIN', 'ROLE_ORG_ADMIN'];
-const ORGANIZATION_MEMBER_ROLES = ['ORGANIZATION_MEMBER', 'ORG_MEMBER', 'ROLE_ORGANIZATION_MEMBER', 'ROLE_ORG_MEMBER'];
-const ORGANIZATION_STAFF_ROLES = ['ORGANIZATION_STAFF', 'ORG_STAFF', 'ROLE_ORGANIZATION_STAFF', 'ROLE_ORG_STAFF'];
-
-class AgentAccessMenuComponent {
-    applicationCode = input('primecasa', ...(ngDevMode ? [{ debugName: "applicationCode" }] : []));
-    applyRouterLink = input('/agents', ...(ngDevMode ? [{ debugName: "applyRouterLink" }] : []));
-    dashboardRouterLink = input('/organization', ...(ngDevMode ? [{ debugName: "dashboardRouterLink" }] : []));
-    showApplyAction = input(true, ...(ngDevMode ? [{ debugName: "showApplyAction" }] : []));
-    dashboardLabel = input('Agent dashboard', ...(ngDevMode ? [{ debugName: "dashboardLabel" }] : []));
-    authStore = inject(AuthStore);
-    authContextStore = inject(AuthContextStore);
-    onboardingApplicantService = inject(OnboardingApplicantService);
-    mine = toSignal(toObservable(computed(() => ({
-        authenticated: this.authStore.authenticated(),
-        loaded: this.authStore.loaded(),
-        applicationCode: this.applicationCode(),
-    }))).pipe(switchMap(({ authenticated, loaded, applicationCode }) => {
-        if (!loaded || !authenticated || !applicationCode) {
-            return of(null);
-        }
-        return this.onboardingApplicantService.listMine(applicationCode).pipe(catchError(() => of([])));
-    })), { initialValue: null });
-    latestApplication = computed(() => {
-        const applications = this.mine();
-        if (!applications?.length) {
-            return null;
-        }
-        return [...applications].sort((left, right) => this.toTimestamp(right) - this.toTimestamp(left))[0] ?? null;
-    }, ...(ngDevMode ? [{ debugName: "latestApplication" }] : []));
-    hasDashboardAccess = computed(() => {
-        this.authStore.loaded();
-        const appId = this.authContextStore.appId() ?? this.authStore.primaryApplication()?.appId ?? this.authStore.primaryOrganization()?.appId ?? null;
-        return this.authStore.hasOrganizationRole(appId, null, ...ORGANIZATION_OWNER_ROLES, ...ORGANIZATION_ADMIN_ROLES, ...ORGANIZATION_MEMBER_ROLES);
-    }, ...(ngDevMode ? [{ debugName: "hasDashboardAccess" }] : []));
-    entry = computed(() => {
-        if (this.hasDashboardAccess()) {
-            return {
-                icon: 'storefront',
-                label: this.dashboardLabel(),
-                routerLink: this.dashboardRouterLink(),
-            };
-        }
-        const application = this.latestApplication();
-        if (application) {
-            return {
-                icon: 'assignment',
-                label: this.applicationLabel(application.status),
-                routerLink: this.applicationRouterLink(application),
-            };
+const LAST_ALLOWED_URL_KEY = 'rolatech.auth.last-allowed-url';
+function normalizeUrl(url) {
+    if (!url) {
+        return null;
+    }
+    if (url.startsWith('http://') || url.startsWith('https://')) {
+        try {
+            const parsed = new URL(url);
+            return `${parsed.pathname}${parsed.search}${parsed.hash}` || '/';
         }
-        if (!this.showApplyAction()) {
+        catch {
             return null;
         }
-        return {
-            icon: 'badge',
-            label: 'Apply as agent',
-            routerLink: this.applyRouterLink(),
-        };
-    }, ...(ngDevMode ? [{ debugName: "entry" }] : []));
-    applicationLabel(status) {
-        switch (status) {
-            case 'APPROVED':
-                return 'Agent application approved';
-            case 'FAILED':
-                return 'Agent application result';
-            case 'NEED_MORE_INFO':
-                return 'Agent application updates';
-            case 'SUBMITTED':
-            case 'IN_REVIEW':
-                return 'Agent application review';
-            default:
-                return 'Continue agent application';
-        }
-    }
-    applicationRouterLink(application) {
-        const route = this.canOpenReview(application) ? 'review' : 'form';
-        return ['/agents', application.id, route];
     }
-    canOpenReview(application) {
-        const progress = application.progress;
-        if (progress && !this.isFormComplete(progress)) {
-            return false;
-        }
-        return application.status !== 'DRAFT' || this.isFormComplete(progress);
+    return url.startsWith('/') ? url : `/${url}`;
+}
+function isAccessBoundaryUrl(url) {
+    return url.startsWith('/forbidden') || url.startsWith('/unauthorized');
+}
+function rememberAllowedUrl(url) {
+    if (typeof window === 'undefined') {
+        return;
     }
-    isFormComplete(progress) {
-        return Boolean(progress?.profileCompleted && progress.qualificationCompleted && progress.financialCompleted && progress.bankingCompleted);
+    const normalizedUrl = normalizeUrl(url);
+    if (!normalizedUrl || isAccessBoundaryUrl(normalizedUrl)) {
+        return;
     }
-    toTimestamp(application) {
-        return Date.parse(application.updatedAt ?? application.createdAt ?? '') || 0;
+    window.sessionStorage.setItem(LAST_ALLOWED_URL_KEY, normalizedUrl);
+}
+function readLastAllowedUrl() {
+    if (typeof window === 'undefined') {
+        return null;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AgentAccessMenuComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.1", type: AgentAccessMenuComponent, isStandalone: true, selector: "rolatech-agent-access-menu", inputs: { applicationCode: { classPropertyName: "applicationCode", publicName: "applicationCode", isSignal: true, isRequired: false, transformFunction: null }, applyRouterLink: { classPropertyName: "applyRouterLink", publicName: "applyRouterLink", isSignal: true, isRequired: false, transformFunction: null }, dashboardRouterLink: { classPropertyName: "dashboardRouterLink", publicName: "dashboardRouterLink", isSignal: true, isRequired: false, transformFunction: null }, showApplyAction: { classPropertyName: "showApplyAction", publicName: "showApplyAction", isSignal: true, isRequired: false, transformFunction: null }, dashboardLabel: { classPropertyName: "dashboardLabel", publicName: "dashboardLabel", isSignal: true, isRequired: false, transformFunction: null } }, ngImport: i0, template: `
-    @if (entry(); as item) {
-      <a mat-menu-item [routerLink]="item.routerLink" class="px-6 flex items-center cursor-pointer">
-        <mat-icon>{{ item.icon }}</mat-icon>
-        <span class="flex items-center pl-1">{{ item.label }}</span>
-      </a>
+    const value = normalizeUrl(window.sessionStorage.getItem(LAST_ALLOWED_URL_KEY));
+    if (!value || isAccessBoundaryUrl(value)) {
+        return null;
     }
-  `, isInline: true, dependencies: [{ kind: "ngmodule", type: MatMenuModule }, { kind: "component", type: i1.MatMenuItem, selector: "[mat-menu-item]", inputs: ["role", "disabled", "disableRipple"], exportAs: ["matMenuItem"] }, { kind: "ngmodule", type: MatIconModule }, { kind: "component", type: i2.MatIcon, selector: "mat-icon", inputs: ["color", "inline", "svgIcon", "fontSet", "fontIcon"], exportAs: ["matIcon"] }, { kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "routerLink"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+    return value;
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AgentAccessMenuComponent, decorators: [{
-            type: Component,
-            args: [{
-                    selector: 'rolatech-agent-access-menu',
-                    imports: [MatMenuModule, MatIconModule, RouterLink],
-                    template: `
-    @if (entry(); as item) {
-      <a mat-menu-item [routerLink]="item.routerLink" class="px-6 flex items-center cursor-pointer">
-        <mat-icon>{{ item.icon }}</mat-icon>
-        <span class="flex items-center pl-1">{{ item.label }}</span>
-      </a>
+function createForbiddenUrlTree(router, deniedUrl, reason = 'forbidden') {
+    const queryParams = {
+        reason,
+    };
+    const normalizedDeniedUrl = normalizeUrl(deniedUrl);
+    if (normalizedDeniedUrl) {
+        queryParams['denied'] = normalizedDeniedUrl;
     }
-  `,
-                    changeDetection: ChangeDetectionStrategy.OnPush,
-                }]
-        }], propDecorators: { applicationCode: [{ type: i0.Input, args: [{ isSignal: true, alias: "applicationCode", required: false }] }], applyRouterLink: [{ type: i0.Input, args: [{ isSignal: true, alias: "applyRouterLink", required: false }] }], dashboardRouterLink: [{ type: i0.Input, args: [{ isSignal: true, alias: "dashboardRouterLink", required: false }] }], showApplyAction: [{ type: i0.Input, args: [{ isSignal: true, alias: "showApplyAction", required: false }] }], dashboardLabel: [{ type: i0.Input, args: [{ isSignal: true, alias: "dashboardLabel", required: false }] }] } });
+    const fallbackUrl = readLastAllowedUrl();
+    if (fallbackUrl) {
+        queryParams['fallback'] = fallbackUrl;
+    }
+    return router.createUrlTree(['/forbidden'], { queryParams });
+}
 
 class AuthService {
     environment = inject(APP_CONFIG);
@@ -370,15 +285,15 @@ class AuthService {
             .get(`${this.environment.baseUrl}/auth/introspect`, {
             withCredentials: true,
         })
-            .pipe(switchMap$1((res) => {
+            .pipe(switchMap((res) => {
             if (!res.authenticated) {
                 this.authStore.clear();
                 this.authContextStore.clear();
                 return of(res);
             }
             return forkJoin({
-                user: this.me().pipe(catchError$1(() => of(null))),
-                context: this.getMeContext().pipe(catchError$1(() => of(this.emptyContext(res)))),
+                user: this.me().pipe(catchError(() => of(null))),
+                context: this.getMeContext().pipe(catchError(() => of(this.emptyContext(res)))),
             }).pipe(map(({ user, context }) => {
                 this.authStore.update({
                     authenticated: true,
@@ -395,7 +310,7 @@ class AuthService {
                 this.syncContext(context);
                 return res;
             }));
-        }), catchError$1((error) => {
+        }), catchError((error) => {
             this.authStore.clear();
             this.authContextStore.clear();
             return throwError(() => error);
@@ -584,6 +499,214 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImpor
             args: [{ providedIn: 'root' }]
         }] });
 
+class ForbiddenComponent {
+    route = inject(ActivatedRoute);
+    router = inject(Router);
+    location = inject(Location);
+    authService = inject(AuthService);
+    authStore = inject(AuthStore);
+    authContextStore = inject(AuthContextStore);
+    environment = inject(APP_CONFIG);
+    switchingAccount = signal(false, ...(ngDevMode ? [{ debugName: "switchingAccount" }] : []));
+    deniedUrl = this.normalizeRoute(this.route.snapshot.queryParamMap.get('denied'));
+    fallbackUrl = this.resolveFallbackUrl();
+    authenticated = this.authStore.authenticated;
+    accountLabel = computed(() => this.authStore.username() ?? this.authStore.user()?.email ?? 'this account', ...(ngDevMode ? [{ debugName: "accountLabel" }] : []));
+    goBackOrFallback() {
+        if (this.fallbackUrl) {
+            this.router.navigateByUrl(this.fallbackUrl);
+            return;
+        }
+        this.location.back();
+    }
+    signOutAndSwitchAccount() {
+        const signInUrl = this.buildSignInUrl();
+        this.switchingAccount.set(true);
+        this.authService
+            .logout()
+            .pipe(catchError$1(() => {
+            this.authStore.clear();
+            this.authContextStore.clear();
+            return of(null);
+        }))
+            .subscribe({
+            next: () => {
+                window.location.href = signInUrl;
+            },
+            error: () => {
+                window.location.href = signInUrl;
+            },
+        });
+    }
+    goToSignIn() {
+        window.location.href = this.buildSignInUrl();
+    }
+    buildSignInUrl() {
+        const continueUrl = this.buildContinueUrl();
+        return `${this.environment.accountsUrl}/signin?continue=${encodeURIComponent(continueUrl)}`;
+    }
+    buildContinueUrl() {
+        if (typeof window === 'undefined') {
+            return this.environment.myaccountUrl;
+        }
+        const target = this.deniedUrl || this.fallbackUrl || '/';
+        return new URL(target, window.location.origin).toString();
+    }
+    resolveFallbackUrl() {
+        const queryFallback = this.normalizeRoute(this.route.snapshot.queryParamMap.get('fallback'));
+        const storedFallback = this.normalizeRoute(readLastAllowedUrl());
+        const fallback = queryFallback || storedFallback;
+        if (!fallback || fallback === this.deniedUrl || fallback.startsWith('/forbidden')) {
+            return null;
+        }
+        return fallback;
+    }
+    normalizeRoute(url) {
+        if (!url) {
+            return null;
+        }
+        return url.startsWith('/') ? url : `/${url}`;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ForbiddenComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.1", type: ForbiddenComponent, isStandalone: true, selector: "rolatech-forbidden", ngImport: i0, template: "<section class=\"forbidden-page\">\n  <article class=\"forbidden-page__card\">\n    <span class=\"forbidden-page__eyebrow\">403</span>\n    <h1 class=\"forbidden-page__title\">This account cannot open that page</h1>\n\n    @if (authenticated()) {\n      <p class=\"forbidden-page__description\">\n        You are signed in as <strong>{{ accountLabel() }}</strong>, but that account does not have permission to view this route.\n      </p>\n    } @else {\n      <p class=\"forbidden-page__description\">You do not have permission to open this route with the current session.</p>\n    }\n\n    @if (deniedUrl) {\n      <div class=\"forbidden-page__route\">\n        <span class=\"forbidden-page__route-label\">Attempted page</span>\n        <code class=\"forbidden-page__route-value\">{{ deniedUrl }}</code>\n      </div>\n    }\n\n    <p class=\"forbidden-page__hint\">\n      Return to a page that still works for this account, or sign out and continue with the correct account to retry access.\n    </p>\n\n    <div class=\"forbidden-page__actions\">\n      <button mat-stroked-button type=\"button\" (click)=\"goBackOrFallback()\">\n        {{ fallbackUrl ? 'Back to allowed page' : 'Go back' }}\n      </button>\n\n      @if (authenticated()) {\n        <button mat-flat-button type=\"button\" (click)=\"signOutAndSwitchAccount()\" [disabled]=\"switchingAccount()\">\n          @if (switchingAccount()) {\n            <mat-progress-spinner diameter=\"18\" mode=\"indeterminate\"></mat-progress-spinner>\n          }\n          <span>{{ switchingAccount() ? 'Switching account...' : 'Sign out and switch account' }}</span>\n        </button>\n      } @else {\n        <button mat-flat-button type=\"button\" (click)=\"goToSignIn()\">Sign in</button>\n      }\n    </div>\n\n    <p class=\"forbidden-page__support\">\n      If this should be available for the current account, ask an administrator to review the role or permission assignment.\n    </p>\n  </article>\n</section>\n", styles: [":host{display:grid;min-height:100dvh;padding:1.5rem;place-items:center;background:radial-gradient(circle at top left,color-mix(in srgb,var(--rt-brand-color) 14%,transparent),transparent 42%),var(--rt-base-background, #ffffff)}.forbidden-page{width:min(100%,42rem)}.forbidden-page__card{display:flex;flex-direction:column;gap:1rem;padding:1.5rem;border:1px solid var(--rt-border-color, rgba(15, 23, 42, .08));border-radius:1.5rem;background:color-mix(in srgb,var(--rt-raised-background, #ffffff) 96%,transparent);box-shadow:0 24px 56px -42px color-mix(in srgb,var(--rt-text-primary) 24%,transparent)}.forbidden-page__eyebrow{display:inline-flex;align-self:flex-start;padding:.32rem .72rem;border-radius:9999px;background:color-mix(in srgb,var(--mat-sys-error, #b91c1c) 12%,transparent);color:var(--mat-sys-error, #b91c1c);font-size:.78rem;font-weight:800;letter-spacing:.08em;text-transform:uppercase}.forbidden-page__title{margin:0;color:var(--rt-text-primary);font-size:clamp(1.8rem,4vw,2.4rem);line-height:1.05}.forbidden-page__description,.forbidden-page__hint,.forbidden-page__support{margin:0;color:var(--rt-text-secondary);line-height:1.6}.forbidden-page__route{display:flex;flex-direction:column;gap:.45rem;padding:.95rem 1rem;border:1px dashed var(--rt-border-color, rgba(15, 23, 42, .08));border-radius:1rem;background:color-mix(in srgb,var(--rt-10-percent-layer, rgba(15, 23, 42, .08)) 72%,transparent)}.forbidden-page__route-label{font-size:.8rem;font-weight:700;letter-spacing:.04em;text-transform:uppercase;color:var(--rt-text-secondary)}.forbidden-page__route-value{overflow-wrap:anywhere;color:var(--rt-text-primary);font-family:SFMono-Regular,ui-monospace,monospace;font-size:.95rem}.forbidden-page__actions{display:flex;flex-wrap:wrap;gap:.75rem;align-items:center}.forbidden-page__actions button{display:inline-flex;gap:.55rem;align-items:center}@media(max-width:640px){:host{padding:1rem}.forbidden-page__card{padding:1.2rem}.forbidden-page__actions{flex-direction:column;align-items:stretch}.forbidden-page__actions button{justify-content:center}}\n"], dependencies: [{ kind: "ngmodule", type: MatButtonModule }, { kind: "component", type: i1.MatButton, selector: "    button[matButton], a[matButton], button[mat-button], button[mat-raised-button],    button[mat-flat-button], button[mat-stroked-button], a[mat-button], a[mat-raised-button],    a[mat-flat-button], a[mat-stroked-button]  ", inputs: ["matButton"], exportAs: ["matButton", "matAnchor"] }, { kind: "ngmodule", type: MatProgressSpinnerModule }, { kind: "component", type: i2.MatProgressSpinner, selector: "mat-progress-spinner, mat-spinner", inputs: ["color", "mode", "value", "diameter", "strokeWidth"], exportAs: ["matProgressSpinner"] }] });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: ForbiddenComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'rolatech-forbidden', imports: [MatButtonModule, MatProgressSpinnerModule], template: "<section class=\"forbidden-page\">\n  <article class=\"forbidden-page__card\">\n    <span class=\"forbidden-page__eyebrow\">403</span>\n    <h1 class=\"forbidden-page__title\">This account cannot open that page</h1>\n\n    @if (authenticated()) {\n      <p class=\"forbidden-page__description\">\n        You are signed in as <strong>{{ accountLabel() }}</strong>, but that account does not have permission to view this route.\n      </p>\n    } @else {\n      <p class=\"forbidden-page__description\">You do not have permission to open this route with the current session.</p>\n    }\n\n    @if (deniedUrl) {\n      <div class=\"forbidden-page__route\">\n        <span class=\"forbidden-page__route-label\">Attempted page</span>\n        <code class=\"forbidden-page__route-value\">{{ deniedUrl }}</code>\n      </div>\n    }\n\n    <p class=\"forbidden-page__hint\">\n      Return to a page that still works for this account, or sign out and continue with the correct account to retry access.\n    </p>\n\n    <div class=\"forbidden-page__actions\">\n      <button mat-stroked-button type=\"button\" (click)=\"goBackOrFallback()\">\n        {{ fallbackUrl ? 'Back to allowed page' : 'Go back' }}\n      </button>\n\n      @if (authenticated()) {\n        <button mat-flat-button type=\"button\" (click)=\"signOutAndSwitchAccount()\" [disabled]=\"switchingAccount()\">\n          @if (switchingAccount()) {\n            <mat-progress-spinner diameter=\"18\" mode=\"indeterminate\"></mat-progress-spinner>\n          }\n          <span>{{ switchingAccount() ? 'Switching account...' : 'Sign out and switch account' }}</span>\n        </button>\n      } @else {\n        <button mat-flat-button type=\"button\" (click)=\"goToSignIn()\">Sign in</button>\n      }\n    </div>\n\n    <p class=\"forbidden-page__support\">\n      If this should be available for the current account, ask an administrator to review the role or permission assignment.\n    </p>\n  </article>\n</section>\n", styles: [":host{display:grid;min-height:100dvh;padding:1.5rem;place-items:center;background:radial-gradient(circle at top left,color-mix(in srgb,var(--rt-brand-color) 14%,transparent),transparent 42%),var(--rt-base-background, #ffffff)}.forbidden-page{width:min(100%,42rem)}.forbidden-page__card{display:flex;flex-direction:column;gap:1rem;padding:1.5rem;border:1px solid var(--rt-border-color, rgba(15, 23, 42, .08));border-radius:1.5rem;background:color-mix(in srgb,var(--rt-raised-background, #ffffff) 96%,transparent);box-shadow:0 24px 56px -42px color-mix(in srgb,var(--rt-text-primary) 24%,transparent)}.forbidden-page__eyebrow{display:inline-flex;align-self:flex-start;padding:.32rem .72rem;border-radius:9999px;background:color-mix(in srgb,var(--mat-sys-error, #b91c1c) 12%,transparent);color:var(--mat-sys-error, #b91c1c);font-size:.78rem;font-weight:800;letter-spacing:.08em;text-transform:uppercase}.forbidden-page__title{margin:0;color:var(--rt-text-primary);font-size:clamp(1.8rem,4vw,2.4rem);line-height:1.05}.forbidden-page__description,.forbidden-page__hint,.forbidden-page__support{margin:0;color:var(--rt-text-secondary);line-height:1.6}.forbidden-page__route{display:flex;flex-direction:column;gap:.45rem;padding:.95rem 1rem;border:1px dashed var(--rt-border-color, rgba(15, 23, 42, .08));border-radius:1rem;background:color-mix(in srgb,var(--rt-10-percent-layer, rgba(15, 23, 42, .08)) 72%,transparent)}.forbidden-page__route-label{font-size:.8rem;font-weight:700;letter-spacing:.04em;text-transform:uppercase;color:var(--rt-text-secondary)}.forbidden-page__route-value{overflow-wrap:anywhere;color:var(--rt-text-primary);font-family:SFMono-Regular,ui-monospace,monospace;font-size:.95rem}.forbidden-page__actions{display:flex;flex-wrap:wrap;gap:.75rem;align-items:center}.forbidden-page__actions button{display:inline-flex;gap:.55rem;align-items:center}@media(max-width:640px){:host{padding:1rem}.forbidden-page__card{padding:1.2rem}.forbidden-page__actions{flex-direction:column;align-items:stretch}.forbidden-page__actions button{justify-content:center}}\n"] }]
+        }] });
+
+class UnauthorizedComponent {
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: UnauthorizedComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.1", type: UnauthorizedComponent, isStandalone: true, selector: "rolatech-unauthorized", ngImport: i0, template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>401.</b>\n    <p>Unauthorized page.</p>\n  </div>\n</div>\n", styles: [""] });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: UnauthorizedComponent, decorators: [{
+            type: Component,
+            args: [{ selector: 'rolatech-unauthorized', template: "<div class=\"p-6 max-w-lg h-auto max-h-32\">\n  <div class=\"flex flex-col\">\n    <b>401.</b>\n    <p>Unauthorized page.</p>\n  </div>\n</div>\n" }]
+        }] });
+
+const PLATFORM_ADMIN_ROLES = ['PLATFORM_ADMIN', 'ROLE_PLATFORM_ADMIN'];
+const APPLICATION_OWNER_ROLES = ['APPLICATION_OWNER', 'APP_OWNER', 'ROLE_APPLICATION_OWNER', 'ROLE_APP_OWNER'];
+const APPLICATION_ADMIN_ROLES = ['APPLICATION_ADMIN', 'APP_ADMIN', 'ROLE_APPLICATION_ADMIN', 'ROLE_APP_ADMIN'];
+const ORGANIZATION_OWNER_ROLES = ['ORGANIZATION_OWNER', 'ORG_OWNER', 'ROLE_ORGANIZATION_OWNER', 'ROLE_ORG_OWNER'];
+const ORGANIZATION_ADMIN_ROLES = ['ORGANIZATION_ADMIN', 'ORG_ADMIN', 'ROLE_ORGANIZATION_ADMIN', 'ROLE_ORG_ADMIN'];
+const ORGANIZATION_MEMBER_ROLES = ['ORGANIZATION_MEMBER', 'ORG_MEMBER', 'ROLE_ORGANIZATION_MEMBER', 'ROLE_ORG_MEMBER'];
+const ORGANIZATION_STAFF_ROLES = ['ORGANIZATION_STAFF', 'ORG_STAFF', 'ROLE_ORGANIZATION_STAFF', 'ROLE_ORG_STAFF'];
+
+class AgentAccessMenuComponent {
+    applicationCode = input('primecasa', ...(ngDevMode ? [{ debugName: "applicationCode" }] : []));
+    applyRouterLink = input('/agents', ...(ngDevMode ? [{ debugName: "applyRouterLink" }] : []));
+    dashboardRouterLink = input('/organization', ...(ngDevMode ? [{ debugName: "dashboardRouterLink" }] : []));
+    showApplyAction = input(true, ...(ngDevMode ? [{ debugName: "showApplyAction" }] : []));
+    dashboardLabel = input('Agent dashboard', ...(ngDevMode ? [{ debugName: "dashboardLabel" }] : []));
+    authStore = inject(AuthStore);
+    authContextStore = inject(AuthContextStore);
+    onboardingApplicantService = inject(OnboardingApplicantService);
+    mine = toSignal(toObservable(computed(() => ({
+        authenticated: this.authStore.authenticated(),
+        loaded: this.authStore.loaded(),
+        applicationCode: this.applicationCode(),
+    }))).pipe(switchMap$1(({ authenticated, loaded, applicationCode }) => {
+        if (!loaded || !authenticated || !applicationCode) {
+            return of(null);
+        }
+        return this.onboardingApplicantService.listMine(applicationCode).pipe(catchError$1(() => of([])));
+    })), { initialValue: null });
+    latestApplication = computed(() => {
+        const applications = this.mine();
+        if (!applications?.length) {
+            return null;
+        }
+        return [...applications].sort((left, right) => this.toTimestamp(right) - this.toTimestamp(left))[0] ?? null;
+    }, ...(ngDevMode ? [{ debugName: "latestApplication" }] : []));
+    hasDashboardAccess = computed(() => {
+        this.authStore.loaded();
+        const appId = this.authContextStore.appId() ?? this.authStore.primaryApplication()?.appId ?? this.authStore.primaryOrganization()?.appId ?? null;
+        return this.authStore.hasOrganizationRole(appId, null, ...ORGANIZATION_OWNER_ROLES, ...ORGANIZATION_ADMIN_ROLES, ...ORGANIZATION_MEMBER_ROLES);
+    }, ...(ngDevMode ? [{ debugName: "hasDashboardAccess" }] : []));
+    entry = computed(() => {
+        if (this.hasDashboardAccess()) {
+            return {
+                icon: 'storefront',
+                label: this.dashboardLabel(),
+                routerLink: this.dashboardRouterLink(),
+            };
+        }
+        const application = this.latestApplication();
+        if (application) {
+            return {
+                icon: 'assignment',
+                label: this.applicationLabel(application.status),
+                routerLink: this.applicationRouterLink(application),
+            };
+        }
+        if (!this.showApplyAction()) {
+            return null;
+        }
+        return {
+            icon: 'badge',
+            label: 'Apply as agent',
+            routerLink: this.applyRouterLink(),
+        };
+    }, ...(ngDevMode ? [{ debugName: "entry" }] : []));
+    applicationLabel(status) {
+        switch (status) {
+            case 'APPROVED':
+                return 'Agent application approved';
+            case 'FAILED':
+                return 'Agent application result';
+            case 'NEED_MORE_INFO':
+                return 'Agent application updates';
+            case 'SUBMITTED':
+            case 'IN_REVIEW':
+                return 'Agent application review';
+            default:
+                return 'Continue agent application';
+        }
+    }
+    applicationRouterLink(application) {
+        const route = this.canOpenReview(application) ? 'review' : 'form';
+        return ['/agents', application.id, route];
+    }
+    canOpenReview(application) {
+        const progress = application.progress;
+        if (progress && !this.isFormComplete(progress)) {
+            return false;
+        }
+        return application.status !== 'DRAFT' || this.isFormComplete(progress);
+    }
+    isFormComplete(progress) {
+        return Boolean(progress?.profileCompleted && progress.qualificationCompleted && progress.financialCompleted && progress.bankingCompleted);
+    }
+    toTimestamp(application) {
+        return Date.parse(application.updatedAt ?? application.createdAt ?? '') || 0;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AgentAccessMenuComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.1", type: AgentAccessMenuComponent, isStandalone: true, selector: "rolatech-agent-access-menu", inputs: { applicationCode: { classPropertyName: "applicationCode", publicName: "applicationCode", isSignal: true, isRequired: false, transformFunction: null }, applyRouterLink: { classPropertyName: "applyRouterLink", publicName: "applyRouterLink", isSignal: true, isRequired: false, transformFunction: null }, dashboardRouterLink: { classPropertyName: "dashboardRouterLink", publicName: "dashboardRouterLink", isSignal: true, isRequired: false, transformFunction: null }, showApplyAction: { classPropertyName: "showApplyAction", publicName: "showApplyAction", isSignal: true, isRequired: false, transformFunction: null }, dashboardLabel: { classPropertyName: "dashboardLabel", publicName: "dashboardLabel", isSignal: true, isRequired: false, transformFunction: null } }, ngImport: i0, template: `
+    @if (entry(); as item) {
+      <a mat-menu-item [routerLink]="item.routerLink" class="px-6 flex items-center cursor-pointer">
+        <mat-icon>{{ item.icon }}</mat-icon>
+        <span class="flex items-center pl-1">{{ item.label }}</span>
+      </a>
+    }
+  `, isInline: true, dependencies: [{ kind: "ngmodule", type: MatMenuModule }, { kind: "component", type: i1$1.MatMenuItem, selector: "[mat-menu-item]", inputs: ["role", "disabled", "disableRipple"], exportAs: ["matMenuItem"] }, { kind: "ngmodule", type: MatIconModule }, { kind: "component", type: i2$1.MatIcon, selector: "mat-icon", inputs: ["color", "inline", "svgIcon", "fontSet", "fontIcon"], exportAs: ["matIcon"] }, { kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "routerLink"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AgentAccessMenuComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'rolatech-agent-access-menu',
+                    imports: [MatMenuModule, MatIconModule, RouterLink],
+                    template: `
+    @if (entry(); as item) {
+      <a mat-menu-item [routerLink]="item.routerLink" class="px-6 flex items-center cursor-pointer">
+        <mat-icon>{{ item.icon }}</mat-icon>
+        <span class="flex items-center pl-1">{{ item.label }}</span>
+      </a>
+    }
+  `,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                }]
+        }], propDecorators: { applicationCode: [{ type: i0.Input, args: [{ isSignal: true, alias: "applicationCode", required: false }] }], applyRouterLink: [{ type: i0.Input, args: [{ isSignal: true, alias: "applyRouterLink", required: false }] }], dashboardRouterLink: [{ type: i0.Input, args: [{ isSignal: true, alias: "dashboardRouterLink", required: false }] }], showApplyAction: [{ type: i0.Input, args: [{ isSignal: true, alias: "showApplyAction", required: false }] }], dashboardLabel: [{ type: i0.Input, args: [{ isSignal: true, alias: "dashboardLabel", required: false }] }] } });
+
 class FaceidDetectDialogComponent {
     dialogRef = inject(MatDialogRef);
     environment = inject(APP_CONFIG);
@@ -671,7 +794,7 @@ class AddressComponent {
         this.output.emit(this.address());
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AddressComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.1", type: AddressComponent, isStandalone: true, selector: "rolatech-address", inputs: { address: { classPropertyName: "address", publicName: "address", isSignal: true, isRequired: false, transformFunction: null } }, outputs: { address: "addressChange", output: "output" }, ngImport: i0, template: "<div>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Name </mat-label>\n    <input matInput [(ngModel)]=\"address().name\" />\n  </mat-form-field>\n  @if (address().type === addressType.BILLING) {\n    <mat-form-field appearance=\"fill\">\n      <mat-label i18n> Email </mat-label>\n      <input matInput [(ngModel)]=\"address().email\" />\n    </mat-form-field>\n  }\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Phone </mat-label>\n    <input matInput [(ngModel)]=\"address().phone\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> province </mat-label>\n    <input matInput [(ngModel)]=\"address().province\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> City </mat-label>\n    <input matInput [(ngModel)]=\"address().city\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> District </mat-label>\n    <input matInput [(ngModel)]=\"address().district\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Street </mat-label>\n    <input matInput [(ngModel)]=\"address().street\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Detail </mat-label>\n    <input matInput [(ngModel)]=\"address().detail\" />\n  </mat-form-field>\n</div>\n", styles: ["mat-form-field{width:100%}\n"], dependencies: [{ kind: "ngmodule", type: AngularCommonModule }, { kind: "directive", type: i1$1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1$1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1$1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "ngmodule", type: AngularComponentsModule }, { kind: "component", type: i2$1.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i2$1.MatLabel, selector: "mat-label" }, { kind: "directive", type: i3.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }] });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "21.2.1", type: AddressComponent, isStandalone: true, selector: "rolatech-address", inputs: { address: { classPropertyName: "address", publicName: "address", isSignal: true, isRequired: false, transformFunction: null } }, outputs: { address: "addressChange", output: "output" }, ngImport: i0, template: "<div>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Name </mat-label>\n    <input matInput [(ngModel)]=\"address().name\" />\n  </mat-form-field>\n  @if (address().type === addressType.BILLING) {\n    <mat-form-field appearance=\"fill\">\n      <mat-label i18n> Email </mat-label>\n      <input matInput [(ngModel)]=\"address().email\" />\n    </mat-form-field>\n  }\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Phone </mat-label>\n    <input matInput [(ngModel)]=\"address().phone\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> province </mat-label>\n    <input matInput [(ngModel)]=\"address().province\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> City </mat-label>\n    <input matInput [(ngModel)]=\"address().city\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> District </mat-label>\n    <input matInput [(ngModel)]=\"address().district\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Street </mat-label>\n    <input matInput [(ngModel)]=\"address().street\" />\n  </mat-form-field>\n  <mat-form-field appearance=\"fill\">\n    <mat-label i18n> Detail </mat-label>\n    <input matInput [(ngModel)]=\"address().detail\" />\n  </mat-form-field>\n</div>\n", styles: ["mat-form-field{width:100%}\n"], dependencies: [{ kind: "ngmodule", type: AngularCommonModule }, { kind: "directive", type: i1$2.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1$2.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1$2.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "ngmodule", type: AngularComponentsModule }, { kind: "component", type: i2$2.MatFormField, selector: "mat-form-field", inputs: ["hideRequiredMarker", "color", "floatLabel", "appearance", "subscriptSizing", "hintLabel"], exportAs: ["matFormField"] }, { kind: "directive", type: i2$2.MatLabel, selector: "mat-label" }, { kind: "directive", type: i3.MatInput, selector: "input[matInput], textarea[matInput], select[matNativeControl],      input[matNativeControl], textarea[matNativeControl]", inputs: ["disabled", "id", "placeholder", "name", "required", "type", "errorStateMatcher", "aria-describedby", "value", "readonly", "disabledInteractive"], exportAs: ["matInput"] }] });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.1", ngImport: i0, type: AddressComponent, decorators: [{
             type: Component,
@@ -693,8 +816,7 @@ const AuthGuard = (route, state) => {
         const routeRoles = route.data['roles'];
         const passRoled = routeRoles ? roles?.some((r) => routeRoles.indexOf(r) >= 0) : true;
         if (authenticated && !passRoled) {
-            router.navigate(['/forbidden']);
-            return false;
+            return createForbiddenUrlTree(router, state.url, 'role');
         }
         if (authenticated) {
             if (isSignInPage) {
@@ -712,6 +834,7 @@ const AuthGuard = (route, state) => {
                 return false;
             }
             // 3. Otherwise, if the user is already where they need to be, allow navigation
+            rememberAllowedUrl(state.url);
             return true;
         }
         else {
@@ -799,21 +922,34 @@ function matchesRouteAccessPolicy(authStore, authContextStore, policy) {
 }
 
 function accessGuard(policy, fallbackUrl = '/forbidden') {
-    return () => {
+    return (_route, state) => {
         const router = inject(Router);
         const authService = inject(AuthService);
         const authStore = inject(AuthStore);
         const authContextStore = inject(AuthContextStore);
-        return authService.ensureLoaded().pipe(map(() => (matchesRouteAccessPolicy(authStore, authContextStore, policy) ? true : router.parseUrl(fallbackUrl))));
+        return authService.ensureLoaded().pipe(map(() => {
+            if (matchesRouteAccessPolicy(authStore, authContextStore, policy)) {
+                rememberAllowedUrl(state.url);
+                return true;
+            }
+            return fallbackUrl === '/forbidden' ? createForbiddenUrlTree(router, state.url, 'policy') : router.parseUrl(fallbackUrl);
+        }));
     };
 }
 function accessMatchGuard(policy, fallbackUrl = '/forbidden') {
-    return () => {
+    return (_route, segments) => {
         const router = inject(Router);
         const authService = inject(AuthService);
         const authStore = inject(AuthStore);
         const authContextStore = inject(AuthContextStore);
-        return authService.ensureLoaded().pipe(map(() => (matchesRouteAccessPolicy(authStore, authContextStore, policy) ? true : router.parseUrl(fallbackUrl))));
+        const attemptedUrl = segments.length ? `/${segments.map((segment) => segment.path).join('/')}` : router.url;
+        return authService.ensureLoaded().pipe(map(() => {
+            if (matchesRouteAccessPolicy(authStore, authContextStore, policy)) {
+                rememberAllowedUrl(router.url);
+                return true;
+            }
+            return fallbackUrl === '/forbidden' ? createForbiddenUrlTree(router, attemptedUrl, 'policy') : router.parseUrl(fallbackUrl);
+        }));
     };
 }
 
@@ -848,25 +984,19 @@ function landingRedirectGuard(targets = {}) {
 
 const RoleGuard = (route, state) => {
     const authService = inject(AuthService);
-    const environment = inject(APP_CONFIG);
     const platformId = inject(PLATFORM_ID);
-    const snackBar = inject(MatSnackBar);
     const router = inject(Router);
-    const isContinue = state.url.includes('continue');
-    const continueUrl = route.queryParams['continue'];
     if (!isPlatformBrowser(platformId)) {
         return of(false);
     }
     const routeRoles = route.data['roles'];
-    // if (!routeRoles) {
-    //   return of(false);
-    // }
-    return authService.ensureLoaded().pipe(filter((res) => res.roles !== null && res.roles.length > 0), map$1(({ roles }) => {
-        const authed = roles.some((r) => routeRoles?.indexOf(r) >= 0);
-        if (!authed) {
-            router.navigate(['/forbidden']);
+    return authService.ensureLoaded().pipe(map$1(({ roles }) => {
+        const authed = routeRoles ? (roles ?? []).some((role) => routeRoles.indexOf(role) >= 0) : true;
+        if (authed) {
+            rememberAllowedUrl(state.url);
+            return true;
         }
-        return authed;
+        return createForbiddenUrlTree(router, state.url, 'role');
     }));
 };
 
@@ -1150,7 +1280,7 @@ class ErrorInterceptor {
     isRefreshingToken = false;
     authService = inject(AuthService);
     intercept(request, next) {
-        return next.handle(request).pipe(catchError((error) => {
+        return next.handle(request).pipe(catchError$1((error) => {
             if (error instanceof HttpErrorResponse) {
                 switch (error.status) {
                     case 400:
@@ -1216,7 +1346,7 @@ class AuthInterceptor {
             //   // window.location.href = res.headers.get('Location') as string;
             // }
             return res;
-        }), catchError$1((error) => {
+        }), catchError((error) => {
             if (isPlatformBrowser(this.platformId)) {
                 if (error.url?.includes('auth/introspect')) {
                     // if (window.location.origin !== `${this.environment.accountsUrl}`) {
@@ -1284,7 +1414,7 @@ function provideAngularAuth(config) {
                     if (config?.autoLoadSession === false || !isPlatformBrowser(platformId)) {
                         return Promise.resolve();
                     }
-                    return firstValueFrom(authService.ensureLoaded().pipe(catchError$1(() => of(null))));
+                    return firstValueFrom(authService.ensureLoaded().pipe(catchError(() => of(null))));
                 };
             },
         },