@salesforce/ui-bundle-template-feature-angular-authentication 12.7.0 → 12.8.0-canary.1019.37.1.g1f7b157f

package/dist/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [12.8.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v12.7.0...v12.8.0) (2026-09-23)
+
+**Note:** Version bump only for package @salesforce/ui-bundle-template-base-sfdx-project
+
+
+
+
+
 ## [12.7.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v12.6.3...v12.7.0) (2026-09-22)
 
 

package/dist/LICENSE.txt

@@ -0,0 +1,82 @@
+Terms of Use
+
+Copyright 2026 Salesforce, Inc. All rights reserved.
+
+These Terms of Use govern the download, installation, and/or use of this
+software provided by Salesforce, Inc. ("Salesforce") (the "Software"), were
+last updated on April 15, 2025, and constitute a legally binding
+agreement between you and Salesforce. If you do not agree to these Terms of
+Use, do not install or use the Software.
+
+Salesforce grants you a worldwide, non-exclusive, no-charge, royalty-free
+copyright license to reproduce, prepare derivative works of, publicly
+display, publicly perform, sublicense, and distribute the Software and
+derivative works subject to these Terms. These Terms shall be included in
+all copies or substantial portions of the Software.
+
+Subject to the limited rights expressly granted hereunder, Salesforce
+reserves all rights, title, and interest in and to all intellectual
+property subsisting in the Software. No rights are granted to you hereunder
+other than as expressly set forth herein. Users residing in countries on
+the United States Office of Foreign Assets Control sanction list, or which
+are otherwise subject to a US export embargo, may not use the Software.
+
+Implementation of the Software may require development work, for which you
+are responsible. The Software may contain bugs, errors and
+incompatibilities and is made available on an AS IS basis without support,
+updates, or service level commitments.
+
+Salesforce reserves the right at any time to modify, suspend, or
+discontinue, the Software (or any part thereof) with or without notice. You
+agree that Salesforce shall not be liable to you or to any third party for
+any modification, suspension, or discontinuance.
+
+You agree to defend Salesforce against any claim, demand, suit or
+proceeding made or brought against Salesforce by a third party arising out
+of or accruing from (a) your use of the Software, and (b) any application
+you develop with the Software that infringes any copyright, trademark,
+trade secret, trade dress, patent, or other intellectual property right of
+any person or defames any person or violates their rights of publicity or
+privacy (each a "Claim Against Salesforce"), and will indemnify Salesforce
+from any damages, attorney fees, and costs finally awarded against
+Salesforce as a result of, or for any amounts paid by Salesforce under a
+settlement approved by you in writing of, a Claim Against Salesforce,
+provided Salesforce (x) promptly gives you written notice of the Claim
+Against Salesforce, (y) gives you sole control of the defense and
+settlement of the Claim Against Salesforce (except that you may not settle
+any Claim Against Salesforce unless it unconditionally releases Salesforce
+of all liability), and (z) gives you all reasonable assistance, at your
+expense.
+
+WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, THE SOFTWARE IS NOT
+SUPPORTED AND IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL SALESFORCE HAVE ANY LIABILITY FOR ANY DAMAGES,
+INCLUDING, BUT NOT LIMITED TO, DIRECT, INDIRECT, SPECIAL, INCIDENTAL,
+PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR DAMAGES BASED ON LOST PROFITS, DATA,
+OR USE, IN CONNECTION WITH THE SOFTWARE, HOWEVER CAUSED AND WHETHER IN
+CONTRACT, TORT, OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT YOU
+HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+These Terms of Use shall be governed exclusively by the internal laws of
+the State of California, without regard to its conflicts of laws
+rules. Each party hereby consents to the exclusive jurisdiction of the
+state and federal courts located in San Francisco County, California to
+adjudicate any dispute arising out of or relating to these Terms of Use and
+the download, installation, and/or use of the Software. Except as expressly
+stated herein, these Terms of Use constitute the entire agreement between
+the parties, and supersede all prior and contemporaneous agreements,
+proposals, or representations, written or oral, concerning their subject
+matter. No modification, amendment, or waiver of any provision of these
+Terms of Use shall be effective unless it is by an update to these Terms of
+Use that Salesforce makes available, or is in writing and signed by the
+party against whom the modification, amendment, or waiver is to be
+asserted.
+
+Data Privacy: Salesforce may collect, process, and store device,
+system, and other information related to your use of the Software. This
+information includes, but is not limited to, IP address, user metrics, and
+other data ("Usage Data"). Salesforce may use Usage Data for analytics,
+product development, and marketing purposes. You acknowledge that files
+generated in conjunction with the Software may contain sensitive or
+confidential data, and you are solely responsible for anonymizing and
+protecting such data.

package/dist/force-app/main/default/classes/UIBundleSocialLoginConfig.cls

@@ -0,0 +1,145 @@
+/**
+ * REST endpoint for Social Login configuration on React Experience Cloud sites.
+ *
+ * Endpoint: GET /services/apexrest/auth/social-login-config?startURL=/
+ *
+ * This replicates the behavior of the OOTB community_login/socialLogin LWC:
+ *   - applauncher.SocialLoginController.getAuthProviders()
+ *   - applauncher.SocialLoginController.getSamlProviders()
+ *   - applauncher.SocialLoginController.getCommunityDomainSsoUrl()
+ *   - applauncher.SocialLoginController.getSamlSsoUrl()
+ *   - applauncher.SocialLoginController.handleIdp()
+ *
+ * The OOTB LWC does not render on React (Site Container) sites due to a platform
+ * restriction (isSiteContainer check in node-loginsettings.ftl).
+ * This endpoint enables a custom React component to achieve the same functionality.
+ *
+ * @see https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_AuthConfiguration.htm
+ */
+@RestResource(urlMapping='/auth/social-login-config')
+global with sharing class UIBundleSocialLoginConfig {
+
+    @HttpGet
+    global static SocialLoginConfigResponse getConfig() {
+        try {
+            // Resolve the post-authentication redirect path, sanitized against
+            // open-redirect attacks (CWE-601). See resolveStartUrl.
+            String startUrl = resolveStartUrl();
+
+            String communityUrl = Site.getBaseUrl();
+            Auth.AuthConfiguration authConfig = new Auth.AuthConfiguration(communityUrl, startUrl);
+
+            List<AuthProviderInfo> authProviders = new List<AuthProviderInfo>();
+            List<SamlProviderInfo> samlProviders = new List<SamlProviderInfo>();
+            String autoRedirectUrl = null;
+
+            // Fetch OAuth Auth Providers (Google, Facebook, etc.)
+            List<AuthProvider> rawAuthProviders = authConfig.getAuthProviders();
+            for (AuthProvider ap : rawAuthProviders) {
+                String ssoUrl = Auth.AuthConfiguration.getAuthProviderSsoDomainUrl(
+                    communityUrl, startUrl, ap.DeveloperName
+                );
+                authProviders.add(new AuthProviderInfo(
+                    ap.DeveloperName,
+                    ap.FriendlyName,
+                    ap.IconUrl,
+                    ssoUrl
+                ));
+            }
+
+            // Fetch SAML SSO Providers
+            List<SamlSsoConfig> rawSamlProviders = authConfig.getSamlProviders();
+            for (SamlSsoConfig saml : rawSamlProviders) {
+                String ssoUrl = Auth.AuthConfiguration.getSamlSsoUrl(
+                    communityUrl, startUrl, saml.Id
+                );
+                samlProviders.add(new SamlProviderInfo(
+                    saml.Id,
+                    saml.MasterLabel,
+                    ssoUrl
+                ));
+            }
+
+            // handleIdp behavior: auto-redirect if exactly one IDP and no username/password login
+            Integer totalProviders = rawAuthProviders.size() + rawSamlProviders.size();
+            if (totalProviders == 1 && !authConfig.getUsernamePasswordEnabled()) {
+                if (!authProviders.isEmpty()) {
+                    autoRedirectUrl = authProviders[0].ssoUrl;
+                } else if (!samlProviders.isEmpty()) {
+                    autoRedirectUrl = samlProviders[0].ssoUrl;
+                }
+            }
+
+            return new SocialLoginConfigResponse(authProviders, samlProviders, autoRedirectUrl);
+        } catch (Exception ex) {
+            System.debug(LoggingLevel.ERROR, 'UIBundleSocialLoginConfig error: ' + ex.getMessage());
+            return new SocialLoginConfigResponse(
+                new List<AuthProviderInfo>(),
+                new List<SamlProviderInfo>(),
+                null
+            );
+        }
+    }
+
+    /**
+     * Resolves the post-authentication redirect path from the request and
+     * sanitizes it to prevent open-redirect attacks (CWE-601).
+     *
+     * Delegates to the shared UIBundleAuthUtils.getSanitizedStartUrl — the same
+     * validation used by UIBundleLogin and UIBundleRegistration — which
+     * URL-decodes the value (catching encoded bypasses such as %2f%2f) and then
+     * rejects absolute, protocol-relative ("//"), backslash, "@", ":" and
+     * control-character inputs, falling back to the community path prefix. Only
+     * safe, community-relative paths survive, prefixed with Site.getPathPrefix()
+     * so the redirect lands on this community rather than the org default.
+     */
+    @TestVisible
+    private static String resolveStartUrl() {
+        return UIBundleAuthUtils.getSanitizedStartUrl(
+            RestContext.request.params.get('startURL'),
+            Site.getPathPrefix()
+        );
+    }
+
+    global class SocialLoginConfigResponse {
+        global List<AuthProviderInfo> authProviders;
+        global List<SamlProviderInfo> samlProviders;
+        global String autoRedirectUrl;
+
+        global SocialLoginConfigResponse(
+            List<AuthProviderInfo> authProviders,
+            List<SamlProviderInfo> samlProviders,
+            String autoRedirectUrl
+        ) {
+            this.authProviders = authProviders;
+            this.samlProviders = samlProviders;
+            this.autoRedirectUrl = autoRedirectUrl;
+        }
+    }
+
+    global class AuthProviderInfo {
+        global String developerName;
+        global String friendlyName;
+        global String iconUrl;
+        global String ssoUrl;
+
+        global AuthProviderInfo(String developerName, String friendlyName, String iconUrl, String ssoUrl) {
+            this.developerName = developerName;
+            this.friendlyName = friendlyName;
+            this.iconUrl = iconUrl;
+            this.ssoUrl = ssoUrl;
+        }
+    }
+
+    global class SamlProviderInfo {
+        global String id;
+        global String masterLabel;
+        global String ssoUrl;
+
+        global SamlProviderInfo(String id, String masterLabel, String ssoUrl) {
+            this.id = id;
+            this.masterLabel = masterLabel;
+            this.ssoUrl = ssoUrl;
+        }
+    }
+}

package/dist/force-app/main/default/classes/UIBundleSocialLoginConfig.cls-meta.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ApexClass xmlns="http://soap.sforce.com/2006/04/metadata">
+    <apiVersion>67.0</apiVersion>
+    <status>Active</status>
+</ApexClass>

package/dist/force-app/main/default/classes/UIBundleSocialLoginConfig_Test.cls

@@ -0,0 +1,181 @@
+/**
+ * Test class for UIBundleSocialLoginConfig REST endpoint.
+ *
+ * Auth.AuthConfiguration requires a valid community URL so these tests
+ * exercise the error-handling path and verify the response wrapper structure.
+ * Integration-level testing of actual Auth Provider/SAML discovery happens
+ * in the target org via the React component E2E flow.
+ */
+@isTest
+private class UIBundleSocialLoginConfig_Test {
+
+    /**
+     * Test that the endpoint returns an empty config when no community context
+     * is available (covers the catch block graceful fallback).
+     */
+    @isTest
+    static void testGetConfigNoSiteContext() {
+        RestRequest req = new RestRequest();
+        req.requestURI = '/services/apexrest/auth/social-login-config';
+        req.httpMethod = 'GET';
+        req.params.put('startURL', '/');
+        RestContext.request = req;
+        RestContext.response = new RestResponse();
+
+        Test.startTest();
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse result =
+            UIBundleSocialLoginConfig.getConfig();
+        Test.stopTest();
+
+        // Should return empty lists (graceful fallback), not null
+        System.assertNotEquals(null, result, 'Response should not be null');
+        System.assertNotEquals(null, result.authProviders, 'authProviders list should not be null');
+        System.assertNotEquals(null, result.samlProviders, 'samlProviders list should not be null');
+        System.assertEquals(0, result.authProviders.size(), 'authProviders should be empty without community context');
+        System.assertEquals(0, result.samlProviders.size(), 'samlProviders should be empty without community context');
+        System.assertEquals(null, result.autoRedirectUrl, 'autoRedirectUrl should be null without providers');
+    }
+
+    /**
+     * Test that the endpoint handles a missing startURL parameter gracefully
+     * (defaults to "/").
+     */
+    @isTest
+    static void testGetConfigNoStartUrl() {
+        RestRequest req = new RestRequest();
+        req.requestURI = '/services/apexrest/auth/social-login-config';
+        req.httpMethod = 'GET';
+        // Intentionally not setting startURL param
+        RestContext.request = req;
+        RestContext.response = new RestResponse();
+
+        Test.startTest();
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse result =
+            UIBundleSocialLoginConfig.getConfig();
+        Test.stopTest();
+
+        System.assertNotEquals(null, result, 'Response should not be null even without startURL');
+        System.assertNotEquals(null, result.authProviders, 'authProviders should not be null');
+        System.assertNotEquals(null, result.samlProviders, 'samlProviders should not be null');
+    }
+
+    /**
+     * Test the inner class constructors for code coverage.
+     */
+    @isTest
+    static void testInnerClassConstructors() {
+        Test.startTest();
+
+        UIBundleSocialLoginConfig.AuthProviderInfo authInfo =
+            new UIBundleSocialLoginConfig.AuthProviderInfo(
+                'TestProvider', 'Test Provider', 'https://example.com/icon.png', 'https://example.com/sso'
+            );
+        System.assertEquals('TestProvider', authInfo.developerName);
+        System.assertEquals('Test Provider', authInfo.friendlyName);
+        System.assertEquals('https://example.com/icon.png', authInfo.iconUrl);
+        System.assertEquals('https://example.com/sso', authInfo.ssoUrl);
+
+        UIBundleSocialLoginConfig.SamlProviderInfo samlInfo =
+            new UIBundleSocialLoginConfig.SamlProviderInfo(
+                '001000000000001', 'Test SAML', 'https://example.com/saml/sso'
+            );
+        System.assertEquals('001000000000001', samlInfo.id);
+        System.assertEquals('Test SAML', samlInfo.masterLabel);
+        System.assertEquals('https://example.com/saml/sso', samlInfo.ssoUrl);
+
+        List<UIBundleSocialLoginConfig.AuthProviderInfo> authList =
+            new List<UIBundleSocialLoginConfig.AuthProviderInfo>{ authInfo };
+        List<UIBundleSocialLoginConfig.SamlProviderInfo> samlList =
+            new List<UIBundleSocialLoginConfig.SamlProviderInfo>{ samlInfo };
+
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse resp =
+            new UIBundleSocialLoginConfig.SocialLoginConfigResponse(
+                authList, samlList, 'https://example.com/redirect'
+            );
+        System.assertEquals(1, resp.authProviders.size());
+        System.assertEquals(1, resp.samlProviders.size());
+        System.assertEquals('https://example.com/redirect', resp.autoRedirectUrl);
+
+        Test.stopTest();
+    }
+
+    // ---- Open-redirect sanitization (CWE-601) -------------------------------
+    // resolveStartUrl() is the boundary where the endpoint sanitizes the
+    // caller-supplied startURL before it is embedded in the SSO redirect URL.
+    // These tests assert malicious values never survive that boundary and that
+    // legitimate relative paths do.
+
+    @isTest
+    static void resolveStartUrlRejectsAbsoluteUrl() {
+        assertNotReflected('https://evil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlRejectsProtocolRelativeUrl() {
+        assertNotReflected('//evil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlRejectsBackslashVariant() {
+        assertNotReflected('/\\evil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlRejectsEncodedBypass() {
+        assertNotReflected('%2f%2fevil-attacker.com');
+    }
+
+    @isTest
+    static void resolveStartUrlAllowsRelativePath() {
+        setRequest('/dashboard');
+        String resolved = UIBundleSocialLoginConfig.resolveStartUrl();
+        System.assertNotEquals(null, resolved, 'A valid relative path should resolve to a non-null value');
+        System.assert(
+            resolved.endsWith('/dashboard'),
+            'A valid relative path must be preserved (optionally prefixed): ' + resolved
+        );
+        System.assert(!resolved.startsWith('http'), 'Result must not be absolute: ' + resolved);
+    }
+
+    @isTest
+    static void getConfigWithMaliciousStartUrlReturnsGracefulEmpty() {
+        // End-to-end: a malicious startURL must not crash the endpoint; without
+        // a real site context it returns the graceful empty response (unchanged).
+        setRequest('https://evil-attacker.com');
+
+        Test.startTest();
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse result =
+            UIBundleSocialLoginConfig.getConfig();
+        Test.stopTest();
+
+        System.assertNotEquals(null, result, 'Response should not be null');
+        System.assertEquals(0, result.authProviders.size(), 'No providers without site context');
+        System.assertEquals(0, result.samlProviders.size(), 'No SAML providers without site context');
+        System.assertEquals(null, result.autoRedirectUrl, 'No auto-redirect without providers');
+    }
+
+    // ---- helpers ------------------------------------------------------------
+
+    /** Asserts a malicious startURL value is not reflected by resolveStartUrl(). */
+    private static void assertNotReflected(String maliciousStartUrl) {
+        setRequest(maliciousStartUrl);
+        String resolved = UIBundleSocialLoginConfig.resolveStartUrl();
+        String safe = resolved == null ? '' : resolved;
+        System.assert(!safe.contains('evil-attacker'), 'Malicious host must not be reflected: ' + safe);
+        System.assert(!safe.startsWith('http'), 'Result must not be an absolute URL: ' + safe);
+        System.assert(!safe.startsWith('//'), 'Result must not be protocol-relative: ' + safe);
+        System.assert(!safe.contains('\\'), 'Result must not contain a backslash: ' + safe);
+    }
+
+    /** Builds a GET RestContext with the given startURL param (null => param omitted). */
+    private static void setRequest(String startUrlValue) {
+        RestRequest req = new RestRequest();
+        req.requestURI = '/services/apexrest/auth/social-login-config';
+        req.httpMethod = 'GET';
+        if (startUrlValue != null) {
+            req.params.put('startURL', startUrlValue);
+        }
+        RestContext.request = req;
+        RestContext.response = new RestResponse();
+    }
+}

package/dist/force-app/main/default/classes/UIBundleSocialLoginConfig_Test.cls-meta.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ApexClass xmlns="http://soap.sforce.com/2006/04/metadata">
+    <apiVersion>67.0</apiVersion>
+    <status>Active</status>
+</ApexClass>

package/dist/force-app/main/default/uiBundles/feature-angular-authentication/package.json

@@ -28,8 +28,8 @@
     "@angular/router": "^21.2.0",
     "@ng-icons/core": "^32.2.0",
     "@ng-icons/lucide": "^32.2.0",
-    "@salesforce/angular-plugin-ui-bundle": "^12.7.0",
-    "@salesforce/platform-sdk": "^12.7.0",
+    "@salesforce/angular-plugin-ui-bundle": "12.8.0-canary.1019.37.1.g1f7b157f",
+    "@salesforce/platform-sdk": "12.8.0-canary.1019.37.1.g1f7b157f",
     "@spartan-ng/brain": "^1.3.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -61,7 +61,7 @@
     "typescript": "~5.9.2",
     "typescript-eslint": "^8.0.0",
     "vitest": "^4.1.11",
-    "@salesforce/graphiti": "^12.7.0"
+    "@salesforce/graphiti": "12.8.0-canary.1019.37.1.g1f7b157f"
   },
   "overrides": {
     "undici": "^7.28.0"

package/dist/force-app/main/default/uiBundles/feature-angular-authentication/src/app/components/ui/dialog/dialog.html

@@ -10,7 +10,7 @@
 		<div hlmDialogHeader>
 			<ng-content select="[header]" />
 		</div>
-		<div class="text-sm">
+		<div class="min-w-0 text-sm">
 			<ng-content />
 		</div>
 		<div hlmDialogFooter>

package/dist/force-app/main/default/uiBundles/feature-angular-authentication/src/app/components/ui/icon/icon.ts

@@ -12,13 +12,16 @@ import {
 	lucideChevronDown,
 	lucideChevronRight,
 	lucideCircleAlert,
+	lucideFile,
 	lucideFileQuestion,
 	lucideGlobe,
+	lucideImage,
 	lucideListFilter,
 	lucideLogIn,
 	lucideLogOut,
 	lucideSearch,
 	lucideSearchX,
+	lucideUpload,
 	lucideUser,
 	lucideUserPen,
 	lucideUserPlus,
@@ -43,6 +46,9 @@ export const APP_ICONS = {
 	notFound: lucideFileQuestion,
 	globe: lucideGlobe,
 	check: lucideCheck,
+	image: lucideImage,
+	upload: lucideUpload,
+	file: lucideFile,
 } as const;
 
 export type AppIconName = keyof typeof APP_ICONS;

package/dist/force-app/main/default/uiBundles/feature-angular-authentication/src/app/features/authentication/social-login/social-login.html

@@ -0,0 +1,39 @@
+@if (hasProviders()) {
+<div class="mt-6">
+	@if (showHeader()) {
+	<div class="relative">
+		<div class="absolute inset-0 flex items-center">
+			<span class="w-full border-t"></span>
+		</div>
+		<div class="relative flex justify-center text-xs uppercase">
+			<span class="bg-background px-2 text-muted-foreground">{{ headerText() }}</span>
+		</div>
+	</div>
+	}
+
+	<div class="mt-4 grid gap-2">
+		@for (provider of authProviders(); track provider.developerName) {
+		<button
+			type="button"
+			(click)="redirectTo(provider.ssoUrl)"
+			[attr.aria-label]="'Sign in with ' + provider.friendlyName"
+			class="inline-flex w-full items-center justify-center gap-2 rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+		>
+			@if (provider.iconUrl) {
+			<img [src]="provider.iconUrl" alt="" class="h-4 w-4" aria-hidden="true" />
+			}
+			<span>{{ provider.friendlyName }}</span>
+		</button>
+		} @for (provider of samlProviders(); track provider.id) {
+		<button
+			type="button"
+			(click)="redirectTo(provider.ssoUrl)"
+			[attr.aria-label]="'Sign in with ' + provider.masterLabel"
+			class="inline-flex w-full items-center justify-center gap-2 rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+		>
+			<span>{{ provider.masterLabel }}</span>
+		</button>
+		}
+	</div>
+</div>
+}

package/dist/force-app/main/default/uiBundles/feature-angular-authentication/src/app/features/authentication/social-login/social-login.ts

@@ -0,0 +1,107 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import {
+	ChangeDetectionStrategy,
+	Component,
+	type OnInit,
+	computed,
+	inject,
+	input,
+	signal,
+} from "@angular/core";
+import { ActivatedRoute } from "@angular/router";
+import { DataClient } from "../../../api/data-client.service";
+import { getStartUrl } from "../utils/auth-helpers";
+
+interface AuthProviderInfo {
+	developerName: string;
+	friendlyName: string;
+	iconUrl: string | null;
+	ssoUrl: string;
+}
+
+interface SamlProviderInfo {
+	id: string;
+	masterLabel: string;
+	ssoUrl: string;
+}
+
+interface SocialLoginConfigResponse {
+	authProviders: AuthProviderInfo[];
+	samlProviders: SamlProviderInfo[];
+	autoRedirectUrl: string | null;
+}
+
+/**
+ * Social Login (IDP) component — Angular port of the React `SocialLogin`.
+ *
+ * Replicates the OOTB community_login/socialLogin LWC behavior which does not
+ * render on Site Container sites due to a platform restriction (isSiteContainer
+ * check in node-loginsettings.ftl).
+ *
+ * Behavior:
+ * - On init, fetches configured Auth Providers + SAML Providers
+ * - If only one IDP is configured and username/password is disabled, auto-redirects
+ * - Renders a button per provider with icon (Auth Providers) or without (SAML)
+ * - On click, redirects to the SSO URL to initiate the OAuth/SAML flow
+ *
+ * Backend: UIBundleSocialLoginConfig.cls (Apex REST endpoint), copied verbatim
+ * from the React feature. Uses the Auth.AuthConfiguration API.
+ */
+@Component({
+	selector: "app-social-login",
+	changeDetection: ChangeDetectionStrategy.OnPush,
+	templateUrl: "./social-login.html",
+})
+export class SocialLoginComponent implements OnInit {
+	private readonly route = inject(ActivatedRoute);
+	private readonly dataClient = inject(DataClient);
+
+	/** Whether to show the header text above the buttons. Default: true */
+	readonly showHeader = input(true);
+
+	/** Header text. Default: "Or log in using:" */
+	readonly headerText = input("Or log in using:");
+
+	protected readonly authProviders = signal<AuthProviderInfo[]>([]);
+	protected readonly samlProviders = signal<SamlProviderInfo[]>([]);
+	protected readonly hasProviders = computed(
+		() => this.authProviders().length > 0 || this.samlProviders().length > 0,
+	);
+
+	async ngOnInit(): Promise<void> {
+		const startUrl = getStartUrl(this.route.snapshot.queryParamMap);
+		const config = await this.fetchConfig(startUrl);
+		if (!config) {
+			return;
+		}
+		if (config.autoRedirectUrl) {
+			window.location.assign(config.autoRedirectUrl);
+			return;
+		}
+		this.authProviders.set(config.authProviders ?? []);
+		this.samlProviders.set(config.samlProviders ?? []);
+	}
+
+	protected redirectTo(ssoUrl: string): void {
+		window.location.assign(ssoUrl);
+	}
+
+	private async fetchConfig(startUrl: string): Promise<SocialLoginConfigResponse | null> {
+		try {
+			const response = await this.dataClient.fetch(
+				`/services/apexrest/auth/social-login-config?startURL=${encodeURIComponent(startUrl)}`,
+				{ method: "GET", headers: { Accept: "application/json" } },
+			);
+			if (!response.ok) {
+				return null;
+			}
+			return (await response.json()) as SocialLoginConfigResponse;
+		} catch {
+			return null;
+		}
+	}
+}

package/dist/force-app/main/default/uiBundles/feature-angular-authentication/src/app/pages/login/login-page.html

@@ -43,5 +43,7 @@
 				</app-field>
 			</div>
 		</app-auth-form>
+
+		<app-social-login />
 	</div>
 </main>

package/dist/force-app/main/default/uiBundles/feature-angular-authentication/src/app/pages/login/login-page.ts

@@ -8,6 +8,7 @@ import { FormBuilder } from "@angular/forms";
 import { ActivatedRoute, Router, RouterLink } from "@angular/router";
 import { DataClient } from "../../api/data-client.service";
 import { AuthFormComponent } from "../../features/authentication/auth-form/auth-form";
+import { SocialLoginComponent } from "../../features/authentication/social-login/social-login";
 import { ReactiveFormPageBase } from "../../features/authentication/reactive-form-page.base";
 import { FieldComponent } from "../../components/ui/field/field";
 import { InputComponent } from "../../components/ui/input/input";
@@ -32,7 +33,7 @@ import {
 @Component({
 	selector: "app-login-page",
 	changeDetection: ChangeDetectionStrategy.OnPush,
-	imports: [RouterLink, AuthFormComponent, FieldComponent, InputComponent],
+	imports: [RouterLink, AuthFormComponent, FieldComponent, InputComponent, SocialLoginComponent],
 	templateUrl: "./login-page.html",
 })
 export class LoginPageComponent extends ReactiveFormPageBase {

package/dist/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "12.7.0",
+  "version": "12.8.0-canary.1019.37.1.g1f7b157f",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-      "version": "12.7.0",
+      "version": "12.8.0-canary.1019.37.1.g1f7b157f",
       "license": "SEE LICENSE IN LICENSE.txt",
       "dependencies": {
         "fast-xml-parser": "^5.9.3",

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "12.7.0",
+  "version": "12.8.0-canary.1019.37.1.g1f7b157f",
   "description": "Base SFDX project template",
   "license": "SEE LICENSE IN LICENSE.txt",
   "publishConfig": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-feature-angular-authentication",
-  "version": "12.7.0",
+  "version": "12.8.0-canary.1019.37.1.g1f7b157f",
   "private": false,
   "engines": {
     "node": ">=22"