@zambon-dev/shared 2.0.0 → 2.1.0

package/i18n/external-content/en.json

@@ -0,0 +1,10 @@
+{
+  "ExternalContent-Blocked-Title": "Cannot be displayed",
+  "ExternalContent-Blocked-Message": "This menu item points to an address that is not allowed. Ask an administrator to review it.",
+  "ExternalContent-OpenInNewTab": "Open in a new browser tab",
+  "ExternalContent-SlowHint": "Still loading. Some sites do not allow being displayed inside another application — try opening it in a new browser tab.",
+  "ExternalContent-Unavailable-Title": "Content unavailable",
+  "ExternalContent-Unavailable-Message": "Reopen this item from the menu to load it.",
+
+  "": ""
+}

package/i18n/external-content/pt.json

@@ -0,0 +1,10 @@
+{
+  "ExternalContent-Blocked-Title": "Não é possível exibir",
+  "ExternalContent-Blocked-Message": "Este item de menu aponta para um endereço não permitido. Peça a um administrador para revisá-lo.",
+  "ExternalContent-OpenInNewTab": "Abrir em nova aba do navegador",
+  "ExternalContent-SlowHint": "Ainda carregando. Alguns sites não permitem ser exibidos dentro de outra aplicação — tente abrir em uma nova aba do navegador.",
+  "ExternalContent-Unavailable-Title": "Conteúdo indisponível",
+  "ExternalContent-Unavailable-Message": "Reabra este item pelo menu para carregá-lo.",
+
+  "": ""
+}

package/index.d.ts

@@ -1,5 +1,6 @@
 export * from './lib/auth';
 export * from './lib/components';
+export { ExternalContentComponent, externalContentRoutes } from './lib/features/external-content';
 export { OperationsHistoryChildListComponent, OperationsHistoryModalComponent } from './lib/features/operations-history';
 export { ServicesHistoryChildListComponent, ServicesHistoryViewComponent } from './lib/features/services-history';
 export * from './lib/i18n';

package/lib/features/external-content/external-content.component.d.ts

@@ -0,0 +1,43 @@
+import { OnInit } from '@angular/core';
+import { SafeResourceUrl } from '@angular/platform-browser';
+import { TabViewBase } from '@zambon-dev/framework';
+import * as i0 from "@angular/core";
+/**
+ * Displays an external destination inside an application tab.
+ *
+ * Routed as `/external-content/:menuID` — the destination itself never travels in the URL, so no
+ * one can hand-craft a link that makes the application frame an arbitrary site.
+ *
+ * A `TabViewBase` like any other screen, so its actions live in the ribbon rather than in a
+ * bar of its own: it must be routed under `DefaultTabViewComponent`, which is what renders the
+ * `#ribbon` template this view publishes. Use the exported `externalContentRoutes`.
+ */
+export declare class ExternalContentComponent extends TabViewBase implements OnInit {
+    protected frameUrl?: SafeResourceUrl;
+    protected isBlocked: boolean;
+    protected isFrameLoading: boolean;
+    protected isSlow: boolean;
+    protected isUnavailable: boolean;
+    protected label: string;
+    protected resolvedUrl: string;
+    private activatedRoute;
+    private configs;
+    private externalContentService;
+    private externalUrlResolverService;
+    private sanitizer;
+    private slowHintTimeout?;
+    private tabService;
+    constructor();
+    ngOnDestroy(): void;
+    ngOnInit(): void;
+    protected onFrameLoad(): void;
+    protected onOpenInNewTab(): void;
+    protected onReload(): void;
+    private clearSlowHint;
+    private isOriginAllowed;
+    private show;
+    private displayFrame;
+    private startSlowHint;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ExternalContentComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<ExternalContentComponent, "shared-external-content", never, {}, {}, never, never, true, never>;
+}

package/lib/features/external-content/external-content.routes.d.ts

@@ -0,0 +1,25 @@
+import { Routes } from '@angular/router';
+/**
+ * Route table for embedded external content. Spread it into `MainLayoutComponent`'s children:
+ *
+ * ```ts
+ * { path: '', component: MainLayoutComponent, canActivate: [AuthGuard], children: [
+ *   ...externalContentRoutes,
+ *   // the application's own features
+ * ] }
+ * ```
+ *
+ * Three things about the shape are load-bearing and must not be "simplified" away:
+ *
+ * - The path is nested one segment per route. `RouteHelper.getRouteURL` and
+ *   `CustomReuseStrategy.getUrlFromRoute` collect segments walking up the parent chain and then
+ *   reverse the flat list, so a route declared `'external-content/:menuID'` rebuilds as
+ *   `/:menuID/external-content` and every tab URL is wrong.
+ * - `DefaultTabViewComponent` hosts the view. It is what renders the `#ribbon` template the
+ *   component publishes, so dropping it leaves the Reload and Open-in-a-new-browser-tab actions
+ *   with nowhere to appear.
+ * - `FRAMEWORK_VIEW_TYPE` must be present. `TabsComponent` re-creates the tab after a page refresh
+ *   by looking for a `Details` or `List` view in the activated route tree, and navigates to `/`
+ *   when it finds neither — the embedded tab would vanish on F5.
+ */
+export declare const externalContentRoutes: Routes;

package/lib/features/external-content/index.d.ts

@@ -0,0 +1,2 @@
+export { ExternalContentComponent } from './external-content.component';
+export { externalContentRoutes } from './external-content.routes';

package/lib/layouts/main-layout/main-layout.component.d.ts

@@ -4,6 +4,8 @@ export declare class MainLayoutComponent implements OnInit, OnDestroy {
     private logoutModal;
     private authenticationService;
     private destroy$;
+    private externalContentService;
+    private externalUrlResolverService;
     private router;
     private sidebarService;
     private tabService;
@@ -13,6 +15,7 @@ export declare class MainLayoutComponent implements OnInit, OnDestroy {
     ngOnInit(): void;
     onLogoutClick(): void;
     onLogoutConfirm(): void;
+    private openExternalMenu;
     static ɵfac: i0.ɵɵFactoryDeclaration<MainLayoutComponent, never>;
     static ɵcmp: i0.ɵɵComponentDeclaration<MainLayoutComponent, "shared-main-layout", never, {}, {}, never, never, true, never>;
 }

package/lib/models/current-user-info.d.ts

@@ -1,8 +1,23 @@
 export interface ICurrentUserInfo {
     costCenterName: string;
+    /**
+     * Optional e-mail address. Present only when the sign-in response includes it; it is one of the
+     * values behind the `{email}` placeholder in an external menu URL.
+     */
+    email?: string;
     name: string;
     /** Optional avatar image URL. Falls back to initials when absent. */
     pictureUrl?: string;
     /** Optional job position/title shown under the user name. Line is hidden when absent. */
     position?: string;
+    /**
+     * Optional stable user identifier. Present only when the sign-in response includes it; it is
+     * the value behind the `{userId}` placeholder in an external menu URL.
+     */
+    userID?: number;
+    /**
+     * Login user name. Already carried by the persisted sign-in response; declared here because it
+     * is the value behind the `{userName}` placeholder in an external menu URL.
+     */
+    username?: string;
 }

package/lib/models/external-content.d.ts

@@ -0,0 +1,28 @@
+import { InjectionToken } from '@angular/core';
+/** First segment of the route that hosts embedded external content. */
+export declare const EXTERNAL_CONTENT_ROUTE_PATH: string;
+/**
+ * Flat projection of an external menu item, used to restore an embedded tab.
+ *
+ * Deliberately not a `SidebarMenu`: that class carries a `parent` back-reference, so it is a
+ * circular structure that `JSON.stringify` refuses, and holding one would pin the whole menu tree.
+ */
+export interface IExternalContentEntry {
+    id: number;
+    label: string;
+    url: string;
+}
+export declare class ExternalContentConfigs {
+    /**
+     * Origins an embedded menu item may point at, for example `['https://reports.example.com']`.
+     * Empty — the default — allows any `http`/`https` origin.
+     *
+     * Populating it is the single highest-value control here after the scheme check: it narrows a
+     * compromised menu row from "frame anything on the internet" to "frame one of our report hosts".
+     */
+    allowedOrigins: string[];
+    /** Milliseconds to wait for the frame's first `load` before hinting that framing may be refused. */
+    slowFrameHintDelay: number;
+    constructor(options?: Partial<ExternalContentConfigs>);
+}
+export declare const EXTERNAL_CONTENT_CONFIGS: InjectionToken<ExternalContentConfigs>;

package/lib/models/index.d.ts

@@ -1,5 +1,6 @@
 export * from './auth-response';
 export * from './current-user-info';
+export * from './external-content';
 export * from './notification';
 export * from './operations-history';
 export * from './services-history';

package/lib/services/external-content.service.d.ts

@@ -0,0 +1,35 @@
+import { SidebarMenu } from '@zambon-dev/library';
+import { Observable } from 'rxjs';
+import { IExternalContentEntry } from '../models';
+import * as i0 from "@angular/core";
+/**
+ * Remembers which external destination sits behind an embedded tab's `/external-content/:menuID`
+ * route, and resolves it back when the view is created.
+ *
+ * The destination never travels in the route, so the id has to be resolved to a URL somehow. That
+ * happens in three steps, cheapest first:
+ *
+ * 1. the in-memory registry — the item was clicked in this browsing session;
+ * 2. `sessionStorage` — the user pressed F5 on the embedded tab;
+ * 3. the application's `SidebarService.getMenuFromUrl()` — a cold deep link.
+ *
+ * Step 3 reuses the abstract hook every application already implements, so nothing new is required
+ * of a consumer: an application whose menu endpoint cannot resolve `/external-content/:id` simply
+ * gets the unavailable state on a cold deep link, which is the documented behaviour.
+ */
+export declare class ExternalContentService {
+    private readonly maxEntries;
+    private readonly storageKey;
+    private registry;
+    private sidebarService;
+    /** Resolves the destination behind an embedded tab, or `undefined` when it cannot be recovered. */
+    find(menuID: number): Observable<IExternalContentEntry | undefined>;
+    /** Remembers a menu so its embedded tab survives a page refresh. */
+    register(menu: SidebarMenu): void;
+    private readAllFromStorage;
+    private readFromStorage;
+    private toEntry;
+    private writeToStorage;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ExternalContentService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ExternalContentService>;
+}

package/lib/services/external-url-resolver.service.d.ts

@@ -0,0 +1,49 @@
+import * as i0 from "@angular/core";
+/**
+ * Resolves the runtime placeholders in an external menu URL, and vets the result before it is
+ * handed to the browser.
+ *
+ * Placeholder syntax is `{name}`, case-sensitive, drawn from a **closed** set:
+ *
+ * | Token        | Source                                              |
+ * |--------------|-----------------------------------------------------|
+ * | `{email}`    | `ICurrentUserInfo.email`                            |
+ * | `{language}` | `TranslateService.currentLang`, then `defaultLang`  |
+ * | `{userId}`   | `ICurrentUserInfo.userID`                           |
+ * | `{userName}` | `ICurrentUserInfo.username`                         |
+ *
+ * The set is closed by construction rather than reflected off the stored user info, and that is a
+ * security property, not a style choice: `AuthenticationService` persists the entire sign-in
+ * response under `userInfo`, tokens included, so a reflective implementation would let a menu URL
+ * configured as `?t={token}` hand the JWT to a third party. No authentication token is ever
+ * substituted.
+ */
+export declare class ExternalUrlResolverService {
+    private authenticationService;
+    private translate;
+    /** Placeholder grammar, used only to *detect* tokens this version does not know. */
+    private readonly unknownPlaceholderPattern;
+    /**
+     * Whether `url` is an absolute `http`/`https` address.
+     *
+     * Rejects relative paths, malformed values, protocol-relative `//host/path` (which throws
+     * without a base), and the schemes that would execute rather than navigate: `javascript:`,
+     * `data:`, `blob:`, `file:`.
+     */
+    isAllowed(url: string): boolean;
+    /**
+     * Substitutes every known placeholder, URL-encoding each value.
+     *
+     * Because every value is percent-encoded, a placeholder must occupy one *whole* value — a full
+     * path segment, or a full query-parameter value. Encoding is what stops a display name that
+     * contains `&` from injecting an extra query parameter into the destination.
+     *
+     * A known placeholder with no value becomes an empty string; an unrecognized `{…}` is left
+     * exactly as configured, so a report URL that legitimately contains braces is not corrupted.
+     */
+    resolve(url: string): string;
+    private getPlaceholderValues;
+    private warnAboutUnknownPlaceholders;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ExternalUrlResolverService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<ExternalUrlResolverService>;
+}

package/lib/services/index.d.ts

@@ -1,4 +1,6 @@
 export { AuthenticationService } from './authentication.service';
+export { ExternalContentService } from './external-content.service';
+export { ExternalUrlResolverService } from './external-url-resolver.service';
 export { NotificationsService } from './notifications.service';
 export { OperationsHistoryService } from './operations-history.service';
 export { ServicesHistoryService } from './services-history.service';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zambon-dev/shared",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Shared Angular services, utilities, and styles for Zambon applications.",
   "keywords": [
     "angular",