mesauth-angular 1.17.1 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mesauth-angular",
-  "version": "1.17.1",
+  "version": "1.18.0",
   "description": "Angular helper library to connect to a backend API and SignalR hub to surface the current logged-in user and incoming notifications with dark/light theme support",
   "keywords": [
     "angular",

package/types/mesauth-angular.d.ts

@@ -16,6 +16,23 @@ interface MesAuthConfig {
      * Allows updating themes, icons, and labels without republishing the npm package.
      */
     uiAssetsUrl?: string;
+    /**
+     * Hostnames of backend services that run MesAuth.Authorizer middleware.
+     * The interceptor will attach Bearer + X-Refresh-Token headers to requests
+     * going to any of these hosts so the authorizer can silently refresh tokens.
+     * Example: ["mes.kefico.vn", "api.kefico.vn"]
+     */
+    trustedHosts?: string[];
+    /**
+     * Called after a successful sign-in (login, externalLogin, or notifySignedIn).
+     * Use this to persist tokens to localStorage or sessionStorage for cross-origin requests.
+     */
+    onSignedIn?: (accessToken: string, refreshToken?: string) => void;
+    /**
+     * Called during sign-out (before the logout HTTP request completes).
+     * Use this to clear any persisted tokens from localStorage or sessionStorage.
+     */
+    onSigningOut?: () => void;
 }
 /** Injection token for MesAuth configuration */
 declare const MES_AUTH_CONFIG: InjectionToken<MesAuthConfig>;
@@ -169,6 +186,12 @@ declare class MesAuthService {
     private startConnection;
     stop(): void;
     logout(): Observable<any>;
+    /**
+     * Call this after a successful local login to trigger the `onSignedIn` lifecycle hook.
+     * This allows the config's `onSignedIn` callback (e.g. localStorage persistence) to
+     * run consistently for both normal login and external/SSO login flows.
+     */
+    notifySignedIn(accessToken: string, refreshToken?: string): void;
     get currentUser(): IUser | null;
     get isAuthenticated(): boolean;
     /**
@@ -188,6 +211,35 @@ declare class MesAuthService {
         avatarRatio: string | null;
     }>;
     getUserX(userId: string): Observable<IUser | null>;
+    /** POST a peer-issued JWT to the local /auth/external-login, returning local tokens. */
+    externalLogin(peerToken: string): Observable<{
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    /** List active trusted issuers (public, no auth required). */
+    getTrustedIssuers(): Observable<{
+        issuer: string;
+        origin: string;
+        displayName: string;
+        priority: number;
+    }[]>;
+    /** List origins that are allowed to silent-SSO from this host (public, no auth required). */
+    getSsoAllowedPeers(): Observable<{
+        peerOrigin: string;
+    }[]>;
+    /**
+     * Get a short-lived SSO exchange token from this host (requires active session cookie).
+     * Used by the /sso/check page before postMessaging the token to a peer's iframe.
+     */
+    getSsoToken(): Observable<{
+        token: string;
+    }>;
+    /**
+     * Open a hidden iframe to `${issuerOrigin}/sso/check` and wait for a postMessage reply.
+     * Returns the peer's short-lived SSO token, or null if the peer has no active session
+     * or does not respond within `timeoutMs` milliseconds.
+     */
+    trySilentSsoFromPeer(issuerOrigin: string, timeoutMs?: number): Promise<string | null>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<MesAuthService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<MesAuthService>;
 }
@@ -803,7 +855,7 @@ interface MaUiManifest {
     features?: Record<string, boolean>;
 }
 /** Current installed package version — keep in sync with package.json. */
-declare const PACKAGE_VERSION = "1.17.1";
+declare const PACKAGE_VERSION = "1.18.0";
 /**
  * Provides server-driven UI configuration loaded from the hosted manifest.
  * Components read `labels()` and `features()` signals instead of hardcoded strings.
@@ -908,5 +960,28 @@ declare class MaUserMenuComponent {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<MaUserMenuComponent, "ma-user-menu", never, { "name": { "alias": "name"; "required": true; "isSignal": true; }; "color": { "alias": "color"; "required": false; "isSignal": true; }; "disabled": { "alias": "disabled"; "required": false; "isSignal": true; }; }, { "itemClick": "itemClick"; }, never, ["[maUserMenuIcon]"], true, never>;
 }
 
-export { ALL_ACTIONS, AVATAR_FRAMES, ApprovalActionType, ApprovalDocumentStatus, ApprovalStepMode, ApprovalStepStatus, MES_AUTH_CONFIG, MaApprovalPanelComponent, MaApprovalService, MaArvContainerComponent, MaAvatarComponent, MaIconComponent, MaThemeDirective, MaUiConfigService, MaUserComponent, MaUserMenuColor, MaUserMenuComponent, MaUserXComponent, MesAuthModule, MesAuthService, NotificationBadgeComponent, NotificationPanelComponent, NotificationType, PACKAGE_VERSION, ThemeService, ToastContainerComponent, ToastService, UserProfileComponent, extractXMaPerm, mesAuthInterceptor, provideMesAuth, withXMaPerm, xMaResource };
+/**
+ * Invoked by the /sso/check page component on init.
+ *
+ * Flow:
+ *  1. Verify the page is inside an iframe (window !== window.parent).
+ *  2. Fetch the list of allowed peer origins from the backend.
+ *  3. If the opener's origin is in the allow-list, get a short-lived SSO token
+ *     from this host's /auth/sso-token endpoint (uses the current session cookie).
+ *  4. postMessage the result back to the opener.
+ *
+ * If the user is not logged in, /auth/sso-token returns 401 → post { ok: false }.
+ */
+declare function runSsoCheckHandshake(authService: MesAuthService): Promise<void>;
+/**
+ * Invoked by the login page component after a successful local login.
+ *
+ * If the URL contains `return_via=postMessage&target_origin=<url>`, this function
+ * posts the newly issued SSO token back to the opener window and closes this popup.
+ *
+ * @returns true if it handled the return-via flow (caller should NOT do normal navigation).
+ */
+declare function runReturnViaPostMessageIfRequested(authService: MesAuthService): Promise<boolean>;
+
+export { ALL_ACTIONS, AVATAR_FRAMES, ApprovalActionType, ApprovalDocumentStatus, ApprovalStepMode, ApprovalStepStatus, MES_AUTH_CONFIG, MaApprovalPanelComponent, MaApprovalService, MaArvContainerComponent, MaAvatarComponent, MaIconComponent, MaThemeDirective, MaUiConfigService, MaUserComponent, MaUserMenuColor, MaUserMenuComponent, MaUserXComponent, MesAuthModule, MesAuthService, NotificationBadgeComponent, NotificationPanelComponent, NotificationType, PACKAGE_VERSION, ThemeService, ToastContainerComponent, ToastService, UserProfileComponent, extractXMaPerm, mesAuthInterceptor, provideMesAuth, runReturnViaPostMessageIfRequested, runSsoCheckHandshake, withXMaPerm, xMaResource };
 export type { ApprovalDashboardDto, ApprovalDocumentDto, ApprovalDocumentSummaryDto, ApprovalHistoryDto, ApprovalReferenceDto, ApprovalStepDto, ApprovalStepRequest, ApprovalSubmitResult, ApprovalTemplateDto, ApprovalTemplateStepDto, ApprovalTemplateSummaryDto, ApproveRejectRequest, AvatarFrameDef, AvatarShape, AvatarSize, CreateApprovalRequest, CreateApprovalResponseDto, CreateApprovalTemplateRequest, DelegateRequest, FrontEndRoute, IUser, MaUiManifest, MesAuthConfig, NotificationDto, PagedList, PermissionHeader, RealTimeNotificationDto, RequestConfig, RolePreviewUserDto, StepRoleDto, Theme, Toast, UpdateApprovalTemplateRequest, UserFrontEndRoutesGrouped };