valtech-components 2.0.795 → 2.0.797

package/src/lib/services/auth/index.ts

@@ -1,128 +0,0 @@
-/**
- * Valtech Auth Service
- *
- * Servicio de autenticación reutilizable para aplicaciones Angular.
- * Proporciona autenticación con AuthV2, MFA, sincronización entre pestañas,
- * refresh proactivo de tokens, y registro automático de dispositivos para
- * push notifications.
- *
- * @example
- * ```typescript
- * // En main.ts
- * import { bootstrapApplication } from '@angular/platform-browser';
- * import { provideValtechAuth, provideValtechFirebase } from 'valtech-components';
- * import { environment } from './environments/environment';
- *
- * bootstrapApplication(AppComponent, {
- *   providers: [
- *     provideValtechFirebase(environment.firebase),
- *     provideValtechAuth({
- *       apiUrl: environment.apiUrl,
- *       enableFirebaseIntegration: true,
- *       enableDeviceRegistration: true, // Auto-registra dispositivos para push
- *     }),
- *   ],
- * });
- *
- * // En app.routes.ts
- * import { authGuard, guestGuard, permissionGuard } from 'valtech-components';
- *
- * const routes: Routes = [
- *   { path: 'login', canActivate: [guestGuard], loadComponent: () => import('./login.page') },
- *   { path: 'dashboard', canActivate: [authGuard], loadComponent: () => import('./dashboard.page') },
- *   { path: 'admin', canActivate: [authGuard, permissionGuard('admin:*')], loadComponent: () => import('./admin.page') },
- * ];
- *
- * // En componentes
- * import { AuthService } from 'valtech-components';
- *
- * @Component({...})
- * export class LoginComponent {
- *   private auth = inject(AuthService);
- *
- *   async login() {
- *     await firstValueFrom(this.auth.signin({ email, password }));
- *     if (this.auth.mfaPending().required) {
- *       // Mostrar UI de MFA
- *     } else {
- *       this.router.navigate(['/dashboard']);
- *     }
- *   }
- *
- *   // Habilitar notificaciones push (solicita permisos + registra dispositivo)
- *   async enableNotifications() {
- *     const result = await this.auth.enableNotifications();
- *     if (result.granted) {
- *       console.log('Notificaciones habilitadas');
- *     }
- *   }
- *
- *   // Verificar estado de permisos
- *   get canReceiveNotifications(): boolean {
- *     return this.auth.getNotificationPermissionState() === 'granted';
- *   }
- *
- *   // En template: usar signals directamente
- *   // {{ auth.user()?.email }}
- *   // @if (auth.hasPermission('templates:edit')) { ... }
- * }
- * ```
- */
-
-// Tipos
-export * from './types';
-
-// Configuración
-export {
-  VALTECH_AUTH_CONFIG,
-  provideValtechAuth,
-  provideValtechAuthInterceptor,
-  DEFAULT_AUTH_CONFIG,
-} from './config';
-
-// Servicio principal
-export { AuthService } from './auth.service';
-
-// Guards
-export {
-  authGuard,
-  guestGuard,
-  permissionGuard,
-  permissionGuardFromRoute,
-  superAdminGuard,
-  roleGuard,
-} from './guards';
-
-// Interceptor (para uso avanzado)
-export { authInterceptor } from './interceptor';
-
-// Servicios internos (para testing o extensión)
-export { AuthStateService } from './auth-state.service';
-export { TokenService } from './token.service';
-export { AuthStorageService } from './storage.service';
-export { AuthSyncService } from './sync.service';
-
-// Servicios de gestión de dispositivos y sesiones
-export { DeviceService } from './device.service';
-export { SessionService } from './session.service';
-
-// OAuth (Login social)
-export { OAuthService } from './oauth.service';
-export { OAuthCallbackComponent } from './oauth-callback.component';
-
-// Cross-app session handoff (OAuth Authorization Code pattern internal)
-export { HandoffService, HANDOFF_TOKEN_PARAM, HANDOFF_ROUTE_PARAM } from './handoff.service';
-export type {
-  HandoffCreateRequest,
-  HandoffCreateResponse,
-  HandoffExchangeResponse,
-  DetectAndExchangeOptions,
-} from './handoff.service';
-
-// Active organization switch orchestration
-export { OrgSwitchService } from './org-switch.service';
-export type { OrgChangedEvent, SwitchOrgOptions } from './org-switch.service';
-
-// Cross-app cross-org notification click handler
-export { NotificationActionService } from './notification-action.service';
-export type { NotificationOpenResult } from './notification-action.service';

package/src/lib/services/auth/interceptor.ts

@@ -1,177 +0,0 @@
-import { inject } from '@angular/core';
-import {
-  HttpInterceptorFn,
-  HttpRequest,
-  HttpHandlerFn,
-  HttpEvent,
-  HttpErrorResponse,
-} from '@angular/common/http';
-import { Observable, throwError, BehaviorSubject } from 'rxjs';
-import { catchError, filter, take, switchMap, finalize } from 'rxjs/operators';
-import { AuthService } from './auth.service';
-import { VALTECH_AUTH_CONFIG } from './config';
-
-// Control de estado de refresco (singleton a nivel de módulo)
-let isRefreshing = false;
-const refreshTokenSubject = new BehaviorSubject<string | null>(null);
-
-/**
- * Interceptor HTTP que:
- * 1. Agrega header Authorization con Bearer token a requests API
- * 2. Maneja errores 401 refrescando el token automáticamente
- * 3. Encola requests durante el refresco para evitar múltiples refresh
- *
- * @example
- * ```typescript
- * // Incluido automáticamente por provideValtechAuth()
- * // Para uso manual:
- * import { provideHttpClient, withInterceptors } from '@angular/common/http';
- * import { authInterceptor } from 'valtech-components';
- *
- * bootstrapApplication(AppComponent, {
- *   providers: [
- *     provideHttpClient(withInterceptors([authInterceptor])),
- *   ],
- * });
- * ```
- */
-export const authInterceptor: HttpInterceptorFn = (
-  request: HttpRequest<unknown>,
-  next: HttpHandlerFn
-): Observable<HttpEvent<unknown>> => {
-  const authService = inject(AuthService);
-  const config = inject(VALTECH_AUTH_CONFIG);
-
-  // Omitir requests que no son a nuestra API
-  if (!isApiRequest(request, config.apiUrl)) {
-    return next(request);
-  }
-
-  // Omitir endpoints públicos que no necesitan token
-  if (isPublicEndpoint(request, config.authPrefix!)) {
-    return next(request);
-  }
-
-  const accessToken = authService.accessToken();
-
-  // Agregar header de autorización si hay token
-  if (accessToken) {
-    request = addAuthHeader(request, accessToken);
-  }
-
-  return next(request).pipe(
-    catchError((error: HttpErrorResponse) => {
-      if (error.status === 401 && !isNoRefreshEndpoint(request, config.authPrefix!)) {
-        return handle401Error(request, next, authService);
-      }
-
-      if (error.status === 403) {
-        console.error(
-          '[ValtechAuth] Permiso denegado:',
-          error.error?.message || 'Acceso prohibido'
-        );
-      }
-
-      return throwError(() => error);
-    })
-  );
-};
-
-/**
- * Agrega header de autorización a la request.
- */
-function addAuthHeader(
-  request: HttpRequest<unknown>,
-  token: string
-): HttpRequest<unknown> {
-  return request.clone({
-    setHeaders: {
-      Authorization: `Bearer ${token}`,
-    },
-  });
-}
-
-/**
- * Verifica si la request es a nuestra API.
- */
-function isApiRequest(request: HttpRequest<unknown>, apiUrl: string): boolean {
-  return request.url.startsWith(apiUrl) || request.url.includes('/v2/auth');
-}
-
-/**
- * Verifica si la request es a un endpoint público que NO requiere token.
- */
-function isPublicEndpoint(
-  request: HttpRequest<unknown>,
-  authPrefix: string
-): boolean {
-  const publicEndpoints = [
-    '/signin',
-    '/signup',
-    '/refresh',
-    '/logout',
-    '/mfa/verify', // Solo durante login
-  ];
-  return publicEndpoints.some((endpoint) =>
-    request.url.includes(`${authPrefix}${endpoint}`)
-  );
-}
-
-/**
- * Verifica si la request es a un endpoint que NO debe reintentar refresh en 401.
- */
-function isNoRefreshEndpoint(
-  request: HttpRequest<unknown>,
-  authPrefix: string
-): boolean {
-  // Endpoints que no deben intentar refresh en 401:
-  // - Públicos: signin, signup, refresh, logout
-  // - MFA: verify (durante login), confirm (401 = código incorrecto), disable (401 = contraseña incorrecta)
-  const noRefreshEndpoints = [
-    '/signin',
-    '/signup',
-    '/refresh',
-    '/logout',
-    '/mfa/verify',
-    '/mfa/confirm',
-    '/mfa/disable',
-  ];
-  return noRefreshEndpoints.some((endpoint) =>
-    request.url.includes(`${authPrefix}${endpoint}`)
-  );
-}
-
-/**
- * Maneja errores 401 refrescando el token.
- */
-function handle401Error(
-  request: HttpRequest<unknown>,
-  next: HttpHandlerFn,
-  authService: AuthService
-): Observable<HttpEvent<unknown>> {
-  if (!isRefreshing) {
-    isRefreshing = true;
-    refreshTokenSubject.next(null);
-
-    return authService.refreshAccessToken().pipe(
-      switchMap((response) => {
-        refreshTokenSubject.next(response.accessToken);
-        return next(addAuthHeader(request, response.accessToken));
-      }),
-      catchError((error) => {
-        authService.logout();
-        return throwError(() => error);
-      }),
-      finalize(() => {
-        isRefreshing = false;
-      })
-    );
-  }
-
-  // Esperar a que termine el refresco en curso
-  return refreshTokenSubject.pipe(
-    filter((token): token is string => token !== null),
-    take(1),
-    switchMap((token) => next(addAuthHeader(request, token)))
-  );
-}

package/src/lib/services/auth/notification-action.service.ts

@@ -1,133 +0,0 @@
-/**
- * NotificationActionService — orquesta el "click en notificación" cross-app cross-org.
- *
- * Flujo:
- *   1. markAsRead (best-effort, no bloquea)
- *   2. Si appId destino !== appId actual → handoff token + redirect a app destino
- *   3. Si orgId destino !== activeOrg → switchTo(orgId) (sin reload, navega después)
- *   4. router.navigateByUrl(actionRoute)
- *
- * Requiere:
- *   - ValtechAuthConfig.appId  (identifica la app actual)
- *   - ValtechAuthConfig.appUrls (mapa baseUrl para handoff cross-app)
- */
-
-import { HttpErrorResponse } from '@angular/common/http';
-import { Inject, Injectable } from '@angular/core';
-import { Router } from '@angular/router';
-import { firstValueFrom } from 'rxjs';
-
-import { AuthService } from './auth.service';
-import { VALTECH_AUTH_CONFIG } from './config';
-import { HandoffService } from './handoff.service';
-import { OrgSwitchService } from './org-switch.service';
-import { ValtechAuthConfig } from './types';
-import { NotificationDocument, NotificationsService } from '../firebase/notifications.service';
-
-/** Resultado descriptivo del open() — útil para tests y telemetría. */
-export type NotificationOpenResult =
-  | 'navigated'
-  | 'navigated-after-switch-org'
-  | 'redirected-cross-app'
-  | 'no-action-route'
-  | 'cross-app-unconfigured'
-  | 'handoff-failed';
-
-@Injectable({ providedIn: 'root' })
-export class NotificationActionService {
-  constructor(
-    @Inject(VALTECH_AUTH_CONFIG) private config: ValtechAuthConfig,
-    private auth: AuthService,
-    private orgSwitch: OrgSwitchService,
-    private handoff: HandoffService,
-    private notifications: NotificationsService,
-    private router: Router
-  ) {}
-
-  /**
-   * Abre la notificación: marca como leída, switch-org si toca, navegación local o
-   * redirect cross-app vía handoff.
-   *
-   * No lanza errores hacia la UI — devuelve un resultado descriptivo. Errores
-   * técnicos quedan en console.warn.
-   */
-  async open(notif: NotificationDocument): Promise<NotificationOpenResult> {
-    // 1) Mark as read (best-effort, no bloquea el flujo principal)
-    if (notif.id && !notif.isRead) {
-      this.notifications.markAsRead(notif.id).catch(err => {
-        console.warn('[NotificationAction] markAsRead failed', err);
-      });
-    }
-
-    const route = notif.actionRoute;
-    if (!route) {
-      return 'no-action-route';
-    }
-
-    const currentApp = this.config.appId;
-    const targetApp = notif.appId;
-
-    // 2) Cross-app: handoff + full redirect
-    //
-    // baseUrl resolution priority:
-    //   (1) response.targetBaseUrl  — backend lookup en app-config (preferred, single source of truth)
-    //   (2) config.appUrls[targetApp] — fallback frontend mientras backend agrega el campo
-    if (targetApp && currentApp && targetApp !== currentApp) {
-      try {
-        const resp = await firstValueFrom(
-          this.handoff.createHandoff({ targetAppId: targetApp, route })
-        );
-        const baseUrl = resp.targetBaseUrl ?? this.config.appUrls?.[targetApp];
-        if (!baseUrl) {
-          console.warn(
-            `[NotificationAction] No baseUrl for app '${targetApp}' — backend did not return targetBaseUrl and no appUrls fallback configured`
-          );
-          return 'cross-app-unconfigured';
-        }
-        const url = this.buildHandoffUrl(baseUrl, resp.token, route);
-        if (typeof window !== 'undefined') {
-          window.location.href = url;
-        }
-        return 'redirected-cross-app';
-      } catch (err) {
-        const msg = err instanceof HttpErrorResponse ? err.message : String(err);
-        console.warn('[NotificationAction] createHandoff failed:', msg);
-        return 'handoff-failed';
-      }
-    }
-
-    // 3) Same app — switch-org si toca (sin reload — la navegación posterior monta page fresh)
-    let switched = false;
-    if (notif.orgId) {
-      const active = this.activeOrg();
-      if (active && active !== notif.orgId) {
-        await this.orgSwitch.switchTo(notif.orgId);
-        switched = true;
-      }
-    }
-
-    // 4) Navigate local
-    await this.router.navigateByUrl(route);
-    return switched ? 'navigated-after-switch-org' : 'navigated';
-  }
-
-  private activeOrg(): string {
-    const user = this.auth.user();
-    return (
-      (user as { activeOrgId?: string; activeOrg?: string } | null)?.activeOrgId ??
-      (user as { activeOrgId?: string; activeOrg?: string } | null)?.activeOrg ??
-      ''
-    );
-  }
-
-  /**
-   * Construye URL absoluta para handoff cross-app preservando pathname y otros
-   * params existentes de la baseUrl.
-   */
-  private buildHandoffUrl(baseUrl: string, token: string, route: string): string {
-    const url = new URL(baseUrl);
-    url.searchParams.set('handoff', token);
-    url.searchParams.set('route', route);
-    return url.toString();
-  }
-}

package/src/lib/services/auth/oauth-callback.component.ts

@@ -1,202 +0,0 @@
-import { Component, OnInit } from '@angular/core';
-import { CommonModule } from '@angular/common';
-import { OAuthCallbackData, OAuthResult, OAuthError } from './types';
-
-/**
- * Componente de callback para OAuth.
- *
- * Este componente procesa la respuesta del servidor OAuth y envía
- * los tokens a la ventana padre via postMessage.
- *
- * Debe agregarse a las rutas de la aplicación:
- * ```typescript
- * // app.routes.ts
- * import { OAuthCallbackComponent } from 'valtech-components';
- *
- * export const routes: Routes = [
- *   { path: 'auth/oauth/callback', component: OAuthCallbackComponent },
- *   // ... otras rutas
- * ];
- * ```
- *
- * El backend redirige a esta ruta con los tokens en query params:
- * `/auth/oauth/callback?access_token=xxx&refresh_token=xxx&expires_in=900`
- *
- * O con error:
- * `/auth/oauth/callback?error=INVALID_CODE&error_description=...`
- */
-@Component({
-  selector: 'val-oauth-callback',
-  standalone: true,
-  imports: [CommonModule],
-  template: `
-    <div class="oauth-callback">
-      <div class="oauth-callback__spinner"></div>
-      <p class="oauth-callback__text">{{ message }}</p>
-    </div>
-  `,
-  styles: [`
-    .oauth-callback {
-      display: flex;
-      flex-direction: column;
-      align-items: center;
-      justify-content: center;
-      height: 100vh;
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-    }
-
-    .oauth-callback__spinner {
-      width: 40px;
-      height: 40px;
-      border: 3px solid #f3f3f3;
-      border-top: 3px solid #3498db;
-      border-radius: 50%;
-      animation: spin 1s linear infinite;
-      margin-bottom: 16px;
-    }
-
-    @keyframes spin {
-      0% { transform: rotate(0deg); }
-      100% { transform: rotate(360deg); }
-    }
-
-    .oauth-callback__text {
-      color: #666;
-      font-size: 14px;
-    }
-  `],
-})
-export class OAuthCallbackComponent implements OnInit {
-  message = 'Procesando autenticación...';
-
-  ngOnInit(): void {
-    this.processCallback();
-  }
-
-  private processCallback(): void {
-    const params = new URLSearchParams(window.location.search);
-
-    // DEBUG: Log all received params
-    console.log('[OAuthCallback] URL params received:', {
-      url: window.location.href,
-      hasAccessToken: params.has('access_token'),
-      hasRefreshToken: params.has('refresh_token'),
-      hasFirebaseToken: params.has('firebase_token'),
-      firebaseTokenLength: params.get('firebase_token')?.length || 0,
-      error: params.get('error'),
-    });
-
-    // Verificar si hay error
-    const error = params.get('error');
-    if (error) {
-      this.sendToParent({
-        type: 'oauth-callback',
-        error: {
-          code: error,
-          message: params.get('error_description') || 'Error de autenticación',
-        } as OAuthError,
-      });
-      this.message = 'Error de autenticación';
-      this.closeAfterDelay();
-      return;
-    }
-
-    // Extraer tokens
-    const accessToken = params.get('access_token');
-    const refreshToken = params.get('refresh_token');
-    const expiresIn = params.get('expires_in');
-    const firebaseToken = params.get('firebase_token');
-
-    if (!accessToken || !refreshToken) {
-      this.sendToParent({
-        type: 'oauth-callback',
-        error: {
-          code: 'MISSING_TOKENS',
-          message: 'No se recibieron los tokens de autenticación',
-        } as OAuthError,
-      });
-      this.message = 'Error: tokens no recibidos';
-      this.closeAfterDelay();
-      return;
-    }
-
-    // Extraer roles y permisos (pueden venir como JSON en base64)
-    let roles: string[] | undefined;
-    let permissions: string[] | undefined;
-
-    const rolesParam = params.get('roles');
-    const permissionsParam = params.get('permissions');
-
-    if (rolesParam) {
-      try {
-        roles = JSON.parse(atob(rolesParam));
-      } catch {
-        roles = rolesParam.split(',');
-      }
-    }
-
-    if (permissionsParam) {
-      try {
-        permissions = JSON.parse(atob(permissionsParam));
-      } catch {
-        permissions = permissionsParam.split(',');
-      }
-    }
-
-    // Enviar tokens a la ventana padre
-    const result: OAuthResult = {
-      accessToken,
-      refreshToken,
-      expiresIn: expiresIn ? parseInt(expiresIn, 10) : 900,
-      firebaseToken: firebaseToken || undefined,
-      roles,
-      permissions,
-      isNewUser: params.get('is_new_user') === 'true',
-      linked: params.get('linked') === 'true',
-    };
-
-    this.sendToParent({
-      type: 'oauth-callback',
-      tokens: result,
-    });
-
-    this.message = 'Autenticación exitosa';
-    this.closeAfterDelay();
-  }
-
-  private sendToParent(data: OAuthCallbackData): void {
-    // Siempre guardar en localStorage como fallback (para COOP issues)
-    try {
-      localStorage.setItem('oauth_callback_data', JSON.stringify(data));
-      localStorage.setItem('oauth_callback_timestamp', Date.now().toString());
-      console.log('[OAuthCallback] Saved to localStorage as fallback');
-    } catch (e) {
-      console.warn('[OAuthCallback] Could not save to localStorage:', e);
-    }
-
-    // Intentar postMessage (puede fallar por COOP)
-    try {
-      if (window.opener && !window.opener.closed) {
-        window.opener.postMessage(data, window.location.origin);
-        console.log('[OAuthCallback] postMessage sent to opener');
-      } else if (window.parent !== window) {
-        window.parent.postMessage(data, window.location.origin);
-        console.log('[OAuthCallback] postMessage sent to parent');
-      } else {
-        console.log('[OAuthCallback] No opener/parent available, using localStorage only');
-      }
-    } catch (e) {
-      // COOP blocks postMessage - localStorage fallback already saved
-      console.warn('[OAuthCallback] postMessage blocked (COOP), using localStorage fallback:', e);
-    }
-  }
-
-  private closeAfterDelay(): void {
-    // Dar tiempo para que el mensaje se envíe antes de cerrar
-    setTimeout(() => {
-      if (window.opener) {
-        window.close();
-      }
-    }, 500);
-  }
-}