valtech-components 4.0.172 → 4.0.173

package/esm2022/lib/version.mjs

@@ -2,5 +2,5 @@
  * Current version of valtech-components.
  * This is automatically updated during the publish process.
  */
-export const VERSION = '4.0.172';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9saWIvdmVyc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBDdXJyZW50IHZlcnNpb24gb2YgdmFsdGVjaC1jb21wb25lbnRzLlxuICogVGhpcyBpcyBhdXRvbWF0aWNhbGx5IHVwZGF0ZWQgZHVyaW5nIHRoZSBwdWJsaXNoIHByb2Nlc3MuXG4gKi9cbmV4cG9ydCBjb25zdCBWRVJTSU9OID0gJzQuMC4xNzInO1xuIl19
+export const VERSION = '4.0.173';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9saWIvdmVyc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBDdXJyZW50IHZlcnNpb24gb2YgdmFsdGVjaC1jb21wb25lbnRzLlxuICogVGhpcyBpcyBhdXRvbWF0aWNhbGx5IHVwZGF0ZWQgZHVyaW5nIHRoZSBwdWJsaXNoIHByb2Nlc3MuXG4gKi9cbmV4cG9ydCBjb25zdCBWRVJTSU9OID0gJzQuMC4xNzMnO1xuIl19

package/fesm2022/valtech-components.mjs

@@ -1,7 +1,7 @@
 import * as i0 from '@angular/core';
 import { inject, InjectionToken, makeEnvironmentProviders, APP_INITIALIZER, ErrorHandler, Injectable, DestroyRef, Inject, signal, computed, PLATFORM_ID, isDevMode, Optional, runInInjectionContext, effect, Pipe, TemplateRef, ViewContainerRef, input, Directive, EventEmitter, Component, Input, Output, ChangeDetectionStrategy, HostBinding, HostListener, SecurityContext, NgZone, ViewChild, ElementRef, ChangeDetectorRef, output, ContentChild, model, ViewEncapsulation, untracked, viewChild, Injector, isSignal } from '@angular/core';
-import { BehaviorSubject, throwError, Subject, map, distinctUntilChanged, filter as filter$1, take as take$1, firstValueFrom, of, from, EMPTY, Observable, interval, debounceTime, switchMap as switchMap$1, catchError as catchError$1, takeUntil, isObservable, forkJoin, race, timer, shareReplay } from 'rxjs';
-import { catchError, switchMap, finalize, filter, take, timeout, map as map$1, tap, distinctUntilChanged as distinctUntilChanged$1, retry, debounceTime as debounceTime$1, takeUntil as takeUntil$1 } from 'rxjs/operators';
+import { BehaviorSubject, throwError, Subject, map, distinctUntilChanged, filter as filter$1, take as take$1, firstValueFrom, of, from, EMPTY, Observable, interval, debounceTime, switchMap as switchMap$1, catchError as catchError$1, takeUntil, isObservable, forkJoin, race, timer, shareReplay as shareReplay$1 } from 'rxjs';
+import { catchError, switchMap, finalize, filter, take, timeout, map as map$1, tap, shareReplay, distinctUntilChanged as distinctUntilChanged$1, retry, debounceTime as debounceTime$1, takeUntil as takeUntil$1 } from 'rxjs/operators';
 import * as i1$3 from '@angular/common/http';
 import { provideHttpClient, withInterceptors, HttpClient, HttpErrorResponse } from '@angular/common/http';
 import * as i1$1 from '@angular/fire/firestore';
@@ -56,7 +56,7 @@ import { BrowserMultiFormatReader } from '@zxing/browser';
  * Current version of valtech-components.
  * This is automatically updated during the publish process.
  */
-const VERSION = '4.0.172';
+const VERSION = '4.0.173';
 
 // Control de estado de refresco (singleton a nivel de módulo)
 let isRefreshing = false;
@@ -8349,6 +8349,13 @@ class AuthService {
         this.refreshTimerId = null;
         this.syncSubscription = null;
         this.firestoreRBACUnsubscribe = null;
+        // Single-flight refresh: un solo POST /refresh en vuelo a la vez. Todos los
+        // callers (bootstrap, reestablecer Firebase, interceptor 401, timer proactivo)
+        // comparten el MISMO observable. Sin esto, refreshes concurrentes chocan contra
+        // la rotación de refresh token del backend: el primero rota el token y el
+        // segundo llega con el token ya invalidado → 401 → logout espurio (el usuario
+        // cae a la landing al actualizar). Ver project_pwa-login-freeze.
+        this.inFlightRefresh$ = null;
         // =============================================
         // ESTADO PÚBLICO (Signals readonly)
         // =============================================
@@ -8759,13 +8766,20 @@ class AuthService {
      * que el cliente debe guardar para el próximo refresh.
      */
     refreshAccessToken() {
+        // Single-flight: si ya hay un /refresh en vuelo, devolvemos el MISMO
+        // observable (multicast vía shareReplay). Evita la carrera contra la rotación
+        // de refresh token del backend, que producía 401 espurios → logout al
+        // actualizar. Ver inFlightRefresh$ y project_pwa-login-freeze.
+        if (this.inFlightRefresh$) {
+            return this.inFlightRefresh$;
+        }
         // H-05 same-site-aware: en same-site (prod) el refresh va SOLO por la cookie
         // HttpOnly (body vacío), no se persiste en localStorage → un XSS no lo roba.
         // En cross-site (dev) la cookie de terceros se bloquea (Safari ITP / Chrome
         // 3rd-party phase-out) → se manda en el body + se persiste (fallback).
         // withCredentials adjunta la cookie cuando el browser la permite.
         const body = this.storageService.cookieOnly ? {} : { refreshToken: this.state().refreshToken };
-        return this.http
+        this.inFlightRefresh$ = this.http
             .post(`${this.baseUrl}/refresh`, body, { withCredentials: true })
             .pipe(
         // Nunca dejar el refresh colgado: si la red/Lambda no responde a tiempo,
@@ -8795,7 +8809,17 @@ class AuthService {
             // initialize() only clears state (no redirect). Auto-navigating to
             // /login from this method redirects even users on public routes.
             return throwError(() => error);
-        }));
+        }), 
+        // Liberar el slot al terminar (éxito, error o timeout) para que el
+        // próximo refresh real arranque uno nuevo.
+        finalize(() => {
+            this.inFlightRefresh$ = null;
+        }), 
+        // Multicast: los side-effects del tap corren UNA vez y todos los callers
+        // concurrentes reciben la misma respuesta/error. refCount:false → que un
+        // caller se desuscribe temprano NO cancela la rotación de token en vuelo.
+        shareReplay({ bufferSize: 1, refCount: false }));
+        return this.inFlightRefresh$;
     }
     /**
      * Maneja autenticación exitosa desde fuentes externas (OAuth, etc).
@@ -61908,7 +61932,7 @@ class LegalContentService {
         const stream = fallback && fallback !== locale
             ? primary.pipe(catchError$1(() => this.loadOne(slug, fallback, options.basePath)))
             : primary;
-        const shared = stream.pipe(shareReplay({ bufferSize: 1, refCount: false }));
+        const shared = stream.pipe(shareReplay$1({ bufferSize: 1, refCount: false }));
         this.cache.set(key, shared);
         return shared;
     }