valtech-components 4.0.177 → 4.0.178

package/fesm2022/valtech-components.mjs

@@ -1,7 +1,7 @@
 import * as i0 from '@angular/core';
 import { inject, InjectionToken, makeEnvironmentProviders, APP_INITIALIZER, ErrorHandler, Injectable, DestroyRef, Inject, signal, computed, PLATFORM_ID, isDevMode, Optional, runInInjectionContext, effect, Pipe, TemplateRef, ViewContainerRef, input, Directive, EventEmitter, Component, Input, Output, ChangeDetectionStrategy, HostBinding, HostListener, SecurityContext, NgZone, ViewChild, ElementRef, ChangeDetectorRef, output, ContentChild, model, ViewEncapsulation, untracked, viewChild, Injector, isSignal } from '@angular/core';
-import { BehaviorSubject, throwError, Subject, map, distinctUntilChanged, filter as filter$1, take as take$1, firstValueFrom, of, from, EMPTY, Observable, interval, debounceTime, switchMap as switchMap$1, catchError as catchError$1, takeUntil, isObservable, forkJoin, race, timer, shareReplay } from 'rxjs';
-import { catchError, switchMap, finalize, filter, take, timeout, map as map$1, tap, distinctUntilChanged as distinctUntilChanged$1, retry, debounceTime as debounceTime$1, takeUntil as takeUntil$1 } from 'rxjs/operators';
+import { BehaviorSubject, throwError, Subject, map, distinctUntilChanged, filter as filter$1, take as take$1, firstValueFrom, of, from, EMPTY, Observable, interval, debounceTime, switchMap as switchMap$1, catchError as catchError$1, takeUntil, isObservable, forkJoin, race, timer, shareReplay as shareReplay$1 } from 'rxjs';
+import { catchError, switchMap, finalize, filter, take, timeout, map as map$1, tap, shareReplay, distinctUntilChanged as distinctUntilChanged$1, retry, debounceTime as debounceTime$1, takeUntil as takeUntil$1 } from 'rxjs/operators';
 import * as i1$3 from '@angular/common/http';
 import { provideHttpClient, withInterceptors, HttpClient, HttpErrorResponse } from '@angular/common/http';
 import * as i1$1 from '@angular/fire/firestore';
@@ -56,7 +56,7 @@ import { BrowserMultiFormatReader } from '@zxing/browser';
  * Current version of valtech-components.
  * This is automatically updated during the publish process.
  */
-const VERSION = '4.0.177';
+const VERSION = '4.0.178';
 
 // Control de estado de refresco (singleton a nivel de módulo)
 let isRefreshing = false;
@@ -6587,145 +6587,21 @@ class OAuthService {
             this.clearLocalStorageFallback();
             const nonce = this.generateNonce();
             this.expectedNonce = nonce;
-            // popup=true sobrevive el bounce cross-origin (Google/MS borran window.name
-            // por privacidad). El backend lo reenvía en el redirect final vía appendParams.
-            const redirectUri = `${window.location.origin}/auth/oauth/callback?popup=true`;
+            // Flujo REDIRECT (sin popup). El popup quedaba COLGADO bajo COOP: Google
+            // setea Cross-Origin-Opener-Policy → window.opener queda severado (el
+            // postMessage del popup no llega), BroadcastChannel/localStorage no siempre
+            // entregan, y popup.closed queda bloqueado ("COOP policy would block the
+            // window.closed call") → ni siquiera dispara el cancel: la ventana principal
+            // espera para siempre sin redirigir. Navegamos la VENTANA COMPLETA al /start;
+            // al volver, OAuthCallbackComponent corre como ventana principal (redirect_uri
+            // SIN popup=true) y completa la sesión vía completeInMainWindow → navega al
+            // home. Sin popup = sin COOP = sin cuelgue. (El link-flow sigue por popup.)
+            const redirectUri = `${window.location.origin}/auth/oauth/callback`;
             const startUrl = `${this.config?.apiUrl}/v2/auth/oauth/${provider}/start?redirect_uri=${encodeURIComponent(redirectUri)}&client_nonce=${encodeURIComponent(nonce)}`;
-            // Abrir popup centrado
-            const width = 500;
-            const height = 600;
-            const left = window.screenX + (window.outerWidth - width) / 2;
-            const top = window.screenY + (window.outerHeight - height) / 2;
-            const features = `width=${width},height=${height},left=${left},top=${top},popup=yes`;
-            this.popup = window.open(startUrl, 'oauth', features);
-            if (!this.popup) {
-                observer.error({
-                    code: 'POPUP_BLOCKED',
-                    message: 'El navegador bloqueó la ventana emergente. Por favor, permite popups para este sitio.',
-                });
-                return () => { };
-            }
-            // Escuchar mensajes del popup
-            this.messageHandler = (event) => {
-                // Validar origen
-                if (event.origin !== window.location.origin) {
-                    return;
-                }
-                // Validar tipo de mensaje
-                const data = event.data;
-                if (data?.type !== 'oauth-callback') {
-                    return;
-                }
-                // Verificar el nonce del flujo (M-07): si no coincide, no es nuestro
-                // callback → ignorar (no consumir el observable).
-                if (!this.isNonceValid(data)) {
-                    return;
-                }
-                // Limpiar
-                this.cleanup();
-                // Emitir resultado dentro de NgZone para trigger change detection
-                this.ngZone.run(() => {
-                    if (data.error) {
-                        observer.error(data.error);
-                    }
-                    else if (data.tokens) {
-                        observer.next(data.tokens);
-                        observer.complete();
-                    }
-                    else {
-                        observer.error({
-                            code: 'INVALID_RESPONSE',
-                            message: 'Respuesta inválida del servidor de autenticación',
-                        });
-                    }
-                });
-            };
-            window.addEventListener('message', this.messageHandler);
-            // BroadcastChannel: canal adicional immune a COOP (funciona entre misma
-            // origin sin importar el browsing context group). Es el canal más fiable
-            // cuando COOP sever el link opener→popup al pasar por Google/MS.
-            try {
-                this.broadcastChannel = new BroadcastChannel('valtech-oauth-callback');
-                this.broadcastChannel.onmessage = (event) => {
-                    const data = event.data;
-                    if (data?.type !== 'oauth-callback')
-                        return;
-                    if (!this.isNonceValid(data))
-                        return;
-                    this.clearLocalStorageFallback();
-                    this.cleanup();
-                    this.ngZone.run(() => {
-                        if (data.error) {
-                            observer.error(data.error);
-                        }
-                        else if (data.tokens) {
-                            observer.next(data.tokens);
-                            observer.complete();
-                        }
-                        else {
-                            observer.error({
-                                code: 'INVALID_RESPONSE',
-                                message: 'Respuesta inválida del servidor de autenticación',
-                            });
-                        }
-                    });
-                };
-            }
-            catch {
-                // BroadcastChannel no disponible (contextos muy restringidos) — ignorar
-            }
-            // Polling de localStorage (COOP workaround - no podemos detectar popup.closed)
-            // También verifica si el popup se cerró manualmente
-            this.checkClosedInterval = setInterval(() => {
-                // Primero verificar localStorage (funciona aunque COOP bloquee todo)
-                const storedData = this.checkLocalStorageFallback();
-                if (storedData) {
-                    this.cleanup();
-                    this.ngZone.run(() => {
-                        if (storedData.error) {
-                            observer.error(storedData.error);
-                        }
-                        else if (storedData.tokens) {
-                            // Gate de diagnóstico: la metadata de tokens (keys, presencia y
-                            // longitud del firebaseToken) no debe filtrarse a la consola en
-                            // producción (L4 del audit). Solo en dev.
-                            if (isDevMode()) {
-                                console.log('[OAuthService] Retrieved tokens from localStorage fallback', {
-                                    keys: Object.keys(storedData.tokens),
-                                    hasFirebaseToken: !!storedData.tokens.firebaseToken,
-                                    firebaseTokenLength: storedData.tokens.firebaseToken?.length ?? 0,
-                                });
-                            }
-                            observer.next(storedData.tokens);
-                            observer.complete();
-                        }
-                        else {
-                            observer.error({
-                                code: 'INVALID_RESPONSE',
-                                message: 'Respuesta inválida del servidor de autenticación',
-                            });
-                        }
-                    });
-                    return;
-                }
-                // Intentar verificar si popup se cerró (puede fallar por COOP)
-                try {
-                    if (this.popup?.closed) {
-                        this.cleanup();
-                        this.ngZone.run(() => {
-                            observer.error({
-                                code: 'POPUP_CLOSED',
-                                message: 'Se cerró la ventana de autenticación',
-                            });
-                        });
-                    }
-                }
-                catch {
-                    // COOP bloquea acceso a popup.closed - ignorar y seguir con polling
-                }
-            }, 300);
-            // Cleanup cuando el observable se destruye
-            return () => this.cleanup();
+            window.location.assign(startUrl);
+            // La página se descarga acá; el observable no emite (la finalización ocurre
+            // en el callback, ya como ventana principal). Sin listeners ni polling.
+            return () => { };
         });
     }
     /**
@@ -8352,6 +8228,13 @@ class AuthService {
         this.refreshTimerId = null;
         this.syncSubscription = null;
         this.firestoreRBACUnsubscribe = null;
+        // Single-flight refresh: un solo POST /refresh en vuelo a la vez. Todos los
+        // callers (bootstrap, reestablecer Firebase, interceptor 401, timer proactivo)
+        // comparten el MISMO observable. Sin esto, refreshes concurrentes chocan contra
+        // la rotación de refresh token del backend: el primero rota el token y el
+        // segundo llega con el token ya invalidado → 401 → logout espurio (el usuario
+        // cae a la landing al actualizar). Ver project_pwa-login-freeze.
+        this.inFlightRefresh$ = null;
         // =============================================
         // ESTADO PÚBLICO (Signals readonly)
         // =============================================
@@ -8762,13 +8645,20 @@ class AuthService {
      * que el cliente debe guardar para el próximo refresh.
      */
     refreshAccessToken() {
+        // Single-flight: si ya hay un /refresh en vuelo, devolvemos el MISMO
+        // observable (multicast vía shareReplay). Evita la carrera contra la rotación
+        // de refresh token del backend, que producía 401 espurios → logout al
+        // actualizar. Ver inFlightRefresh$ y project_pwa-login-freeze.
+        if (this.inFlightRefresh$) {
+            return this.inFlightRefresh$;
+        }
         // H-05 same-site-aware: en same-site (prod) el refresh va SOLO por la cookie
         // HttpOnly (body vacío), no se persiste en localStorage → un XSS no lo roba.
         // En cross-site (dev) la cookie de terceros se bloquea (Safari ITP / Chrome
         // 3rd-party phase-out) → se manda en el body + se persiste (fallback).
         // withCredentials adjunta la cookie cuando el browser la permite.
         const body = this.storageService.cookieOnly ? {} : { refreshToken: this.state().refreshToken };
-        return this.http
+        this.inFlightRefresh$ = this.http
             .post(`${this.baseUrl}/refresh`, body, { withCredentials: true })
             .pipe(
         // Nunca dejar el refresh colgado: si la red/Lambda no responde a tiempo,
@@ -8798,7 +8688,17 @@ class AuthService {
             // initialize() only clears state (no redirect). Auto-navigating to
             // /login from this method redirects even users on public routes.
             return throwError(() => error);
-        }));
+        }), 
+        // Liberar el slot al terminar (éxito, error o timeout) para que el
+        // próximo refresh real arranque uno nuevo.
+        finalize(() => {
+            this.inFlightRefresh$ = null;
+        }), 
+        // Multicast: los side-effects del tap corren UNA vez y todos los callers
+        // concurrentes reciben la misma respuesta/error. refCount:false → que un
+        // caller se desuscribe temprano NO cancela la rotación de token en vuelo.
+        shareReplay({ bufferSize: 1, refCount: false }));
+        return this.inFlightRefresh$;
     }
     /**
      * Maneja autenticación exitosa desde fuentes externas (OAuth, etc).
@@ -28351,6 +28251,13 @@ class UpdateBannerComponent {
                 dismissAction: this.tr('dismissAction'),
             };
         });
+        /**
+         * Feedback visual mientras se aplica el update. El botón pasa a estado
+         * WORKING (spinner) y se bloquean nuevos taps. `applyUpdate()` siempre
+         * recarga la página al terminar (try/finally), así que NO reseteamos este
+         * flag: queda en true hasta que el reload reemplaza la app.
+         */
+        this.applying = signal(false);
         if (!this.i18n.hasNamespace(UPDATE_BANNER_I18N_NAMESPACE)) {
             this.i18n.registerContent(UPDATE_BANNER_I18N_NAMESPACE, {
                 es: UPDATE_BANNER_DEFAULT_CONTENT.es,
@@ -28360,6 +28267,11 @@ class UpdateBannerComponent {
     }
     /** Aplica la actualización (activa el SW si existe + recarga). */
     onUpdate() {
+        // Anti multi-tap: el botón WORKING no queda `disabled` a nivel DOM, así que
+        // sin este guard un usuario impaciente dispararía applyUpdate() N veces.
+        if (this.applying())
+            return;
+        this.applying.set(true);
         void this.version.applyUpdate();
     }
     /** Descarta el banner opcional. No-op en modo obligatorio. */
@@ -28429,7 +28341,7 @@ class UpdateBannerComponent {
                 color: 'primary',
                 fill: 'solid',
                 size: 'small',
-                state: 'ENABLED',
+                state: applying() ? 'WORKING' : 'ENABLED',
                 type: 'button',
               }"
               (onClick)="onUpdate()"
@@ -28441,7 +28353,7 @@ class UpdateBannerComponent {
                   color: 'dark',
                   fill: 'clear',
                   size: 'small',
-                  state: 'ENABLED',
+                  state: applying() ? 'DISABLED' : 'ENABLED',
                   type: 'button',
                 }"
                 (onClick)="onDismiss()"
@@ -28504,7 +28416,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.14", ngImpo
                 color: 'primary',
                 fill: 'solid',
                 size: 'small',
-                state: 'ENABLED',
+                state: applying() ? 'WORKING' : 'ENABLED',
                 type: 'button',
               }"
               (onClick)="onUpdate()"
@@ -28516,7 +28428,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.14", ngImpo
                   color: 'dark',
                   fill: 'clear',
                   size: 'small',
-                  state: 'ENABLED',
+                  state: applying() ? 'DISABLED' : 'ENABLED',
                   type: 'button',
                 }"
                 (onClick)="onDismiss()"
@@ -35347,7 +35259,7 @@ class HtmlViewerModalComponent {
     <ion-content>
       <iframe [srcdoc]="safeHtml" style="width: 100%; height: 100%; border: none;" title="Visor de documento"></iframe>
     </ion-content>
-  `, isInline: true, styles: [":host{display:flex;flex-direction:column}ion-content{--padding-bottom: 0;--padding-top: 0}iframe{display:block}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "component", type: IonButton, selector: "ion-button", inputs: ["buttonType", "color", "disabled", "download", "expand", "fill", "form", "href", "mode", "rel", "routerAnimation", "routerDirection", "shape", "size", "strong", "target", "type"] }, { kind: "component", type: IonHeader, selector: "ion-header", inputs: ["collapse", "mode", "translucent"] }, { kind: "component", type: IonToolbar, selector: "ion-toolbar", inputs: ["color", "mode"] }, { kind: "component", type: IonButtons, selector: "ion-buttons", inputs: ["collapse"] }, { kind: "component", type: IonContent, selector: "ion-content", inputs: ["color", "fixedSlotPlacement", "forceOverscroll", "fullscreen", "scrollEvents", "scrollX", "scrollY"] }, { kind: "component", type: IonIcon, selector: "ion-icon", inputs: ["color", "flipRtl", "icon", "ios", "lazy", "md", "mode", "name", "sanitize", "size", "src"] }] }); }
+  `, isInline: true, styles: [":host{display:flex;flex-direction:column}ion-content{--padding-top: 12px;--padding-bottom: 12px;--padding-start: 12px;--padding-end: 12px;--background: var(--ion-color-light, #f4f5f8)}iframe{display:block;border-radius:8px;background:#fff}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "component", type: IonButton, selector: "ion-button", inputs: ["buttonType", "color", "disabled", "download", "expand", "fill", "form", "href", "mode", "rel", "routerAnimation", "routerDirection", "shape", "size", "strong", "target", "type"] }, { kind: "component", type: IonHeader, selector: "ion-header", inputs: ["collapse", "mode", "translucent"] }, { kind: "component", type: IonToolbar, selector: "ion-toolbar", inputs: ["color", "mode"] }, { kind: "component", type: IonButtons, selector: "ion-buttons", inputs: ["collapse"] }, { kind: "component", type: IonContent, selector: "ion-content", inputs: ["color", "fixedSlotPlacement", "forceOverscroll", "fullscreen", "scrollEvents", "scrollX", "scrollY"] }, { kind: "component", type: IonIcon, selector: "ion-icon", inputs: ["color", "flipRtl", "icon", "ios", "lazy", "md", "mode", "name", "sanitize", "size", "src"] }] }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.14", ngImport: i0, type: HtmlViewerModalComponent, decorators: [{
             type: Component,
@@ -35370,7 +35282,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "18.2.14", ngImpo
     <ion-content>
       <iframe [srcdoc]="safeHtml" style="width: 100%; height: 100%; border: none;" title="Visor de documento"></iframe>
     </ion-content>
-  `, styles: [":host{display:flex;flex-direction:column}ion-content{--padding-bottom: 0;--padding-top: 0}iframe{display:block}\n"] }]
+  `, styles: [":host{display:flex;flex-direction:column}ion-content{--padding-top: 12px;--padding-bottom: 12px;--padding-start: 12px;--padding-end: 12px;--background: var(--ion-color-light, #f4f5f8)}iframe{display:block;border-radius:8px;background:#fff}\n"] }]
         }], propDecorators: { html: [{
                 type: Input
             }], title: [{
@@ -61903,7 +61815,7 @@ class LegalContentService {
         const stream = fallback && fallback !== locale
             ? primary.pipe(catchError$1(() => this.loadOne(slug, fallback, options.basePath)))
             : primary;
-        const shared = stream.pipe(shareReplay({ bufferSize: 1, refCount: false }));
+        const shared = stream.pipe(shareReplay$1({ bufferSize: 1, refCount: false }));
         this.cache.set(key, shared);
         return shared;
     }