import { HttpInterceptorFn, HttpContextToken } from '@angular/common/http'; import * as _angular_core from '@angular/core'; import { InjectionToken, EnvironmentProviders, OnInit } from '@angular/core'; import { PersistentAuthUser } from '@edsis/sdk/auth'; import { CanActivateFn, Routes } from '@angular/router'; import { EdsisWindowControlAction } from '@edsis/angular/services/runtime'; import { LayoutService, DesktopAppBarPlatform } from '@edsis/theme/layout'; import * as _edsis_angular_module_auth from '@edsis/angular/module/auth'; import * as _angular_forms from '@angular/forms'; /** * Seluruh teks yang tampil di halaman auth (login, logout, verify). * Override sebagian/seluruhnya lewat `provideEdsisAuth({ messages: ... })` * untuk deployment berbahasa lain atau branding berbeda. */ interface EdsisAuthMessages { readonly brand: { /** Teks singkat di kotak logo (mis. inisial produk). */ readonly mark: string; }; readonly login: { readonly title: string; readonly intro: string; readonly badge: string; readonly emailPlaceholder: string; readonly submit: string; readonly submitting: string; readonly emailRequired: string; readonly emailInvalid: string; readonly magicLinkSent: string; readonly magicLinkFailed: string; readonly oauthComingSoon: string; readonly oauthGoogleAria: string; readonly oauthMicrosoftAria: string; readonly oauthAppleAria: string; readonly healthUnavailableTitle: string; readonly healthUnavailableBody: string; readonly healthRetry: string; readonly healthChecking: string; }; readonly google: { readonly title: string; readonly intro: string; readonly badge: string; /** Aria tombol Google di halaman login saat sign-in aktif (config terisi). */ readonly signInAria: string; /** Status di halaman login selama full-page redirect ke Google berlangsung. */ readonly googleRedirecting: string; readonly gatewayStartFailed: string; readonly gatewayHandoffInProgress: string; readonly gatewaySessionMissing: string; readonly nativeSignInInProgress: string; readonly nativeSignInUnavailable: string; readonly nativeSignInFailed: string; readonly googleExchangeInProgress: string; readonly exchangeInProgressAria: string; readonly googleStateMismatch: string; readonly googleAccessDenied: string; /** Error generik callback; juga fallback saat backend tidak mengirim pesan. */ readonly googleCallbackError: string; readonly googleRetry: string; readonly missingAccessToken: string; readonly successRedirect: string; readonly openDashboard: string; }; readonly logout: { readonly title: string; readonly intro: string; readonly badge: string; readonly pending: string; readonly pendingAria: string; readonly success: string; readonly failed: string; readonly failedNote: string; readonly backToLogin: string; readonly openDashboard: string; }; readonly verify: { readonly title: string; readonly intro: string; readonly badge: string; readonly pending: string; readonly pendingAria: string; readonly tokenMissing: string; readonly invalidOrExpired: string; readonly successRedirect: string; readonly missingAccessToken: string; readonly requestNewLink: string; readonly openDashboard: string; }; } declare const DEFAULT_EDSIS_AUTH_MESSAGES: EdsisAuthMessages; /** Override per-bagian; field yang tidak diisi memakai default. */ type EdsisAuthMessagesOverride = { readonly [K in keyof EdsisAuthMessages]?: Partial; }; declare const EDSIS_AUTH_MESSAGES: InjectionToken; declare function mergeEdsisAuthMessages(override?: EdsisAuthMessagesOverride): EdsisAuthMessages; declare const GOOGLE_AUTH_GATEWAY_DEFAULT_START_ENDPOINT: "/v1/auth/google/start"; declare const GOOGLE_AUTH_GATEWAY_DEFAULT_HANDOFF_ENDPOINT: "/v1/auth/google/handoff"; /** * Path route callback Google di dalam `authRoutes`; juga menjadi sumber * derivasi `redirectUri` (`${appUrl}/auth/google/callback`), sehingga URL yang * didaftarkan di Google Cloud Console selalu konsisten dengan route library. */ declare const GOOGLE_OAUTH_CALLBACK_ROUTE_PATH: "auth/google/callback"; /** * Health-check backend auth di halaman login (opt-in). * Sehat = HTTP 2xx dalam `timeoutMs`; body respons tidak diparse. */ interface EdsisAuthHealthCheckConfig { /** Default `false` — tanpa flag, perilaku login tidak berubah. */ enabled?: boolean; /** Default `${apiUrl}/health`. */ url?: string; /** Default 4000. */ timeoutMs?: number; } /** * Google Sign-In dengan authorization-code flow. Exchange code dilakukan * backend (`POST {apiUrl}/v1/auth/google`) sehingga client secret tidak pernah * menyentuh frontend. */ interface EdsisAuthGoogleDirectOauthConfig { /** Optional for backward compatibility; omitting it selects direct mode. */ mode?: 'direct'; /** * OAuth 2.0 client ID dari Google Cloud Console. String kosong dianggap * tidak dikonfigurasi (tombol Google tetap placeholder), sehingga aman * meneruskan nilai environment yang di-inject build-time apa adanya. */ clientId: string; } interface EdsisAuthGoogleGatewayEndpointsConfig { /** * Base URL Auth Gateway. Default `apiUrl`; jika diisi, origin-nya wajib * sama dengan `apiUrl` agar seluruh cookie/session auth tetap satu origin. */ baseUrl?: string; /** Default `/v1/auth/google/start`; harus path relatif terhadap `baseUrl`. */ startEndpoint?: string; /** Default `/v1/auth/google/handoff`; harus path relatif terhadap `baseUrl`. */ handoffEndpoint?: string; } /** * Google Sign-In terpusat untuk MFE. Gateway memiliki konfigurasi Google dan * refresh cookie; MFE hanya memiliki ID allowlist dan PKCE verifier sekali pakai. */ interface EdsisAuthGoogleGatewayOauthConfig { mode: 'gateway'; /** ID lower-kebab-case yang terdaftar bersama return URL pada Auth Gateway. */ mfeId: string; /** Optional jika Gateway memakai base URL dan endpoint auth standar dari `apiUrl`. */ gateway?: EdsisAuthGoogleGatewayEndpointsConfig; } /** `{ clientId }` lama tetap memilih direct mode tanpa perubahan konsumer. */ type EdsisAuthGoogleOauthConfig = EdsisAuthGoogleDirectOauthConfig | EdsisAuthGoogleGatewayOauthConfig; interface EdsisAuthNativeGoogleConfig { /** Default `true` saat blok konfigurasi ini diberikan. */ enabled?: boolean; /** Harus path same-origin. Default `/api`. */ apiUrl?: `/${string}`; } interface EdsisAuthOauthConfig { google?: EdsisAuthGoogleOauthConfig; nativeGoogle?: EdsisAuthNativeGoogleConfig; } interface EdsisAuthConfig { apiUrl: string; appUrl: string; loginPath?: string; logoutPath?: string; verifyPath?: string; authenticatedHomePath?: string; guestHomePath?: string; /** Override teks UI halaman auth (i18n/branding). */ messages?: EdsisAuthMessagesOverride; /** * Interceptor tambahan dari aplikasi (mis. `layoutLoadingInterceptor` dari * `@edsis/theme/layout`), dijalankan setelah interceptor auth Edsis. */ httpInterceptors?: readonly HttpInterceptorFn[]; healthCheck?: EdsisAuthHealthCheckConfig; /** * Provider OAuth di halaman login (saat ini hanya Google). Callback direct * maupun Gateway tidak dikonfigurasi konsumer; library menurunkannya dari * `appUrl` sebagai `${appUrl}/auth/google/callback`. */ oauth?: EdsisAuthOauthConfig; } interface ResolvedEdsisAuthHealthCheck { enabled: boolean; url: string; timeoutMs: number; } interface ResolvedEdsisAuthGoogleDirectOauth { mode: 'direct'; clientId: string; /** Diturunkan dari `appUrl`: `${appUrl}/auth/google/callback`. */ redirectUri: string; } interface ResolvedEdsisAuthGoogleGatewayOauth { mode: 'gateway'; mfeId: string; /** Callback MFE exact yang didaftarkan pada allowlist Gateway. */ returnUrl: string; gateway: { baseUrl: string; startUrl: string; handoffUrl: string; }; } type ResolvedEdsisAuthGoogleOauth = ResolvedEdsisAuthGoogleDirectOauth | ResolvedEdsisAuthGoogleGatewayOauth; interface ResolvedEdsisAuthOauth { /** `null` saat Google Sign-In tidak dikonfigurasi (perilaku placeholder lama). */ google: ResolvedEdsisAuthGoogleOauth | null; /** Flow native tablet; selalu memakai endpoint same-origin. */ nativeGoogle: { readonly apiUrl: `/${string}`; } | null; } interface ResolvedEdsisAuthConfig { apiUrl: string; appUrl: string; loginPath: `/${string}`; logoutPath: `/${string}`; verifyPath: `/${string}`; authenticatedHomePath: `/${string}`; guestHomePath: `/${string}`; healthCheck: ResolvedEdsisAuthHealthCheck; oauth: ResolvedEdsisAuthOauth; } declare const EDSIS_AUTH_CONFIG: InjectionToken; declare function resolveEdsisAuthConfig(config: EdsisAuthConfig): ResolvedEdsisAuthConfig; declare function provideEdsisAuth(config: EdsisAuthConfig): EnvironmentProviders; interface AuthUser extends PersistentAuthUser { readonly role?: string; } /** Native desktop features are optional; browser consumers have no bridge. */ declare function setAuthNotificationBadge(unreadCount: number): Promise; /** * Cookie-backed authentication state. The access token intentionally exists * only in this service instance; the long-lived refresh token is an HttpOnly * cookie owned by the server. */ declare class AuthService { private readonly http; private readonly config; private readonly router; private readonly runtime; private readonly nativeGoogleAdapter; private readonly accessTokenState; private readonly userState; private refreshInFlight; private initialization; readonly accessToken: _angular_core.Signal; readonly user: _angular_core.Signal; readonly isAuthenticated: _angular_core.Signal; get apiUrl(): string; get sessionApiUrl(): string; /** Restores an existing cookie session. A missing/expired cookie is normal. */ initialize(): Promise; private restoreSession; /** One shared refresh operation for initializer and concurrent 401 retries. */ refresh(): Promise; loadCurrentUser(): Promise; logout(): Promise; clearSession(): void; /** Allows existing OAuth exchanges to establish the same memory-only state. */ acceptTokenResponse(response: unknown): void; redirectToLogin(): void; private applyTokenResponse; private clearNativeGoogleSession; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵprov: _angular_core.ɵɵInjectableDeclaration; } declare const authenticatedGuard: CanActivateFn; declare const homeRedirectGuard: CanActivateFn; declare const guestOnlyGuard: CanActivateFn; declare const EDSIS_SKIP_AUTH: HttpContextToken; declare const edsisAuthInterceptor: HttpInterceptorFn; type NativeGooglePlatform = 'ios' | 'android'; interface NativeGoogleSignInResult { readonly platform: NativeGooglePlatform; readonly idToken: string; readonly clientInstanceId: string; } interface EdsisNativeGoogleAuthAdapter { signInWithGoogle(input: { readonly nonce: string; }): Promise; signOutFromGoogle(): Promise; } declare const EDSIS_NATIVE_GOOGLE_AUTH_ADAPTER: InjectionToken; declare class TauriNativeGoogleAuthAdapter implements EdsisNativeGoogleAuthAdapter { signInWithGoogle(input: { readonly nonce: string; }): Promise; signOutFromGoogle(): Promise; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵprov: _angular_core.ɵɵInjectableDeclaration; } declare function isNativeGoogleSignInResult(value: unknown): value is NativeGoogleSignInResult; declare class NativeGoogleAuthService { private readonly http; private readonly auth; private readonly config; private readonly runtime; private readonly adapter; readonly requiresNativeGoogle: _angular_core.Signal; readonly isAvailable: _angular_core.Signal; signIn(): Promise; private exchangeNativeToken; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵprov: _angular_core.ɵɵInjectableDeclaration; } declare const GOOGLE_GATEWAY_SESSION_STORAGE_KEY = "auth-google-gateway-session"; declare const GOOGLE_GATEWAY_SESSION_VERSION: 1; interface GoogleGatewaySession { readonly version: typeof GOOGLE_GATEWAY_SESSION_VERSION; readonly mfeId: string; readonly returnUrl: string; readonly codeVerifier: string; readonly expiresAt: number; } interface GoogleGatewaySessionExpectation { readonly mfeId: string; readonly returnUrl: string; readonly now?: number; } /** RFC 7636 verifier with 256 bits of entropy and no persisted token material. */ declare function createGooglePkceVerifier(windowRef: Window): string; /** RFC 7636 S256 challenge for the verifier retained in the one-time session. */ declare function createGooglePkceChallenge(windowRef: Window, codeVerifier: string): Promise; /** Stores only the verifier and short-lived correlation metadata. */ declare function storeGoogleGatewaySession(documentRef: Document, session: GoogleGatewaySession): void; declare function clearGoogleGatewaySession(documentRef: Document): void; /** * Consumes the PKCE session exactly once. Malformed, expired, or cross-MFE * records fail closed after removal so they cannot be replayed. */ declare function consumeGoogleGatewaySession(documentRef: Document, expected: GoogleGatewaySessionExpectation): GoogleGatewaySession | null; /** HTTP client for the central Google Auth Gateway mode. */ declare class GoogleGatewayAuthService { private readonly config; private readonly documentRef; private readonly http; start(): Promise; consumeSession(): GoogleGatewaySession | null; exchangeHandoff(handoffCode: string, session: GoogleGatewaySession): Promise; private requireGatewayConfig; private requireWindow; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵprov: _angular_core.ɵɵInjectableDeclaration; } declare const GOOGLE_OAUTH_STATE_STORAGE_KEY = "auth-google-state"; declare const GOOGLE_OAUTH_AUTHORIZE_URL = "https://accounts.google.com/o/oauth2/v2/auth"; interface GoogleAuthorizeUrlOptions { clientId: string; redirectUri: string; state: string; } /** Nilai `state` acak berbasis crypto (anti-CSRF untuk round-trip OAuth). */ declare function createGoogleOauthState(windowRef: Window): string; declare function buildGoogleAuthorizeUrl(options: GoogleAuthorizeUrlOptions): string; declare function storeGoogleOauthState(documentRef: Document, state: string): void; /** * Baca lalu hapus state dari sessionStorage. State sekali pakai: dikonsumsi di * semua cabang callback agar tidak bocor ke percobaan login berikutnya. */ declare function consumeGoogleOauthState(documentRef: Document): string; declare const authRoutes: Routes; declare class AuthShellPage { private readonly runtimeContext; private readonly nativeHost; protected readonly layout: LayoutService; protected readonly isDesktopAppearance: _angular_core.Signal; protected readonly desktopAppBarPlatform: _angular_core.Signal; protected onDesktopWindowControlRequested(action: EdsisWindowControlAction): void; protected onDesktopWindowDragRequested(): void; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵcmp: _angular_core.ɵɵComponentDeclaration; } declare class AuthGoogleCallbackPage { private readonly documentRef; private readonly destroyRef; private readonly injector; private readonly route; private readonly router; private readonly location; private readonly authSessionService; private readonly authService; private readonly authConfig; private readonly googleGateway; protected readonly messages: _edsis_angular_module_auth.EdsisAuthMessages; protected readonly loginPath: `/${string}`; protected readonly authenticatedHomePath: `/${string}`; protected readonly state: _angular_core.WritableSignal<"pending" | "success" | "error">; protected readonly message: _angular_core.WritableSignal; private readonly retryLink; constructor(); private handleCallback; private clearCallbackParamsFromAddressBar; private exchangeDirectCode; private exchangeGatewayHandoff; private complete; private callbackErrorMessage; private fail; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵcmp: _angular_core.ɵɵComponentDeclaration; } type AuthHealthStatus = 'idle' | 'checking' | 'healthy' | 'unhealthy'; /** * Health-check backend auth untuk `AuthLoginPage` (internal, di-provide oleh * `provideEdsisAuth`). Sehat = HTTP 2xx dalam `timeoutMs`; body tidak diparse. * Tanpa polling — hanya on-load, pre-submit, dan Retry manual. */ declare class AuthHealthService { private readonly http; private readonly config; private readonly _status; readonly status: _angular_core.Signal; readonly isChecking: _angular_core.Signal; readonly isUnhealthy: _angular_core.Signal; private inFlight; /** true jika sehat ATAU health-check dimatikan. Tak pernah throw. */ check(): Promise; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵprov: _angular_core.ɵɵInjectableDeclaration; } declare class AuthLoginPage { private readonly documentRef; private readonly destroyRef; private readonly formBuilder; private readonly injector; private readonly authMagicLinkService; private readonly authConfig; private readonly googleGateway; private readonly nativeGoogle; private readonly router; protected readonly messages: _edsis_angular_module_auth.EdsisAuthMessages; protected readonly health: AuthHealthService; protected readonly googleOauth: _edsis_angular_module_auth.ResolvedEdsisAuthGoogleOauth | null; protected readonly isGoogleRedirecting: _angular_core.WritableSignal; protected readonly googleErrorMessage: _angular_core.WritableSignal; protected readonly requiresNativeGoogle: _angular_core.Signal; protected readonly isNativeGoogle: _angular_core.Signal; protected readonly googleSignInAvailable: _angular_core.Signal; protected readonly googleFeedbackMessage: _angular_core.Signal; protected readonly googleProgressMessage: _angular_core.Signal; protected readonly form: _angular_forms.FormGroup<{ email: _angular_forms.FormControl; }>; protected readonly isSubmitting: _angular_core.WritableSignal; protected readonly responseMessage: _angular_core.WritableSignal; protected readonly errorMessage: _angular_core.WritableSignal; protected readonly emailControl: _angular_forms.FormControl; protected readonly emailFeedbackId = "email-feedback"; protected readonly healthBannerId = "auth-health-banner"; private readonly retryButton; private readonly emailControlState; constructor(); protected readonly hasInlineError: _angular_core.Signal; protected readonly inlineErrorMessage: _angular_core.Signal; protected readonly feedbackMessage: _angular_core.Signal; protected readonly feedbackTone: _angular_core.Signal<"success" | "error" | null>; protected readonly fieldTone: _angular_core.Signal<"success" | "error" | "idle">; protected readonly emailFieldClasses: _angular_core.Signal<"flex-nowrap bg-background/70 shadow-sm [&>[data-slot=input-group-control]]:h-12! [&>[data-slot=input-group-control]]:px-4! [&>[data-slot=input-group-control]]:text-base!" | "flex-nowrap bg-background/70 shadow-sm [&>[data-slot=input-group-control]]:h-12! [&>[data-slot=input-group-control]]:px-4! [&>[data-slot=input-group-control]]:text-base! border-destructive focus-within:border-destructive focus-within:ring-destructive/20" | "flex-nowrap bg-background/70 shadow-sm [&>[data-slot=input-group-control]]:h-12! [&>[data-slot=input-group-control]]:px-4! [&>[data-slot=input-group-control]]:text-base! border-emerald-500 focus-within:border-emerald-500 focus-within:ring-emerald-500/20">; protected retryHealth(): void; protected signInWithGoogle(): void; private signInWithGatewayGoogle; private signInWithNativeGoogle; protected redirectTo(url: string): void; protected submit(): Promise; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵcmp: _angular_core.ɵɵComponentDeclaration; } declare class AuthLogoutPage implements OnInit { private readonly destroyRef; private readonly router; private readonly authService; private readonly authConfig; protected readonly messages: _edsis_angular_module_auth.EdsisAuthMessages; protected readonly guestHomePath: `/${string}`; protected readonly authenticatedHomePath: `/${string}`; protected readonly state: _angular_core.WritableSignal<"pending" | "success" | "error">; protected readonly message: _angular_core.WritableSignal; ngOnInit(): void; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵcmp: _angular_core.ɵɵComponentDeclaration; } declare class AuthVerifyPage { private readonly documentRef; private readonly destroyRef; private readonly route; private readonly router; private readonly location; private readonly authMagicLinkService; private readonly authConfig; private readonly authService; protected readonly messages: _edsis_angular_module_auth.EdsisAuthMessages; private readonly queryParamMap; private readonly fragment; private handledToken; private verifySubscription; protected readonly guestHomePath: `/${string}`; protected readonly authenticatedHomePath: `/${string}`; protected readonly state: _angular_core.WritableSignal<"pending" | "success" | "error">; protected readonly message: _angular_core.WritableSignal; protected readonly token: _angular_core.InputSignal; constructor(); private clearTokenFromAddressBar; private verify; static ɵfac: _angular_core.ɵɵFactoryDeclaration; static ɵcmp: _angular_core.ɵɵComponentDeclaration; } export { AuthGoogleCallbackPage, AuthLoginPage, AuthLogoutPage, AuthService, AuthShellPage, AuthVerifyPage, DEFAULT_EDSIS_AUTH_MESSAGES, EDSIS_AUTH_CONFIG, EDSIS_AUTH_MESSAGES, EDSIS_NATIVE_GOOGLE_AUTH_ADAPTER, EDSIS_SKIP_AUTH, GOOGLE_AUTH_GATEWAY_DEFAULT_HANDOFF_ENDPOINT, GOOGLE_AUTH_GATEWAY_DEFAULT_START_ENDPOINT, GOOGLE_GATEWAY_SESSION_STORAGE_KEY, GOOGLE_GATEWAY_SESSION_VERSION, GOOGLE_OAUTH_AUTHORIZE_URL, GOOGLE_OAUTH_CALLBACK_ROUTE_PATH, GOOGLE_OAUTH_STATE_STORAGE_KEY, GoogleGatewayAuthService, NativeGoogleAuthService, TauriNativeGoogleAuthAdapter, authRoutes, authenticatedGuard, buildGoogleAuthorizeUrl, clearGoogleGatewaySession, consumeGoogleGatewaySession, consumeGoogleOauthState, createGoogleOauthState, createGooglePkceChallenge, createGooglePkceVerifier, edsisAuthInterceptor, guestOnlyGuard, homeRedirectGuard, isNativeGoogleSignInResult, mergeEdsisAuthMessages, provideEdsisAuth, resolveEdsisAuthConfig, setAuthNotificationBadge, storeGoogleGatewaySession, storeGoogleOauthState }; export type { AuthUser, EdsisAuthConfig, EdsisAuthGoogleDirectOauthConfig, EdsisAuthGoogleGatewayEndpointsConfig, EdsisAuthGoogleGatewayOauthConfig, EdsisAuthGoogleOauthConfig, EdsisAuthHealthCheckConfig, EdsisAuthMessages, EdsisAuthMessagesOverride, EdsisAuthNativeGoogleConfig, EdsisAuthOauthConfig, EdsisNativeGoogleAuthAdapter, GoogleAuthorizeUrlOptions, GoogleGatewaySession, GoogleGatewaySessionExpectation, NativeGooglePlatform, NativeGoogleSignInResult, ResolvedEdsisAuthConfig, ResolvedEdsisAuthGoogleDirectOauth, ResolvedEdsisAuthGoogleGatewayOauth, ResolvedEdsisAuthGoogleOauth, ResolvedEdsisAuthHealthCheck, ResolvedEdsisAuthOauth };