feat: bridge entitlements and admin portal from native SDKs

Bumps FronteggSwift 1.2.76 -> 1.3.6 and com.frontegg.sdk:android 1.3.18 ->
1.3.31, which is where the entitlements API and the embedded admin portal
landed on the native side. Adds a thin Capacitor bridge so JS callers can use
both features without touching native code.

New JS surface on FronteggService:
- loadEntitlements(forceRefresh?) — call after login and after switchTenant
- getFeatureEntitlement(key) -> { isEntitled, justification }
- getPermissionEntitlement(key) -> { isEntitled, justification }
- showAdminPortal() — Beta; presents AdminPortalView on iOS, starts
  AdminPortalActivity on Android (declared by the SDK manifest)

Docs (usage.md) gain "Entitlements" and "Admin portal (Beta)" sections,
including the justification enum table. Version bumped to 2.1.0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dianaKhortiuk-frontegg

FronteggIonicCapacitor.podspec

@@ -13,7 +13,7 @@ Pod::Spec.new do |s|
   s.source_files = 'ios/Plugin/**/*.{swift,h,m,c,cc,mm,cpp}'
   s.ios.deployment_target  = '14.0'
   s.dependency 'Capacitor'
-  s.dependency "FronteggSwift", "1.2.76"
+  s.dependency "FronteggSwift", "1.3.6"
   s.swift_version = '5.1'
   s.pod_target_xcconfig = {
     'CODE_SIGNING_ALLOWED' => 'YES'

android/build.gradle

@@ -62,7 +62,7 @@ dependencies {
     implementation "androidx.browser:browser:1.8.0"
     implementation 'io.reactivex.rxjava3:rxkotlin:3.0.1'
     implementation 'com.google.code.gson:gson:2.10'
-    implementation 'com.frontegg.sdk:android:1.3.18'
+    implementation 'com.frontegg.sdk:android:1.3.31'
 
     testImplementation "junit:junit:$junitVersion"
     androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"

android/src/main/java/com/frontegg/ionic/FronteggNativePlugin.java

@@ -2,15 +2,18 @@
 
 
 
+import android.app.Activity;
 import android.os.Handler;
 import android.os.Looper;
 import android.util.Log;
 
 import kotlin.Unit;
 
+import com.frontegg.android.AdminPortalActivity;
 import com.frontegg.android.FronteggApp;
 import com.frontegg.android.FronteggAppKt;
 import com.frontegg.android.FronteggAuth;
+import com.frontegg.android.models.Entitlement;
 import com.frontegg.android.models.User;
 import com.frontegg.android.regions.RegionConfig;
 import com.getcapacitor.JSObject;
@@ -295,6 +298,62 @@ public void refreshToken(PluginCall call) {
     }
 
 
+    @PluginMethod
+    public void loadEntitlements(PluginCall call) {
+        Boolean forceRefresh = call.getBoolean("forceRefresh", false);
+        FronteggAppKt.getFronteggAuth(this.getContext()).loadEntitlements(
+                forceRefresh != null ? forceRefresh : false,
+                (success) -> {
+                    JSObject result = new JSObject();
+                    result.put("success", success);
+                    call.resolve(result);
+                    return null;
+                });
+    }
+
+    @PluginMethod
+    public void getFeatureEntitlement(PluginCall call) {
+        String key = call.getString("key");
+        if (key == null) {
+            call.reject("No key provided");
+            return;
+        }
+        Entitlement entitlement = FronteggAppKt.getFronteggAuth(this.getContext())
+                .getFeatureEntitlements(key, null);
+        JSObject result = new JSObject();
+        result.put("isEntitled", entitlement.isEntitled());
+        result.put("justification", entitlement.getJustification());
+        call.resolve(result);
+    }
+
+    @PluginMethod
+    public void getPermissionEntitlement(PluginCall call) {
+        String key = call.getString("key");
+        if (key == null) {
+            call.reject("No key provided");
+            return;
+        }
+        Entitlement entitlement = FronteggAppKt.getFronteggAuth(this.getContext())
+                .getPermissionEntitlements(key, null);
+        JSObject result = new JSObject();
+        result.put("isEntitled", entitlement.isEntitled());
+        result.put("justification", entitlement.getJustification());
+        call.resolve(result);
+    }
+
+    @PluginMethod
+    public void showAdminPortal(PluginCall call) {
+        Activity activity = this.getActivity();
+        if (activity == null) {
+            call.reject("No host activity available");
+            return;
+        }
+        new Handler(Looper.getMainLooper()).post(() -> {
+            AdminPortalActivity.open(activity);
+            call.resolve();
+        });
+    }
+
     @PluginMethod
     public void getAuthState(PluginCall call) {
         call.resolve(getData());

docs/usage.md

@@ -287,3 +287,56 @@ export class MyPage implements OnInit {
   }
 }
 ```
+
+### Entitlements
+
+The SDK exposes the underlying Frontegg entitlements API so you can gate features and check permissions on-device. Call `loadEntitlements()` once after a successful login, and again after `switchTenant()` — the tenant context determines which features and permissions resolve.
+
+```typescript
+import { Inject } from '@angular/core';
+import { FronteggService } from '@frontegg/ionic-capacitor';
+
+@Component({
+  /** .... */
+})
+export class MyPage {
+
+  constructor(@Inject('Frontegg') private fronteggService: FronteggService) {}
+
+  async ngOnInit() {
+    // After login (or after switchTenant):
+    await this.fronteggService.loadEntitlements();
+
+    const feature = await this.fronteggService.getFeatureEntitlement('beta-dashboard');
+    if (feature.isEntitled) {
+      // show the gated feature
+    } else {
+      console.log('Not entitled because:', feature.justification);
+    }
+
+    const permission = await this.fronteggService.getPermissionEntitlement('billing.read');
+    // permission.isEntitled / permission.justification
+  }
+}
+```
+
+`justification` values returned when `isEntitled` is `false`:
+
+| Justification | Meaning |
+|---|---|
+| `ENTITLEMENTS_DISABLED` | Entitlements are disabled for this account. |
+| `ENTITLEMENTS_NOT_LOADED` | `loadEntitlements()` was not called (or failed). |
+| `MISSING_FEATURE` / `MISSING_PERMISSION` | The user does not hold this key. |
+| `NOT_AUTHENTICATED` (iOS) | No user is currently signed in. |
+
+### Admin portal (Beta)
+
+The SDK can present the Frontegg-hosted admin portal inside the app. On iOS this is a SwiftUI sheet over your root view controller; on Android this is `AdminPortalActivity` (declared by the SDK).
+
+```typescript
+this.fronteggService.showAdminPortal();
+```
+
+> **Beta:** the portal API may change in future minor releases. Behavior and styling are inherited from the underlying iOS/Android SDKs.
+
+Android requires no manifest change — the SDK declares `AdminPortalActivity` itself. iOS requires no additional setup. Just call `showAdminPortal()` from any view.

ios/Plugin/FronteggNativePlugin.m

@@ -12,6 +12,10 @@
            CAP_PLUGIN_METHOD(refreshToken, CAPPluginReturnPromise);
            CAP_PLUGIN_METHOD(initWithRegion, CAPPluginReturnPromise);
            CAP_PLUGIN_METHOD(directLoginAction, CAPPluginReturnPromise);
+           CAP_PLUGIN_METHOD(loadEntitlements, CAPPluginReturnPromise);
+           CAP_PLUGIN_METHOD(getFeatureEntitlement, CAPPluginReturnPromise);
+           CAP_PLUGIN_METHOD(getPermissionEntitlement, CAPPluginReturnPromise);
+           CAP_PLUGIN_METHOD(showAdminPortal, CAPPluginReturnPromise);
 )
 
 

ios/Plugin/FronteggNativePlugin.swift

@@ -2,6 +2,7 @@ import FronteggSwift
 import Foundation
 import Combine
 import Capacitor
+import SwiftUI
 
 /**
  * Please read the Capacitor iOS Plugin Development Guide
@@ -252,6 +253,55 @@ public class FronteggNativePlugin: CAPPlugin {
         }
     }
 
+    @objc func loadEntitlements(_ call: CAPPluginCall) {
+        let forceRefresh = call.getBool("forceRefresh", false)
+        fronteggApp.auth.loadEntitlements(forceRefresh: forceRefresh) { success in
+            call.resolve(["success": success])
+        }
+    }
+
+    @objc func getFeatureEntitlement(_ call: CAPPluginCall) {
+        guard let key = call.options["key"] as? String else {
+            call.reject("No key provided")
+            return
+        }
+        let entitlement = fronteggApp.auth.getFeatureEntitlements(featureKey: key)
+        call.resolve([
+            "isEntitled": entitlement.isEntitled,
+            "justification": entitlement.justification as Any
+        ])
+    }
+
+    @objc func getPermissionEntitlement(_ call: CAPPluginCall) {
+        guard let key = call.options["key"] as? String else {
+            call.reject("No key provided")
+            return
+        }
+        let entitlement = fronteggApp.auth.getPermissionEntitlements(permissionKey: key)
+        call.resolve([
+            "isEntitled": entitlement.isEntitled,
+            "justification": entitlement.justification as Any
+        ])
+    }
+
+    @objc func showAdminPortal(_ call: CAPPluginCall) {
+        DispatchQueue.main.async {
+            guard let root = self.bridge?.viewController else {
+                call.reject("No host view controller available")
+                return
+            }
+            if #available(iOS 14.0, *) {
+                let host = UIHostingController(rootView: AdminPortalView())
+                host.modalPresentationStyle = .pageSheet
+                root.present(host, animated: true) {
+                    call.resolve()
+                }
+            } else {
+                call.reject("Admin portal requires iOS 14.0+")
+            }
+        }
+    }
+
     @objc func getAuthState(_ call: CAPPluginCall) {
         let auth = fronteggApp.auth
         var jsonUser: [String: Any]? = nil

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontegg/ionic-capacitor",
-  "version": "2.0.12",
+  "version": "2.1.0",
   "description": "Frontegg Ionic Capacitor SDK",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",

src/definitions.ts

@@ -192,6 +192,61 @@ export interface FronteggNativePlugin {
    * @returns A promise that resolves when the token refresh is completed.
    */
   refreshToken(): Promise<void>;
+
+  /**
+   * Loads (or reloads) the current user's entitlements for the active tenant.
+   * Must be called after a successful login and after switching tenants.
+   * @param payload.forceRefresh - If true, bypasses any cached state and re-fetches from the server.
+   * @returns A promise resolving to `{ success: true }` if entitlements were loaded.
+   */
+  loadEntitlements(payload?: {
+    forceRefresh?: boolean;
+  }): Promise<{ success: boolean }>;
+
+  /**
+   * Checks whether the current user is entitled to a specific feature.
+   * @param payload.key - The feature key as configured in Frontegg.
+   * @returns A promise resolving to an Entitlement describing the result.
+   */
+  getFeatureEntitlement(payload: { key: string }): Promise<Entitlement>;
+
+  /**
+   * Checks whether the current user holds a specific permission.
+   * @param payload.key - The permission key as configured in Frontegg.
+   * @returns A promise resolving to an Entitlement describing the result.
+   */
+  getPermissionEntitlement(payload: { key: string }): Promise<Entitlement>;
+
+  /**
+   * Opens the Frontegg admin portal (BETA).
+   * On iOS this presents a SwiftUI sheet containing a WKWebView; on Android
+   * it starts an embedded WebView Activity. The portal is dismissed by the
+   * user (swipe / X button / back button).
+   *
+   * NOTE: Beta API — the surface may change in future minor releases.
+   *
+   * Android: requires `AdminPortalActivity` declared in the host app's
+   * AndroidManifest.xml. See the setup guide.
+   */
+  showAdminPortal(): Promise<void>;
+}
+
+/**
+ * Represents the result of an entitlement check.
+ */
+export interface Entitlement {
+  /**
+   * Whether the user is entitled.
+   */
+  isEntitled: boolean;
+
+  /**
+   * Optional reason when `isEntitled` is false. Common values:
+   * - "ENTITLEMENTS_DISABLED": entitlements feature is disabled on this account
+   * - "ENTITLEMENTS_NOT_LOADED": `loadEntitlements()` was not called yet
+   * - "MISSING_FEATURE" / "MISSING_PERMISSION": user does not hold this key
+   */
+  justification?: string | null;
 }
 
 /**

src/frontegg.service.ts

@@ -1,6 +1,7 @@
 import { registerPlugin } from '@capacitor/core';
 
 import type {
+  Entitlement,
   FronteggConstants,
   FronteggNativePlugin,
   FronteggServiceOptions,
@@ -289,4 +290,36 @@ export class FronteggService {
   public refreshToken(): Promise<void> {
     return FronteggNative.refreshToken();
   }
+
+  /**
+   * Load (or reload) entitlements for the current user and active tenant.
+   * Call after a successful login and after `switchTenant()`.
+   */
+  public loadEntitlements(forceRefresh = false): Promise<{ success: boolean }> {
+    return FronteggNative.loadEntitlements({ forceRefresh });
+  }
+
+  /**
+   * Check whether the current user is entitled to a feature.
+   */
+  public getFeatureEntitlement(key: string): Promise<Entitlement> {
+    return FronteggNative.getFeatureEntitlement({ key });
+  }
+
+  /**
+   * Check whether the current user holds a permission.
+   */
+  public getPermissionEntitlement(key: string): Promise<Entitlement> {
+    return FronteggNative.getPermissionEntitlement({ key });
+  }
+
+  /**
+   * Open the Frontegg admin portal (BETA).
+   * iOS: presents a SwiftUI sheet over the host view controller.
+   * Android: starts AdminPortalActivity — must be declared in the host
+   * AndroidManifest.xml.
+   */
+  public showAdminPortal(): Promise<void> {
+    return FronteggNative.showAdminPortal();
+  }
 }

src/index.ts

@@ -1,3 +1,3 @@
 export { FronteggService } from './frontegg.service';
-export { FronteggState } from './definitions';
+export { Entitlement, FronteggState } from './definitions';
 export { LogLevel } from './logger';