@acorex-platform/framework-server 0.0.10 → 0.0.15

package/security/src/lib/auth/public.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/public.decorator.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC,6DAA6D;AAC7D,eAAO,MAAM,MAAM,wDAAyC,CAAC"}

package/security/src/lib/auth/request-meta.util.d.ts

@@ -0,0 +1,13 @@
+import type { Request } from 'express';
+export interface AuthRequestMeta {
+    ipAddress: string;
+    userAgent: string;
+    clientName: string;
+}
+export declare function resolveAuthRequestMeta(req: Request): AuthRequestMeta;
+export declare function parseUserAgent(userAgent: string): {
+    browser: string;
+    operatingSystem: string;
+    deviceName: string;
+};
+//# sourceMappingURL=request-meta.util.d.ts.map

package/security/src/lib/auth/request-meta.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-meta.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAYpE;AAOD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,CAmCA"}

package/security/src/lib/auth/request-meta.util.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAuthRequestMeta = resolveAuthRequestMeta;
+exports.parseUserAgent = parseUserAgent;
+function resolveAuthRequestMeta(req) {
+    const userAgent = String(req.headers['user-agent'] ?? 'unknown');
+    const forwarded = req.headers['x-forwarded-for'];
+    const ipAddress = Array.isArray(forwarded)
+        ? String(forwarded[0] ?? req.ip ?? 'unknown')
+        : String(forwarded?.split(',')[0]?.trim() ?? req.ip ?? 'unknown');
+    return {
+        ipAddress,
+        userAgent,
+        clientName: resolveClientName(userAgent),
+    };
+}
+function resolveClientName(userAgent) {
+    const parsed = parseUserAgent(userAgent);
+    return `${parsed.browser} on ${parsed.operatingSystem}`;
+}
+function parseUserAgent(userAgent) {
+    const ua = userAgent.toLowerCase();
+    let browser = 'Unknown Browser';
+    if (ua.includes('edg/')) {
+        browser = 'Edge';
+    }
+    else if (ua.includes('chrome/')) {
+        browser = 'Chrome';
+    }
+    else if (ua.includes('firefox/')) {
+        browser = 'Firefox';
+    }
+    else if (ua.includes('safari/') && !ua.includes('chrome/')) {
+        browser = 'Safari';
+    }
+    let operatingSystem = 'Unknown OS';
+    if (ua.includes('windows')) {
+        operatingSystem = 'Windows';
+    }
+    else if (ua.includes('mac os')) {
+        operatingSystem = 'macOS';
+    }
+    else if (ua.includes('android')) {
+        operatingSystem = 'Android';
+    }
+    else if (ua.includes('iphone') || ua.includes('ipad')) {
+        operatingSystem = 'iOS';
+    }
+    else if (ua.includes('linux')) {
+        operatingSystem = 'Linux';
+    }
+    let deviceName = 'Desktop';
+    if (ua.includes('mobile')) {
+        deviceName = 'Mobile';
+    }
+    else if (ua.includes('tablet') || ua.includes('ipad')) {
+        deviceName = 'Tablet';
+    }
+    return { browser, operatingSystem, deviceName };
+}
+//#endregion
+//# sourceMappingURL=request-meta.util.js.map

package/security/src/lib/auth/request-meta.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-meta.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":";;AAUA,wDAYC;AAOD,wCAuCC;AA1DD,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;IAEpE,OAAO;QACL,SAAS;QACT,SAAS;QACT,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,GAAG,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAK9C,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEnC,IAAI,OAAO,GAAG,iBAAiB,CAAC;IAChC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,IAAI,eAAe,GAAG,YAAY,CAAC;IACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,YAAY"}

package/security/src/lib/auth/strategies/local.strategy.d.ts

@@ -0,0 +1,12 @@
+import { Strategy } from 'passport-local';
+import { LoginAttemptService } from '../login-attempt.service';
+declare const LocalStrategy_base: new (...args: [] | [options: import("passport-local").IStrategyOptionsWithRequest] | [options: import("passport-local").IStrategyOptions]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+export declare class LocalStrategy extends LocalStrategy_base {
+    private readonly loginAttempts;
+    constructor(loginAttempts: LoginAttemptService);
+    validate(username: string, password: string): Promise<import("../auth.types").SecurityManagementUserRecord>;
+}
+export {};
+//# sourceMappingURL=local.strategy.d.ts.map

package/security/src/lib/auth/strategies/local.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.strategy.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/auth/strategies/local.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;;;;AAI/D,qBACa,aAAc,SAAQ,kBAAmC;IACxD,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,mBAAmB;IAIzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAGlD"}

package/security/src/lib/auth/strategies/local.strategy.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalStrategy = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const passport_local_1 = require("passport-local");
+const login_attempt_service_1 = require("../login-attempt.service");
+//#region ---- Passport local strategy ----
+let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)(passport_local_1.Strategy, 'local') {
+    constructor(loginAttempts) {
+        super({ usernameField: 'username', passwordField: 'password' });
+        this.loginAttempts = loginAttempts;
+    }
+    async validate(username, password) {
+        return this.loginAttempts.authenticateLocal(this.loginAttempts.strategyName(), username, password);
+    }
+};
+exports.LocalStrategy = LocalStrategy;
+exports.LocalStrategy = LocalStrategy = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [login_attempt_service_1.LoginAttemptService])
+], LocalStrategy);
+//#endregion
+//# sourceMappingURL=local.strategy.js.map

package/security/src/lib/auth/strategies/local.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.strategy.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/auth/strategies/local.strategy.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,+CAAoD;AACpD,mDAA0C;AAC1C,oEAA+D;AAE/D,2CAA2C;AAGpC,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,IAAA,2BAAgB,EAAC,yBAAQ,EAAE,OAAO,CAAC;IACpE,YAA6B,aAAkC;QAC7D,KAAK,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;QADrC,kBAAa,GAAb,aAAa,CAAqB;IAE/D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrG,CAAC;CACF,CAAA;AARY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;6CAEiC,2CAAmB;GADpD,aAAa,CAQzB;AAED,YAAY"}

package/security/src/lib/auth/token-resolver.service.d.ts

@@ -0,0 +1,12 @@
+import { AuthCookieService } from './auth-cookie.service';
+export interface ResolvedAccessToken {
+    token: string;
+    source: 'bearer' | 'access-cookie';
+}
+export declare class TokenResolverService {
+    private readonly cookies;
+    constructor(cookies: AuthCookieService);
+    resolveAccessToken(headers?: Record<string, string | string[] | undefined>, cookies?: Record<string, unknown>): ResolvedAccessToken | null;
+    extractBearerToken(authorization?: string | string[]): string | null;
+}
+//# sourceMappingURL=token-resolver.service.d.ts.map

package/security/src/lib/auth/token-resolver.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-resolver.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token-resolver.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI1D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,eAAe,CAAC;CACpC;AAED,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kBAAkB,CAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,mBAAmB,GAAG,IAAI;IAc7B,kBAAkB,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;CAQrE"}

package/security/src/lib/auth/token-resolver.service.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenResolverService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const auth_cookie_service_1 = require("./auth-cookie.service");
+let TokenResolverService = class TokenResolverService {
+    constructor(cookies) {
+        this.cookies = cookies;
+    }
+    resolveAccessToken(headers, cookies) {
+        const bearer = this.extractBearerToken(headers?.authorization);
+        if (bearer) {
+            return { token: bearer, source: 'bearer' };
+        }
+        const accessCookie = this.cookies.readAccessTokenCookie(cookies);
+        if (accessCookie) {
+            return { token: accessCookie, source: 'access-cookie' };
+        }
+        return null;
+    }
+    extractBearerToken(authorization) {
+        const header = Array.isArray(authorization) ? authorization[0] : authorization;
+        if (!header?.startsWith('Bearer ')) {
+            return null;
+        }
+        const token = header.slice('Bearer '.length).trim();
+        return token.length > 0 ? token : null;
+    }
+};
+exports.TokenResolverService = TokenResolverService;
+exports.TokenResolverService = TokenResolverService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_cookie_service_1.AuthCookieService])
+], TokenResolverService);
+//#endregion
+//# sourceMappingURL=token-resolver.service.js.map

package/security/src/lib/auth/token-resolver.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-resolver.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token-resolver.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,+DAA0D;AAUnD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAA6B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAE3D,kBAAkB,CAChB,OAAuD,EACvD,OAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB,CAAC,aAAiC;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAC/E,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;CACF,CAAA;AA5BY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAE2B,uCAAiB;GAD5C,oBAAoB,CA4BhC;AAED,YAAY"}

package/security/src/lib/auth/token.service.d.ts

@@ -0,0 +1,26 @@
+import type { AccessTokenPayload, AuthApplicationDto, AuthTenantDto, AuthTokenResponseDto, AuthUserDto, RefreshTokenPayload } from './auth.types';
+export interface IssueTokenContext {
+    tenantId?: string;
+    applicationId?: string;
+    tenant?: AuthTenantDto;
+    application?: AuthApplicationDto;
+    sessionId?: string;
+}
+export declare class TokenService {
+    private readonly logger;
+    issueTokenResponse(user: AuthUserDto, context?: IssueTokenContext): AuthTokenResponseDto;
+    verifyAccessToken(token: string): AccessTokenPayload;
+    verifyRefreshToken(token: string): RefreshTokenPayload;
+    accessTokenMaxAgeMs(): number;
+    accessTokenExpiresInSeconds(): number;
+    issueIdToken(user: AuthUserDto, audience: string, claims?: {
+        email?: string;
+        picture?: string;
+    }): string;
+    refreshTokenMaxAgeMs(): number;
+    jwtSecret(): string;
+    accessTokenTtl(): string;
+    refreshTokenTtl(): string;
+    private parseTtlToMs;
+}
+//# sourceMappingURL=token.service.d.ts.map

package/security/src/lib/auth/token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAItB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,iBAAsB,GAAG,oBAAoB;IAyC5F,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB;IAYpD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB;IAYtD,mBAAmB,IAAI,MAAM;IAI7B,2BAA2B,IAAI,MAAM;IAIrC,YAAY,CACV,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,MAAM;IAoBT,oBAAoB,IAAI,MAAM;IAI9B,SAAS,IAAI,MAAM;IASnB,cAAc,IAAI,MAAM;IAIxB,eAAe,IAAI,MAAM;IAIzB,OAAO,CAAC,YAAY;CAUrB"}

package/security/src/lib/auth/token.service.js

@@ -0,0 +1,125 @@
+"use strict";
+var TokenService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const jwt = tslib_1.__importStar(require("jsonwebtoken"));
+const crypto_1 = require("crypto");
+let TokenService = TokenService_1 = class TokenService {
+    constructor() {
+        this.logger = new common_1.Logger(TokenService_1.name);
+    }
+    issueTokenResponse(user, context = {}) {
+        const sessionId = context.sessionId ?? (0, crypto_1.randomUUID)();
+        const accessPayload = {
+            sub: user.id,
+            username: user.name,
+            type: 'access',
+            sid: sessionId,
+            ...(context.tenantId ? { tid: context.tenantId } : {}),
+            ...(context.applicationId ? { aid: context.applicationId } : {}),
+        };
+        const refreshPayload = {
+            sub: user.id,
+            type: 'refresh',
+            jti: (0, crypto_1.randomUUID)(),
+            sid: sessionId,
+            ...(context.tenantId ? { tid: context.tenantId } : {}),
+            ...(context.applicationId ? { aid: context.applicationId } : {}),
+        };
+        const accessToken = jwt.sign(accessPayload, this.jwtSecret(), {
+            expiresIn: this.accessTokenTtl(),
+        });
+        const refreshToken = jwt.sign(refreshPayload, this.jwtSecret(), {
+            expiresIn: this.refreshTokenTtl(),
+        });
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: this.accessTokenTtl(),
+            sessionId,
+            user,
+            tenant: context.tenant ?? (context.tenantId ? { id: context.tenantId } : null),
+            application: context.application ??
+                (context.applicationId ? { id: context.applicationId } : null),
+        };
+    }
+    verifyAccessToken(token) {
+        try {
+            const payload = jwt.verify(token, this.jwtSecret());
+            if (payload.type !== 'access' || !payload.sub) {
+                throw new Error('Invalid access token');
+            }
+            return payload;
+        }
+        catch {
+            throw new Error('Invalid or expired access token');
+        }
+    }
+    verifyRefreshToken(token) {
+        try {
+            const payload = jwt.verify(token, this.jwtSecret());
+            if (payload.type !== 'refresh' || !payload.sub || !payload.jti) {
+                throw new Error('Invalid refresh token');
+            }
+            return payload;
+        }
+        catch {
+            throw new Error('Invalid or expired refresh token');
+        }
+    }
+    accessTokenMaxAgeMs() {
+        return this.parseTtlToMs(this.accessTokenTtl());
+    }
+    accessTokenExpiresInSeconds() {
+        return Math.floor(this.accessTokenMaxAgeMs() / 1000);
+    }
+    issueIdToken(user, audience, claims = {}) {
+        const issuer = process.env['AUTH_OAUTH_ISSUER']?.trim()?.replace(/\/$/, '') ||
+            `http://localhost:${process.env['PORT']?.trim() || '5500'}/api`;
+        return jwt.sign({
+            sub: user.id,
+            name: user.title,
+            email: claims.email,
+            picture: claims.picture,
+        }, this.jwtSecret(), {
+            expiresIn: this.accessTokenTtl(),
+            issuer,
+            audience,
+        });
+    }
+    refreshTokenMaxAgeMs() {
+        return this.parseTtlToMs(this.refreshTokenTtl());
+    }
+    jwtSecret() {
+        const secret = process.env['JWT_SECRET']?.trim();
+        if (!secret) {
+            this.logger.warn('JWT_SECRET is not set; using insecure development default');
+            return 'acorex-dev-jwt-secret-change-me';
+        }
+        return secret;
+    }
+    accessTokenTtl() {
+        return process.env['JWT_ACCESS_EXPIRES_IN']?.trim() || '8h';
+    }
+    refreshTokenTtl() {
+        return process.env['JWT_REFRESH_EXPIRES_IN']?.trim() || '7d';
+    }
+    parseTtlToMs(ttl) {
+        const match = /^(\d+)([smhd])$/i.exec(ttl.trim());
+        if (!match) {
+            return 8 * 60 * 60 * 1000;
+        }
+        const value = Number(match[1]);
+        const unit = match[2].toLowerCase();
+        const multipliers = { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 };
+        return value * (multipliers[unit] ?? 3_600_000);
+    }
+};
+exports.TokenService = TokenService;
+exports.TokenService = TokenService = TokenService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], TokenService);
+//#endregion
+//# sourceMappingURL=token.service.js.map

package/security/src/lib/auth/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,0DAAoC;AACpC,mCAAoC;AAqB7B,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAAlB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAkI1D,CAAC;IAhIC,kBAAkB,CAAC,IAAiB,EAAE,UAA6B,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;QACpD,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,SAAS;YACT,IAAI;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAwB,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,YAAY,CACV,IAAiB,EACjB,QAAgB,EAChB,SAA+C,EAAE;QAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzE,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,MAAM,CAAC;QAElE,OAAO,GAAG,CAAC,IAAI,CACb;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD,IAAI,CAAC,SAAS,EAAE,EAChB;YACE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;YAChE,MAAM;YACN,QAAQ;SACT,CACF,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9E,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9D,CAAC;IAED,eAAe;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAnIY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAmIxB;AAED,YAAY"}

package/security/src/lib/entity-storage/policy-enforce.middleware.d.ts

@@ -24,3 +24,4 @@ export declare class PolicyEnforceMiddleware implements EntityStorageMiddleware
     private evalScopeKey;
     private loadPolicies;
 }
+//# sourceMappingURL=policy-enforce.middleware.d.ts.map

package/security/src/lib/entity-storage/policy-enforce.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-enforce.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAOhD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAC9B,CAAC,CAAC;CACJ;AAuBD,qBACa,uBAAwB,YAAW,uBAAuB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,QAAQ,CAAC,MAAM;aAC6C,WAAW,EAAE;;MAEvE;IAEI,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqJlF,OAAO,CAAC,YAAY;YA4BN,YAAY;CAuB3B"}

package/security/src/lib/entity-storage/policy-enforce.middleware.js

@@ -4,6 +4,7 @@ exports.PolicyEnforceMiddleware = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
 const policy_expression_evaluator_util_1 = require("./policy-expression-evaluator.util");
 const policy_field_util_1 = require("./policy-field.util");
 const POLICY_ENTITY = 'SecurityManagement.Policy';
@@ -83,6 +84,10 @@ let PolicyEnforceMiddleware = class PolicyEnforceMiddleware {
         });
         const isEditable = (t) => editableTargets.includes(t) || editableTargets.includes('*');
         if (ctx.op === 'create' || ctx.op === 'update') {
+            if ((0, abstract_1.isSystemCommandBypass)(ctx.locals)) {
+                await next();
+                return;
+            }
             let existing;
             if (ctx.op === 'update' && ctx.id) {
                 try {

package/security/src/lib/entity-storage/policy-enforce.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-enforce.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA8E;AAM9E,yFAAgF;AAChF,2DAAgF;AAmBhF,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,IAAI,WAAW,GAAgE,IAAI,CAAC;AACpF,IAAI,iBAAiB,GAAwC,IAAI,CAAC;AAElE,YAAY;AAEZ,6CAA6C;AAE7C,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,MAAoB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QACY,cAAS,GAAG,IAAI,6DAA0B,EAAE,CAAC;QAErD,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAkB;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;IAqMJ,CAAC;IAnMC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAuB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,gBAAgB,GAAa,EAAE,CAAC;QACpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,SAAoD,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,SAAS,EAAE,QAAQ;gBAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM;gBACvC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;aACxE;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA8B,EAA+B,EAAE;YAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBACrE,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;4BACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC;YACpD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;YAClD,gBAAgB,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/F,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;gBACjD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,2BAAoB,CAC5B,+EAA+E,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,CAAC,OAAiB,EAAE,EAAE;oBACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACzB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC9B,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,IAAA,sCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAoB,CAC5B,8EAA8E,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,MAAM,mBAAmB,GAAG,CAAC,GAA4B,EAAE,EAAE;gBAC3D,IAAA,sCAAkB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACvC,IAAA,yCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAA+C,CAAC;gBACnE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,mBAAmB,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,GAAyB,EAAE,QAAkB;QAC7E,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE;YACxD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAK,OAAkB,EAAE,CAAC;oBAC1E,OAAQ,OAAmC,CAAC,IAAI,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAwB,CAAC;oBACxD,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;CACF,CAAA;AA3MY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CA2MnC;AAED,YAAY"}
+{"version":3,"file":"policy-enforce.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA8E;AAM9E,6EAAuF;AACvF,yFAAgF;AAChF,2DAAgF;AAmBhF,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,IAAI,WAAW,GAAgE,IAAI,CAAC;AACpF,IAAI,iBAAiB,GAAwC,IAAI,CAAC;AAElE,YAAY;AAEZ,6CAA6C;AAE7C,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,MAAoB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QACY,cAAS,GAAG,IAAI,6DAA0B,EAAE,CAAC;QAErD,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAkB;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;IA0MJ,CAAC;IAxMC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAuB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,gBAAgB,GAAa,EAAE,CAAC;QACpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,SAAoD,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,SAAS,EAAE,QAAQ;gBAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM;gBACvC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;aACxE;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA8B,EAA+B,EAAE;YAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBACrE,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;4BACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC;YACpD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;YAClD,gBAAgB,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/F,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;gBACjD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,2BAAoB,CAC5B,+EAA+E,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,CAAC,OAAiB,EAAE,EAAE;oBACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACzB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC9B,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,IAAA,sCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAoB,CAC5B,8EAA8E,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,MAAM,mBAAmB,GAAG,CAAC,GAA4B,EAAE,EAAE;gBAC3D,IAAA,sCAAkB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACvC,IAAA,yCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAA+C,CAAC;gBACnE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,mBAAmB,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,GAAyB,EAAE,QAAkB;QAC7E,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE;YACxD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAK,OAAkB,EAAE,CAAC;oBAC1E,OAAQ,OAAmC,CAAC,IAAI,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAwB,CAAC;oBACxD,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;CACF,CAAA;AAhNY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CAgNnC;AAED,YAAY"}

package/security/src/lib/entity-storage/policy-expression-evaluator.util.d.ts

@@ -5,3 +5,4 @@ export declare class BackendExpressionEvaluator {
     evaluate(source: unknown, scope?: BackendExpressionScope): Promise<unknown>;
     private evaluateStringExpression;
 }
+//# sourceMappingURL=policy-expression-evaluator.util.d.ts.map

package/security/src/lib/entity-storage/policy-expression-evaluator.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-expression-evaluator.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-expression-evaluator.util.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7D,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAE/D,OAAO,CAAC,oBAAoB;IAWtB,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,GAAE,sBAA2B,GAAG,OAAO,CAAC,OAAO,CAAC;YAwBvE,wBAAwB;CAmCvC"}

package/security/src/lib/entity-storage/policy-field.util.d.ts

@@ -1,3 +1,4 @@
 export declare function maskPolicyValue(value: unknown): unknown;
 export declare function removePolicyFields(obj: Record<string, unknown>, paths: string[]): void;
 export declare function setMaskedPolicyFields(obj: Record<string, unknown>, paths: string[]): void;
+//# sourceMappingURL=policy-field.util.d.ts.map

package/security/src/lib/entity-storage/policy-field.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-field.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-field.util.ts"],"names":[],"mappings":"AAEA,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAqCtF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CA4CzF"}

package/security/src/lib/entity-storage/visibility-filter.middleware.d.ts

@@ -27,3 +27,4 @@ export declare class VisibilityFilterMiddleware implements EntityStorageMiddlewa
     private resolveUserTenantId;
 }
 export {};
+//# sourceMappingURL=visibility-filter.middleware.d.ts.map

package/security/src/lib/entity-storage/visibility-filter.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility-filter.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIvC,OAAO,EAEL,WAAW,EAEX,oBAAoB,EAEpB,uBAAuB,EAExB,MAAM,wCAAwC,CAAC;AAgBhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAY9E,KAAK,kBAAkB,GAAG,OAAO,GAAG;IAElC,CAAC,mBAAmB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAE/C,CAAC;AAIF;;;;;;;;;;GAUG;AAEH,qBAEa,0BAA2B,YAAW,uBAAuB;IAY3C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAVrD,QAAQ,CAAC,MAAM;aAEK,WAAW,EAAE;;MAI/B;gBAI4C,OAAO,EAAE,kBAAkB;IAInE,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YA0FpE,mBAAmB;CAwBlC"}

package/security/src/lib/oauth/connect.controller.d.ts

@@ -0,0 +1,25 @@
+import type { Request, Response } from 'express';
+import { PlatformOAuthService } from './platform-oauth.service';
+import type { OAuthTokenResponse } from './platform-oauth.types';
+export declare class ConnectController {
+    private readonly oauth;
+    constructor(oauth: PlatformOAuthService);
+    getDiscoveryDocument(): {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+    };
+    getJwksDocument(): {
+        keys: unknown[];
+    };
+    authorize(query: Record<string, string | undefined>, res: Response): void;
+    googleCallback(code: string | undefined, state: string | undefined, error: string | undefined, req: Request, res: Response): Promise<void>;
+    token(req: Request): Promise<OAuthTokenResponse>;
+    private readFormBody;
+}
+//# sourceMappingURL=connect.controller.d.ts.map

package/security/src/lib/oauth/connect.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,qBAGa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,oBAAoB;IAIxD,oBAAoB;;;;;;;;;;IAMpB,eAAe;;;IAMf,SAAS,CAAU,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAS,GAAG,EAAE,QAAQ,GAAG,IAAI;IAkBnF,cAAc,CACH,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAiBV,KAAK,CAAQ,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAM7D,OAAO,CAAC,YAAY;CAUrB"}

package/security/src/lib/oauth/connect.controller.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const public_decorator_1 = require("../auth/public.decorator");
+const request_meta_util_1 = require("../auth/request-meta.util");
+const platform_oauth_service_1 = require("./platform-oauth.service");
+//#region ---- Platform OAuth connect endpoints ----
+let ConnectController = class ConnectController {
+    constructor(oauth) {
+        this.oauth = oauth;
+    }
+    getDiscoveryDocument() {
+        return this.oauth.getDiscoveryDocument();
+    }
+    getJwksDocument() {
+        return this.oauth.getJwksDocument();
+    }
+    authorize(query, res) {
+        const provider = query['acr_values']?.trim() || 'google';
+        const redirectUrl = this.oauth.beginAuthorization({
+            responseType: query['response_type']?.trim() || '',
+            clientId: query['client_id']?.trim() || '',
+            redirectUri: query['redirect_uri']?.trim() || '',
+            scope: query['scope']?.trim() || 'openid profile email',
+            codeChallenge: query['code_challenge']?.trim() || '',
+            codeChallengeMethod: query['code_challenge_method']?.trim() || '',
+            provider,
+            state: query['state']?.trim(),
+        });
+        res.redirect(redirectUrl);
+    }
+    async googleCallback(code, state, error, req, res) {
+        if (error) {
+            res.status(400).send(`Google authorization failed: ${error}`);
+            return;
+        }
+        if (!code?.trim() || !state?.trim()) {
+            throw new common_1.BadRequestException('code and state are required.');
+        }
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(req);
+        const redirectUrl = await this.oauth.completeGoogleCallback(code.trim(), state.trim());
+        res.redirect(redirectUrl);
+    }
+    async token(req) {
+        const body = this.readFormBody(req);
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(req);
+        return this.oauth.exchangeAuthorizationCode(body, meta);
+    }
+    readFormBody(req) {
+        const body = req.body;
+        if (!body || typeof body !== 'object') {
+            return {};
+        }
+        return Object.fromEntries(Object.entries(body).map(([key, value]) => [key, value == null ? undefined : String(value)]));
+    }
+};
+exports.ConnectController = ConnectController;
+tslib_1.__decorate([
+    (0, common_1.Get)('.well-known/openid-configuration'),
+    (0, swagger_1.ApiOperation)({ summary: 'OpenID Connect discovery document' }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", void 0)
+], ConnectController.prototype, "getDiscoveryDocument", null);
+tslib_1.__decorate([
+    (0, common_1.Get)('.well-known/jwks.json'),
+    (0, swagger_1.ApiOperation)({ summary: 'JSON Web Key Set (platform broker — HS256 tokens, empty for discovery clients)' }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", void 0)
+], ConnectController.prototype, "getJwksDocument", null);
+tslib_1.__decorate([
+    (0, common_1.Get)('connect/authorize'),
+    (0, swagger_1.ApiOperation)({ summary: 'Begin external provider authorization (Google platform login)' }),
+    tslib_1.__param(0, (0, common_1.Query)()),
+    tslib_1.__param(1, (0, common_1.Res)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
+    tslib_1.__metadata("design:returntype", void 0)
+], ConnectController.prototype, "authorize", null);
+tslib_1.__decorate([
+    (0, common_1.Get)('connect/callback/google'),
+    (0, swagger_1.ApiOperation)({ summary: 'Google OAuth callback for platform login' }),
+    tslib_1.__param(0, (0, common_1.Query)('code')),
+    tslib_1.__param(1, (0, common_1.Query)('state')),
+    tslib_1.__param(2, (0, common_1.Query)('error')),
+    tslib_1.__param(3, (0, common_1.Req)()),
+    tslib_1.__param(4, (0, common_1.Res)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object, Object, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "googleCallback", null);
+tslib_1.__decorate([
+    (0, common_1.Post)('connect/token'),
+    (0, swagger_1.ApiOperation)({ summary: 'Exchange authorization code or refresh token for platform tokens' }),
+    tslib_1.__param(0, (0, common_1.Req)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "token", null);
+exports.ConnectController = ConnectController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('connect'),
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Controller)(),
+    tslib_1.__metadata("design:paramtypes", [platform_oauth_service_1.PlatformOAuthService])
+], ConnectController);
+//#endregion
+//# sourceMappingURL=connect.controller.js.map

package/security/src/lib/oauth/connect.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":";;;;AAAA,2CAQwB;AACxB,6CAAwD;AAExD,+DAAkD;AAClD,iEAAmE;AACnE,qEAAgE;AAGhE,oDAAoD;AAK7C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAA6B,KAA2B;QAA3B,UAAK,GAAL,KAAK,CAAsB;IAAG,CAAC;IAI5D,oBAAoB;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;IAC3C,CAAC;IAID,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAID,SAAS,CAAU,KAAyC,EAAS,GAAa;QAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAClD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC1C,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,sBAAsB;YACvD,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACpD,mBAAmB,EAAE,KAAK,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,QAAQ;YACR,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CACH,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EAClC,GAAY,EACZ,GAAa;QAEpB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAY;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAEO,YAAY,CAAC,GAAY;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7F,CAAC;IACJ,CAAC;CACF,CAAA;AA1EY,8CAAiB;AAK5B;IAFC,IAAA,YAAG,EAAC,kCAAkC,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;;;6DAG9D;AAID;IAFC,IAAA,YAAG,EAAC,uBAAuB,CAAC;IAC5B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC;;;;wDAG3G;AAID;IAFC,IAAA,YAAG,EAAC,mBAAmB,CAAC;IACxB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;IAChF,mBAAA,IAAA,cAAK,GAAE,CAAA;IAA6C,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAcnE;AAIK;IAFL,IAAA,YAAG,EAAC,yBAAyB,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAEnE,mBAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,YAAG,GAAE,CAAA;IACL,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAcP;AAIK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IACjF,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;8CAIjB;4BA9DU,iBAAiB;IAH7B,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,yBAAM,GAAE;IACR,IAAA,mBAAU,GAAE;6CAEyB,6CAAoB;GAD7C,iBAAiB,CA0E7B;AAED,YAAY"}