@acorex-platform/framework-server 0.0.10

package/report/src/lib/report.decorators.d.ts

@@ -0,0 +1,6 @@
+export declare const REPORT_QUERY_METADATA: unique symbol;
+export declare const REPORT_DEFINITION_PROVIDER_METADATA: unique symbol;
+/** Marks an injectable class as a report query handler (implements {@link BackendReportQueryHandler}). */
+export declare const ReportQuery: () => import("@nestjs/common").CustomDecorator<typeof REPORT_QUERY_METADATA>;
+/** Marks an injectable class as a report definition provider (implements {@link BackendReportDefinitionProvider}). */
+export declare const ReportDefinitionProvider: () => import("@nestjs/common").CustomDecorator<typeof REPORT_DEFINITION_PROVIDER_METADATA>;

package/report/src/lib/report.decorators.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportDefinitionProvider = exports.ReportQuery = exports.REPORT_DEFINITION_PROVIDER_METADATA = exports.REPORT_QUERY_METADATA = void 0;
+const common_1 = require("@nestjs/common");
+//#region ---- Report registration metadata ----
+exports.REPORT_QUERY_METADATA = Symbol('REPORT_QUERY');
+exports.REPORT_DEFINITION_PROVIDER_METADATA = Symbol('REPORT_DEFINITION_PROVIDER');
+/** Marks an injectable class as a report query handler (implements {@link BackendReportQueryHandler}). */
+const ReportQuery = () => (0, common_1.SetMetadata)(exports.REPORT_QUERY_METADATA, true);
+exports.ReportQuery = ReportQuery;
+/** Marks an injectable class as a report definition provider (implements {@link BackendReportDefinitionProvider}). */
+const ReportDefinitionProvider = () => (0, common_1.SetMetadata)(exports.REPORT_DEFINITION_PROVIDER_METADATA, true);
+exports.ReportDefinitionProvider = ReportDefinitionProvider;
+//#endregion
+//# sourceMappingURL=report.decorators.js.map

package/report/src/lib/report.decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.decorators.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/report/src/lib/report.decorators.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAE7C,gDAAgD;AAEnC,QAAA,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;AAC/C,QAAA,mCAAmC,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAExF,0GAA0G;AACnG,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,6BAAqB,EAAE,IAAI,CAAC,CAAC;AAA7D,QAAA,WAAW,eAAkD;AAE1E,sHAAsH;AAC/G,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,2CAAmC,EAAE,IAAI,CAAC,CAAC;AAAxF,QAAA,wBAAwB,4BAAgE;AAErG,YAAY"}

package/report/src/lib/report.module.d.ts

@@ -0,0 +1,2 @@
+export declare class ReportModule {
+}

package/report/src/lib/report.module.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const core_2 = require("@acorex-platform/framework-server/core");
+const report_definition_registry_1 = require("./report-definition.registry");
+const report_query_registry_1 = require("./report-query.registry");
+const report_execute_service_1 = require("./report-execute.service");
+//#region ---- Report platform module ----
+let ReportModule = class ReportModule {
+};
+exports.ReportModule = ReportModule;
+exports.ReportModule = ReportModule = tslib_1.__decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [core_2.EntityStorageModule, core_1.DiscoveryModule],
+        providers: [
+            report_query_registry_1.BackendReportQueryRegistry,
+            report_definition_registry_1.BackendReportDefinitionRegistry,
+            report_execute_service_1.ReportExecuteService,
+        ],
+        exports: [
+            report_execute_service_1.ReportExecuteService,
+            report_query_registry_1.BackendReportQueryRegistry,
+            report_definition_registry_1.BackendReportDefinitionRegistry,
+        ],
+    })
+], ReportModule);
+//#endregion
+//# sourceMappingURL=report.module.js.map

package/report/src/lib/report.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/report/src/lib/report.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAgD;AAChD,uCAA+C;AAC/C,iEAA6E;AAC7E,6EAA+E;AAC/E,mEAAqE;AACrE,qEAAgE;AAEhE,0CAA0C;AAgBnC,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAdxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,EAAE,sBAAe,CAAC;QAC/C,SAAS,EAAE;YACT,kDAA0B;YAC1B,4DAA+B;YAC/B,6CAAoB;SACrB;QACD,OAAO,EAAE;YACP,6CAAoB;YACpB,kDAA0B;YAC1B,4DAA+B;SAChC;KACF,CAAC;GACW,YAAY,CAAG;AAE5B,YAAY"}

package/report/src/lib/report.types.d.ts

@@ -0,0 +1,74 @@
+export interface ReportExecuteBodyDto {
+    reportId: string;
+    layoutId: string;
+    filters?: unknown;
+    dataSource?: ReportQueryDataSourceDto;
+}
+export interface ReportQueryDataSourceDto {
+    type: string;
+    name?: string;
+    pagination?: boolean;
+    sortFields?: Array<{
+        name: string;
+        dir?: 'asc' | 'desc';
+    }>;
+}
+export interface ReportExecuteResponseDto {
+    layout: Record<string, unknown>;
+    data: Record<string, unknown>;
+}
+export interface ReportQueryInput {
+    filters?: unknown;
+    logic?: 'and' | 'or';
+    skip?: number;
+    take?: number;
+    sort?: Array<{
+        field: string;
+        dir: 'asc' | 'desc';
+    }>;
+    summary?: unknown[];
+}
+export interface ReportQueryResult {
+    items: Record<string, unknown>[];
+    total: number;
+    summary?: Record<string, number | null>;
+}
+export interface BackendReportQueryHandler {
+    readonly name: string;
+    run(input: ReportQueryInput): Promise<ReportQueryResult>;
+}
+export declare const REPORT_ENTITY = "ReportManagement.Report";
+export declare const REPORT_CATEGORY_ENTITY = "ReportManagement.ReportCategory";
+export interface BackendReportCategory {
+    id: string;
+    title: string;
+    description?: string;
+    parentId?: string;
+    childrenCount?: number;
+    itemsCount?: number;
+}
+export interface BackendReportLayoutDefinition {
+    id: string;
+    title: string;
+    description?: string;
+    icon?: string;
+    isDefault?: boolean;
+    layout: Record<string, unknown>;
+    dataSource?: ReportQueryDataSourceDto;
+    actions?: Record<string, unknown>[];
+    export?: Record<string, unknown>;
+}
+export interface BackendReportDefinition {
+    id: string;
+    title: string;
+    description?: string;
+    categoryIds: string[];
+    parameterGroups?: Record<string, unknown>[];
+    permissions?: string[];
+    layouts: BackendReportLayoutDefinition[];
+    defaultLayoutId: string;
+}
+export interface BackendReportDefinitionProvider {
+    getCategories?(): BackendReportCategory[];
+    getDefinitions(): BackendReportDefinition[];
+}

package/report/src/lib/report.types.js

@@ -0,0 +1,10 @@
+"use strict";
+//#region ---- Execute report DTOs ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REPORT_CATEGORY_ENTITY = exports.REPORT_ENTITY = void 0;
+//#endregion
+//#region ---- Report definition contracts ----
+exports.REPORT_ENTITY = 'ReportManagement.Report';
+exports.REPORT_CATEGORY_ENTITY = 'ReportManagement.ReportCategory';
+//#endregion
+//# sourceMappingURL=report.types.js.map

package/report/src/lib/report.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.types.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/report/src/lib/report.types.ts"],"names":[],"mappings":";AAAA,uCAAuC;;;AA6CvC,YAAY;AAEZ,+CAA+C;AAElC,QAAA,aAAa,GAAG,yBAAyB,CAAC;AAC1C,QAAA,sBAAsB,GAAG,iCAAiC,CAAC;AAuCxE,YAAY"}

package/report/src/lib/report.util.d.ts

@@ -0,0 +1 @@
+export declare function resolveDisplayTitle(title: unknown, locale?: string): string;

package/report/src/lib/report.util.js

@@ -0,0 +1,19 @@
+"use strict";
+//#region ---- Report display helpers ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveDisplayTitle = resolveDisplayTitle;
+function resolveDisplayTitle(title, locale = 'en-US') {
+    if (title == null) {
+        return '';
+    }
+    if (typeof title === 'string') {
+        return title;
+    }
+    if (typeof title === 'object') {
+        const map = title;
+        return map[locale] ?? map['en-US'] ?? Object.values(map)[0] ?? '';
+    }
+    return String(title);
+}
+//#endregion
+//# sourceMappingURL=report.util.js.map

package/report/src/lib/report.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.util.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/report/src/lib/report.util.ts"],"names":[],"mappings":";AAAA,0CAA0C;;AAE1C,kDAYC;AAZD,SAAgB,mBAAmB,CAAC,KAAc,EAAE,MAAM,GAAG,OAAO;IAClE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAA+B,CAAC;QAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,YAAY"}

package/security/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@acorex-platform/framework-server/security",
+  "version": "0.0.0-ACOREX",
+  "private": true,
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "dependencies": {
+    "tslib": "^2.3.0"
+  },
+  "peerDependencies": {
+    "@acorex-platform/framework-client/auth": "0.0.0-ACOREX",
+    "@acorex-platform/framework-server/core": "0.0.0-ACOREX",
+    "@acorex-platform/framework-server/jql/abstract": "0.0.0-ACOREX",
+    "@nestjs/common": "^11.0.0"
+  }
+}

package/security/src/index.d.ts

@@ -0,0 +1,13 @@
+export * from './lib/security.module';
+export * from './lib/auth/auth.service';
+export * from './lib/auth/auth.types';
+export * from './lib/auth/public.decorator';
+export * from './lib/auth/jwt-auth.guard';
+export * from './lib/session/backend-session.service';
+export * from './lib/session/backend-session.types';
+export * from './lib/session/current-session.decorator';
+export * from './lib/session/session-context.service';
+export * from './lib/session/session-context.types';
+export * from './lib/authorization/platform-root-user.util';
+export * from './lib/entity-storage/visibility-filter.middleware';
+export * from './lib/entity-storage/policy-enforce.middleware';

package/security/src/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lib/security.module"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth.service"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth.types"), exports);
+tslib_1.__exportStar(require("./lib/auth/public.decorator"), exports);
+tslib_1.__exportStar(require("./lib/auth/jwt-auth.guard"), exports);
+tslib_1.__exportStar(require("./lib/session/backend-session.service"), exports);
+tslib_1.__exportStar(require("./lib/session/backend-session.types"), exports);
+tslib_1.__exportStar(require("./lib/session/current-session.decorator"), exports);
+tslib_1.__exportStar(require("./lib/session/session-context.service"), exports);
+tslib_1.__exportStar(require("./lib/session/session-context.types"), exports);
+tslib_1.__exportStar(require("./lib/authorization/platform-root-user.util"), exports);
+tslib_1.__exportStar(require("./lib/entity-storage/visibility-filter.middleware"), exports);
+tslib_1.__exportStar(require("./lib/entity-storage/policy-enforce.middleware"), exports);
+//# sourceMappingURL=index.js.map

package/security/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,kEAAwC;AACxC,gEAAsC;AACtC,sEAA4C;AAC5C,oEAA0C;AAC1C,gFAAsD;AACtD,8EAAoD;AACpD,kFAAwD;AACxD,gFAAsD;AACtD,8EAAoD;AACpD,sFAA4D;AAC5D,4FAAkE;AAClE,yFAA+D"}

package/security/src/lib/auth/auth.controller.d.ts

@@ -0,0 +1,10 @@
+import { AuthService } from './auth.service';
+import type { AuthTokenResponseDto, RefreshTokenRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
+export declare class AuthController {
+    private readonly auth;
+    constructor(auth: AuthService);
+    signIn(body: SignInRequestDto): Promise<AuthTokenResponseDto>;
+    refresh(body: RefreshTokenRequestDto): Promise<AuthTokenResponseDto>;
+    updateSession(authorization: string | undefined, body: UpdateSessionRequestDto): Promise<AuthTokenResponseDto>;
+    private extractBearerToken;
+}

package/security/src/lib/auth/auth.controller.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const auth_service_1 = require("./auth.service");
+const jwt_auth_guard_1 = require("./jwt-auth.guard");
+//#region ---- Auth REST API ----
+let AuthController = class AuthController {
+    constructor(auth) {
+        this.auth = auth;
+    }
+    signIn(body) {
+        return this.auth.signIn(body);
+    }
+    refresh(body) {
+        if (!body.refreshToken?.trim()) {
+            throw new common_1.UnauthorizedException('refreshToken is required');
+        }
+        return this.auth.refreshSession(body.refreshToken);
+    }
+    updateSession(authorization, body) {
+        const token = this.extractBearerToken(authorization);
+        if (!token) {
+            throw new common_1.UnauthorizedException('Bearer access token is required');
+        }
+        return this.auth.updateSession(token, body);
+    }
+    extractBearerToken(authorization) {
+        if (!authorization?.startsWith('Bearer ')) {
+            return null;
+        }
+        const token = authorization.slice('Bearer '.length).trim();
+        return token.length > 0 ? token : null;
+    }
+};
+exports.AuthController = AuthController;
+tslib_1.__decorate([
+    (0, common_1.Post)('signin'),
+    (0, swagger_1.ApiOperation)({ summary: 'Sign in with username and password' }),
+    (0, swagger_1.ApiBody)({
+        schema: {
+            type: 'object',
+            required: ['username', 'password'],
+            properties: {
+                strategy: { type: 'string' },
+                username: { type: 'string' },
+                password: { type: 'string' },
+            },
+        },
+    }),
+    tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthController.prototype, "signIn", null);
+tslib_1.__decorate([
+    (0, common_1.Post)('refresh'),
+    (0, swagger_1.ApiOperation)({ summary: 'Refresh access token' }),
+    (0, swagger_1.ApiBody)({
+        schema: {
+            type: 'object',
+            required: ['refreshToken'],
+            properties: {
+                refreshToken: { type: 'string' },
+            },
+        },
+    }),
+    tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
+tslib_1.__decorate([
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Post)('session'),
+    (0, swagger_1.ApiOperation)({ summary: 'Update session tenant/application context' }),
+    (0, swagger_1.ApiBody)({
+        schema: {
+            type: 'object',
+            properties: {
+                tenantId: { type: 'string' },
+                applicationId: { type: 'string' },
+                tenant: {
+                    type: 'object',
+                    properties: {
+                        id: { type: 'string' },
+                        name: { type: 'string' },
+                        title: { type: 'string' },
+                    },
+                },
+                application: {
+                    type: 'object',
+                    properties: {
+                        id: { type: 'string' },
+                        name: { type: 'string' },
+                        title: { type: 'string' },
+                    },
+                },
+            },
+        },
+    }),
+    tslib_1.__param(0, (0, common_1.Headers)('authorization')),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuthController.prototype, "updateSession", null);
+exports.AuthController = AuthController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('auth'),
+    (0, common_1.Controller)('v1/auth'),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService])
+], AuthController);
+//#endregion
+//# sourceMappingURL=auth.controller.js.map

package/security/src/lib/auth/auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.controller.ts"],"names":[],"mappings":";;;;AAAA,2CAOwB;AACxB,6CAAgF;AAChF,iDAA6C;AAC7C,qDAAgD;AAQhD,iCAAiC;AAI1B,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;IAAG,CAAC;IAelD,MAAM,CAAS,IAAsB;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAaD,OAAO,CAAS,IAA4B;QAC1C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IA+BD,aAAa,CACe,aAAiC,EACnD,IAA6B;QAErC,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEO,kBAAkB,CAAC,aAAsB;QAC/C,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;CACF,CAAA;AArFY,wCAAc;AAgBzB;IAbC,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IAC/D,IAAA,iBAAO,EAAC;QACP,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;YAClC,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC7B;SACF;KACF,CAAC;IACM,mBAAA,IAAA,aAAI,GAAE,CAAA;;;;4CAEb;AAaD;IAXC,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IACjD,IAAA,iBAAO,EAAC;QACP,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC;SACF;KACF,CAAC;IACO,mBAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAKd;AA+BD;IA7BC,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACtE,IAAA,iBAAO,EAAC;QACP,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACjC,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;iBACF;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;iBACF;aACF;SACF;KACF,CAAC;IAEC,mBAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,mBAAA,IAAA,aAAI,GAAE,CAAA;;;;mDAOR;yBA5EU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,SAAS,CAAC;6CAEe,0BAAW;GADnC,cAAc,CAqF1B;AAED,YAAY"}

package/security/src/lib/auth/auth.service.d.ts

@@ -0,0 +1,22 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import type { AccessTokenPayload, AuthTokenResponseDto, RefreshTokenPayload, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
+export declare class AuthService {
+    private readonly entityStorage;
+    private readonly logger;
+    constructor(entityStorage: EntityStorageMiddlewareService);
+    signIn(dto: SignInRequestDto): Promise<AuthTokenResponseDto>;
+    refreshSession(refreshToken: string): Promise<AuthTokenResponseDto>;
+    updateSession(currentAccessToken: string, dto: UpdateSessionRequestDto): Promise<AuthTokenResponseDto>;
+    verifyAccessToken(token: string): AccessTokenPayload;
+    verifyRefreshToken(token: string): RefreshTokenPayload;
+    private findUserByCredentials;
+    private findUserById;
+    private listUsers;
+    private toAuthUser;
+    private issueTokenResponse;
+    private jwtSecret;
+    private accessTokenTtl;
+    private refreshTokenTtl;
+    private resolveTenantDto;
+    private resolveApplicationDto;
+}

package/security/src/lib/auth/auth.service.js

@@ -0,0 +1,238 @@
+"use strict";
+var AuthService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const lodash_es_1 = require("lodash-es");
+const jwt = tslib_1.__importStar(require("jsonwebtoken"));
+//#region ---- Auth service ----
+const USER_ENTITY = 'SecurityManagement.User';
+const TENANT_ENTITY = 'TenantManagement.Tenant';
+const APPLICATION_ENTITY = 'ApplicationManagement.Application';
+const ACTIVE_ACCOUNT_STATE = 'active';
+const ALLOWED_ACCESS_STATE = 'allowed';
+let AuthService = AuthService_1 = class AuthService {
+    constructor(entityStorage) {
+        this.entityStorage = entityStorage;
+        this.logger = new common_1.Logger(AuthService_1.name);
+    }
+    async signIn(dto) {
+        if (dto.strategy && dto.strategy !== 'user-pass') {
+            throw new common_1.BadRequestException(`Unsupported auth strategy: ${dto.strategy}`);
+        }
+        const user = await this.findUserByCredentials(dto.username, dto.password);
+        if (!user) {
+            throw new common_1.UnauthorizedException('Invalid username or password');
+        }
+        // Match mock sign-in: user + tokens only. Tenant/application are chosen client-side
+        // via tenant-chooser / app-chooser and committed through updateSession.
+        return this.issueTokenResponse(this.toAuthUser(user), {});
+    }
+    async refreshSession(refreshToken) {
+        const payload = this.verifyRefreshToken(refreshToken);
+        const user = await this.findUserById(payload.sub);
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not found');
+        }
+        const [tenant, application] = await Promise.all([
+            this.resolveTenantDto(payload.tid),
+            this.resolveApplicationDto(payload.aid),
+        ]);
+        return this.issueTokenResponse(this.toAuthUser(user), {
+            tenantId: payload.tid,
+            applicationId: payload.aid,
+            tenant,
+            application,
+        });
+    }
+    async updateSession(currentAccessToken, dto) {
+        const current = this.verifyAccessToken(currentAccessToken);
+        const user = await this.findUserById(current.sub);
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not found');
+        }
+        const tenantId = dto.tenantId ?? dto.tenant?.id ?? current.tid;
+        const applicationId = dto.applicationId ?? dto.application?.id ?? current.aid;
+        const [tenant, application] = await Promise.all([
+            this.resolveTenantDto(tenantId, dto.tenant),
+            this.resolveApplicationDto(applicationId, dto.application),
+        ]);
+        return this.issueTokenResponse(this.toAuthUser(user), {
+            tenantId,
+            applicationId,
+            tenant,
+            application,
+        });
+    }
+    verifyAccessToken(token) {
+        try {
+            const payload = jwt.verify(token, this.jwtSecret());
+            if (payload.type !== 'access' || !payload.sub) {
+                throw new common_1.UnauthorizedException('Invalid access token');
+            }
+            return payload;
+        }
+        catch (error) {
+            if (error instanceof common_1.UnauthorizedException) {
+                throw error;
+            }
+            throw new common_1.UnauthorizedException('Invalid or expired access token');
+        }
+    }
+    verifyRefreshToken(token) {
+        try {
+            const payload = jwt.verify(token, this.jwtSecret());
+            if (payload.type !== 'refresh' || !payload.sub) {
+                throw new common_1.UnauthorizedException('Invalid refresh token');
+            }
+            return payload;
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Invalid or expired refresh token');
+        }
+    }
+    //#region ---- User lookup ----
+    async findUserByCredentials(username, password) {
+        const users = await this.listUsers();
+        const candidates = users.filter((u) => u.username === username &&
+            u.accountState === ACTIVE_ACCOUNT_STATE &&
+            ((0, lodash_es_1.isNil)(u.accessState) || u.accessState === ALLOWED_ACCESS_STATE));
+        for (const user of candidates) {
+            if (await (0, core_2.verifyPassword)(password, user.password)) {
+                return user;
+            }
+        }
+        return null;
+    }
+    async findUserById(userId) {
+        const record = await this.entityStorage.getOne(USER_ENTITY, userId);
+        return record ?? null;
+    }
+    async listUsers() {
+        const result = await this.entityStorage.query(USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 2000 }));
+        const items = (0, lodash_es_1.get)(result, 'items', []);
+        return Array.isArray(items) ? items : [];
+    }
+    toAuthUser(user) {
+        return {
+            id: user.id,
+            name: user.username ?? user.id,
+            title: user.displayName ?? user.username ?? user.id,
+        };
+    }
+    //#endregion
+    //#region ---- Token issuance ----
+    issueTokenResponse(user, context) {
+        const accessPayload = {
+            sub: user.id,
+            username: user.name,
+            type: 'access',
+            ...(context.tenantId ? { tid: context.tenantId } : {}),
+            ...(context.applicationId ? { aid: context.applicationId } : {}),
+        };
+        const refreshPayload = {
+            sub: user.id,
+            type: 'refresh',
+            ...(context.tenantId ? { tid: context.tenantId } : {}),
+            ...(context.applicationId ? { aid: context.applicationId } : {}),
+        };
+        const accessToken = jwt.sign(accessPayload, this.jwtSecret(), {
+            expiresIn: this.accessTokenTtl(),
+        });
+        const refreshToken = jwt.sign(refreshPayload, this.jwtSecret(), {
+            expiresIn: this.refreshTokenTtl(),
+        });
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: this.accessTokenTtl(),
+            user,
+            tenant: context.tenant ?? (context.tenantId ? { id: context.tenantId } : null),
+            application: context.application ??
+                (context.applicationId ? { id: context.applicationId } : null),
+        };
+    }
+    jwtSecret() {
+        const secret = process.env['JWT_SECRET']?.trim();
+        if (!secret) {
+            this.logger.warn('JWT_SECRET is not set; using insecure development default');
+            return 'acorex-dev-jwt-secret-change-me';
+        }
+        return secret;
+    }
+    accessTokenTtl() {
+        return process.env['JWT_ACCESS_EXPIRES_IN']?.trim() || '8h';
+    }
+    refreshTokenTtl() {
+        return process.env['JWT_REFRESH_EXPIRES_IN']?.trim() || '7d';
+    }
+    async resolveTenantDto(tenantId, partial) {
+        if (!tenantId) {
+            return undefined;
+        }
+        if (partial?.title?.trim()) {
+            return {
+                id: tenantId,
+                name: partial.name,
+                title: partial.title,
+            };
+        }
+        const tenant = (await this.entityStorage.getOne(TENANT_ENTITY, tenantId));
+        if (!tenant) {
+            return partial?.name || partial?.title
+                ? { id: tenantId, name: partial.name, title: partial.title }
+                : { id: tenantId };
+        }
+        const title = String(tenant['title'] ?? partial?.title ?? '');
+        const fallbackName = title.toLowerCase().replace(/\s+/g, '-');
+        return {
+            id: tenantId,
+            name: String(tenant['name'] ?? partial?.name ?? (fallbackName || 'default-name')),
+            title,
+        };
+    }
+    async resolveApplicationDto(applicationId, partial) {
+        if (!applicationId) {
+            return undefined;
+        }
+        if (partial?.title?.trim() && partial?.name?.trim()) {
+            return {
+                id: applicationId,
+                name: partial.name,
+                title: partial.title,
+            };
+        }
+        const application = (await this.entityStorage.getOne(APPLICATION_ENTITY, applicationId));
+        if (!application) {
+            return partial?.name || partial?.title
+                ? { id: applicationId, name: partial.name, title: partial.title }
+                : { id: applicationId };
+        }
+        const title = String(application['title'] ?? partial?.title ?? '');
+        const code = application['code'] != null ? String(application['code']) : undefined;
+        const routeName = code === 'MAGFA-001'
+            ? 'magfa-commerce'
+            : partial?.name ||
+                (application['name'] != null
+                    ? String(application['name'])
+                    : undefined) ||
+                title.toLowerCase().replace(/\s+/g, '-') ||
+                'default-name';
+        return {
+            id: applicationId,
+            name: routeName,
+            title,
+        };
+    }
+};
+exports.AuthService = AuthService;
+exports.AuthService = AuthService = AuthService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], AuthService);
+//#endregion
+//# sourceMappingURL=auth.service.js.map