@acorex-platform/framework-server 0.0.10

package/security/src/lib/auth/auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAKwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,0DAAoC;AAapC,gCAAgC;AAEhC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAC/D,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAEsB,CAAC;IAE9E,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,4BAAmB,CAC3B,8BAA8B,GAAG,CAAC,QAAQ,EAAE,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,oFAAoF;QACpF,wEAAwE;QACxE,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;YAClC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACpD,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,aAAa,EAAE,OAAO,CAAC,GAAG;YAC1B,MAAM;YACN,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,kBAA0B,EAC1B,GAA4B;QAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC;QAC/D,MAAM,aAAa,GACjB,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC;QAE1D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;YAC3C,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC;SAC3D,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACpD,QAAQ;YACR,aAAa;YACb,MAAM;YACN,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CACxB,KAAK,EACL,IAAI,CAAC,SAAS,EAAE,CACM,CAAC;YACzB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/C,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,+BAA+B;IAEvB,KAAK,CAAC,qBAAqB,CACjC,QAAgB,EAChB,QAAgB;QAEhB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACvB,CAAC,CAAC,YAAY,KAAK,oBAAoB;YACvC,CAAC,IAAA,iBAAK,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,oBAAoB,CAAC,CACnE,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,MAAc;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpE,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEO,UAAU,CAAC,IAAkC;QACnD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;SACpD,CAAC;IACJ,CAAC;IAED,YAAY;IAEZ,kCAAkC;IAE1B,kBAAkB,CACxB,IAAiB,EACjB,OAKC;QAED,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,IAAI;YACJ,MAAM,EACJ,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAEO,SAAS;QACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,CAC5D,CAAC;YACF,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,cAAc;QACpB,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9D,CAAC;IAEO,eAAe;QACrB,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,QAAiB,EACjB,OAAuB;QAEvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAC7C,aAAa,EACb,QAAQ,CACT,CAAmC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,KAAK;gBACpC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;gBAC5D,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE9D,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,MAAM,CACV,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,IAAI,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC,CACpE;YACD,KAAK;SACN,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,aAAsB,EACtB,OAA4B;QAE5B,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YACpD,OAAO;gBACL,EAAE,EAAE,aAAa;gBACjB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAClD,kBAAkB,EAClB,aAAa,CACd,CAAmC,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,KAAK;gBACpC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;gBACjE,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GACR,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,SAAS,GACb,IAAI,KAAK,WAAW;YAClB,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,OAAO,EAAE,IAAI;gBACb,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI;oBAC1B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC7B,CAAC,CAAC,SAAS,CAAC;gBACd,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;gBACxC,cAAc,CAAC;QAErB,OAAO;YACL,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,SAAS;YACf,KAAK;SACN,CAAC;IACJ,CAAC;CAGF,CAAA;AA3SY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,WAAW,CA2SvB;AAED,YAAY"}

package/security/src/lib/auth/auth.types.d.ts

@@ -0,0 +1,69 @@
+export interface SignInRequestDto {
+    strategy?: string;
+    username: string;
+    password: string;
+}
+export interface UpdateSessionRequestDto {
+    tenantId?: string;
+    applicationId?: string;
+    tenant?: {
+        id: string;
+        name?: string;
+        title?: string;
+    };
+    application?: {
+        id: string;
+        name?: string;
+        title?: string;
+    };
+}
+export interface RefreshTokenRequestDto {
+    refreshToken: string;
+}
+export interface AuthUserDto {
+    id: string;
+    name: string;
+    title: string;
+}
+export interface AuthTenantDto {
+    id: string;
+    name?: string;
+    title?: string;
+}
+export interface AuthApplicationDto {
+    id: string;
+    name?: string;
+    title?: string;
+}
+export interface AuthTokenResponseDto {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: string;
+    user: AuthUserDto;
+    tenant?: AuthTenantDto | null;
+    application?: AuthApplicationDto | null;
+}
+export interface AccessTokenPayload {
+    sub: string;
+    username: string;
+    tid?: string;
+    aid?: string;
+    type: 'access';
+}
+export interface RefreshTokenPayload {
+    sub: string;
+    type: 'refresh';
+    tid?: string;
+    aid?: string;
+}
+export interface SecurityManagementUserRecord {
+    id: string;
+    username?: string;
+    displayName?: string;
+    password?: string;
+    accountState?: string;
+    accessState?: string | null;
+    ownershipInfo?: {
+        tenantId?: string | null;
+    };
+}

package/security/src/lib/auth/auth.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- Auth DTOs & token payloads ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=auth.types.js.map

package/security/src/lib/auth/auth.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.types.ts"],"names":[],"mappings":";AAAA,8CAA8C;;AAuE9C,YAAY"}

package/security/src/lib/auth/jwt-auth.guard.d.ts

@@ -0,0 +1,14 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthService } from './auth.service';
+/**
+ * Opt-in guard for routes that require a valid Bearer access token.
+ * Apply with `@UseGuards(JwtAuthGuard)` — not registered globally so public APIs stay open.
+ */
+export declare class JwtAuthGuard implements CanActivate {
+    private readonly reflector;
+    private readonly authService;
+    constructor(reflector: Reflector, authService: AuthService);
+    canActivate(context: ExecutionContext): boolean;
+    private extractBearerToken;
+}

package/security/src/lib/auth/jwt-auth.guard.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const auth_service_1 = require("./auth.service");
+const public_decorator_1 = require("./public.decorator");
+const current_session_decorator_1 = require("../session/current-session.decorator");
+//#region ---- JWT auth guard ----
+/**
+ * Opt-in guard for routes that require a valid Bearer access token.
+ * Apply with `@UseGuards(JwtAuthGuard)` — not registered globally so public APIs stay open.
+ */
+let JwtAuthGuard = class JwtAuthGuard {
+    constructor(reflector, authService) {
+        this.reflector = reflector;
+        this.authService = authService;
+    }
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractBearerToken(request.headers?.authorization);
+        if (!token) {
+            throw new common_1.UnauthorizedException('Bearer access token is required');
+        }
+        let payload;
+        try {
+            payload = this.authService.verifyAccessToken(token);
+        }
+        catch (error) {
+            if (error instanceof common_1.UnauthorizedException) {
+                throw error;
+            }
+            throw new common_1.UnauthorizedException('Invalid or expired access token');
+        }
+        const session = {
+            userId: payload.sub,
+            username: payload.username,
+            tenantId: payload.tid,
+            applicationId: payload.aid,
+        };
+        request[current_session_decorator_1.CURRENT_SESSION_KEY] = session;
+        return true;
+    }
+    extractBearerToken(authorization) {
+        const header = Array.isArray(authorization) ? authorization[0] : authorization;
+        if (!header?.startsWith('Bearer ')) {
+            return null;
+        }
+        const token = header.slice('Bearer '.length).trim();
+        return token.length > 0 ? token : null;
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.Reflector,
+        auth_service_1.AuthService])
+], JwtAuthGuard);
+//#endregion
+//# sourceMappingURL=jwt-auth.guard.js.map

package/security/src/lib/auth/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/jwt-auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,iDAA6C;AAC7C,yDAAmD;AACnD,oFAA2E;AAG3E,kCAAkC;AAElC;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YACmB,SAAoB,EACpB,WAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAG7C,CAAC;QAEL,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAA0B;YACrC,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,aAAa,EAAE,OAAO,CAAC,GAAG;SAC3B,CAAC;QAEF,OAAO,CAAC,+CAAmB,CAAC,GAAG,OAAO,CAAC;QAEvC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB,CAAC,aAAiC;QAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAC/E,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;CACF,CAAA;AAxDY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;6CAGmB,gBAAS;QACP,0BAAW;GAHhC,YAAY,CAwDxB;AAED,YAAY"}

package/security/src/lib/auth/public.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare const IS_PUBLIC_KEY = "isPublic";
+/** Skips JWT authentication for this route or controller. */
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;

package/security/src/lib/auth/public.decorator.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+//#region ---- Public route metadata ----
+exports.IS_PUBLIC_KEY = 'isPublic';
+/** Skips JWT authentication for this route or controller. */
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;
+//#endregion
+//# sourceMappingURL=public.decorator.js.map

package/security/src/lib/auth/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/public.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAE7C,yCAAyC;AAE5B,QAAA,aAAa,GAAG,UAAU,CAAC;AAExC,6DAA6D;AACtD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,qBAAa,EAAE,IAAI,CAAC,CAAC;AAAhD,QAAA,MAAM,UAA0C;AAE7D,YAAY"}

package/security/src/lib/authorization/platform-root-user.util.d.ts

@@ -0,0 +1,18 @@
+/** Server-side platform operator helpers (no Angular / client dependency). */
+export declare const PLATFORM_OPERATOR_WILDCARD_FEATURE = "*";
+export declare const PLATFORM_OPERATOR_WILDCARD_PERMISSION = "*";
+export declare const PLATFORM_ROOT_USER_IDS: Set<string>;
+export declare const PLATFORM_ROOT_USERNAMES: Set<string>;
+export type PlatformRootUsername = 'root' | 'root2' | 'super-root';
+export declare function isPlatformRootUserId(userId: string): boolean;
+export declare function isPlatformRootUsername(username: string): boolean;
+export declare function isPlatformRootUserRecord(user: Record<string, unknown>): boolean;
+export declare function isPlatformRootSessionUser(context: {
+    user?: {
+        id?: string;
+        name?: string;
+    } | null;
+}): boolean;
+export declare function hasPlatformOperatorWildcardPermission(permissions: readonly string[]): boolean;
+export declare function isPlatformOperator(username: string): boolean;
+export declare function isPlatformOperatorForFeatures(username: string, _featureKeys: readonly string[]): boolean;

package/security/src/lib/authorization/platform-root-user.util.js

@@ -0,0 +1,51 @@
+"use strict";
+/** Server-side platform operator helpers (no Angular / client dependency). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ROOT_USERNAMES = exports.PLATFORM_ROOT_USER_IDS = exports.PLATFORM_OPERATOR_WILDCARD_PERMISSION = exports.PLATFORM_OPERATOR_WILDCARD_FEATURE = void 0;
+exports.isPlatformRootUserId = isPlatformRootUserId;
+exports.isPlatformRootUsername = isPlatformRootUsername;
+exports.isPlatformRootUserRecord = isPlatformRootUserRecord;
+exports.isPlatformRootSessionUser = isPlatformRootSessionUser;
+exports.hasPlatformOperatorWildcardPermission = hasPlatformOperatorWildcardPermission;
+exports.isPlatformOperator = isPlatformOperator;
+exports.isPlatformOperatorForFeatures = isPlatformOperatorForFeatures;
+exports.PLATFORM_OPERATOR_WILDCARD_FEATURE = '*';
+exports.PLATFORM_OPERATOR_WILDCARD_PERMISSION = '*';
+exports.PLATFORM_ROOT_USER_IDS = new Set([
+    'f0000001-0000-4000-a000-000000000001',
+    'f0000001-0000-4000-a000-000000000002',
+    'f0000001-0000-4000-a000-000000000003',
+]);
+exports.PLATFORM_ROOT_USERNAMES = new Set(['root', 'root2', 'super-root']);
+function isPlatformRootUserId(userId) {
+    return exports.PLATFORM_ROOT_USER_IDS.has(userId);
+}
+function isPlatformRootUsername(username) {
+    return exports.PLATFORM_ROOT_USERNAMES.has(username);
+}
+function isPlatformRootUserRecord(user) {
+    const username = user['username'];
+    if (typeof username === 'string' && isPlatformRootUsername(username)) {
+        return true;
+    }
+    const id = user['id'];
+    return typeof id === 'string' && isPlatformRootUserId(id);
+}
+function isPlatformRootSessionUser(context) {
+    const userId = context.user?.id;
+    if (userId != null && isPlatformRootUserId(userId)) {
+        return true;
+    }
+    const username = context.user?.name;
+    return username != null && isPlatformRootUsername(username);
+}
+function hasPlatformOperatorWildcardPermission(permissions) {
+    return permissions.includes(exports.PLATFORM_OPERATOR_WILDCARD_PERMISSION);
+}
+function isPlatformOperator(username) {
+    return isPlatformRootUsername(username);
+}
+function isPlatformOperatorForFeatures(username, _featureKeys) {
+    return isPlatformOperator(username);
+}
+//# sourceMappingURL=platform-root-user.util.js.map

package/security/src/lib/authorization/platform-root-user.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-root-user.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/authorization/platform-root-user.util.ts"],"names":[],"mappings":";AAAA,8EAA8E;;;AAe9E,oDAEC;AAED,wDAEC;AAED,4DAQC;AAED,8DAUC;AAED,sFAEC;AAED,gDAEC;AAED,sEAEC;AArDY,QAAA,kCAAkC,GAAG,GAAG,CAAC;AACzC,QAAA,qCAAqC,GAAG,GAAG,CAAC;AAE5C,QAAA,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;CACvC,CAAC,CAAC;AAEU,QAAA,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AAIhF,SAAgB,oBAAoB,CAAC,MAAc;IACjD,OAAO,8BAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,OAAO,+BAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAA6B;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAgB,yBAAyB,CAAC,OAEzC;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IAChC,IAAI,MAAM,IAAI,IAAI,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IACpC,OAAO,QAAQ,IAAI,IAAI,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,SAAgB,qCAAqC,CAAC,WAA8B;IAClF,OAAO,WAAW,CAAC,QAAQ,CAAC,6CAAqC,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,6BAA6B,CAAC,QAAgB,EAAE,YAA+B;IAC7F,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC"}

package/security/src/lib/entity-storage/policy-enforce.middleware.d.ts

@@ -0,0 +1,26 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+export type PolicyEffect = 'editable' | 'readonly' | 'hidden' | 'immutable' | 'masked';
+export interface PolicyEffectRule {
+    effect: PolicyEffect;
+    target: string;
+}
+export interface PolicyEntityModel {
+    resource?: {
+        type?: string;
+        target?: string;
+    };
+    rules?: Array<{
+        conditions: unknown;
+        effects?: PolicyEffectRule[];
+    }>;
+}
+export declare class PolicyEnforceMiddleware implements EntityStorageMiddleware {
+    private readonly evaluator;
+    readonly target: {
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private evalScopeKey;
+    private loadPolicies;
+}

package/security/src/lib/entity-storage/policy-enforce.middleware.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyEnforceMiddleware = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const policy_expression_evaluator_util_1 = require("./policy-expression-evaluator.util");
+const policy_field_util_1 = require("./policy-field.util");
+const POLICY_ENTITY = 'SecurityManagement.Policy';
+const POLICY_CACHE_TTL_MS = 30_000;
+let policyCache = null;
+let policyLoadPromise = null;
+//#endregion
+//#region ---- Policy enforce middleware ----
+function matchesEntity(target, entityName) {
+    if (!target || target === '*') {
+        return true;
+    }
+    return target === entityName;
+}
+function collectTargets(rules, effect) {
+    return rules.filter((r) => r.effect === effect).map((r) => r.target).filter(Boolean);
+}
+let PolicyEnforceMiddleware = class PolicyEnforceMiddleware {
+    constructor() {
+        this.evaluator = new policy_expression_evaluator_util_1.BackendExpressionEvaluator();
+        this.target = {
+            ops: ['create', 'update', 'delete', 'getOne', 'query'],
+            order: 5,
+        };
+    }
+    async execute(ctx, next) {
+        if (ctx.entityName === POLICY_ENTITY) {
+            if (ctx.op === 'create' || ctx.op === 'update' || ctx.op === 'delete') {
+                policyCache = null;
+            }
+            await next();
+            return;
+        }
+        const policies = await this.loadPolicies(ctx);
+        const applicable = policies.filter((p) => p?.resource?.type === 'entity' && matchesEntity(p.resource?.target ?? '', ctx.entityName));
+        if (!applicable.length) {
+            await next();
+            return;
+        }
+        let activeRules = [];
+        let readonlyTargets = [];
+        let immutableTargets = [];
+        let hiddenTargets = [];
+        let maskedTargets = [];
+        let editableTargets = [];
+        const buildScope = (overrides) => ({
+            context: {
+                op: ctx.op,
+                entity: ctx.entityName,
+                id: ctx.id,
+                data: ctx.data,
+                existing: overrides?.existing,
+                result: overrides?.result ?? ctx.result,
+                eval: (key) => this.evalScopeKey(key, ctx, overrides?.existing),
+            },
+        });
+        const evaluateActiveRules = async (scope) => {
+            const list = [];
+            for (const pol of applicable) {
+                for (const rule of pol.rules ?? []) {
+                    const active = await this.evaluator.evaluate(rule.conditions, scope);
+                    if (active) {
+                        for (const eff of rule.effects ?? []) {
+                            list.push(eff);
+                        }
+                    }
+                }
+            }
+            return list;
+        };
+        const deriveTargets = (rules) => ({
+            readonlyTargets: collectTargets(rules, 'readonly'),
+            immutableTargets: collectTargets(rules, 'immutable'),
+            hiddenTargets: collectTargets(rules, 'hidden'),
+            maskedTargets: collectTargets(rules, 'masked'),
+            editableTargets: collectTargets(rules, 'editable'),
+        });
+        const isEditable = (t) => editableTargets.includes(t) || editableTargets.includes('*');
+        if (ctx.op === 'create' || ctx.op === 'update') {
+            let existing;
+            if (ctx.op === 'update' && ctx.id) {
+                try {
+                    existing = await ctx.backend.getOne(ctx.entityName, ctx.id);
+                }
+                catch {
+                    existing = undefined;
+                }
+            }
+            activeRules = await evaluateActiveRules(buildScope({ existing }));
+            ({ readonlyTargets, immutableTargets, hiddenTargets, maskedTargets, editableTargets } =
+                deriveTargets(activeRules));
+            if (ctx.data && typeof ctx.data === 'object') {
+                const data = ctx.data;
+                if (immutableTargets.includes('*')) {
+                    throw new core_1.MiddlewareAbortError('Update forbidden by policy: Record is marked as system and cannot be modified', { status: 409, code: 'POLICY_IMMUTABLE_RECORD', details: { entity: ctx.entityName, id: ctx.id } });
+                }
+                const forbiddenPaths = [];
+                const addForbidden = (targets) => {
+                    for (const t of targets) {
+                        if (t !== '*' && !isEditable(t)) {
+                            forbiddenPaths.push(t);
+                        }
+                    }
+                };
+                addForbidden(readonlyTargets);
+                addForbidden(immutableTargets);
+                (0, policy_field_util_1.removePolicyFields)(data, Array.from(new Set(forbiddenPaths)));
+                ctx.data = data;
+            }
+        }
+        if (ctx.op === 'delete') {
+            let existing;
+            if (ctx.id) {
+                try {
+                    existing = await ctx.backend.getOne(ctx.entityName, ctx.id);
+                }
+                catch {
+                    existing = undefined;
+                }
+            }
+            activeRules = await evaluateActiveRules(buildScope({ existing }));
+            ({ readonlyTargets, immutableTargets, hiddenTargets, maskedTargets, editableTargets } =
+                deriveTargets(activeRules));
+            if (immutableTargets.includes('*')) {
+                throw new core_1.MiddlewareAbortError('Delete forbidden by policy: Record is marked as system and cannot be deleted', { status: 409, code: 'POLICY_IMMUTABLE_RECORD', details: { entity: ctx.entityName, id: ctx.id } });
+            }
+        }
+        await next();
+        if (ctx.op === 'getOne' || ctx.op === 'query') {
+            activeRules = await evaluateActiveRules(buildScope({ result: ctx.result }));
+            ({ readonlyTargets, immutableTargets, hiddenTargets, maskedTargets, editableTargets } =
+                deriveTargets(activeRules));
+            const applyReadTransforms = (obj) => {
+                (0, policy_field_util_1.removePolicyFields)(obj, hiddenTargets);
+                (0, policy_field_util_1.setMaskedPolicyFields)(obj, maskedTargets);
+            };
+            if (ctx.op === 'query') {
+                const result = ctx.result;
+                result?.items?.forEach(applyReadTransforms);
+            }
+            else if (ctx.result && typeof ctx.result === 'object') {
+                applyReadTransforms(ctx.result);
+            }
+        }
+    }
+    evalScopeKey(key, ctx, existing) {
+        const getNested = (obj, path) => {
+            if (!obj || !path) {
+                return undefined;
+            }
+            return path.split('.').reduce((current, part) => {
+                if (current && typeof current === 'object' && part in current) {
+                    return current[part];
+                }
+                return undefined;
+            }, obj);
+        };
+        if (ctx.op === 'delete' && existing) {
+            return getNested(existing, key);
+        }
+        if (ctx.data) {
+            const dataValue = getNested(ctx.data, key);
+            if (dataValue !== undefined) {
+                return dataValue;
+            }
+        }
+        if (existing) {
+            return getNested(existing, key);
+        }
+        return undefined;
+    }
+    async loadPolicies(ctx) {
+        const now = Date.now();
+        if (policyCache && now - policyCache.timestamp < POLICY_CACHE_TTL_MS) {
+            return policyCache.policies;
+        }
+        if (!policyLoadPromise) {
+            policyLoadPromise = (async () => {
+                try {
+                    const res = await ctx.backend.query(POLICY_ENTITY, { skip: 0, take: 1000 });
+                    const items = (res?.items ?? []);
+                    policyCache = { policies: items, timestamp: Date.now() };
+                    return items;
+                }
+                catch {
+                    return [];
+                }
+                finally {
+                    policyLoadPromise = null;
+                }
+            })();
+        }
+        return policyLoadPromise;
+    }
+};
+exports.PolicyEnforceMiddleware = PolicyEnforceMiddleware;
+exports.PolicyEnforceMiddleware = PolicyEnforceMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], PolicyEnforceMiddleware);
+//#endregion
+//# sourceMappingURL=policy-enforce.middleware.js.map

package/security/src/lib/entity-storage/policy-enforce.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-enforce.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA8E;AAM9E,yFAAgF;AAChF,2DAAgF;AAmBhF,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,IAAI,WAAW,GAAgE,IAAI,CAAC;AACpF,IAAI,iBAAiB,GAAwC,IAAI,CAAC;AAElE,YAAY;AAEZ,6CAA6C;AAE7C,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,MAAoB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QACY,cAAS,GAAG,IAAI,6DAA0B,EAAE,CAAC;QAErD,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAkB;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;IAqMJ,CAAC;IAnMC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAuB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,gBAAgB,GAAa,EAAE,CAAC;QACpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,SAAoD,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,SAAS,EAAE,QAAQ;gBAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM;gBACvC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;aACxE;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA8B,EAA+B,EAAE;YAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBACrE,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;4BACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC;YACpD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;YAClD,gBAAgB,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/F,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;gBACjD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,2BAAoB,CAC5B,+EAA+E,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,CAAC,OAAiB,EAAE,EAAE;oBACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACzB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC9B,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,IAAA,sCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAoB,CAC5B,8EAA8E,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,MAAM,mBAAmB,GAAG,CAAC,GAA4B,EAAE,EAAE;gBAC3D,IAAA,sCAAkB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACvC,IAAA,yCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAA+C,CAAC;gBACnE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,mBAAmB,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,GAAyB,EAAE,QAAkB;QAC7E,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE;YACxD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAK,OAAkB,EAAE,CAAC;oBAC1E,OAAQ,OAAmC,CAAC,IAAI,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAwB,CAAC;oBACxD,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;CACF,CAAA;AA3MY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CA2MnC;AAED,YAAY"}

package/security/src/lib/entity-storage/policy-expression-evaluator.util.d.ts

@@ -0,0 +1,7 @@
+export type BackendExpressionScope = Record<string, unknown>;
+export declare class BackendExpressionEvaluator {
+    private readonly expressionCache;
+    private getOrCompileFunction;
+    evaluate(source: unknown, scope?: BackendExpressionScope): Promise<unknown>;
+    private evaluateStringExpression;
+}

package/security/src/lib/entity-storage/policy-expression-evaluator.util.js

@@ -0,0 +1,70 @@
+"use strict";
+//#region ---- Backend expression evaluator ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackendExpressionEvaluator = void 0;
+class BackendExpressionEvaluator {
+    constructor() {
+        this.expressionCache = new Map();
+    }
+    getOrCompileFunction(expression) {
+        if (!this.expressionCache.has(expression)) {
+            const hasMultipleStatements = expression.includes(';') || expression.includes('\n');
+            const fn = hasMultipleStatements
+                ? new Function('scope', `with (scope) { return (async function() { ${expression} })(); }`)
+                : new Function('scope', `with (scope) { return (async function() { return ${expression}; })(); }`);
+            this.expressionCache.set(expression, fn);
+        }
+        return this.expressionCache.get(expression);
+    }
+    async evaluate(source, scope = {}) {
+        try {
+            if (typeof source === 'string' && source.includes('{{')) {
+                return await this.evaluateStringExpression(source, scope);
+            }
+            if (Array.isArray(source)) {
+                return Promise.all(source.map((item) => this.evaluate(item, scope)));
+            }
+            if (typeof source === 'object' && source !== null) {
+                const evaluatedObject = {};
+                for (const key of Object.keys(source)) {
+                    evaluatedObject[key] = await this.evaluate(source[key], scope);
+                }
+                return evaluatedObject;
+            }
+            return source;
+        }
+        catch {
+            return false;
+        }
+    }
+    async evaluateStringExpression(templateExpression, scope) {
+        const exactMatch = templateExpression.match(/^\s*\{\{\s*([\s\S]*?)\s*\}\}\s*$/);
+        if (exactMatch) {
+            const sandbox = this.getOrCompileFunction(exactMatch[1]);
+            return sandbox(scope);
+        }
+        const regex = /\{\{\s*([\s\S]*?)\s*\}\}/g;
+        const matches = [];
+        let match;
+        while ((match = regex.exec(templateExpression)) !== null) {
+            matches.push({ expression: match[1], start: match.index, end: regex.lastIndex });
+        }
+        const values = await Promise.all(matches.map((m) => {
+            const sandbox = this.getOrCompileFunction(m.expression);
+            return sandbox(scope);
+        }));
+        let result = '';
+        let lastIndex = 0;
+        matches.forEach((m, i) => {
+            result += templateExpression.slice(lastIndex, m.start);
+            const value = values[i];
+            result += value !== undefined && value !== null ? String(value) : '';
+            lastIndex = m.end;
+        });
+        result += templateExpression.slice(lastIndex);
+        return result;
+    }
+}
+exports.BackendExpressionEvaluator = BackendExpressionEvaluator;
+//#endregion
+//# sourceMappingURL=policy-expression-evaluator.util.js.map

package/security/src/lib/entity-storage/policy-expression-evaluator.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-expression-evaluator.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-expression-evaluator.util.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AAIhD,MAAa,0BAA0B;IAAvC;QACmB,oBAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;IAwEjE,CAAC;IAtES,oBAAoB,CAAC,UAAkB;QAC7C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,qBAAqB,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,qBAAqB;gBAC9B,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,6CAA6C,UAAU,UAAU,CAAC;gBAC1F,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,oDAAoD,UAAU,WAAW,CAAC,CAAC;YACrG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe,EAAE,QAAgC,EAAE;QAChE,IAAI,CAAC;YACH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,eAAe,GAA4B,EAAE,CAAC;gBACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,EAAE,CAAC;oBACjE,eAAe,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CACvC,MAAkC,CAAC,GAAG,CAAC,EACxC,KAAK,CACN,CAAC;gBACJ,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,kBAA0B,EAC1B,KAA6B;QAE7B,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,KAAK,GAAG,2BAA2B,CAAC;QAC1C,MAAM,OAAO,GAA8D,EAAE,CAAC;QAC9E,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACxD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAzED,gEAyEC;AAED,YAAY"}

package/security/src/lib/entity-storage/policy-field.util.d.ts

@@ -0,0 +1,3 @@
+export declare function maskPolicyValue(value: unknown): unknown;
+export declare function removePolicyFields(obj: Record<string, unknown>, paths: string[]): void;
+export declare function setMaskedPolicyFields(obj: Record<string, unknown>, paths: string[]): void;