@acorex-platform/framework-server 0.0.10

package/security/src/lib/entity-storage/policy-field.util.js

@@ -0,0 +1,95 @@
+"use strict";
+//#region ---- Policy field transforms ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskPolicyValue = maskPolicyValue;
+exports.removePolicyFields = removePolicyFields;
+exports.setMaskedPolicyFields = setMaskedPolicyFields;
+function maskPolicyValue(value) {
+    if (value == null) {
+        return value;
+    }
+    const str = String(value);
+    if (str.length <= 4) {
+        return '****';
+    }
+    return `${'*'.repeat(Math.max(0, str.length - 4))}${str.slice(-4)}`;
+}
+function removePolicyFields(obj, paths) {
+    if (!obj || !paths?.length) {
+        return;
+    }
+    const deleteByPath = (target, path) => {
+        const parts = path.split('.');
+        let cursor = target;
+        for (let i = 0; i < parts.length - 1; i++) {
+            const key = parts[i];
+            if (cursor == null || typeof cursor !== 'object') {
+                return;
+            }
+            cursor = cursor[key];
+        }
+        const lastKey = parts[parts.length - 1];
+        if (cursor && typeof cursor === 'object' && Object.prototype.hasOwnProperty.call(cursor, lastKey)) {
+            delete cursor[lastKey];
+        }
+    };
+    if (paths.includes('*')) {
+        for (const key of Object.keys(obj)) {
+            delete obj[key];
+        }
+    }
+    for (const p of paths) {
+        if (!p || p === '*') {
+            continue;
+        }
+        if (p.includes('.')) {
+            deleteByPath(obj, p);
+        }
+        else if (Object.prototype.hasOwnProperty.call(obj, p)) {
+            delete obj[p];
+        }
+    }
+}
+function setMaskedPolicyFields(obj, paths) {
+    if (!obj || !paths?.length) {
+        return;
+    }
+    const maskByPath = (target, path) => {
+        const parts = path.split('.');
+        let cursor = target;
+        for (let i = 0; i < parts.length - 1; i++) {
+            const key = parts[i];
+            if (cursor == null || typeof cursor !== 'object') {
+                return;
+            }
+            cursor = cursor[key];
+        }
+        const lastKey = parts[parts.length - 1];
+        if (cursor && typeof cursor === 'object' && Object.prototype.hasOwnProperty.call(cursor, lastKey)) {
+            cursor[lastKey] = maskPolicyValue(cursor[lastKey]);
+        }
+    };
+    if (paths.includes('*')) {
+        for (const key of Object.keys(obj)) {
+            if (Object.prototype.hasOwnProperty.call(obj, key)) {
+                const val = obj[key];
+                if (val == null || typeof val !== 'object') {
+                    obj[key] = maskPolicyValue(val);
+                }
+            }
+        }
+    }
+    for (const p of paths) {
+        if (!p || p === '*') {
+            continue;
+        }
+        if (p.includes('.')) {
+            maskByPath(obj, p);
+        }
+        else if (Object.prototype.hasOwnProperty.call(obj, p)) {
+            obj[p] = maskPolicyValue(obj[p]);
+        }
+    }
+}
+//#endregion
+//# sourceMappingURL=policy-field.util.js.map

package/security/src/lib/entity-storage/policy-field.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-field.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-field.util.ts"],"names":[],"mappings":";AAAA,2CAA2C;;AAE3C,0CASC;AAED,gDAqCC;AAED,sDA4CC;AA9FD,SAAgB,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAA4B,EAAE,KAAe;IAC9E,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,MAA+B,EAAE,IAAY,EAAQ,EAAE;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,GAAY,MAAM,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAClG,OAAQ,MAAkC,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,GAA4B,EAAE,KAAe;IACjF,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAA+B,EAAE,IAAY,EAAQ,EAAE;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,GAAY,MAAM,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACjG,MAAkC,CAAC,OAAO,CAAC,GAAG,eAAe,CAC3D,MAAkC,CAAC,OAAO,CAAC,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC3C,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,YAAY"}

package/security/src/lib/entity-storage/visibility-filter.middleware.d.ts

@@ -0,0 +1,29 @@
+import type { Request } from 'express';
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+import { CURRENT_SESSION_KEY } from '../session/current-session.decorator';
+import type { BackendRequestSession } from '../session/backend-session.types';
+type RequestWithSession = Request & {
+    [CURRENT_SESSION_KEY]?: BackendRequestSession;
+};
+/**
+
+ * Injects SQL/JQL-level visibility filters before query execution.
+
+ * - Hides records with stateInfo.isHidden === true (unless bypassed)
+
+ * - Scopes by ownershipInfo.tenantId / applicationId from session (unless bypassed)
+
+ * - getOne is not filtered (direct access allowed, matching mock)
+
+ */
+export declare class VisibilityFilterMiddleware implements EntityStorageMiddleware {
+    private readonly request;
+    readonly target: {
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    constructor(request: RequestWithSession);
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private resolveUserTenantId;
+}
+export {};

package/security/src/lib/entity-storage/visibility-filter.middleware.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VisibilityFilterMiddleware = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const lodash_es_1 = require("lodash-es");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const current_session_decorator_1 = require("../session/current-session.decorator");
+//#region ---- Visibility filter middleware (server) ----
+const USER_ENTITY = 'SecurityManagement.User';
+/**
+
+ * Injects SQL/JQL-level visibility filters before query execution.
+
+ * - Hides records with stateInfo.isHidden === true (unless bypassed)
+
+ * - Scopes by ownershipInfo.tenantId / applicationId from session (unless bypassed)
+
+ * - getOne is not filtered (direct access allowed, matching mock)
+
+ */
+let VisibilityFilterMiddleware = class VisibilityFilterMiddleware {
+    constructor(request) {
+        this.request = request;
+        this.target = {
+            ops: ['query'],
+            order: 8,
+        };
+    }
+    async execute(ctx, next) {
+        if (!ctx.request) {
+            await next();
+            return;
+        }
+        const params = ctx.request.params;
+        const bypassVisibility = (0, abstract_1.isFilterBypassed)(params, abstract_1.VISIBILITY_FILTER_BYPASS) ||
+            ctx.locals.get(abstract_1.VISIBILITY_FILTER_BYPASS) === true;
+        const bypassOwnership = (0, abstract_1.isFilterBypassed)(params, abstract_1.OWNERSHIP_FILTER_BYPASS) ||
+            ctx.locals.get(abstract_1.OWNERSHIP_FILTER_BYPASS) === true;
+        if (bypassVisibility && bypassOwnership) {
+            await next();
+            return;
+        }
+        const session = this.request?.[current_session_decorator_1.CURRENT_SESSION_KEY];
+        const sessionTenantId = session?.tenantId;
+        const sessionApplicationId = session?.applicationId;
+        let effectiveTenantId = sessionTenantId;
+        if (!bypassOwnership && !effectiveTenantId && session?.userId) {
+            effectiveTenantId = await this.resolveUserTenantId(ctx, session.userId);
+        }
+        const systemFilter = (0, abstract_1.buildEntityVisibilityAxpFilter)({
+            tenantId: effectiveTenantId,
+            applicationId: sessionApplicationId,
+            bypassVisibility,
+            bypassOwnership,
+        });
+        if (systemFilter) {
+            ctx.request = {
+                ...ctx.request,
+                filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, systemFilter),
+            };
+        }
+        await next();
+    }
+    async resolveUserTenantId(ctx, userId) {
+        try {
+            const user = (await ctx.backend.getOne(USER_ENTITY, userId));
+            const tenantId = (0, lodash_es_1.get)(user, 'ownershipInfo.tenantId');
+            return typeof tenantId === 'string' && tenantId ? tenantId : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+};
+exports.VisibilityFilterMiddleware = VisibilityFilterMiddleware;
+exports.VisibilityFilterMiddleware = VisibilityFilterMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)({ scope: common_1.Scope.REQUEST }),
+    tslib_1.__param(0, (0, common_1.Inject)(core_1.REQUEST)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], VisibilityFilterMiddleware);
+//#endregion
+//# sourceMappingURL=visibility-filter.middleware.js.map

package/security/src/lib/entity-storage/visibility-filter.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility-filter.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA2D;AAE3D,uCAAuC;AAIvC,yCAAgC;AAYhC,6EAYwD;AAExD,oFAA2E;AAM3E,yDAAyD;AAIzD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAY9C;;;;;;;;;;GAUG;AAII,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAYrC,YAA6B,OAA4C;QAA3B,YAAO,GAAP,OAAO,CAAoB;QAVhE,WAAM,GAAG;YAEhB,GAAG,EAAE,CAAC,OAAO,CAAkB;YAE/B,KAAK,EAAE,CAAC;SAET,CAAC;IAI0E,CAAC;IAI7E,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAEhE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAEjB,MAAM,IAAI,EAAE,CAAC;YAEb,OAAO;QAET,CAAC;QAID,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAElC,MAAM,gBAAgB,GAEpB,IAAA,2BAAgB,EAAC,MAAM,EAAE,mCAAwB,CAAC;YAElD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAwB,CAAC,KAAK,IAAI,CAAC;QAEpD,MAAM,eAAe,GAEnB,IAAA,2BAAgB,EAAC,MAAM,EAAE,kCAAuB,CAAC;YAEjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAuB,CAAC,KAAK,IAAI,CAAC;QAInD,IAAI,gBAAgB,IAAI,eAAe,EAAE,CAAC;YAExC,MAAM,IAAI,EAAE,CAAC;YAEb,OAAO;QAET,CAAC;QAID,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,+CAAmB,CAAC,CAAC;QAEpD,MAAM,eAAe,GAAG,OAAO,EAAE,QAAQ,CAAC;QAE1C,MAAM,oBAAoB,GAAG,OAAO,EAAE,aAAa,CAAC;QAEpD,IAAI,iBAAiB,GAAG,eAAe,CAAC;QAIxC,IAAI,CAAC,eAAe,IAAI,CAAC,iBAAiB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YAE9D,iBAAiB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAE1E,CAAC;QAID,MAAM,YAAY,GAAG,IAAA,yCAA8B,EAAC;YAElD,QAAQ,EAAE,iBAAiB;YAE3B,aAAa,EAAE,oBAAoB;YAEnC,gBAAgB;YAEhB,eAAe;SAEhB,CAAC,CAAC;QAIH,IAAI,YAAY,EAAE,CAAC;YAEjB,GAAG,CAAC,OAAO,GAAG;gBAEZ,GAAG,GAAG,CAAC,OAAO;gBAEd,MAAM,EAAE,IAAA,+BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC;aAE/D,CAAC;QAEJ,CAAC;QAID,MAAM,IAAI,EAAE,CAAC;IAEf,CAAC;IAIO,KAAK,CAAC,mBAAmB,CAE/B,GAAyB,EAEzB,MAAc;QAId,IAAI,CAAC;YAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAmC,CAAC;YAE/F,MAAM,QAAQ,GAAG,IAAA,eAAG,EAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;YAErD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzE,CAAC;QAAC,MAAM,CAAC;YAEP,OAAO,SAAS,CAAC;QAEnB,CAAC;IAEH,CAAC;CAEF,CAAA;AAlIY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IActB,mBAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;;GAZjB,0BAA0B,CAkItC;AAID,YAAY"}

package/security/src/lib/security.module.d.ts

@@ -0,0 +1,8 @@
+import { MiddlewareConsumer, NestModule } from '@nestjs/common';
+/**
+ * JWT authentication and per-request session context.
+ * Routes are public by default; apply {@link JwtAuthGuard} only where auth is required.
+ */
+export declare class SecurityModule implements NestModule {
+    configure(consumer: MiddlewareConsumer): void;
+}

package/security/src/lib/security.module.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const auth_controller_1 = require("./auth/auth.controller");
+const auth_service_1 = require("./auth/auth.service");
+const jwt_auth_guard_1 = require("./auth/jwt-auth.guard");
+const policy_enforce_middleware_1 = require("./entity-storage/policy-enforce.middleware");
+const visibility_filter_middleware_1 = require("./entity-storage/visibility-filter.middleware");
+const abp_controller_1 = require("./session/abp.controller");
+const applications_controller_1 = require("./session/applications.controller");
+const backend_session_service_1 = require("./session/backend-session.service");
+const optional_jwt_session_middleware_1 = require("./session/optional-jwt-session.middleware");
+const session_context_service_1 = require("./session/session-context.service");
+const tenants_controller_1 = require("./session/tenants.controller");
+//#region ---- Platform security module ----
+/**
+ * JWT authentication and per-request session context.
+ * Routes are public by default; apply {@link JwtAuthGuard} only where auth is required.
+ */
+let SecurityModule = class SecurityModule {
+    configure(consumer) {
+        consumer.apply(optional_jwt_session_middleware_1.OptionalJwtSessionMiddleware).forRoutes('*');
+    }
+};
+exports.SecurityModule = SecurityModule;
+exports.SecurityModule = SecurityModule = tslib_1.__decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [core_1.EntityStorageModule],
+        controllers: [auth_controller_1.AuthController, tenants_controller_1.TenantsController, applications_controller_1.ApplicationsController, abp_controller_1.AbpController],
+        providers: [
+            auth_service_1.AuthService,
+            backend_session_service_1.BackendSessionService,
+            session_context_service_1.SessionContextService,
+            jwt_auth_guard_1.JwtAuthGuard,
+            optional_jwt_session_middleware_1.OptionalJwtSessionMiddleware,
+            visibility_filter_middleware_1.VisibilityFilterMiddleware,
+            policy_enforce_middleware_1.PolicyEnforceMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: visibility_filter_middleware_1.VisibilityFilterMiddleware,
+                multi: true,
+            },
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: policy_enforce_middleware_1.PolicyEnforceMiddleware,
+                multi: true,
+            },
+        ],
+        exports: [
+            auth_service_1.AuthService,
+            backend_session_service_1.BackendSessionService,
+            session_context_service_1.SessionContextService,
+            jwt_auth_guard_1.JwtAuthGuard,
+            visibility_filter_middleware_1.VisibilityFilterMiddleware,
+            policy_enforce_middleware_1.PolicyEnforceMiddleware,
+            core_1.ENTITY_STORAGE_MIDDLEWARE,
+        ],
+    })
+], SecurityModule);
+//#endregion
+//# sourceMappingURL=security.module.js.map

package/security/src/lib/security.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":";;;;AAAA,2CAA+F;AAC/F,iEAAwG;AACxG,4DAAwD;AACxD,sDAAkD;AAClD,0DAAqD;AACrD,0FAAqF;AACrF,gGAA2F;AAC3F,6DAAyD;AACzD,+EAA2E;AAC3E,+EAA0E;AAC1E,+FAAyF;AACzF,+EAA0E;AAC1E,qEAAiE;AAEjE,4CAA4C;AAE5C;;;GAGG;AAkCI,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,8DAA4B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AAJY,wCAAc;yBAAd,cAAc;IAjC1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,CAAC;QAC9B,WAAW,EAAE,CAAC,gCAAc,EAAE,sCAAiB,EAAE,gDAAsB,EAAE,8BAAa,CAAC;QACvF,SAAS,EAAE;YACT,0BAAW;YACX,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,8DAA4B;YAC5B,yDAA0B;YAC1B,mDAAuB;YACvB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,yDAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,mDAAuB;gBACpC,KAAK,EAAE,IAAI;aACA;SACd;QACD,OAAO,EAAE;YACP,0BAAW;YACX,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,yDAA0B;YAC1B,mDAAuB;YACvB,gCAAyB;SAC1B;KACF,CAAC;GACW,cAAc,CAI1B;AAED,YAAY"}

package/security/src/lib/session/abp.controller.d.ts

@@ -0,0 +1,9 @@
+import { BackendSessionService } from './backend-session.service';
+import { SessionContextService } from './session-context.service';
+import type { ApplicationConfigurationDto } from './session-context.types';
+export declare class AbpController {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    getApplicationConfiguration(): Promise<ApplicationConfigurationDto>;
+}

package/security/src/lib/session/abp.controller.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AbpController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwt_auth_guard_1 = require("../auth/jwt-auth.guard");
+const backend_session_service_1 = require("./backend-session.service");
+const session_context_service_1 = require("./session-context.service");
+//#region ---- ABP compatibility REST API ----
+let AbpController = class AbpController {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    getApplicationConfiguration() {
+        const session = this.backendSession.requireAuthenticated();
+        return this.sessionContext.getApplicationConfiguration(session.userId);
+    }
+};
+exports.AbpController = AbpController;
+tslib_1.__decorate([
+    (0, common_1.Get)('application-configuration'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, swagger_1.ApiOperation)({ summary: 'Return granted permission policies for the authenticated user' }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AbpController.prototype, "getApplicationConfiguration", null);
+exports.AbpController = AbpController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('abp'),
+    (0, common_1.Controller)('abp'),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], AbpController);
+//#endregion
+//# sourceMappingURL=abp.controller.js.map

package/security/src/lib/session/abp.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abp.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/abp.controller.ts"],"names":[],"mappings":";;;;AAAA,2CAA4D;AAC5D,6CAAuE;AACvE,2DAAsD;AACtD,uEAAkE;AAClE,uEAAkE;AAGlE,8CAA8C;AAIvC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAMJ,2BAA2B;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AAdY,sCAAa;AAUxB;IAJC,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAChC,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;;;;gEAI1F;wBAbU,aAAa;IAFzB,IAAA,iBAAO,EAAC,KAAK,CAAC;IACd,IAAA,mBAAU,EAAC,KAAK,CAAC;6CAGmB,+CAAqB;QACrB,+CAAqB;GAH7C,aAAa,CAczB;AAED,YAAY"}

package/security/src/lib/session/applications.controller.d.ts

@@ -0,0 +1,9 @@
+import { BackendSessionService } from './backend-session.service';
+import { SessionContextService } from './session-context.service';
+import type { SessionApplicationItemDto, SessionContextListResponseDto } from './session-context.types';
+export declare class ApplicationsController {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    getApplicationsForCurrentTenant(): Promise<SessionContextListResponseDto<SessionApplicationItemDto>>;
+}

package/security/src/lib/session/applications.controller.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplicationsController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwt_auth_guard_1 = require("../auth/jwt-auth.guard");
+const backend_session_service_1 = require("./backend-session.service");
+const session_context_service_1 = require("./session-context.service");
+//#region ---- Application session REST API ----
+let ApplicationsController = class ApplicationsController {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    getApplicationsForCurrentTenant() {
+        const session = this.backendSession.requireAuthenticated();
+        return this.sessionContext.getApplicationsForCurrentTenant(session.userId, session.tenantId);
+    }
+};
+exports.ApplicationsController = ApplicationsController;
+tslib_1.__decorate([
+    (0, common_1.Get)('applications-for-current-tenant'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, swagger_1.ApiOperation)({ summary: 'List applications available for the current tenant session' }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], ApplicationsController.prototype, "getApplicationsForCurrentTenant", null);
+exports.ApplicationsController = ApplicationsController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('applications'),
+    (0, common_1.Controller)('applications'),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], ApplicationsController);
+//#endregion
+//# sourceMappingURL=applications.controller.js.map

package/security/src/lib/session/applications.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/applications.controller.ts"],"names":[],"mappings":";;;;AAAA,2CAA4D;AAC5D,6CAAuE;AACvE,2DAAsD;AACtD,uEAAkE;AAClE,uEAAkE;AAGlE,gDAAgD;AAIzC,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAMJ,+BAA+B;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,cAAc,CAAC,+BAA+B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/F,CAAC;CACF,CAAA;AAdY,wDAAsB;AAUjC;IAJC,IAAA,YAAG,EAAC,iCAAiC,CAAC;IACtC,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC;;;;6EAIvF;iCAbU,sBAAsB;IAFlC,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,mBAAU,EAAC,cAAc,CAAC;6CAGU,+CAAqB;QACrB,+CAAqB;GAH7C,sBAAsB,CAclC;AAED,YAAY"}

package/security/src/lib/session/backend-session.service.d.ts

@@ -0,0 +1,21 @@
+import type { Request } from 'express';
+import type { BackendRequestSession } from './backend-session.types';
+import { CURRENT_SESSION_KEY } from './current-session.decorator';
+type RequestWithSession = Request & {
+    [CURRENT_SESSION_KEY]?: BackendRequestSession;
+};
+/**
+ * Request-scoped session read from {@link CURRENT_SESSION_KEY} set by {@link JwtAuthGuard}
+ * or {@link OptionalJwtSessionMiddleware}.
+ */
+export declare class BackendSessionService {
+    private readonly request;
+    constructor(request: RequestWithSession);
+    private resolveRequest;
+    getSession(): BackendRequestSession | null;
+    get userId(): string | undefined;
+    get tenantId(): string | undefined;
+    get applicationId(): string | undefined;
+    requireAuthenticated(): BackendRequestSession;
+}
+export {};

package/security/src/lib/session/backend-session.service.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackendSessionService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const core_2 = require("@acorex-platform/framework-server/core");
+const current_session_decorator_1 = require("./current-session.decorator");
+/**
+ * Request-scoped session read from {@link CURRENT_SESSION_KEY} set by {@link JwtAuthGuard}
+ * or {@link OptionalJwtSessionMiddleware}.
+ */
+let BackendSessionService = class BackendSessionService {
+    constructor(request) {
+        this.request = request;
+    }
+    resolveRequest() {
+        return this.request ?? (0, core_2.getEntityStorageRequest)();
+    }
+    getSession() {
+        const request = this.resolveRequest();
+        if (!request) {
+            return null;
+        }
+        return request[current_session_decorator_1.CURRENT_SESSION_KEY] ?? null;
+    }
+    get userId() {
+        return this.getSession()?.userId;
+    }
+    get tenantId() {
+        return this.getSession()?.tenantId;
+    }
+    get applicationId() {
+        return this.getSession()?.applicationId;
+    }
+    requireAuthenticated() {
+        const session = this.getSession();
+        if (!session?.userId) {
+            throw new Error('Request is not authenticated');
+        }
+        return session;
+    }
+};
+exports.BackendSessionService = BackendSessionService;
+exports.BackendSessionService = BackendSessionService = tslib_1.__decorate([
+    (0, common_1.Injectable)({ scope: common_1.Scope.REQUEST }),
+    tslib_1.__param(0, (0, common_1.Inject)(core_1.REQUEST)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], BackendSessionService);
+//#endregion
+//# sourceMappingURL=backend-session.service.js.map

package/security/src/lib/session/backend-session.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-session.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA2D;AAC3D,uCAAuC;AAEvC,iEAAiF;AAEjF,2EAAkE;AAQlE;;;GAGG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YAA8C,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAErE,cAAc;QACpB,OAAO,IAAI,CAAC,OAAO,IAAK,IAAA,8BAAuB,GAAqC,CAAC;IACvF,CAAC;IAED,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC,+CAAmB,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC;IACrC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC;IAC1C,CAAC;IAED,oBAAoB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAlCY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,mBAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;;GADjB,qBAAqB,CAkCjC;AAED,YAAY"}

package/security/src/lib/session/backend-session.types.d.ts

@@ -0,0 +1,7 @@
+/** Resolved identity for the current HTTP request (from JWT access token). */
+export interface BackendRequestSession {
+    userId: string;
+    username: string;
+    tenantId?: string;
+    applicationId?: string;
+}

package/security/src/lib/session/backend-session.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- Request session context ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=backend-session.types.js.map

package/security/src/lib/session/backend-session.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-session.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.types.ts"],"names":[],"mappings":";AAAA,2CAA2C;;AAU3C,YAAY"}

package/security/src/lib/session/current-session.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const CURRENT_SESSION_KEY = "acxRequestSession";
+export declare const CurrentSession: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/security/src/lib/session/current-session.decorator.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentSession = exports.CURRENT_SESSION_KEY = void 0;
+const common_1 = require("@nestjs/common");
+//#region ---- Current session param decorator ----
+exports.CURRENT_SESSION_KEY = 'acxRequestSession';
+exports.CurrentSession = (0, common_1.createParamDecorator)((_data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request[exports.CURRENT_SESSION_KEY];
+});
+//#endregion
+//# sourceMappingURL=current-session.decorator.js.map

package/security/src/lib/session/current-session.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-session.decorator.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/current-session.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAGxE,mDAAmD;AAEtC,QAAA,mBAAmB,GAAG,mBAAmB,CAAC;AAE1C,QAAA,cAAc,GAAG,IAAA,6BAAoB,EAChD,CAAC,KAAc,EAAE,GAAqB,EAAqC,EAAE;IAC3E,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAqD,CAAC;IACnG,OAAO,OAAO,CAAC,2BAAmB,CAAC,CAAC;AACtC,CAAC,CACF,CAAC;AAEF,YAAY"}

package/security/src/lib/session/optional-jwt-session.middleware.d.ts

@@ -0,0 +1,22 @@
+import { NestMiddleware } from '@nestjs/common';
+import type { NextFunction, Request, Response } from 'express';
+import { AuthService } from '../auth/auth.service';
+import { CURRENT_SESSION_KEY } from './current-session.decorator';
+import type { BackendRequestSession } from './backend-session.types';
+type RequestWithSession = Request & {
+    [CURRENT_SESSION_KEY]?: BackendRequestSession;
+};
+/**
+ * Populates {@link CURRENT_SESSION_KEY} when a valid Bearer token is present.
+ * Routes stay public when no token is sent (entity storage, optional auth reads).
+ * Invalid or expired tokens are ignored here so unauthenticated flows (e.g. token
+ * refresh) still work; routes needing enforcement use {@link JwtAuthGuard}.
+ */
+export declare class OptionalJwtSessionMiddleware implements NestMiddleware {
+    private readonly authService;
+    private readonly logger;
+    constructor(authService: AuthService);
+    use(req: RequestWithSession, _res: Response, next: NextFunction): void;
+    private extractBearerToken;
+}
+export {};

package/security/src/lib/session/optional-jwt-session.middleware.js

@@ -0,0 +1,59 @@
+"use strict";
+var OptionalJwtSessionMiddleware_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OptionalJwtSessionMiddleware = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const auth_service_1 = require("../auth/auth.service");
+const current_session_decorator_1 = require("./current-session.decorator");
+/**
+ * Populates {@link CURRENT_SESSION_KEY} when a valid Bearer token is present.
+ * Routes stay public when no token is sent (entity storage, optional auth reads).
+ * Invalid or expired tokens are ignored here so unauthenticated flows (e.g. token
+ * refresh) still work; routes needing enforcement use {@link JwtAuthGuard}.
+ */
+let OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware_1 = class OptionalJwtSessionMiddleware {
+    constructor(authService) {
+        this.authService = authService;
+        this.logger = new common_1.Logger(OptionalJwtSessionMiddleware_1.name);
+    }
+    use(req, _res, next) {
+        if (req[current_session_decorator_1.CURRENT_SESSION_KEY]) {
+            next();
+            return;
+        }
+        const token = this.extractBearerToken(req.headers?.authorization);
+        if (!token) {
+            next();
+            return;
+        }
+        try {
+            const payload = this.authService.verifyAccessToken(token);
+            req[current_session_decorator_1.CURRENT_SESSION_KEY] = {
+                userId: payload.sub,
+                username: payload.username,
+                tenantId: payload.tid,
+                applicationId: payload.aid,
+            };
+        }
+        catch {
+            this.logger.debug('Ignoring invalid or expired bearer token');
+        }
+        next();
+    }
+    extractBearerToken(authorization) {
+        const header = Array.isArray(authorization) ? authorization[0] : authorization;
+        if (!header?.startsWith('Bearer ')) {
+            return null;
+        }
+        const token = header.slice('Bearer '.length).trim();
+        return token.length > 0 ? token : null;
+    }
+};
+exports.OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware;
+exports.OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService])
+], OptionalJwtSessionMiddleware);
+//#endregion
+//# sourceMappingURL=optional-jwt-session.middleware.js.map

package/security/src/lib/session/optional-jwt-session.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional-jwt-session.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/optional-jwt-session.middleware.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoE;AAEpE,uDAAmD;AACnD,2EAAkE;AASlE;;;;;GAKG;AAEI,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAGvC,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;QAFpC,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;IAEhB,CAAC;IAEzD,GAAG,CAAC,GAAuB,EAAE,IAAc,EAAE,IAAkB;QAC7D,IAAI,GAAG,CAAC,+CAAmB,CAAC,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1D,GAAG,CAAC,+CAAmB,CAAC,GAAG;gBACzB,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,aAAa,EAAE,OAAO,CAAC,GAAG;aAC3B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;IAEO,kBAAkB,CAAC,aAAiC;QAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAC/E,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;CACF,CAAA;AAxCY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;6CAI+B,0BAAW;GAH1C,4BAA4B,CAwCxC;AAED,YAAY"}

package/security/src/lib/session/session-context.service.d.ts

@@ -0,0 +1,21 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import type { ApplicationConfigurationDto, SessionApplicationItemDto, SessionContextListResponseDto, SessionTenantItemDto } from './session-context.types';
+export declare class SessionContextService {
+    private readonly entityStorage;
+    constructor(entityStorage: EntityStorageMiddlewareService);
+    getAvailableTenantsForUser(userId: string): Promise<SessionContextListResponseDto<SessionTenantItemDto>>;
+    getApplicationsForCurrentTenant(userId: string, tenantId?: string): Promise<SessionContextListResponseDto<SessionApplicationItemDto>>;
+    /**
+     * Resolves which tenants to scope the application list to. The JWT always carries `userId`
+     * (`sub`), while `tid` is only present after tenant selection. To keep the result
+     * deterministic regardless of `tid`, we fall back to the user's active tenant memberships.
+     */
+    private resolveScopedTenantIds;
+    getApplicationConfiguration(userId: string): Promise<ApplicationConfigurationDto>;
+    private getUserPermissions;
+    private extractPermissions;
+    private extractRoleIds;
+    private listEntities;
+    private mapTenant;
+    private mapApplication;
+}