@acorex-platform/framework-server 0.0.15 → 0.0.20

package/jql/abstract/src/lib/entity-store/entity-access-expression.builtins.js

@@ -0,0 +1,129 @@
+"use strict";
+//#region ---- Builtin access expressions ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXP_ACCESS_BUILTIN_EXPRESSIONS = void 0;
+exports.isAccessBuiltinName = isAccessBuiltinName;
+exports.resolveAccessExpression = resolveAccessExpression;
+exports.createScopeStampForPolicy = createScopeStampForPolicy;
+/**
+ * Named predefined expressions. Policy `read` / `write` may store a builtin
+ * name or an inline expression string.
+ */
+exports.AXP_ACCESS_BUILTIN_EXPRESSIONS = {
+    'tenant-owner': 'session.tenantId == row.tenantId',
+    'app-owner': 'session.tenantId == row.tenantId && session.applicationId == row.applicationId',
+    'platform-global-read': 'true',
+    'platform-only-read': 'session.isPlatform',
+    'platform-only-write': 'session.isPlatform',
+    'platform-omniscient-read': 'session.isPlatform || session.tenantId == row.tenantId',
+    /**
+     * Platform sees all; tenants see own tenant+application rows
+     * (SystemInsight SavedView / DashboardWidgetConfig).
+     */
+    'app-omniscient-read': 'session.isPlatform || (session.tenantId == row.tenantId && session.applicationId == row.applicationId)',
+    /**
+     * Identity (User): self OR active tenant+app membership (resolved into
+     * membershipUserIds before evaluation / filter build).
+     */
+    'identity-read': 'session.userId == row.id || user.hasAppMembership()',
+    /**
+     * Identity profile write (User): platform, self, or the user's home tenant.
+     * Pair with a field-allowlist middleware — do not treat as full identity admin.
+     */
+    'identity-profile-write': 'session.isPlatform || session.userId == row.id || session.tenantId == row.homeTenantId',
+    unscoped: 'true',
+    /**
+     * Platform-global rows (no tenantId) plus tenant/app-scoped customizations.
+     * Replaces the former catalog kind filter.
+     */
+    'catalog-read': 'session.isPlatform || !row.tenantId || session.tenantId == row.tenantId',
+    'catalog-write': 'session.isPlatform || (row.tenantId && session.tenantId == row.tenantId)',
+    /**
+     * Platform-global rows (no tenantId) plus application-scoped overlays plus
+     * tenant-wide rows (tenantId set, no applicationId) for the current tenant.
+     * Not cross-tenant omniscient — e.g. Developer (platform tenant-wide) stays
+     * invisible to product tenants.
+     */
+    'app-catalog-read': '!row.tenantId || (session.tenantId == row.tenantId && session.applicationId == row.applicationId) || (row.tenantId && session.tenantId == row.tenantId && !row.applicationId)',
+    'app-catalog-write': 'session.isPlatform || (row.tenantId && session.tenantId == row.tenantId && row.applicationId && session.applicationId == row.applicationId)',
+    /**
+     * Tenant data with optional ResourceShare grants (Project).
+     */
+    'tenant-or-share-read': 'session.tenantId == row.tenantId || user.hasShare(row.id)',
+    /**
+     * ResourceShare grant rows: owner or shared-with session tenant.
+     */
+    'grant-read': 'session.tenantId == row.shareInfo.ownerTenantId || session.tenantId == row.shareInfo.sharedWithTenantId',
+    'grant-write': 'session.tenantId == row.shareInfo.ownerTenantId || session.tenantId == row.shareInfo.sharedWithTenantId',
+    /**
+     * Membership rows (TenantUser / TenantUserAppAccess): top-level tenantId;
+     * platform sessions see all.
+     */
+    'membership-read': 'session.isPlatform || session.tenantId == row.tenantId',
+    'membership-write': 'session.isPlatform || session.tenantId == row.tenantId',
+};
+function isAccessBuiltinName(value) {
+    return Object.prototype.hasOwnProperty.call(exports.AXP_ACCESS_BUILTIN_EXPRESSIONS, value);
+}
+function resolveAccessExpression(builtinOrExpression) {
+    if (isAccessBuiltinName(builtinOrExpression)) {
+        return exports.AXP_ACCESS_BUILTIN_EXPRESSIONS[builtinOrExpression];
+    }
+    return builtinOrExpression;
+}
+/** Create-stamp convention derived from the write (or read) policy token. */
+function createScopeStampForPolicy(options) {
+    const write = options.write;
+    const read = options.read;
+    if (write === 'unscoped' ||
+        read === 'unscoped' ||
+        write === 'identity-read' ||
+        read === 'identity-read' ||
+        write === 'identity-profile-write' ||
+        write === 'grant-write' ||
+        read === 'grant-read' ||
+        write === 'membership-write' ||
+        read === 'membership-read') {
+        return 'none';
+    }
+    if (write === 'app-owner' ||
+        read === 'app-owner') {
+        return 'app';
+    }
+    // Platform-only maintainers (self-policy, platform-global defs) stamp empty scope.
+    if (write === 'platform-only-write' ||
+        write === 'platform-only-read' ||
+        read === 'platform-only-read') {
+        if (read === 'platform-global-read' ||
+            read === 'platform-only-read' ||
+            read === 'catalog-read' ||
+            read === 'app-catalog-read' ||
+            write === 'catalog-write' ||
+            write === 'app-catalog-write') {
+            return 'empty';
+        }
+    }
+    if (write === 'app-catalog-write' || read === 'app-catalog-read') {
+        // Tenant sessions creating app overlays stamp app; platform creates empty
+        // platform-global rows (handled in buildCreateScopeInfo).
+        return 'app';
+    }
+    if (write === 'catalog-write' ||
+        read === 'catalog-read' ||
+        read === 'platform-global-read') {
+        // Tenant sessions creating catalog customizations stamp tenant; platform
+        // creates empty platform-global rows (handled in buildCreateScopeInfo).
+        return 'tenant';
+    }
+    if (write === 'tenant-owner' ||
+        read === 'tenant-owner' ||
+        read === 'platform-omniscient-read' ||
+        write === 'tenant-or-share-read' ||
+        read === 'tenant-or-share-read') {
+        return 'tenant';
+    }
+    // Default fail-closed convention matches default policy (tenant-owner).
+    return 'tenant';
+}
+//#endregion
+//# sourceMappingURL=entity-access-expression.builtins.js.map

package/jql/abstract/src/lib/entity-store/entity-access-expression.builtins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-expression.builtins.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-expression.builtins.ts"],"names":[],"mappings":";AAAA,8CAA8C;;;AA8E9C,kDAEC;AAED,0DAKC;AAGD,8DA0EC;AAhKD;;;GAGG;AACU,QAAA,8BAA8B,GAAG;IAC5C,cAAc,EAAE,kCAAkC;IAClD,WAAW,EACT,gFAAgF;IAClF,sBAAsB,EAAE,MAAM;IAC9B,oBAAoB,EAAE,oBAAoB;IAC1C,qBAAqB,EAAE,oBAAoB;IAC3C,0BAA0B,EACxB,wDAAwD;IAC1D;;;OAGG;IACH,qBAAqB,EACnB,wGAAwG;IAC1G;;;OAGG;IACH,eAAe,EACb,qDAAqD;IACvD;;;OAGG;IACH,wBAAwB,EACtB,wFAAwF;IAC1F,QAAQ,EAAE,MAAM;IAChB;;;OAGG;IACH,cAAc,EACZ,yEAAyE;IAC3E,eAAe,EACb,0EAA0E;IAC5E;;;;;OAKG;IACH,kBAAkB,EAChB,+KAA+K;IACjL,mBAAmB,EACjB,6IAA6I;IAC/I;;OAEG;IACH,sBAAsB,EACpB,2DAA2D;IAC7D;;OAEG;IACH,YAAY,EACV,yGAAyG;IAC3G,aAAa,EACX,yGAAyG;IAC3G;;;OAGG;IACH,iBAAiB,EACf,wDAAwD;IAC1D,kBAAkB,EAChB,wDAAwD;CAClD,CAAC;AAIX,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,sCAA8B,EAAE,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,SAAgB,uBAAuB,CAAC,mBAA2B;IACjE,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,OAAO,sCAA8B,CAAC,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,SAAgB,yBAAyB,CAAC,OAGzC;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,IACE,KAAK,KAAK,UAAU;QACpB,IAAI,KAAK,UAAU;QACnB,KAAK,KAAK,eAAe;QACzB,IAAI,KAAK,eAAe;QACxB,KAAK,KAAK,wBAAwB;QAClC,KAAK,KAAK,aAAa;QACvB,IAAI,KAAK,YAAY;QACrB,KAAK,KAAK,kBAAkB;QAC5B,IAAI,KAAK,iBAAiB,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IACE,KAAK,KAAK,WAAW;QACrB,IAAI,KAAK,WAAW,EACpB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mFAAmF;IACnF,IACE,KAAK,KAAK,qBAAqB;QAC/B,KAAK,KAAK,oBAAoB;QAC9B,IAAI,KAAK,oBAAoB,EAC7B,CAAC;QACD,IACE,IAAI,KAAK,sBAAsB;YAC/B,IAAI,KAAK,oBAAoB;YAC7B,IAAI,KAAK,cAAc;YACvB,IAAI,KAAK,kBAAkB;YAC3B,KAAK,KAAK,eAAe;YACzB,KAAK,KAAK,mBAAmB,EAC7B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,mBAAmB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACjE,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,KAAK,KAAK,eAAe;QACzB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,sBAAsB,EAC/B,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IACE,KAAK,KAAK,cAAc;QACxB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,0BAA0B;QACnC,KAAK,KAAK,sBAAsB;QAChC,IAAI,KAAK,sBAAsB,EAC/B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,wEAAwE;IACxE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-access-expression.engine.d.ts

@@ -0,0 +1,25 @@
+import type { AXPAccessEvalContext, AXPAccessRowView, AXPAccessSession } from './entity-access-policy.types';
+/**
+ * Builds the flattened row view used by expressions.
+ * Prefer scopeInfo attributes; fall back to top-level domain fields (membership, SystemInsight).
+ */
+export declare function buildAccessRowView(record: Record<string, unknown> | null | undefined): AXPAccessRowView;
+export declare function buildAccessSession(options: {
+    userId?: string;
+    tenantId?: string;
+    applicationId?: string;
+}): AXPAccessSession;
+/**
+ * Safe, limited expression evaluator for access policies.
+ * Supports: true/false, session/row paths, ==, !=, &&, ||, !, (),
+ * and helpers user.hasAppMembership() / user.inBu(x) / user.hasShare(x).
+ * Denies on parse/eval errors.
+ */
+export declare function evaluateAccessExpression(builtinOrExpression: string, ctx: AXPAccessEvalContext): boolean;
+export declare function buildDefaultAccessEvalContext(options: {
+    session: AXPAccessSession;
+    row: AXPAccessRowView;
+    membershipUserIds?: string[];
+    sharedResourceIds?: string[];
+}): AXPAccessEvalContext;
+//# sourceMappingURL=entity-access-expression.engine.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-access-expression.engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-expression.engine.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-expression.engine.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAGtC;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACjD,gBAAgB,CAoBlB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,gBAAgB,CAOnB;AAwBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,mBAAmB,EAAE,MAAM,EAC3B,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAsBT;AAyMD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,OAAO,EAAE,gBAAgB,CAAC;IAC1B,GAAG,EAAE,gBAAgB,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,GAAG,oBAAoB,CAgBvB"}

package/jql/abstract/src/lib/entity-store/entity-access-expression.engine.js

@@ -0,0 +1,284 @@
+"use strict";
+//#region ---- Access expression engine ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAccessRowView = buildAccessRowView;
+exports.buildAccessSession = buildAccessSession;
+exports.evaluateAccessExpression = evaluateAccessExpression;
+exports.buildDefaultAccessEvalContext = buildDefaultAccessEvalContext;
+const entity_access_expression_builtins_1 = require("./entity-access-expression.builtins");
+const entity_isolation_policy_1 = require("./entity-isolation-policy");
+/**
+ * Builds the flattened row view used by expressions.
+ * Prefer scopeInfo attributes; fall back to top-level domain fields (membership, SystemInsight).
+ */
+function buildAccessRowView(record) {
+    if (!record) {
+        return {};
+    }
+    const scopeInfo = record['scopeInfo'] ?? {};
+    const shareInfo = record['shareInfo'];
+    return {
+        ...record,
+        id: record['id'] != null ? String(record['id']) : undefined,
+        tenantId: (typeof scopeInfo['tenantId'] === 'string' && scopeInfo['tenantId']) ||
+            (typeof record['tenantId'] === 'string' ? record['tenantId'] : undefined),
+        applicationId: (typeof scopeInfo['applicationId'] === 'string' && scopeInfo['applicationId']) ||
+            (typeof record['applicationId'] === 'string' ? record['applicationId'] : undefined),
+        buId: (typeof scopeInfo['buId'] === 'string' && scopeInfo['buId']) ||
+            (typeof record['buId'] === 'string' ? record['buId'] : undefined),
+        shareInfo: shareInfo && typeof shareInfo === 'object' ? shareInfo : undefined,
+    };
+}
+function buildAccessSession(options) {
+    return {
+        userId: options.userId,
+        tenantId: options.tenantId,
+        applicationId: options.applicationId,
+        isPlatform: (0, entity_isolation_policy_1.isPlatformSessionTenant)(options.tenantId),
+    };
+}
+function readPath(root, path) {
+    const parts = path.split('.');
+    let cur = root;
+    for (const part of parts) {
+        if (cur == null || typeof cur !== 'object') {
+            return undefined;
+        }
+        cur = cur[part];
+    }
+    return cur;
+}
+function normalizeComparable(value) {
+    if (value === null || value === undefined || value === '') {
+        return undefined;
+    }
+    if (typeof value === 'boolean' || typeof value === 'number') {
+        return value;
+    }
+    return String(value);
+}
+/**
+ * Safe, limited expression evaluator for access policies.
+ * Supports: true/false, session/row paths, ==, !=, &&, ||, !, (),
+ * and helpers user.hasAppMembership() / user.inBu(x) / user.hasShare(x).
+ * Denies on parse/eval errors.
+ */
+function evaluateAccessExpression(builtinOrExpression, ctx) {
+    const expression = (0, entity_access_expression_builtins_1.resolveAccessExpression)(builtinOrExpression).trim();
+    if (!expression) {
+        return false;
+    }
+    if (expression === 'true') {
+        return true;
+    }
+    if (expression === 'false') {
+        return false;
+    }
+    // Unresolved kebab builtin names (e.g. stale webpack copy missing a map entry)
+    // must not be parsed as expressions — hyphens break the tokenizer and deny closed.
+    if (/^[a-z][a-z0-9]*(-[a-z0-9]+)+$/.test(expression)) {
+        return false;
+    }
+    try {
+        return evalBoolean(expression, ctx);
+    }
+    catch {
+        return false;
+    }
+}
+function evalBoolean(expression, ctx) {
+    // Tokenize a minimal boolean grammar.
+    const tokens = tokenize(expression);
+    let i = 0;
+    const peek = () => tokens[i];
+    const consume = () => tokens[i++];
+    const parsePrimary = () => {
+        const t = peek();
+        if (!t) {
+            throw new Error('unexpected end');
+        }
+        if (t === 'true') {
+            consume();
+            return true;
+        }
+        if (t === 'false') {
+            consume();
+            return false;
+        }
+        if (t === '!') {
+            consume();
+            return !parsePrimary();
+        }
+        if (t === '(') {
+            consume();
+            const inner = parseOr();
+            if (consume() !== ')') {
+                throw new Error('expected )');
+            }
+            return inner;
+        }
+        // path == path | path != path | helper()
+        if (t.startsWith('user.')) {
+            return parseHelper();
+        }
+        const leftTok = consume();
+        const op = peek();
+        if (op === '==' || op === '!=') {
+            consume();
+            const rightTok = consume();
+            const left = resolveToken(leftTok, ctx);
+            const right = resolveToken(rightTok, ctx);
+            const eq = normalizeComparable(left) === normalizeComparable(right);
+            return op === '==' ? eq : !eq;
+        }
+        // Bare path / helper treated as truthiness
+        const value = resolveToken(leftTok, ctx);
+        return !!normalizeComparable(value);
+    };
+    const parseHelper = () => {
+        const name = consume(); // user.hasAppMembership / user.inBu / user.hasShare
+        if (consume() !== '(') {
+            throw new Error('expected (');
+        }
+        const args = [];
+        if (peek() !== ')') {
+            args.push(consume());
+            while (peek() === ',') {
+                consume();
+                args.push(consume());
+            }
+        }
+        if (consume() !== ')') {
+            throw new Error('expected )');
+        }
+        if (name === 'user.hasAppMembership') {
+            return ctx.user.hasAppMembership();
+        }
+        if (name === 'user.inBu') {
+            const bu = args[0] ? resolveToken(args[0], ctx) : undefined;
+            return ctx.user.inBu(typeof bu === 'string' || bu === undefined ? bu : String(bu));
+        }
+        if (name === 'user.hasShare') {
+            const id = args[0] ? resolveToken(args[0], ctx) : undefined;
+            return ctx.user.hasShare(id == null ? undefined : String(id));
+        }
+        throw new Error(`unknown helper ${name}`);
+    };
+    const parseAnd = () => {
+        let value = parsePrimary();
+        while (peek() === '&&') {
+            consume();
+            const right = parsePrimary();
+            value = value && right;
+        }
+        return value;
+    };
+    const parseOr = () => {
+        let value = parseAnd();
+        while (peek() === '||') {
+            consume();
+            const right = parseAnd();
+            value = value || right;
+        }
+        return value;
+    };
+    const result = parseOr();
+    if (i !== tokens.length) {
+        throw new Error('trailing tokens');
+    }
+    return result;
+}
+function resolveToken(token, ctx) {
+    if (token === 'true') {
+        return true;
+    }
+    if (token === 'false') {
+        return false;
+    }
+    if ((token.startsWith('"') && token.endsWith('"')) ||
+        (token.startsWith("'") && token.endsWith("'"))) {
+        return token.slice(1, -1);
+    }
+    if (token.startsWith('session.')) {
+        return readPath(ctx.session, token.slice('session.'.length));
+    }
+    if (token.startsWith('row.')) {
+        return readPath(ctx.row, token.slice('row.'.length));
+    }
+    // Bare identifiers are invalid
+    throw new Error(`unresolved token ${token}`);
+}
+function tokenize(expression) {
+    const tokens = [];
+    let i = 0;
+    while (i < expression.length) {
+        const ch = expression[i];
+        if (/\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        if (expression.startsWith('&&', i)) {
+            tokens.push('&&');
+            i += 2;
+            continue;
+        }
+        if (expression.startsWith('||', i)) {
+            tokens.push('||');
+            i += 2;
+            continue;
+        }
+        if (expression.startsWith('==', i)) {
+            tokens.push('==');
+            i += 2;
+            continue;
+        }
+        if (expression.startsWith('!=', i)) {
+            tokens.push('!=');
+            i += 2;
+            continue;
+        }
+        if (ch === '!' || ch === '(' || ch === ')' || ch === ',') {
+            tokens.push(ch);
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            const quote = ch;
+            let j = i + 1;
+            while (j < expression.length && expression[j] !== quote) {
+                j++;
+            }
+            tokens.push(expression.slice(i, j + 1));
+            i = j + 1;
+            continue;
+        }
+        // identifier / path / helper name / true|false
+        let j = i;
+        while (j < expression.length && /[A-Za-z0-9_$.]/.test(expression[j])) {
+            j++;
+        }
+        if (j === i) {
+            throw new Error(`bad char ${ch}`);
+        }
+        tokens.push(expression.slice(i, j));
+        i = j;
+    }
+    return tokens;
+}
+function buildDefaultAccessEvalContext(options) {
+    const membershipUserIds = options.membershipUserIds ?? [];
+    const sharedResourceIds = options.sharedResourceIds ?? [];
+    return {
+        session: options.session,
+        row: options.row,
+        membershipUserIds,
+        sharedResourceIds,
+        user: {
+            hasAppMembership: () => !!options.row.id && membershipUserIds.includes(String(options.row.id)),
+            inBu: (_buId) => false,
+            hasShare: (resourceId) => !!resourceId && sharedResourceIds.includes(resourceId),
+        },
+    };
+}
+//#endregion
+//# sourceMappingURL=entity-access-expression.engine.js.map

package/jql/abstract/src/lib/entity-store/entity-access-expression.engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-expression.engine.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-expression.engine.ts"],"names":[],"mappings":";AAAA,4CAA4C;;AAc5C,gDAsBC;AAED,gDAWC;AA8BD,4DAyBC;AAyMD,sEAqBC;AApUD,2FAA8E;AAM9E,uEAAoE;AAEpE;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,MAAkD;IAElD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,SAAS,GAAI,MAAM,CAAC,WAAW,CAAyC,IAAI,EAAE,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,MAAM;QACT,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,QAAQ,EACN,CAAC,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;YACpE,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,aAAa,EACX,CAAC,OAAO,SAAS,CAAC,eAAe,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,eAAe,CAAC,CAAC;YAC9E,CAAC,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,EACF,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,SAAS,EAAE,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAC9E,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAIlC;IACC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,UAAU,EAAE,IAAA,iDAAuB,EAAC,OAAO,CAAC,QAAQ,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAY,IAAI,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CACtC,mBAA2B,EAC3B,GAAyB;IAEzB,MAAM,UAAU,GAAG,IAAA,2DAAuB,EAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,GAAyB;IAChE,sCAAsC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAElC,MAAM,YAAY,GAAG,GAAY,EAAE;QACjC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;QAClB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,GACN,mBAAmB,CAAC,IAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,2CAA2C;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAY,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,CAAC,oDAAoD;QAC5E,IAAI,OAAO,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrB,OAAO,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAClB,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAE,EAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CACtB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CACpC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAY,EAAE;QAC7B,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;QAC3B,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAY,EAAE;QAC5B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACvB,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,GAAyB;IAC5D,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,+BAA+B;IAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBACxD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,CAAC,EAAE,CAAC;QACN,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,GAAG,CAAC,CAAC;IACR,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,6BAA6B,CAAC,OAK7C;IACC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,iBAAiB;QACjB,iBAAiB;QACjB,IAAI,EAAE;YACJ,gBAAgB,EAAE,GAAG,EAAE,CACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACtB,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE,CACvB,CAAC,CAAC,UAAU,IAAI,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC;SACzD;KACF,CAAC;AACJ,CAAC;AAED,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.d.ts

@@ -0,0 +1,12 @@
+import type { AXPEntityAccessPolicyRecord } from './entity-access-policy.types';
+export declare const ENTITY_ACCESS_POLICY_ENTITY = "PlatformManagement.EntityAccessPolicy";
+export declare function setEntityAccessPolicyCache(policies: readonly AXPEntityAccessPolicyRecord[]): void;
+export declare function clearEntityAccessPolicyCache(): void;
+export declare function isEntityAccessPolicyCacheLoaded(): boolean;
+export declare function getEntityAccessPolicyCache(): readonly AXPEntityAccessPolicyRecord[];
+/**
+ * Match order: exact entityName → longest wildcard pattern → `*` → code fallback.
+ */
+export declare function resolveEntityAccessPolicy(entityName: string): AXPEntityAccessPolicyRecord;
+export declare function entityMatchesPattern(entityName: string, pattern: string): boolean;
+//# sourceMappingURL=entity-access-policy.cache.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.cache.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.cache.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF,eAAO,MAAM,2BAA2B,0CAA0C,CAAC;AA4BnF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,GAC/C,IAAI,CAaN;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAInD;AAED,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED,wBAAgB,0BAA0B,IAAI,SAAS,2BAA2B,EAAE,CAEnF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,GACjB,2BAA2B,CA0B7B;AAOD,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAYjF"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.js

@@ -0,0 +1,97 @@
+"use strict";
+//#region ---- Entity access policy cache ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTITY_ACCESS_POLICY_ENTITY = void 0;
+exports.setEntityAccessPolicyCache = setEntityAccessPolicyCache;
+exports.clearEntityAccessPolicyCache = clearEntityAccessPolicyCache;
+exports.isEntityAccessPolicyCacheLoaded = isEntityAccessPolicyCacheLoaded;
+exports.getEntityAccessPolicyCache = getEntityAccessPolicyCache;
+exports.resolveEntityAccessPolicy = resolveEntityAccessPolicy;
+exports.entityMatchesPattern = entityMatchesPattern;
+exports.ENTITY_ACCESS_POLICY_ENTITY = 'PlatformManagement.EntityAccessPolicy';
+const DEFAULT_FALLBACK_POLICY = {
+    id: '__fallback-tenant-owner__',
+    entityName: '*',
+    read: 'tenant-owner',
+    write: 'tenant-owner',
+    enabled: true,
+    description: 'Fail-closed code fallback when no policy row is seeded.',
+};
+const GLOBAL_KEY = '__AXP_ENTITY_ACCESS_POLICY_CACHE__';
+function cacheState() {
+    const g = globalThis;
+    if (!g[GLOBAL_KEY]) {
+        g[GLOBAL_KEY] = { cachedPolicies: [], loaded: false };
+    }
+    return g[GLOBAL_KEY];
+}
+function setEntityAccessPolicyCache(policies) {
+    const state = cacheState();
+    state.cachedPolicies = policies
+        .filter((p) => p && p.enabled !== false && typeof p.entityName === 'string' && !!p.entityName)
+        .map((p) => ({
+        id: String(p.id),
+        entityName: p.entityName,
+        read: p.read || 'tenant-owner',
+        write: p.write || 'tenant-owner',
+        enabled: p.enabled !== false,
+        description: p.description,
+    }));
+    state.loaded = true;
+}
+function clearEntityAccessPolicyCache() {
+    const state = cacheState();
+    state.cachedPolicies = [];
+    state.loaded = false;
+}
+function isEntityAccessPolicyCacheLoaded() {
+    return cacheState().loaded;
+}
+function getEntityAccessPolicyCache() {
+    return cacheState().cachedPolicies;
+}
+/**
+ * Match order: exact entityName → longest wildcard pattern → `*` → code fallback.
+ */
+function resolveEntityAccessPolicy(entityName) {
+    const cachedPolicies = cacheState().cachedPolicies;
+    const exact = cachedPolicies.find((p) => p.entityName === entityName);
+    if (exact) {
+        return exact;
+    }
+    const patterns = cachedPolicies
+        .filter((p) => p.entityName.includes('*') && p.entityName !== '*')
+        .map((p) => ({
+        policy: p,
+        rank: patternRank(p.entityName),
+    }))
+        .filter((x) => entityMatchesPattern(entityName, x.policy.entityName))
+        .sort((a, b) => b.rank - a.rank);
+    if (patterns.length) {
+        return patterns[0].policy;
+    }
+    const star = cachedPolicies.find((p) => p.entityName === '*');
+    if (star) {
+        return star;
+    }
+    return DEFAULT_FALLBACK_POLICY;
+}
+function patternRank(pattern) {
+    // Longer / more specific patterns win (SystemInsight.* before *).
+    return pattern.replace(/\*/g, '').length;
+}
+function entityMatchesPattern(entityName, pattern) {
+    if (pattern === '*') {
+        return true;
+    }
+    if (!pattern.includes('*')) {
+        return entityName === pattern;
+    }
+    // Support prefix.* and exact-ish globs with a single trailing/segment wildcard.
+    const escaped = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*/g, '.*');
+    return new RegExp(`^${escaped}$`).test(entityName);
+}
+//#endregion
+//# sourceMappingURL=entity-access-policy.cache.js.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.cache.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.cache.ts"],"names":[],"mappings":";AAAA,8CAA8C;;;AAgC9C,gEAeC;AAED,oEAIC;AAED,0EAEC;AAED,gEAEC;AAKD,8DA4BC;AAOD,oDAYC;AA7GY,QAAA,2BAA2B,GAAG,uCAAuC,CAAC;AAEnF,MAAM,uBAAuB,GAAgC;IAC3D,EAAE,EAAE,2BAA2B;IAC/B,UAAU,EAAE,GAAG;IACf,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,yDAAyD;CACvE,CAAC;AAOF,MAAM,UAAU,GAAG,oCAAoC,CAAC;AAExD,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAE,CAAC;AACxB,CAAC;AAED,SAAgB,0BAA0B,CACxC,QAAgD;IAEhD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,KAAK,CAAC,cAAc,GAAG,QAAQ;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;SAC7F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,cAAc;QAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,cAAc;QAChC,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK;QAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CAAC;IACN,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,SAAgB,4BAA4B;IAC1C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;IAC1B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAgB,+BAA+B;IAC7C,OAAO,UAAU,EAAE,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,SAAgB,0BAA0B;IACxC,OAAO,UAAU,EAAE,CAAC,cAAc,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CACvC,UAAkB;IAElB,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC,cAAc,CAAC;IACnD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IACtE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;KAChC,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;SACpE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAC9D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,kEAAkE;IAClE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED,SAAgB,oBAAoB,CAAC,UAAkB,EAAE,OAAe;IACtE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,KAAK,OAAO,CAAC;IAChC,CAAC;IACD,gFAAgF;IAChF,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.d.ts

@@ -0,0 +1,44 @@
+/** Stored policy row shape (PlatformManagement.EntityAccessPolicy). */
+export interface AXPEntityAccessPolicyRecord {
+    id: string;
+    /** Exact name or pattern: `ReportManagement.Report` | `SystemInsight.*` | `*`. */
+    entityName: string;
+    /** Builtin name or inline expression. */
+    read: string;
+    /** Builtin name or inline expression. */
+    write: string;
+    enabled?: boolean;
+    description?: string;
+}
+export interface AXPAccessSession {
+    userId?: string;
+    tenantId?: string;
+    applicationId?: string;
+    isPlatform: boolean;
+}
+/** Flattened row view for expression evaluation. */
+export interface AXPAccessRowView {
+    id?: string;
+    tenantId?: string;
+    applicationId?: string;
+    buId?: string;
+    [key: string]: unknown;
+}
+export interface AXPAccessEvalContext {
+    session: AXPAccessSession;
+    row: AXPAccessRowView;
+    /** Pre-resolved identity-read membership user ids. */
+    membershipUserIds?: string[];
+    /** Pre-resolved ResourceShare resource ids. */
+    sharedResourceIds?: string[];
+    /** Helpers (sync predicates for record checks). */
+    user: {
+        hasAppMembership: () => boolean;
+        inBu: (buId: string | undefined) => boolean;
+        hasShare: (resourceId: string | undefined) => boolean;
+    };
+}
+export type AXPAccessMode = 'read' | 'write';
+/** How create middleware should stamp scopeInfo. */
+export type AXPCreateScopeStamp = 'empty' | 'tenant' | 'app' | 'none';
+//# sourceMappingURL=entity-access-policy.types.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.types.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.types.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,GAAG,EAAE,gBAAgB,CAAC;IACtB,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,mDAAmD;IACnD,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;QAC5C,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;KACvD,CAAC;CACH;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7C,oDAAoD;AACpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- Entity access policy types ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=entity-access-policy.types.js.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.types.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.types.ts"],"names":[],"mappings":";AAAA,8CAA8C;;AAmD9C,YAAY"}