@acorex-platform/framework-server 0.0.15 → 0.0.20

package/security/src/lib/entity-storage/entity-access-policy.loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.loader.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/entity-access-policy.loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAWxF;;;GAGG;AACH,qBACa,wBAAyB,YAAW,YAAY;IAG/C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAEvC,aAAa,EAAE,8BAA8B;IAEpE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B9B"}

package/security/src/lib/entity-storage/entity-access-policy.loader.js

@@ -0,0 +1,56 @@
+"use strict";
+var EntityAccessPolicyLoader_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityAccessPolicyLoader = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+//#region ---- Entity access policy cache loader ----
+/**
+ * Loads PlatformManagement.EntityAccessPolicy into the in-memory cache at boot.
+ * Uses server-only scope bypass so the self-policy row does not block the load.
+ */
+let EntityAccessPolicyLoader = EntityAccessPolicyLoader_1 = class EntityAccessPolicyLoader {
+    constructor(entityStorage) {
+        this.entityStorage = entityStorage;
+        this.logger = new common_1.Logger(EntityAccessPolicyLoader_1.name);
+    }
+    async onModuleInit() {
+        await this.reload();
+        // Schemas often register after Nest OnModuleInit — retry like PlatformScopeBootstrap.
+        setTimeout(() => {
+            void this.reload();
+        }, 3000);
+    }
+    async reload() {
+        try {
+            const result = await this.entityStorage.query(abstract_1.ENTITY_ACCESS_POLICY_ENTITY, {
+                skip: 0,
+                take: 10_000,
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const items = (result?.items ?? []);
+            if (!items.length) {
+                this.logger.warn('Entity access policy query returned 0 rows — keeping existing cache');
+                return;
+            }
+            (0, abstract_1.setEntityAccessPolicyCache)(items);
+            this.logger.log(`Loaded ${items.length} entity access policies`);
+        }
+        catch (error) {
+            // Expected before first seed / schema registration — fail-closed fallback applies.
+            this.logger.warn(`Entity access policy cache not loaded yet: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+};
+exports.EntityAccessPolicyLoader = EntityAccessPolicyLoader;
+exports.EntityAccessPolicyLoader = EntityAccessPolicyLoader = EntityAccessPolicyLoader_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], EntityAccessPolicyLoader);
+//#endregion
+//# sourceMappingURL=entity-access-policy.loader.js.map

package/security/src/lib/entity-storage/entity-access-policy.loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.loader.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/entity-access-policy.loader.ts"],"names":[],"mappings":";;;;;AAAA,2CAAkE;AAClE,iEAAwF;AACxF,6EAMwD;AAExD,qDAAqD;AAErD;;;GAGG;AAEI,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAES,CAAC;IAE9E,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,sFAAsF;QACtF,UAAU,CAAC,GAAG,EAAE;YACd,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,sCAA2B,EAAE;gBACzE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,CAAC,8BAAmB,CAAC,EAAE,IAAI;oBAC3B,CAAC,mCAAwB,CAAC,EAAE,IAAI;iBACjC;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAkC,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,IAAA,qCAA0B,EAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,yBAAyB,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAvCY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,wBAAwB,CAuCpC;AAED,YAAY"}

package/security/src/lib/entity-storage/policy-enforce.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-enforce.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAOhD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAC9B,CAAC,CAAC;CACJ;AAuBD,qBACa,uBAAwB,YAAW,uBAAuB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,QAAQ,CAAC,MAAM;aAC6C,WAAW,EAAE;;MAEvE;IAEI,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqJlF,OAAO,CAAC,YAAY;YA4BN,YAAY;CAuB3B"}
+{"version":3,"file":"policy-enforce.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAOhD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAC9B,CAAC,CAAC;CACJ;AAuBD,qBACa,uBAAwB,YAAW,uBAAuB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,QAAQ,CAAC,MAAM;aAC6C,WAAW,EAAE;;MAEvE;IAEI,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA6JlF,OAAO,CAAC,YAAY;YA4BN,YAAY;CAuB3B"}

package/security/src/lib/entity-storage/policy-enforce.middleware.js

@@ -103,7 +103,11 @@ let PolicyEnforceMiddleware = class PolicyEnforceMiddleware {
             if (ctx.data && typeof ctx.data === 'object') {
                 const data = ctx.data;
                 if (immutableTargets.includes('*')) {
-                    throw new core_1.MiddlewareAbortError('Update forbidden by policy: Record is marked as system and cannot be modified', { status: 409, code: 'POLICY_IMMUTABLE_RECORD', details: { entity: ctx.entityName, id: ctx.id } });
+                    throw new core_1.MiddlewareAbortError('This record is marked as system and cannot be modified.', {
+                        status: 409,
+                        code: 'POLICY_IMMUTABLE_RECORD',
+                        details: { entity: ctx.entityName, id: ctx.id, operation: 'update' },
+                    });
                 }
                 const forbiddenPaths = [];
                 const addForbidden = (targets) => {
@@ -133,7 +137,11 @@ let PolicyEnforceMiddleware = class PolicyEnforceMiddleware {
             ({ readonlyTargets, immutableTargets, hiddenTargets, maskedTargets, editableTargets } =
                 deriveTargets(activeRules));
             if (immutableTargets.includes('*')) {
-                throw new core_1.MiddlewareAbortError('Delete forbidden by policy: Record is marked as system and cannot be deleted', { status: 409, code: 'POLICY_IMMUTABLE_RECORD', details: { entity: ctx.entityName, id: ctx.id } });
+                throw new core_1.MiddlewareAbortError('This record is marked as system and cannot be deleted.', {
+                    status: 409,
+                    code: 'POLICY_IMMUTABLE_RECORD',
+                    details: { entity: ctx.entityName, id: ctx.id, operation: 'delete' },
+                });
             }
         }
         await next();

package/security/src/lib/entity-storage/policy-enforce.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-enforce.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA8E;AAM9E,6EAAuF;AACvF,yFAAgF;AAChF,2DAAgF;AAmBhF,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,IAAI,WAAW,GAAgE,IAAI,CAAC;AACpF,IAAI,iBAAiB,GAAwC,IAAI,CAAC;AAElE,YAAY;AAEZ,6CAA6C;AAE7C,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,MAAoB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QACY,cAAS,GAAG,IAAI,6DAA0B,EAAE,CAAC;QAErD,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAkB;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;IA0MJ,CAAC;IAxMC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAuB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,gBAAgB,GAAa,EAAE,CAAC;QACpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,SAAoD,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,SAAS,EAAE,QAAQ;gBAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM;gBACvC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;aACxE;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA8B,EAA+B,EAAE;YAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBACrE,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;4BACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC;YACpD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;YAClD,gBAAgB,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/F,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;gBACjD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,2BAAoB,CAC5B,+EAA+E,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,CAAC,OAAiB,EAAE,EAAE;oBACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACzB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC9B,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,IAAA,sCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAoB,CAC5B,8EAA8E,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,MAAM,mBAAmB,GAAG,CAAC,GAA4B,EAAE,EAAE;gBAC3D,IAAA,sCAAkB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACvC,IAAA,yCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAA+C,CAAC;gBACnE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,mBAAmB,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,GAAyB,EAAE,QAAkB;QAC7E,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE;YACxD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAK,OAAkB,EAAE,CAAC;oBAC1E,OAAQ,OAAmC,CAAC,IAAI,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAwB,CAAC;oBACxD,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;CACF,CAAA;AAhNY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CAgNnC;AAED,YAAY"}
+{"version":3,"file":"policy-enforce.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA8E;AAM9E,6EAAuF;AACvF,yFAAgF;AAChF,2DAAgF;AAmBhF,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,IAAI,WAAW,GAAgE,IAAI,CAAC;AACpF,IAAI,iBAAiB,GAAwC,IAAI,CAAC;AAElE,YAAY;AAEZ,6CAA6C;AAE7C,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,MAAoB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QACY,cAAS,GAAG,IAAI,6DAA0B,EAAE,CAAC;QAErD,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAkB;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;IAkNJ,CAAC;IAhNC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAuB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,gBAAgB,GAAa,EAAE,CAAC;QACpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,SAAoD,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,SAAS,EAAE,QAAQ;gBAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM;gBACvC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;aACxE;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA8B,EAA+B,EAAE;YAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBACrE,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;4BACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC;YACpD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;YAClD,gBAAgB,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/F,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;gBACjD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,2BAAoB,CAC5B,yDAAyD,EACzD;wBACE,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,yBAAyB;wBAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;qBACrE,CACF,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,CAAC,OAAiB,EAAE,EAAE;oBACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACzB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC9B,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,IAAA,sCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAoB,CAC5B,wDAAwD,EACxD;oBACE,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;iBACrE,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,MAAM,mBAAmB,GAAG,CAAC,GAA4B,EAAE,EAAE;gBAC3D,IAAA,sCAAkB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACvC,IAAA,yCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAA+C,CAAC;gBACnE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,mBAAmB,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,GAAyB,EAAE,QAAkB;QAC7E,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE;YACxD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAK,OAAkB,EAAE,CAAC;oBAC1E,OAAQ,OAAmC,CAAC,IAAI,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAwB,CAAC;oBACxD,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;CACF,CAAA;AAxNY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CAwNnC;AAED,YAAY"}

package/security/src/lib/entity-storage/policy-expression-evaluator.util.d.ts

@@ -1,8 +1,10 @@
 export type BackendExpressionScope = Record<string, unknown>;
+/**
+ * Minimal server-side expression evaluator for policy conditions (`{{ ... }}` templates).
+ * Delegates to the shared {@link ExpressionEvaluatorEngine}.
+ */
 export declare class BackendExpressionEvaluator {
-    private readonly expressionCache;
-    private getOrCompileFunction;
+    private readonly engine;
     evaluate(source: unknown, scope?: BackendExpressionScope): Promise<unknown>;
-    private evaluateStringExpression;
 }
 //# sourceMappingURL=policy-expression-evaluator.util.d.ts.map

package/security/src/lib/entity-storage/policy-expression-evaluator.util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-expression-evaluator.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-expression-evaluator.util.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7D,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAE/D,OAAO,CAAC,oBAAoB;IAWtB,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,GAAE,sBAA2B,GAAG,OAAO,CAAC,OAAO,CAAC;YAwBvE,wBAAwB;CAmCvC"}
+{"version":3,"file":"policy-expression-evaluator.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-expression-evaluator.util.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7D;;;GAGG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAEpD,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,GAAE,sBAA2B,GAAG,OAAO,CAAC,OAAO,CAAC;CAGtF"}

package/security/src/lib/entity-storage/policy-expression-evaluator.util.js

@@ -1,68 +1,17 @@
 "use strict";
-//#region ---- Backend expression evaluator ----
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BackendExpressionEvaluator = void 0;
+const core_1 = require("@acorex-platform/framework-shared/core");
+/**
+ * Minimal server-side expression evaluator for policy conditions (`{{ ... }}` templates).
+ * Delegates to the shared {@link ExpressionEvaluatorEngine}.
+ */
 class BackendExpressionEvaluator {
     constructor() {
-        this.expressionCache = new Map();
-    }
-    getOrCompileFunction(expression) {
-        if (!this.expressionCache.has(expression)) {
-            const hasMultipleStatements = expression.includes(';') || expression.includes('\n');
-            const fn = hasMultipleStatements
-                ? new Function('scope', `with (scope) { return (async function() { ${expression} })(); }`)
-                : new Function('scope', `with (scope) { return (async function() { return ${expression}; })(); }`);
-            this.expressionCache.set(expression, fn);
-        }
-        return this.expressionCache.get(expression);
+        this.engine = new core_1.ExpressionEvaluatorEngine();
     }
     async evaluate(source, scope = {}) {
-        try {
-            if (typeof source === 'string' && source.includes('{{')) {
-                return await this.evaluateStringExpression(source, scope);
-            }
-            if (Array.isArray(source)) {
-                return Promise.all(source.map((item) => this.evaluate(item, scope)));
-            }
-            if (typeof source === 'object' && source !== null) {
-                const evaluatedObject = {};
-                for (const key of Object.keys(source)) {
-                    evaluatedObject[key] = await this.evaluate(source[key], scope);
-                }
-                return evaluatedObject;
-            }
-            return source;
-        }
-        catch {
-            return false;
-        }
-    }
-    async evaluateStringExpression(templateExpression, scope) {
-        const exactMatch = templateExpression.match(/^\s*\{\{\s*([\s\S]*?)\s*\}\}\s*$/);
-        if (exactMatch) {
-            const sandbox = this.getOrCompileFunction(exactMatch[1]);
-            return sandbox(scope);
-        }
-        const regex = /\{\{\s*([\s\S]*?)\s*\}\}/g;
-        const matches = [];
-        let match;
-        while ((match = regex.exec(templateExpression)) !== null) {
-            matches.push({ expression: match[1], start: match.index, end: regex.lastIndex });
-        }
-        const values = await Promise.all(matches.map((m) => {
-            const sandbox = this.getOrCompileFunction(m.expression);
-            return sandbox(scope);
-        }));
-        let result = '';
-        let lastIndex = 0;
-        matches.forEach((m, i) => {
-            result += templateExpression.slice(lastIndex, m.start);
-            const value = values[i];
-            result += value !== undefined && value !== null ? String(value) : '';
-            lastIndex = m.end;
-        });
-        result += templateExpression.slice(lastIndex);
-        return result;
+        return this.engine.evaluate(source, scope, { swallowErrors: true });
     }
 }
 exports.BackendExpressionEvaluator = BackendExpressionEvaluator;

package/security/src/lib/entity-storage/policy-expression-evaluator.util.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-expression-evaluator.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-expression-evaluator.util.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AAIhD,MAAa,0BAA0B;IAAvC;QACmB,oBAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;IAwEjE,CAAC;IAtES,oBAAoB,CAAC,UAAkB;QAC7C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,qBAAqB,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,qBAAqB;gBAC9B,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,6CAA6C,UAAU,UAAU,CAAC;gBAC1F,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,oDAAoD,UAAU,WAAW,CAAC,CAAC;YACrG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAe,EAAE,QAAgC,EAAE;QAChE,IAAI,CAAC;YACH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,eAAe,GAA4B,EAAE,CAAC;gBACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,EAAE,CAAC;oBACjE,eAAe,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CACvC,MAAkC,CAAC,GAAG,CAAC,EACxC,KAAK,CACN,CAAC;gBACJ,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,kBAA0B,EAC1B,KAA6B;QAE7B,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,KAAK,GAAG,2BAA2B,CAAC;QAC1C,MAAM,OAAO,GAA8D,EAAE,CAAC;QAC9E,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACxD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAzED,gEAyEC;AAED,YAAY"}
+{"version":3,"file":"policy-expression-evaluator.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-expression-evaluator.util.ts"],"names":[],"mappings":";;;AAAA,iEAAmF;AAMnF;;;GAGG;AACH,MAAa,0BAA0B;IAAvC;QACmB,WAAM,GAAG,IAAI,gCAAyB,EAAE,CAAC;IAK5D,CAAC;IAHC,KAAK,CAAC,QAAQ,CAAC,MAAe,EAAE,QAAgC,EAAE;QAChE,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;CACF;AAND,gEAMC;AAED,YAAY"}

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.d.ts

@@ -0,0 +1,16 @@
+import { OnModuleInit } from '@nestjs/common';
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { PolicyEnforceMiddleware } from './policy-enforce.middleware';
+import { VisibilityFilterMiddleware } from './visibility-filter.middleware';
+/**
+ * Ensures security entity-storage middlewares join the server pipeline.
+ * Mirrors domain/document-management bootstrap when webpack splits duplicate middleware tokens.
+ */
+export declare class SecurityEntityStorageBootstrap implements OnModuleInit {
+    private readonly storage;
+    private readonly visibilityFilter;
+    private readonly policyEnforce;
+    constructor(storage: EntityStorageMiddlewareService, visibilityFilter: VisibilityFilterMiddleware, policyEnforce: PolicyEnforceMiddleware);
+    onModuleInit(): void;
+}
+//# sourceMappingURL=security-entity-storage.bootstrap.d.ts.map

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-entity-storage.bootstrap.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/security-entity-storage.bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAI5E;;;GAGG;AACH,qBACa,8BAA+B,YAAW,YAAY;IAE/D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,OAAO,EAAE,8BAA8B,EACvC,gBAAgB,EAAE,0BAA0B,EAC5C,aAAa,EAAE,uBAAuB;IAGzD,YAAY,IAAI,IAAI;CAKrB"}

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityEntityStorageBootstrap = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const policy_enforce_middleware_1 = require("./policy-enforce.middleware");
+const visibility_filter_middleware_1 = require("./visibility-filter.middleware");
+//#region ---- Security entity-storage pipeline bootstrap ----
+/**
+ * Ensures security entity-storage middlewares join the server pipeline.
+ * Mirrors domain/document-management bootstrap when webpack splits duplicate middleware tokens.
+ */
+let SecurityEntityStorageBootstrap = class SecurityEntityStorageBootstrap {
+    constructor(storage, visibilityFilter, policyEnforce) {
+        this.storage = storage;
+        this.visibilityFilter = visibilityFilter;
+        this.policyEnforce = policyEnforce;
+    }
+    onModuleInit() {
+        for (const middleware of [this.visibilityFilter, this.policyEnforce]) {
+            this.storage.registerLateMiddleware(middleware);
+        }
+    }
+};
+exports.SecurityEntityStorageBootstrap = SecurityEntityStorageBootstrap;
+exports.SecurityEntityStorageBootstrap = SecurityEntityStorageBootstrap = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        visibility_filter_middleware_1.VisibilityFilterMiddleware,
+        policy_enforce_middleware_1.PolicyEnforceMiddleware])
+], SecurityEntityStorageBootstrap);
+//#endregion
+//# sourceMappingURL=security-entity-storage.bootstrap.js.map

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-entity-storage.bootstrap.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/security-entity-storage.bootstrap.ts"],"names":[],"mappings":";;;;AAAA,2CAA0D;AAC1D,iEAAwF;AACxF,2EAAsE;AACtE,iFAA4E;AAE5E,8DAA8D;AAE9D;;;GAGG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IACzC,YACmB,OAAuC,EACvC,gBAA4C,EAC5C,aAAsC;QAFtC,YAAO,GAAP,OAAO,CAAgC;QACvC,qBAAgB,GAAhB,gBAAgB,CAA4B;QAC5C,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;IAEJ,YAAY;QACV,KAAK,MAAM,UAAU,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;CACF,CAAA;AAZY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;6CAGiB,qCAA8B;QACrB,yDAA0B;QAC7B,mDAAuB;GAJ9C,8BAA8B,CAY1C;AAED,YAAY"}

package/security/src/lib/entity-storage/visibility-filter.middleware.d.ts

@@ -1,30 +1,31 @@
-import type { Request } from 'express';
 import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
-import { CURRENT_SESSION_KEY } from '../session/current-session.decorator';
-import type { BackendRequestSession } from '../session/backend-session.types';
-type RequestWithSession = Request & {
-    [CURRENT_SESSION_KEY]?: BackendRequestSession;
-};
 /**
-
- * Injects SQL/JQL-level visibility filters before query execution.
-
- * - Hides records with stateInfo.isHidden === true (unless bypassed)
-
- * - Scopes by ownershipInfo.tenantId / applicationId from session (unless bypassed)
-
- * - getOne is not filtered (direct access allowed, matching mock)
-
+ * Injects scope + visibility filters and authorizes getOne / update / delete.
+ *
+ * - Expression policies from PlatformManagement.EntityAccessPolicy
+ * - Strict attribute filters (no soft-null leak)
+ * - Platform-only write policies are readonly for non-platform sessions
+ * - HTTP clients cannot pass scope bypass (stripped at controller); server locals still can
+ *
+ * Singleton + ALS request (not Nest REQUEST DI). Registered via
+ * {@link SecurityEntityStorageBootstrap}.
  */
 export declare class VisibilityFilterMiddleware implements EntityStorageMiddleware {
-    private readonly request;
     readonly target: {
         ops: AXPEntityOp[];
         order: number;
     };
-    constructor(request: RequestWithSession);
     execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
-    private resolveUserTenantId;
+    private resolveSession;
+    private loadExisting;
+    /**
+     * identity-read: users with active TenantUser for session tenant AND
+     * active TenantUserAppAccess for session application (when configured).
+     * Always includes the signed-in user via expression self-check on getOne;
+     * list filter uses membership ids only (self still appears if they have membership).
+     */
+    private resolveIdentityMembershipUserIds;
+    private resolveSharedResourceIds;
+    private reloadPolicyCache;
 }
-export {};
 //# sourceMappingURL=visibility-filter.middleware.d.ts.map

package/security/src/lib/entity-storage/visibility-filter.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"visibility-filter.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIvC,OAAO,EAEL,WAAW,EAEX,oBAAoB,EAEpB,uBAAuB,EAExB,MAAM,wCAAwC,CAAC;AAgBhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAY9E,KAAK,kBAAkB,GAAG,OAAO,GAAG;IAElC,CAAC,mBAAmB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAE/C,CAAC;AAIF;;;;;;;;;;GAUG;AAEH,qBAEa,0BAA2B,YAAW,uBAAuB;IAY3C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAVrD,QAAQ,CAAC,MAAM;aAEK,WAAW,EAAE;;MAI/B;gBAI4C,OAAO,EAAE,kBAAkB;IAInE,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YA0FpE,mBAAmB;CAwBlC"}
+{"version":3,"file":"visibility-filter.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EAGxB,MAAM,wCAAwC,CAAC;AA8BhD;;;;;;;;;;GAUG;AACH,qBACa,0BAA2B,YAAW,uBAAuB;IACxE,QAAQ,CAAC,MAAM;aAC0D,WAAW,EAAE;;MAEpF;IAEI,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA6KlF,OAAO,CAAC,cAAc;YAKR,YAAY;IAc1B;;;;;OAKG;YACW,gCAAgC;YAmFhC,wBAAwB;YAoCxB,iBAAiB;CAgBhC"}