@acorex-platform/framework-server 0.0.15 → 0.0.20

package/security/src/lib/runtime/runtime-permission.service.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimePermissionService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const current_session_decorator_1 = require("../session/current-session.decorator");
+const session_access_policy_util_1 = require("../session/session-access-policy.util");
+const runtime_permission_checker_token_1 = require("./runtime-permission-checker.token");
+const runtime_permission_util_1 = require("./runtime-permission.util");
+const TENANT_USER_ENTITY = 'TenantManagement.TenantUser';
+const ACTIVE_STATUS = 'active';
+//#endregion
+//#region ---- Runtime permission service ----
+/**
+ * Resolves platform user permissions from scoped UserRole assignments for runtime authz.
+ * Per-request cache (on the HTTP request object) avoids repeated role lookups during bulk runtime operations.
+ * Apps may override results via an optional {@link RUNTIME_PERMISSION_CHECKER} provider.
+ */
+let RuntimePermissionService = class RuntimePermissionService {
+    constructor(entityStorage, permissionChecker) {
+        this.entityStorage = entityStorage;
+        this.permissionChecker = permissionChecker;
+        this.fallbackCache = new Map();
+    }
+    /**
+     * Returns true when the user has all requested permission keys.
+     */
+    async authorize(userId, ...keys) {
+        const normalizedKeys = keys.filter((key) => !(0, runtime_permission_util_1.isEmptyPermissionKey)(key));
+        if (normalizedKeys.length === 0) {
+            return true;
+        }
+        if (!userId?.trim()) {
+            return false;
+        }
+        const permissions = await this.loadUserPermissions(userId);
+        const baseResult = normalizedKeys.every((key) => (0, runtime_permission_util_1.isPermissionGranted)(permissions, key));
+        if (this.permissionChecker) {
+            return this.permissionChecker.check(normalizedKeys, userId, baseResult);
+        }
+        return baseResult;
+    }
+    /**
+     * Ensures the user has all requested permission keys; throws {@link ForbiddenException} otherwise.
+     */
+    async requirePermissions(userId, ...keys) {
+        const allowed = await this.authorize(userId, ...keys);
+        if (!allowed) {
+            throw new common_1.ForbiddenException({
+                code: 'RUNTIME_PERMISSION_DENIED',
+                message: 'Permission denied',
+            });
+        }
+    }
+    /**
+     * Loads deduplicated permission keys for a platform user.
+     */
+    async loadUserPermissions(userId) {
+        const normalizedUserId = userId.trim();
+        const cacheKey = this.buildCacheKey(normalizedUserId);
+        const cache = this.resolveCache();
+        const cached = cache.get(cacheKey);
+        if (cached) {
+            return cached;
+        }
+        const user = await this.entityStorage.getOneAsEngine(runtime_permission_util_1.RUNTIME_PERMISSION_USER_ENTITY, normalizedUserId);
+        const permissions = await this.resolvePermissionsForUser(user && typeof user === 'object' ? user : null);
+        cache.set(cacheKey, permissions);
+        return permissions;
+    }
+    buildCacheKey(userId) {
+        const session = this.resolveSession();
+        return [userId, session?.tenantId ?? '', session?.applicationId ?? ''].join(':');
+    }
+    resolveSession() {
+        const request = (0, core_1.getEntityStorageRequest)();
+        return request?.[current_session_decorator_1.CURRENT_SESSION_KEY];
+    }
+    resolveCache() {
+        const request = (0, core_1.getEntityStorageRequest)();
+        if (request) {
+            request.__runtimePermissionCache ??= new Map();
+            return request.__runtimePermissionCache;
+        }
+        return this.fallbackCache;
+    }
+    async resolvePermissionsForUser(user) {
+        if (!user) {
+            return [];
+        }
+        const session = this.resolveSession();
+        const tenantId = session?.tenantId;
+        if (!tenantId) {
+            return [];
+        }
+        const userId = String(user['id'] ?? '');
+        const membership = await this.findActiveTenantMembership(userId, tenantId);
+        const [rolesResult, grantsResult, userRolesResult] = await Promise.all([
+            this.entityStorage.query(runtime_permission_util_1.RUNTIME_PERMISSION_ROLE_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: 1000,
+            })),
+            this.entityStorage.query(runtime_permission_util_1.RUNTIME_PERMISSION_ROLE_PERMISSION_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: 2000,
+            })),
+            this.entityStorage.query(runtime_permission_util_1.RUNTIME_PERMISSION_USER_ROLE_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: 2000,
+                filter: {
+                    logic: 'and',
+                    filters: [{ field: 'userId', operator: { type: 'equal' }, value: userId }],
+                },
+            })),
+        ]);
+        const roles = Array.isArray(rolesResult?.items)
+            ? rolesResult.items
+            : [];
+        const grants = Array.isArray(grantsResult?.items)
+            ? grantsResult.items
+            : [];
+        const assignments = Array.isArray(userRolesResult?.items)
+            ? userRolesResult.items
+            : [];
+        const context = {
+            tenantId,
+            applicationId: session?.applicationId,
+            hasTenantMembership: !!membership,
+        };
+        const effectiveRoleIds = (0, session_access_policy_util_1.resolveEffectiveRoleIdsFromUserRoles)(assignments, roles, context, {
+            isAccountHolder: membership?.isAccountHolder === true,
+        });
+        if (effectiveRoleIds.length === 0) {
+            return [];
+        }
+        return (0, session_access_policy_util_1.resolvePermissionsFromRoleGrants)(roles, grants, effectiveRoleIds, context);
+    }
+    async findActiveTenantMembership(userId, tenantId) {
+        if (!userId.trim()) {
+            return null;
+        }
+        const result = await this.entityStorage.query(TENANT_USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+            skip: 0,
+            take: 1,
+            filter: {
+                logic: 'and',
+                filters: [
+                    { field: 'userId', operator: { type: 'equal' }, value: userId },
+                    { field: 'tenantId', operator: { type: 'equal' }, value: tenantId },
+                    { field: 'statusId', operator: { type: 'equal' }, value: ACTIVE_STATUS },
+                ],
+            },
+        }));
+        const membership = result?.items?.[0];
+        if (!membership) {
+            return null;
+        }
+        return {
+            isAccountHolder: membership['isAccountHolder'] === true,
+        };
+    }
+};
+exports.RuntimePermissionService = RuntimePermissionService;
+exports.RuntimePermissionService = RuntimePermissionService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(1, (0, common_1.Optional)()),
+    tslib_1.__param(1, (0, common_1.Inject)(runtime_permission_checker_token_1.RUNTIME_PERMISSION_CHECKER)),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService, Object])
+], RuntimePermissionService);
+//#endregion
+//# sourceMappingURL=runtime-permission.service.js.map

package/security/src/lib/runtime/runtime-permission.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission.service.ts"],"names":[],"mappings":";;;;AAAA,2CAAkF;AAClF,iEAGgD;AAChD,6EAAkG;AAElG,oFAA2E;AAE3E,sFAI+C;AAC/C,yFAAgF;AAEhF,uEAOmC;AASnC,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,YAAY;AAEZ,8CAA8C;AAE9C;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAGnC,YACmB,aAA6C,EAG9D,iBAAoE;QAHnD,kBAAa,GAAb,aAAa,CAAgC;QAG7C,sBAAiB,GAAjB,iBAAiB,CAAkC;QANrD,kBAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAO1D,CAAC;IAEJ;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAA0B,EAAE,GAAG,IAAc;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAA,8CAAoB,EAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,6CAAmB,EAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAExF,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAA0B,EAAE,GAAG,IAAc;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,mBAAmB;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAClD,wDAA8B,EAC9B,gBAAgB,CACjB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACtD,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAC5E,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjC,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IAEO,cAAc;QACpB,MAAM,OAAO,GAAG,IAAA,8BAAuB,GAA4C,CAAC;QACpF,OAAO,OAAO,EAAE,CAAC,+CAAmB,CAAC,CAAC;IACxC,CAAC;IAEO,YAAY;QAClB,MAAM,OAAO,GAAG,IAAA,8BAAuB,GAA4C,CAAC;QACpF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,wBAAwB,KAAK,IAAI,GAAG,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC,wBAAwB,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,IAAoC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,KAAK,CACtB,wDAA8B,EAC9B,IAAA,2CAAgC,EAAC;gBAC/B,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI;aACX,CAAC,CACH;YACD,IAAI,CAAC,aAAa,CAAC,KAAK,CACtB,mEAAyC,EACzC,IAAA,2CAAgC,EAAC;gBAC/B,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI;aACX,CAAC,CACH;YACD,IAAI,CAAC,aAAa,CAAC,KAAK,CACtB,6DAAmC,EACnC,IAAA,2CAAgC,EAAC;gBAC/B,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;iBAC3E;aACF,CAAC,CACH;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;YAC7C,CAAC,CAAE,WAAW,CAAC,KAAmC;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;YAC/C,CAAC,CAAE,YAAY,CAAC,KAAmC;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC;YACvD,CAAC,CAAE,eAAe,CAAC,KAAmC;YACtD,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GAA4B;YACvC,QAAQ;YACR,aAAa,EAAE,OAAO,EAAE,aAAa;YACrC,mBAAmB,EAAE,CAAC,CAAC,UAAU;SAClC,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAA,iEAAoC,EAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;YACzF,eAAe,EAAE,UAAU,EAAE,eAAe,KAAK,IAAI;SACtD,CAAC,CAAC;QACH,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAA,6DAAgC,EAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IAEO,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,QAAgB;QAEhB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,kBAAkB,EAClB,IAAA,2CAAgC,EAAC;YAC/B,IAAI,EAAE,CAAC;YACP,IAAI,EAAE,CAAC;YACP,MAAM,EAAE;gBACN,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;oBAC/D,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;oBACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;iBACzE;aACF;SACF,CAAC,CACH,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAwC,CAAC;QAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,eAAe,EAAE,UAAU,CAAC,iBAAiB,CAAC,KAAK,IAAI;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AA3LY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAMR,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,6DAA0B,CAAC,CAAA;6CAFH,qCAA8B;GAJrD,wBAAwB,CA2LpC;AAED,YAAY"}

package/security/src/lib/runtime/runtime-permission.util.d.ts

@@ -0,0 +1,15 @@
+declare const USER_ENTITY = "SecurityManagement.User";
+declare const ROLE_ENTITY = "SecurityManagement.Role";
+declare const ROLE_PERMISSION_ENTITY = "SecurityManagement.RolePermission";
+declare const USER_ROLE_ENTITY = "SecurityManagement.UserRole";
+export { USER_ENTITY as RUNTIME_PERMISSION_USER_ENTITY, ROLE_ENTITY as RUNTIME_PERMISSION_ROLE_ENTITY, ROLE_PERMISSION_ENTITY as RUNTIME_PERMISSION_ROLE_PERMISSION_ENTITY, USER_ROLE_ENTITY as RUNTIME_PERMISSION_USER_ROLE_ENTITY, };
+export declare function isEmptyPermissionKey(key: string): boolean;
+export declare function extractRoleIds(user: Record<string, unknown> | null): string[];
+export declare function flattenRolePermissions(roleItems: unknown[]): string[];
+/**
+ * Returns true when `requiredKey` is granted directly or via common platform aliases:
+ * - `{Module}:Permission:{Entity}.Management` satisfies `{Entity}.View|Create|Edit|Delete`
+ * - `{Module}:Permission:Management` satisfies any `{Module}:Permission:{Entity}.{Action}` runtime entity key
+ */
+export declare function isPermissionGranted(userPermissions: string[], requiredKey: string): boolean;
+//# sourceMappingURL=runtime-permission.util.d.ts.map

package/security/src/lib/runtime/runtime-permission.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission.util.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,WAAW,4BAA4B,CAAC;AAC9C,QAAA,MAAM,WAAW,4BAA4B,CAAC;AAC9C,QAAA,MAAM,sBAAsB,sCAAsC,CAAC;AACnE,QAAA,MAAM,gBAAgB,gCAAgC,CAAC;AAEvD,OAAO,EACL,WAAW,IAAI,8BAA8B,EAC7C,WAAW,IAAI,8BAA8B,EAC7C,sBAAsB,IAAI,yCAAyC,EACnE,gBAAgB,IAAI,mCAAmC,GACxD,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAsB7E;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAUrE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAqB3F"}

package/security/src/lib/runtime/runtime-permission.util.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNTIME_PERMISSION_USER_ROLE_ENTITY = exports.RUNTIME_PERMISSION_ROLE_PERMISSION_ENTITY = exports.RUNTIME_PERMISSION_ROLE_ENTITY = exports.RUNTIME_PERMISSION_USER_ENTITY = void 0;
+exports.isEmptyPermissionKey = isEmptyPermissionKey;
+exports.extractRoleIds = extractRoleIds;
+exports.flattenRolePermissions = flattenRolePermissions;
+exports.isPermissionGranted = isPermissionGranted;
+const lodash_es_1 = require("lodash-es");
+//#region ----- Permission resolution helpers -----
+const USER_ENTITY = 'SecurityManagement.User';
+exports.RUNTIME_PERMISSION_USER_ENTITY = USER_ENTITY;
+const ROLE_ENTITY = 'SecurityManagement.Role';
+exports.RUNTIME_PERMISSION_ROLE_ENTITY = ROLE_ENTITY;
+const ROLE_PERMISSION_ENTITY = 'SecurityManagement.RolePermission';
+exports.RUNTIME_PERMISSION_ROLE_PERMISSION_ENTITY = ROLE_PERMISSION_ENTITY;
+const USER_ROLE_ENTITY = 'SecurityManagement.UserRole';
+exports.RUNTIME_PERMISSION_USER_ROLE_ENTITY = USER_ROLE_ENTITY;
+function isEmptyPermissionKey(key) {
+    return key.trim().length === 0;
+}
+function extractRoleIds(user) {
+    if (!user) {
+        return [];
+    }
+    const roles = (0, lodash_es_1.get)(user, 'roles', (0, lodash_es_1.get)(user, 'roleIds', []));
+    if (!Array.isArray(roles)) {
+        return [];
+    }
+    return roles
+        .map((role) => {
+        if (typeof role === 'string') {
+            return role.trim();
+        }
+        if (role && typeof role === 'object') {
+            const id = (0, lodash_es_1.get)(role, 'id', (0, lodash_es_1.get)(role, 'roleId'));
+            return typeof id === 'string' ? id.trim() : '';
+        }
+        return '';
+    })
+        .filter((id) => id.length > 0);
+}
+function flattenRolePermissions(roleItems) {
+    return roleItems
+        .flatMap((role) => {
+        if (!role || typeof role !== 'object') {
+            return [];
+        }
+        const perms = (0, lodash_es_1.get)(role, 'permissions', []);
+        return Array.isArray(perms) ? perms : [];
+    })
+        .filter((permission, index, array) => typeof permission === 'string' && array.indexOf(permission) === index);
+}
+/**
+ * Returns true when `requiredKey` is granted directly or via common platform aliases:
+ * - `{Module}:Permission:{Entity}.Management` satisfies `{Entity}.View|Create|Edit|Delete`
+ * - `{Module}:Permission:Management` satisfies any `{Module}:Permission:{Entity}.{Action}` runtime entity key
+ */
+function isPermissionGranted(userPermissions, requiredKey) {
+    if (userPermissions.includes(requiredKey)) {
+        return true;
+    }
+    const entityPermissionMatch = /^(.+:\Permission:[^.]+)\.(\w+)$/.exec(requiredKey);
+    if (!entityPermissionMatch) {
+        return false;
+    }
+    const [, entityBase] = entityPermissionMatch;
+    if (userPermissions.includes(`${entityBase}.Management`)) {
+        return true;
+    }
+    const moduleMatch = /^(\w+):\Permission:/.exec(requiredKey);
+    if (moduleMatch && userPermissions.includes(`${moduleMatch[1]}:Permission:Management`)) {
+        return true;
+    }
+    return false;
+}
+//#endregion
+//# sourceMappingURL=runtime-permission.util.js.map

package/security/src/lib/runtime/runtime-permission.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission.util.ts"],"names":[],"mappings":";;;AAgBA,oDAEC;AAED,wCAsBC;AAED,wDAUC;AAOD,kDAqBC;AAlFD,yCAAgC;AAEhC,mDAAmD;AAEnD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAM7B,qDAA8B;AAL/C,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAM7B,qDAA8B;AAL/C,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAMvC,2EAAyC;AALrE,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAMjC,+DAAmC;AAGzD,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,cAAc,CAAC,IAAoC;IACjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,IAAI,EAAE,OAAO,EAAE,IAAA,eAAG,EAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAA,eAAG,EAAC,IAAI,EAAE,IAAI,EAAE,IAAA,eAAG,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAChD,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAgB,sBAAsB,CAAC,SAAoB;IACzD,OAAO,SAAS;SACb,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,eAAyB,EAAE,WAAmB;IAChF,IAAI,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,iCAAiC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,qBAAqB,CAAC;IAC7C,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,UAAU,aAAa,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,WAAW,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,YAAY"}

package/security/src/lib/security.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.module.d.ts","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,kBAAkB,EAAU,UAAU,EAAgC,MAAM,gBAAgB,CAAC;AAyB9G;;;GAGG;AACH,qBA8Ca,cAAe,YAAW,UAAU;IAC/C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAK9C"}
+{"version":3,"file":"security.module.d.ts","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,kBAAkB,EAAU,UAAU,EAAgC,MAAM,gBAAgB,CAAC;AA4B9G;;;GAGG;AACH,qBAuDa,cAAe,YAAW,UAAU;IAC/C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAK9C"}

package/security/src/lib/security.module.js

@@ -5,7 +5,6 @@ const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const core_1 = require("@acorex-platform/framework-server/core");
-const auth_controller_1 = require("./auth/auth.controller");
 const auth_cookie_service_1 = require("./auth/auth-cookie.service");
 const auth_local_credentials_service_1 = require("./auth/auth-local-credentials.service");
 const auth_service_1 = require("./auth/auth.service");
@@ -18,12 +17,16 @@ const jwt_auth_guard_1 = require("./auth/jwt-auth.guard");
 const local_strategy_1 = require("./auth/strategies/local.strategy");
 const connect_controller_1 = require("./oauth/connect.controller");
 const platform_oauth_service_1 = require("./oauth/platform-oauth.service");
+const saml_sp_service_1 = require("./auth/saml/saml-sp.service");
+const entity_access_policy_loader_1 = require("./entity-storage/entity-access-policy.loader");
 const policy_enforce_middleware_1 = require("./entity-storage/policy-enforce.middleware");
+const security_entity_storage_bootstrap_1 = require("./entity-storage/security-entity-storage.bootstrap");
 const visibility_filter_middleware_1 = require("./entity-storage/visibility-filter.middleware");
-const session_controller_1 = require("./session/session.controller");
 const backend_session_service_1 = require("./session/backend-session.service");
 const optional_jwt_session_middleware_1 = require("./session/optional-jwt-session.middleware");
 const session_context_service_1 = require("./session/session-context.service");
+const runtime_permission_service_1 = require("./runtime/runtime-permission.service");
+const auth_runtime_handlers_1 = require("./auth/auth-runtime.handlers");
 //#region ---- Platform security module ----
 /**
  * JWT authentication and per-request session context.
@@ -41,10 +44,11 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
     (0, common_1.Global)(),
     (0, common_1.Module)({
         imports: [core_1.EntityStorageModule, passport_1.PassportModule.register({ session: false })],
-        controllers: [auth_controller_1.AuthController, connect_controller_1.ConnectController, session_controller_1.SessionController],
+        controllers: [connect_controller_1.ConnectController],
         providers: [
             auth_service_1.AuthService,
             platform_oauth_service_1.PlatformOAuthService,
+            saml_sp_service_1.SamlSpService,
             auth_local_credentials_service_1.AuthLocalCredentialsService,
             login_attempt_service_1.LoginAttemptService,
             token_service_1.TokenService,
@@ -59,6 +63,11 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
             optional_jwt_session_middleware_1.OptionalJwtSessionMiddleware,
             visibility_filter_middleware_1.VisibilityFilterMiddleware,
             policy_enforce_middleware_1.PolicyEnforceMiddleware,
+            security_entity_storage_bootstrap_1.SecurityEntityStorageBootstrap,
+            entity_access_policy_loader_1.EntityAccessPolicyLoader,
+            runtime_permission_service_1.RuntimePermissionService,
+            ...auth_runtime_handlers_1.AUTH_RUNTIME_COMMANDS,
+            ...auth_runtime_handlers_1.AUTH_RUNTIME_QUERIES,
             {
                 provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
                 useExisting: visibility_filter_middleware_1.VisibilityFilterMiddleware,
@@ -75,12 +84,15 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
             token_service_1.TokenService,
             token_resolver_service_1.TokenResolverService,
             auth_cookie_service_1.AuthCookieService,
+            saml_sp_service_1.SamlSpService,
             machine_token_service_1.MachineTokenService,
             backend_session_service_1.BackendSessionService,
             session_context_service_1.SessionContextService,
             jwt_auth_guard_1.JwtAuthGuard,
             visibility_filter_middleware_1.VisibilityFilterMiddleware,
             policy_enforce_middleware_1.PolicyEnforceMiddleware,
+            entity_access_policy_loader_1.EntityAccessPolicyLoader,
+            runtime_permission_service_1.RuntimePermissionService,
             core_1.ENTITY_STORAGE_MIDDLEWARE,
         ],
     })

package/security/src/lib/security.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":";;;;AAAA,2CAA8G;AAC9G,+CAAkD;AAClD,iEAAwG;AACxG,4DAAwD;AACxD,oEAA+D;AAC/D,0FAAoF;AACpF,sDAAkD;AAClD,0EAAqE;AACrE,wEAAmE;AACnE,wEAAmE;AACnE,0EAAqE;AACrE,wDAAoD;AACpD,0DAAqD;AACrD,qEAAiE;AACjE,mEAA+D;AAC/D,2EAAsE;AACtE,0FAAqF;AACrF,gGAA2F;AAC3F,qEAAiE;AACjE,+EAA0E;AAC1E,+FAAyF;AACzF,+EAA0E;AAE1E,4CAA4C;AAE5C;;;GAGG;AA+CI,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,SAAS,CAAC,QAA4B;QACpC,QAAQ;aACL,KAAK,CAAC,8DAA4B,CAAC;aACnC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AANY,wCAAc;yBAAd,cAAc;IA9C1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,EAAE,yBAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,WAAW,EAAE,CAAC,gCAAc,EAAE,sCAAiB,EAAE,sCAAiB,CAAC;QACnE,SAAS,EAAE;YACT,0BAAW;YACX,6CAAoB;YACpB,4DAA2B;YAC3B,2CAAmB;YACnB,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,6CAAoB;YACpB,8BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,8DAA4B;YAC5B,yDAA0B;YAC1B,mDAAuB;YACvB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,yDAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,mDAAuB;gBACpC,KAAK,EAAE,IAAI;aACA;SACd;QACD,OAAO,EAAE;YACP,0BAAW;YACX,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,yDAA0B;YAC1B,mDAAuB;YACvB,gCAAyB;SAC1B;KACF,CAAC;GACW,cAAc,CAM1B;AAED,YAAY"}
+{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":";;;;AAAA,2CAA8G;AAC9G,+CAAkD;AAClD,iEAAwG;AACxG,oEAA+D;AAC/D,0FAAoF;AACpF,sDAAkD;AAClD,0EAAqE;AACrE,wEAAmE;AACnE,wEAAmE;AACnE,0EAAqE;AACrE,wDAAoD;AACpD,0DAAqD;AACrD,qEAAiE;AACjE,mEAA+D;AAC/D,2EAAsE;AACtE,iEAA4D;AAC5D,8FAAwF;AACxF,0FAAqF;AACrF,0GAAoG;AACpG,gGAA2F;AAC3F,+EAA0E;AAC1E,+FAAyF;AACzF,+EAA0E;AAC1E,qFAAgF;AAChF,wEAA2F;AAE3F,4CAA4C;AAE5C;;;GAGG;AAwDI,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,SAAS,CAAC,QAA4B;QACpC,QAAQ;aACL,KAAK,CAAC,8DAA4B,CAAC;aACnC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AANY,wCAAc;yBAAd,cAAc;IAvD1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,EAAE,yBAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,WAAW,EAAE,CAAC,sCAAiB,CAAC;QAChC,SAAS,EAAE;YACT,0BAAW;YACX,6CAAoB;YACpB,+BAAa;YACb,4DAA2B;YAC3B,2CAAmB;YACnB,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,6CAAoB;YACpB,8BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,8DAA4B;YAC5B,yDAA0B;YAC1B,mDAAuB;YACvB,kEAA8B;YAC9B,sDAAwB;YACxB,qDAAwB;YACxB,GAAG,6CAAqB;YACxB,GAAG,4CAAoB;YACvB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,yDAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,mDAAuB;gBACpC,KAAK,EAAE,IAAI;aACA;SACd;QACD,OAAO,EAAE;YACP,0BAAW;YACX,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,+BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,yDAA0B;YAC1B,mDAAuB;YACvB,sDAAwB;YACxB,qDAAwB;YACxB,gCAAyB;SAC1B;KACF,CAAC;GACW,cAAc,CAM1B;AAED,YAAY"}

package/security/src/lib/session/session-access-policy.util.d.ts

@@ -1,9 +1,75 @@
 import type { SessionModulesAndFeaturesDto } from './session-context.types';
-/** Permission keys are scoped as `{ModuleName}:...` (e.g. `SecurityManagement:Permission:User.View`). */
+/** Workspace context used to filter role grants before flattening permissions. */
+export interface SessionRoleScopeContext {
+    tenantId?: string;
+    applicationId?: string;
+    hasTenantMembership: boolean;
+}
+export declare function extractPermissionKeys(source: Record<string, unknown> | null | undefined): string[];
+/** @deprecated Use {@link extractPermissionKeys} — permissions no longer live on Role. */
+export declare function extractRolePermissionKeys(role: Record<string, unknown>): string[];
+export declare function isPlatformOperatorRole(role: Record<string, unknown>): boolean;
+/**
+ * Returns whether a role's {@link scopeInfo} applies to the current tenant/application workspace.
+ * Attribute-only: tenantId / applicationId (no catalogScope).
+ */
+export declare function roleAppliesToSession(role: Record<string, unknown>, context: SessionRoleScopeContext): boolean;
+/**
+ * @deprecated Prefer {@link resolveEffectiveRoleIdsFromUserRoles}. Membership roleId was removed.
+ */
+export declare function resolveEffectiveRoleIds(userRoleIds: string[], membershipRoleId: string | undefined): string[];
+/**
+ * Scores a RolePermission / UserRole row for the current workspace.
+ * Higher = more specific. Negative = not applicable.
+ *
+ * tenant+app > tenant-only > platform-default(+optional app) > unscoped default
+ */
+export declare function scoreRolePermissionGrant(grant: Record<string, unknown>, context: SessionRoleScopeContext): number;
+/** Alias — UserRole rows use the same scope scoring as RolePermission. */
+export declare const scoreUserRoleGrant: typeof scoreRolePermissionGrant;
+export declare function extractUserRoleIds(assignment: Record<string, unknown> | null | undefined): string[];
+/**
+ * Unions role ids from all UserRole rows that apply to the current workspace.
+ * Account holders also receive the system `account-holder` role when present in `roles`.
+ */
+export declare function resolveEffectiveRoleIdsFromUserRoles(assignments: Record<string, unknown>[], roles: Record<string, unknown>[], context: SessionRoleScopeContext, options?: {
+    isAccountHolder?: boolean;
+}): string[];
+/**
+ * Resolves which application ids a user may open in the current tenant from UserRole scopes.
+ * - Account holder / any tenant-wide assignment (no applicationId) → `null` (all subscribed apps)
+ * - Only app-scoped assignments → those application ids
+ * - No applicable assignments → empty set (no apps)
+ */
+export declare function resolveAllowedApplicationIdsFromUserRoles(assignments: Record<string, unknown>[], tenantId: string, options?: {
+    isAccountHolder?: boolean;
+}): Set<string> | null;
+/** Picks the most specific RolePermission row for a role in the current workspace. */
+export declare function selectRolePermissionGrant(grants: Record<string, unknown>[], roleId: string, context: SessionRoleScopeContext): Record<string, unknown> | null;
+/**
+ * Resolves effective permission keys from Role identity + RolePermission grants.
+ */
+export declare function resolvePermissionsFromRoleGrants(roles: Record<string, unknown>[], grants: Record<string, unknown>[], effectiveRoleIds: readonly string[], context: SessionRoleScopeContext): string[];
+/**
+ * @deprecated Prefer {@link resolvePermissionsFromRoleGrants}. Kept for transitional callers;
+ * Role documents no longer carry permissions.
+ */
+export declare function resolvePermissionsFromRoles(roles: Record<string, unknown>[], effectiveRoleIds: readonly string[], context: SessionRoleScopeContext): string[];
+/**
+ * Resolves edition module names for a permission key.
+ * Product code registers a conceptual-domain map; legacy fallback uses key prefix.
+ */
+export type AXPPermissionModulesResolver = (permission: string) => readonly string[];
+/** Register the product permission→module map (call once at app/module bootstrap). */
+export declare function registerPermissionModulesResolver(resolver: AXPPermissionModulesResolver): void;
+/** @internal test helper */
+export declare function clearPermissionModulesResolver(): void;
+/** Permission keys are scoped as `{Domain|Module}:Permission:…`. */
 export declare function extractPermissionModuleName(permission: string): string | null;
 /**
- * Returns only permissions whose module prefix is enabled for the current application edition.
- * When edition modules are unknown, no permissions are exposed.
+ * Returns only permissions whose owning module(s) intersect the edition module list.
+ * Match rule is ANY — Access/Setup typically list all domain contributors; unique caps list the owner.
+ * When edition modules are unknown/empty, no permissions are exposed.
  */
 export declare function filterPermissionsByEnabledModules(permissions: string[], modulesAndFeatures: SessionModulesAndFeaturesDto | null): string[];
 //# sourceMappingURL=session-access-policy.util.d.ts.map

package/security/src/lib/session/session-access-policy.util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-access-policy.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/session-access-policy.util.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAI5E,yGAAyG;AACzG,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO7E;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,MAAM,EAAE,EACrB,kBAAkB,EAAE,4BAA4B,GAAG,IAAI,GACtD,MAAM,EAAE,CAWV"}
+{"version":3,"file":"session-access-policy.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/session-access-policy.util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAI5E,kFAAkF;AAClF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AASD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAgBlG;AAED,0FAA0F;AAC1F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEjF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAG7E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAsBT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EAAE,EACrB,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,EAAE,CAMV;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAgCR;AAED,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,iCAA2B,CAAC;AAE3D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAWnG;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAChC,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACtC,MAAM,EAAE,CAqBV;AAED;;;;;GAKG;AACH,wBAAgB,yCAAyC,CACvD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACtC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAgCpB;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACjC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAgBhC;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACjC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,OAAO,EAAE,uBAAuB,GAC/B,MAAM,EAAE,CAYV;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAChC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,OAAO,EAAE,uBAAuB,GAC/B,MAAM,EAAE,CAEV;AAMD;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;AAIrF,sFAAsF;AACtF,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,4BAA4B,GAAG,IAAI,CAE9F;AAED,4BAA4B;AAC5B,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED,oEAAoE;AACpE,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO7E;AAcD;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,MAAM,EAAE,EACrB,kBAAkB,EAAE,4BAA4B,GAAG,IAAI,GACtD,MAAM,EAAE,CAWV"}