@acorex-platform/framework-server 0.0.15 → 0.0.20

package/security/src/lib/session/session-access-policy.util.js

@@ -1,9 +1,231 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.scoreUserRoleGrant = void 0;
+exports.extractPermissionKeys = extractPermissionKeys;
+exports.extractRolePermissionKeys = extractRolePermissionKeys;
+exports.isPlatformOperatorRole = isPlatformOperatorRole;
+exports.roleAppliesToSession = roleAppliesToSession;
+exports.resolveEffectiveRoleIds = resolveEffectiveRoleIds;
+exports.scoreRolePermissionGrant = scoreRolePermissionGrant;
+exports.extractUserRoleIds = extractUserRoleIds;
+exports.resolveEffectiveRoleIdsFromUserRoles = resolveEffectiveRoleIdsFromUserRoles;
+exports.resolveAllowedApplicationIdsFromUserRoles = resolveAllowedApplicationIdsFromUserRoles;
+exports.selectRolePermissionGrant = selectRolePermissionGrant;
+exports.resolvePermissionsFromRoleGrants = resolvePermissionsFromRoleGrants;
+exports.resolvePermissionsFromRoles = resolvePermissionsFromRoles;
+exports.registerPermissionModulesResolver = registerPermissionModulesResolver;
+exports.clearPermissionModulesResolver = clearPermissionModulesResolver;
 exports.extractPermissionModuleName = extractPermissionModuleName;
 exports.filterPermissionsByEnabledModules = filterPermissionsByEnabledModules;
-//#region ----- Permission filtering -----
-/** Permission keys are scoped as `{ModuleName}:...` (e.g. `SecurityManagement:Permission:User.View`). */
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+//#endregion
+//#region ----- Role scope -----
+/** Platform-operator role names — apply only on the platform tenant. */
+const PLATFORM_OPERATOR_ROLE_NAMES = new Set(['root', 'dev']);
+function extractPermissionKeys(source) {
+    if (!source) {
+        return [];
+    }
+    const raw = source['permissions'];
+    if (Array.isArray(raw)) {
+        return raw.filter((permission) => typeof permission === 'string');
+    }
+    if (raw instanceof Set) {
+        return [...raw].filter((permission) => typeof permission === 'string');
+    }
+    return [];
+}
+/** @deprecated Use {@link extractPermissionKeys} — permissions no longer live on Role. */
+function extractRolePermissionKeys(role) {
+    return extractPermissionKeys(role);
+}
+function isPlatformOperatorRole(role) {
+    const name = typeof role['name'] === 'string' ? role['name'] : '';
+    return PLATFORM_OPERATOR_ROLE_NAMES.has(name);
+}
+/**
+ * Returns whether a role's {@link scopeInfo} applies to the current tenant/application workspace.
+ * Attribute-only: tenantId / applicationId (no catalogScope).
+ */
+function roleAppliesToSession(role, context) {
+    const scopeInfo = role['scopeInfo'];
+    const roleTenantId = typeof scopeInfo?.['tenantId'] === 'string' ? scopeInfo['tenantId'] : undefined;
+    const roleApplicationId = typeof scopeInfo?.['applicationId'] === 'string'
+        ? scopeInfo['applicationId']
+        : undefined;
+    if (roleTenantId) {
+        return !!context.tenantId && roleTenantId === context.tenantId;
+    }
+    if (roleApplicationId) {
+        return !!context.applicationId && roleApplicationId === context.applicationId;
+    }
+    // Platform-global role (empty scopeInfo).
+    if (isPlatformOperatorRole(role)) {
+        return (0, abstract_1.isPlatformSessionTenant)(context.tenantId);
+    }
+    return context.hasTenantMembership;
+}
+/**
+ * @deprecated Prefer {@link resolveEffectiveRoleIdsFromUserRoles}. Membership roleId was removed.
+ */
+function resolveEffectiveRoleIds(userRoleIds, membershipRoleId) {
+    const roleIds = new Set(userRoleIds);
+    if (membershipRoleId) {
+        roleIds.add(membershipRoleId);
+    }
+    return [...roleIds];
+}
+/**
+ * Scores a RolePermission / UserRole row for the current workspace.
+ * Higher = more specific. Negative = not applicable.
+ *
+ * tenant+app > tenant-only > platform-default(+optional app) > unscoped default
+ */
+function scoreRolePermissionGrant(grant, context) {
+    const scopeInfo = grant['scopeInfo'];
+    const grantTenantId = typeof scopeInfo?.['tenantId'] === 'string' ? scopeInfo['tenantId'] : undefined;
+    const grantApplicationId = typeof scopeInfo?.['applicationId'] === 'string'
+        ? scopeInfo['applicationId']
+        : undefined;
+    let score = 0;
+    if (grantTenantId) {
+        if (grantTenantId === context.tenantId) {
+            score += 10;
+        }
+        else if ((0, abstract_1.isPlatformSessionTenant)(grantTenantId)) {
+            score += 1;
+        }
+        else {
+            return -1;
+        }
+    }
+    else {
+        score += 1;
+    }
+    if (grantApplicationId) {
+        if (grantApplicationId === context.applicationId) {
+            score += 5;
+        }
+        else {
+            return -1;
+        }
+    }
+    return score;
+}
+/** Alias — UserRole rows use the same scope scoring as RolePermission. */
+exports.scoreUserRoleGrant = scoreRolePermissionGrant;
+function extractUserRoleIds(assignment) {
+    if (!assignment) {
+        return [];
+    }
+    const raw = assignment['roleIds'];
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    return raw.filter((id) => typeof id === 'string' && id.length > 0);
+}
+/**
+ * Unions role ids from all UserRole rows that apply to the current workspace.
+ * Account holders also receive the system `account-holder` role when present in `roles`.
+ */
+function resolveEffectiveRoleIdsFromUserRoles(assignments, roles, context, options) {
+    const roleIds = new Set();
+    for (const assignment of assignments) {
+        if ((0, exports.scoreUserRoleGrant)(assignment, context) < 0) {
+            continue;
+        }
+        for (const roleId of extractUserRoleIds(assignment)) {
+            roleIds.add(roleId);
+        }
+    }
+    if (options?.isAccountHolder) {
+        const accountHolder = roles.find((role) => role['name'] === 'account-holder');
+        const accountHolderId = accountHolder ? String(accountHolder['id'] ?? '') : '';
+        if (accountHolderId) {
+            roleIds.add(accountHolderId);
+        }
+    }
+    return [...roleIds];
+}
+/**
+ * Resolves which application ids a user may open in the current tenant from UserRole scopes.
+ * - Account holder / any tenant-wide assignment (no applicationId) → `null` (all subscribed apps)
+ * - Only app-scoped assignments → those application ids
+ * - No applicable assignments → empty set (no apps)
+ */
+function resolveAllowedApplicationIdsFromUserRoles(assignments, tenantId, options) {
+    if (options?.isAccountHolder) {
+        return null;
+    }
+    const tenantAssignments = assignments.filter((assignment) => {
+        const scopeInfo = assignment['scopeInfo'];
+        const grantTenantId = typeof scopeInfo?.['tenantId'] === 'string' ? scopeInfo['tenantId'] : undefined;
+        return !grantTenantId || grantTenantId === tenantId || (0, abstract_1.isPlatformSessionTenant)(grantTenantId);
+    });
+    if (tenantAssignments.length === 0) {
+        return new Set();
+    }
+    const hasTenantWide = tenantAssignments.some((assignment) => {
+        const scopeInfo = assignment['scopeInfo'];
+        return !scopeInfo?.['applicationId'];
+    });
+    if (hasTenantWide) {
+        return null;
+    }
+    const allowed = new Set();
+    for (const assignment of tenantAssignments) {
+        const scopeInfo = assignment['scopeInfo'];
+        if (typeof scopeInfo?.['applicationId'] === 'string') {
+            allowed.add(scopeInfo['applicationId']);
+        }
+    }
+    return allowed;
+}
+/** Picks the most specific RolePermission row for a role in the current workspace. */
+function selectRolePermissionGrant(grants, roleId, context) {
+    let best = null;
+    let bestScore = -1;
+    for (const grant of grants) {
+        if (String(grant['roleId'] ?? '') !== roleId) {
+            continue;
+        }
+        const score = scoreRolePermissionGrant(grant, context);
+        if (score > bestScore) {
+            best = grant;
+            bestScore = score;
+        }
+    }
+    return bestScore >= 0 ? best : null;
+}
+/**
+ * Resolves effective permission keys from Role identity + RolePermission grants.
+ */
+function resolvePermissionsFromRoleGrants(roles, grants, effectiveRoleIds, context) {
+    const roleIdSet = new Set(effectiveRoleIds);
+    const applicableRoles = roles.filter((role) => roleIdSet.has(String(role['id'])) && roleAppliesToSession(role, context));
+    const permissions = applicableRoles.flatMap((role) => {
+        const grant = selectRolePermissionGrant(grants, String(role['id']), context);
+        return extractPermissionKeys(grant);
+    });
+    return [...new Set(permissions)];
+}
+/**
+ * @deprecated Prefer {@link resolvePermissionsFromRoleGrants}. Kept for transitional callers;
+ * Role documents no longer carry permissions.
+ */
+function resolvePermissionsFromRoles(roles, effectiveRoleIds, context) {
+    return resolvePermissionsFromRoleGrants(roles, roles, effectiveRoleIds, context);
+}
+let permissionModulesResolver = null;
+/** Register the product permission→module map (call once at app/module bootstrap). */
+function registerPermissionModulesResolver(resolver) {
+    permissionModulesResolver = resolver;
+}
+/** @internal test helper */
+function clearPermissionModulesResolver() {
+    permissionModulesResolver = null;
+}
+/** Permission keys are scoped as `{Domain|Module}:Permission:…`. */
 function extractPermissionModuleName(permission) {
     const separatorIndex = permission.indexOf(':');
     if (separatorIndex <= 0) {
@@ -11,9 +233,19 @@ function extractPermissionModuleName(permission) {
     }
     return permission.slice(0, separatorIndex);
 }
+function resolveModulesForPermission(permission) {
+    if (permissionModulesResolver) {
+        return permissionModulesResolver(permission);
+    }
+    const prefix = extractPermissionModuleName(permission);
+    return prefix ? [prefix] : [];
+}
+//#endregion
+//#region ----- Permission filtering -----
 /**
- * Returns only permissions whose module prefix is enabled for the current application edition.
- * When edition modules are unknown, no permissions are exposed.
+ * Returns only permissions whose owning module(s) intersect the edition module list.
+ * Match rule is ANY — Access/Setup typically list all domain contributors; unique caps list the owner.
+ * When edition modules are unknown/empty, no permissions are exposed.
  */
 function filterPermissionsByEnabledModules(permissions, modulesAndFeatures) {
     const enabledModules = modulesAndFeatures?.modules ?? [];
@@ -22,8 +254,8 @@ function filterPermissionsByEnabledModules(permissions, modulesAndFeatures) {
     }
     const enabledModuleSet = new Set(enabledModules);
     return permissions.filter((permission) => {
-        const moduleName = extractPermissionModuleName(permission);
-        return moduleName !== null && enabledModuleSet.has(moduleName);
+        const modules = resolveModulesForPermission(permission);
+        return modules.some((moduleName) => enabledModuleSet.has(moduleName));
     });
 }
 //#endregion

package/security/src/lib/session/session-access-policy.util.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-access-policy.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/session-access-policy.util.ts"],"names":[],"mappings":";;AAKA,kEAOC;AAMD,8EAcC;AA9BD,0CAA0C;AAE1C,yGAAyG;AACzG,SAAgB,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAgB,iCAAiC,CAC/C,WAAqB,EACrB,kBAAuD;IAEvD,MAAM,cAAc,GAAG,kBAAkB,EAAE,OAAO,IAAI,EAAE,CAAC;IACzD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACjD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC3D,OAAO,UAAU,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,YAAY"}
+{"version":3,"file":"session-access-policy.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/session-access-policy.util.ts"],"names":[],"mappings":";;;AAoBA,sDAgBC;AAGD,8DAEC;AAED,wDAGC;AAMD,oDAyBC;AAKD,0DASC;AAQD,4DAmCC;AAKD,gDAWC;AAMD,oFA0BC;AAQD,8FAoCC;AAGD,8DAoBC;AAKD,4EAiBC;AAMD,kEAMC;AAeD,8EAEC;AAGD,wEAEC;AAGD,kEAOC;AAmBD,8EAcC;AA5VD,6EAAyF;AAazF,YAAY;AAEZ,gCAAgC;AAEhC,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9D,SAAgB,qBAAqB,CAAC,MAAkD;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAElC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,GAAG,YAAY,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0FAA0F;AAC1F,SAAgB,yBAAyB,CAAC,IAA6B;IACrE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,sBAAsB,CAAC,IAA6B;IAClE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,OAAO,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA6B,EAC7B,OAAgC;IAEhC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAwC,CAAC;IAC3E,MAAM,YAAY,GAChB,OAAO,SAAS,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,iBAAiB,GACrB,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,KAAK,QAAQ;QAC9C,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC;IACjE,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,iBAAiB,KAAK,OAAO,CAAC,aAAa,CAAC;IAChF,CAAC;IAED,0CAA0C;IAC1C,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAA,kCAAuB,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,mBAAmB,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CACrC,WAAqB,EACrB,gBAAoC;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CACtC,KAA8B,EAC9B,OAAgC;IAEhC,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAwC,CAAC;IAC5E,MAAM,aAAa,GACjB,OAAO,SAAS,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,SAAS,CAAC,UAAU,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,kBAAkB,GACtB,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,KAAK,QAAQ;QAC9C,CAAC,CAAE,SAAS,CAAC,eAAe,CAAY;QACxC,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,aAAa,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;aAAM,IAAI,IAAA,kCAAuB,EAAC,aAAa,CAAC,EAAE,CAAC;YAClD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,kBAAkB,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACjD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC7D,QAAA,kBAAkB,GAAG,wBAAwB,CAAC;AAE3D,SAAgB,kBAAkB,CAAC,UAAsD;IACvF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,SAAgB,oCAAoC,CAClD,WAAsC,EACtC,KAAgC,EAChC,OAAgC,EAChC,OAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,IAAA,0BAAkB,EAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,gBAAgB,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,yCAAyC,CACvD,WAAsC,EACtC,QAAgB,EAChB,OAAuC;IAEvC,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAwC,CAAC;QACjF,MAAM,aAAa,GACjB,OAAO,SAAS,EAAE,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,OAAO,CAAC,aAAa,IAAI,aAAa,KAAK,QAAQ,IAAI,IAAA,kCAAuB,EAAC,aAAa,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAwC,CAAC;QACjF,OAAO,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAwC,CAAC;QACjF,IAAI,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sFAAsF;AACtF,SAAgB,yBAAyB,CACvC,MAAiC,EACjC,MAAc,EACd,OAAgC;IAEhC,IAAI,IAAI,GAAmC,IAAI,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IAEnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,KAAK,CAAC;YACb,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,gCAAgC,CAC9C,KAAgC,EAChC,MAAiC,EACjC,gBAAmC,EACnC,OAAgC;IAEhC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CACnF,CAAC;IAEF,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CACzC,KAAgC,EAChC,gBAAmC,EACnC,OAAgC;IAEhC,OAAO,gCAAgC,CAAC,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC;AAYD,IAAI,yBAAyB,GAAwC,IAAI,CAAC;AAE1E,sFAAsF;AACtF,SAAgB,iCAAiC,CAAC,QAAsC;IACtF,yBAAyB,GAAG,QAAQ,CAAC;AACvC,CAAC;AAED,4BAA4B;AAC5B,SAAgB,8BAA8B;IAC5C,yBAAyB,GAAG,IAAI,CAAC;AACnC,CAAC;AAED,oEAAoE;AACpE,SAAgB,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAkB;IACrD,IAAI,yBAAyB,EAAE,CAAC;QAC9B,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,YAAY;AAEZ,0CAA0C;AAE1C;;;;GAIG;AACH,SAAgB,iCAAiC,CAC/C,WAAqB,EACrB,kBAAuD;IAEvD,MAAM,cAAc,GAAG,kBAAkB,EAAE,OAAO,IAAI,EAAE,CAAC;IACzD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACjD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,YAAY"}

package/security/src/lib/session/session-context.service.d.ts

@@ -13,11 +13,22 @@ export declare class SessionContextService {
     private resolveScopedTenantIds;
     getAccessPolicy(userId: string, tenantId?: string, applicationId?: string): Promise<SessionAccessPolicyDto>;
     private resolveModulesAndFeatures;
+    /**
+     * Limits the app chooser to apps the user may bind via Auth:UpdateSession.
+     * Source of truth is active TenantUserAppAccess (not UserRole / account-holder),
+     * intersected with subscribed applications already resolved above.
+     */
+    private filterApplicationsForUser;
     private getUserPermissions;
-    private extractPermissions;
-    private extractRoleIds;
+    private listUserRoleAssignments;
     private listEntities;
     private mapTenant;
     private mapApplication;
+    /**
+     * Prefer hydrated `editions` lookup; fall back to raw `editionIds` when lookups
+     * are not populated (session list uses bypass query without entity layout expand).
+     * Without an edition id, GetAccessPolicy cannot load modulesAndFeatures → empty menus.
+     */
+    private resolveApplicationEdition;
 }
 //# sourceMappingURL=session-context.service.d.ts.map

package/security/src/lib/session/session-context.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-context.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/session-context.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAIxF,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAE7B,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AAkBjC,qBACa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,8BAA8B;IAEpE,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,CAAC;IAsCxG,+BAA+B,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,6BAA6B,CAAC,yBAAyB,CAAC,CAAC;IAoDpE;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuBxB,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,CAAC;YAQpB,yBAAyB;YAsCzB,kBAAkB;IAoBhC,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,cAAc;YAcR,YAAY;IAS1B,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,cAAc;CA8CvB"}
+{"version":3,"file":"session-context.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/session-context.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAaxF,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAE7B,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AAqBjC,qBACa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,8BAA8B;IAEpE,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,CAAC;IAsCxG,+BAA+B,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,6BAA6B,CAAC,yBAAyB,CAAC,CAAC;IAsDpE;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuBxB,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,CAAC;YAQpB,yBAAyB;IAwCvC;;;;OAIG;YACW,yBAAyB;YAkDzB,kBAAkB;YAgDlB,uBAAuB;YAgBvB,YAAY;IAS1B,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,cAAc;IAkCtB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;CAsClC"}

package/security/src/lib/session/session-context.service.js

@@ -5,13 +5,17 @@ const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@acorex-platform/framework-server/core");
 const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const core_2 = require("@acorex-platform/framework-shared/core");
 const lodash_es_1 = require("lodash-es");
 const session_access_policy_util_1 = require("./session-access-policy.util");
 //#region ---- Entity keys ----
 const USER_ENTITY = 'SecurityManagement.User';
 const ROLE_ENTITY = 'SecurityManagement.Role';
+const ROLE_PERMISSION_ENTITY = 'SecurityManagement.RolePermission';
+const USER_ROLE_ENTITY = 'SecurityManagement.UserRole';
 const TENANT_ENTITY = 'TenantManagement.Tenant';
 const TENANT_USER_ENTITY = 'TenantManagement.TenantUser';
+const TENANT_USER_APP_ACCESS_ENTITY = 'TenantManagement.TenantUserAppAccess';
 const SUBSCRIPTION_ENTITY = 'SubscriptionManagement.Subscription';
 const SUBSCRIPTION_PLAN_ITEM_ENTITY = 'SubscriptionManagement.SubscriptionPlanItem';
 const APPLICATION_ENTITY = 'ApplicationManagement.Application';
@@ -42,7 +46,7 @@ let SessionContextService = class SessionContextService {
             .filter((tenant) => tenantIdsWithSubscriptions.has(String(tenant['id'])) &&
             tenantIdsForUser.has(String(tenant['id'])))
             .map((tenant) => this.mapTenant(tenant));
-        return { items };
+        return { items, total: items.length };
     }
     async getApplicationsForCurrentTenant(userId, tenantId) {
         const [applications, subscriptions, planItems, tenantUsers] = await Promise.all([
@@ -53,11 +57,11 @@ let SessionContextService = class SessionContextService {
         ]);
         const activeApplications = applications.filter((application) => application['statusId'] === ACTIVE_STATUS);
         if (!tenantId) {
-            return { items: [] };
+            return { items: [], total: 0 };
         }
         const scopedTenantIds = this.resolveScopedTenantIds(userId, tenantId, tenantUsers);
         if (!scopedTenantIds.includes(tenantId)) {
-            return { items: [] };
+            return { items: [], total: 0 };
         }
         const planIds = subscriptions
             .filter((subscription) => subscription['subscriberType'] === SUBSCRIBER_TYPE_TENANT &&
@@ -66,7 +70,7 @@ let SessionContextService = class SessionContextService {
             subscription['planId'])
             .map((subscription) => String(subscription['planId']));
         if (planIds.length === 0) {
-            return { items: [] };
+            return { items: [], total: 0 };
         }
         const subscribedEditionIds = new Set(planItems
             .filter((planItem) => planIds.includes(String(planItem['planId'])) && planItem['editionId'])
@@ -78,7 +82,8 @@ let SessionContextService = class SessionContextService {
                 editionIds.some((editionId) => subscribedEditionIds.has(String(editionId))));
         })
             .map((application) => this.mapApplication(application, subscribedEditionIds));
-        return { items };
+        const filteredItems = await this.filterApplicationsForUser(userId, tenantId, items);
+        return { items: filteredItems, total: filteredItems.length };
     }
     /**
      * Resolves which tenants to scope the application list to. The JWT always carries `userId`
@@ -98,7 +103,7 @@ let SessionContextService = class SessionContextService {
     }
     async getAccessPolicy(userId, tenantId, applicationId) {
         const modulesAndFeatures = await this.resolveModulesAndFeatures(userId, tenantId, applicationId);
-        const allPermissions = await this.getUserPermissions(userId);
+        const allPermissions = await this.getUserPermissions(userId, tenantId, applicationId);
         const permissions = (0, session_access_policy_util_1.filterPermissionsByEnabledModules)(allPermissions, modulesAndFeatures);
         return { permissions, modulesAndFeatures };
     }
@@ -112,7 +117,9 @@ let SessionContextService = class SessionContextService {
         if (!editionId) {
             return null;
         }
-        const edition = (await this.entityStorage.getOne(EDITION_ENTITY, editionId));
+        // Edition is a platform catalog — load as engine so session-tenant data filters
+        // cannot hide modulesAndFeatures used by GetAccessPolicy / side menus.
+        const edition = (await this.entityStorage.getOneAsEngine(EDITION_ENTITY, editionId));
         if (!edition) {
             return null;
         }
@@ -127,42 +134,81 @@ let SessionContextService = class SessionContextService {
                 : {},
         };
     }
-    async getUserPermissions(userId) {
-        const user = (await this.entityStorage.getOne(USER_ENTITY, userId));
-        if (!user) {
-            return [];
+    /**
+     * Limits the app chooser to apps the user may bind via Auth:UpdateSession.
+     * Source of truth is active TenantUserAppAccess (not UserRole / account-holder),
+     * intersected with subscribed applications already resolved above.
+     */
+    async filterApplicationsForUser(userId, tenantId, applications) {
+        if (!applications.length) {
+            return applications;
         }
-        const roleIds = this.extractRoleIds(user);
-        if (roleIds.length === 0) {
+        const [tenantUsers, appAccessRows] = await Promise.all([
+            this.listEntities(TENANT_USER_ENTITY),
+            this.listEntities(TENANT_USER_APP_ACCESS_ENTITY),
+        ]);
+        const membershipIds = new Set(tenantUsers
+            .filter((tenantUser) => tenantUser['userId'] === userId &&
+            tenantUser['statusId'] === ACTIVE_STATUS &&
+            String(tenantUser['tenantId']) === tenantId &&
+            typeof tenantUser['id'] === 'string')
+            .map((tenantUser) => String(tenantUser['id'])));
+        if (!membershipIds.size) {
             return [];
         }
-        const roles = await this.listEntities(ROLE_ENTITY);
-        const roleIdSet = new Set(roleIds);
-        const permissions = roles
-            .filter((role) => roleIdSet.has(String(role['id'])))
-            .flatMap((role) => this.extractPermissions(role));
-        return [...new Set(permissions)];
+        const allowedAppIds = new Set(appAccessRows
+            .filter((row) => {
+            const statusOk = row['statusId'] === ACTIVE_STATUS ||
+                row['statusId'] == null ||
+                row['statusId'] === '';
+            return (statusOk &&
+                membershipIds.has(String(row['tenantUserId'])) &&
+                String(row['tenantId']) === tenantId &&
+                typeof row['applicationId'] === 'string');
+        })
+            .map((row) => String(row['applicationId'])));
+        return applications.filter((application) => allowedAppIds.has(application.id));
     }
-    extractPermissions(role) {
-        const raw = role['permissions'];
-        if (Array.isArray(raw)) {
-            return raw.filter((permission) => typeof permission === 'string');
-        }
-        if (raw instanceof Set) {
-            return [...raw].filter((permission) => typeof permission === 'string');
+    async getUserPermissions(userId, tenantId, applicationId) {
+        if (!tenantId) {
+            return [];
         }
-        return [];
-    }
-    extractRoleIds(user) {
-        if (Array.isArray(user['roleIds'])) {
-            return user['roleIds'].filter((id) => typeof id === 'string');
+        // Identity row — always load via engine (self + membership scoping must not block authz).
+        const user = (await this.entityStorage.getOneAsEngine(USER_ENTITY, userId));
+        if (!user) {
+            return [];
         }
-        if (Array.isArray(user['roles'])) {
-            return user['roles']
-                .map((role) => (typeof role === 'object' && role && typeof role['id'] === 'string' ? role['id'] : undefined))
-                .filter((id) => typeof id === 'string');
+        const [roles, rolePermissions, userRoleAssignments, tenantUsers] = await Promise.all([
+            this.listEntities(ROLE_ENTITY),
+            this.listEntities(ROLE_PERMISSION_ENTITY),
+            this.listUserRoleAssignments(userId),
+            this.listEntities(TENANT_USER_ENTITY),
+        ]);
+        const membership = tenantUsers.find((tenantUser) => tenantUser['userId'] === userId &&
+            tenantUser['statusId'] === ACTIVE_STATUS &&
+            String(tenantUser['tenantId']) === tenantId);
+        const context = {
+            tenantId,
+            applicationId,
+            hasTenantMembership: !!membership,
+        };
+        const effectiveRoleIds = (0, session_access_policy_util_1.resolveEffectiveRoleIdsFromUserRoles)(userRoleAssignments, roles, context, { isAccountHolder: membership?.['isAccountHolder'] === true });
+        if (effectiveRoleIds.length === 0) {
+            return [];
         }
-        return [];
+        return (0, session_access_policy_util_1.resolvePermissionsFromRoleGrants)(roles, rolePermissions, effectiveRoleIds, context);
+    }
+    async listUserRoleAssignments(userId) {
+        const result = await this.entityStorage.query(USER_ROLE_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+            skip: 0,
+            take: 2000,
+            filter: {
+                logic: 'and',
+                filters: [{ field: 'userId', operator: { type: 'equal' }, value: userId }],
+            },
+        }));
+        const items = (0, lodash_es_1.get)(result, 'items', []);
+        return Array.isArray(items) ? items : [];
     }
     async listEntities(entityName) {
         const result = await this.entityStorage.query(entityName, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 2000 }));
@@ -170,8 +216,8 @@ let SessionContextService = class SessionContextService {
         return Array.isArray(items) ? items : [];
     }
     mapTenant(tenant) {
-        const title = String(tenant['title'] ?? '');
-        const fallbackName = title.toLowerCase().replace(/\s+/g, '-');
+        const title = (0, core_2.coerceUnknownToMultiLanguageString)(tenant['title']);
+        const fallbackName = (0, core_2.resolveMultiLanguageString)(title, 'en-US').toLowerCase().replace(/\s+/g, '-');
         return {
             id: String(tenant['id']),
             name: String(tenant['name'] ?? (fallbackName || 'default-name')),
@@ -181,24 +227,20 @@ let SessionContextService = class SessionContextService {
         };
     }
     mapApplication(application, subscribedEditionIds) {
-        const editions = Array.isArray(application['editions'])
-            ? application['editions']
-            : [];
-        const edition = editions.find((item) => subscribedEditionIds ? subscribedEditionIds.has(String(item['id'])) : true) ?? editions[0];
+        const edition = this.resolveApplicationEdition(application, subscribedEditionIds);
         const code = application['code'] != null ? String(application['code']) : undefined;
-        const title = String(application['title'] ?? '');
-        const routeName = code === 'MAGFA-001'
-            ? 'magfa-commerce'
-            : (application['name'] != null ? String(application['name']) : undefined) ||
-                title.toLowerCase().replace(/\s+/g, '-') ||
-                'default-name';
+        const title = (0, core_2.coerceUnknownToMultiLanguageString)(application['title']);
+        const resolvedTitle = (0, core_2.resolveMultiLanguageString)(title, 'en-US');
+        const routeName = (application['name'] != null ? String(application['name']) : undefined) ||
+            resolvedTitle.toLowerCase().replace(/\s+/g, '-') ||
+            'default-name';
         return {
             id: String(application['id']),
             code,
             name: routeName,
             title,
             version: application['version'] != null ? String(application['version']) : undefined,
-            description: application['description'],
+            description: (0, core_2.coerceUnknownToMultiLanguageString)(application['description']),
             icon: application['icon'],
             color: application['color'],
             logo: application['logo'] ?? application['logoUrl'],
@@ -207,13 +249,39 @@ let SessionContextService = class SessionContextService {
                 : typeof application['logoUrl'] === 'string'
                     ? application['logoUrl']
                     : undefined,
-            edition: edition
-                ? {
-                    id: String(edition['id']),
-                    title: String(edition['title'] ?? ''),
-                    description: edition['description'],
-                }
-                : undefined,
+            edition,
+        };
+    }
+    /**
+     * Prefer hydrated `editions` lookup; fall back to raw `editionIds` when lookups
+     * are not populated (session list uses bypass query without entity layout expand).
+     * Without an edition id, GetAccessPolicy cannot load modulesAndFeatures → empty menus.
+     */
+    resolveApplicationEdition(application, subscribedEditionIds) {
+        const editions = Array.isArray(application['editions'])
+            ? application['editions']
+            : [];
+        const fromLookup = editions.find((item) => subscribedEditionIds ? subscribedEditionIds.has(String(item['id'])) : true) ?? editions[0];
+        if (fromLookup?.['id'] != null) {
+            return {
+                id: String(fromLookup['id']),
+                title: (0, core_2.coerceUnknownToMultiLanguageString)(fromLookup['title']),
+                description: fromLookup['description'],
+            };
+        }
+        const editionIds = Array.isArray(application['editionIds'])
+            ? application['editionIds'].map((id) => String(id))
+            : [];
+        const editionId = (subscribedEditionIds
+            ? editionIds.find((id) => subscribedEditionIds.has(id))
+            : undefined) ?? editionIds[0];
+        if (!editionId) {
+            return undefined;
+        }
+        return {
+            id: editionId,
+            title: (0, core_2.coerceUnknownToMultiLanguageString)(''),
+            description: undefined,
         };
     }
 };