@acorex-platform/framework-server 0.0.15 → 0.0.20

package/core/src/lib/runtime/runtime-authz-metadata.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-authz-metadata.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-authz-metadata.service.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAA8D;AAC9D,gFAG2D;AAC3D,uEAImD;AACnD,kFAAgH;AAEhH,2EAA8E;AAE9E,YAAY;AAEZ,0CAA0C;AAGnC,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACtC,YAEmB,eAAuC,EAEvC,aAAmC;QAFnC,oBAAe,GAAf,eAAe,CAAwB;QAEvC,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,cAAc,CAAC,GAAW,EAAE,KAAe;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,yCAA8B,CAAC;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;aACjD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO,yCAA8B,CAAC;IACxC,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,KAAe;QACvC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,yCAA8B,CAAC;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;aACjD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO,yCAA8B,CAAC;IACxC,CAAC;IAEO,kBAAkB,CAAC,GAAW,EAAE,KAAe;QACrD,MAAM,MAAM,GAAG,IAAA,+BAAqB,EAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAA,sCAA4B,EAAC,GAAG,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,yCAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,IAAA,2DAA+B,EAAC,UAAU,EAAE,SAAS,CAAC;SACpE,CAAC;IACJ,CAAC;CACF,CAAA;AAtEY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;IAGR,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IAEV,mBAAA,IAAA,iBAAQ,GAAE,CAAA;6CADwB,iCAAqB;QAEvB,+BAAmB;GAL3C,2BAA2B,CAsEvC;AAED,YAAY"}

package/core/src/lib/runtime/runtime-authz.guard.d.ts

@@ -0,0 +1,36 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { AuthService, MachineTokenService, TokenResolverService } from '@acorex-platform/framework-server/security';
+import { RuntimeAuthzMetadataService } from './runtime-authz-metadata.service';
+/**
+ * Key-aware JWT guard for runtime command/query HTTP endpoints.
+ * Skips authentication when handler metadata declares `auth: 'public'`.
+ */
+export declare class RuntimeAuthzGuard implements CanActivate {
+    private readonly metadataService;
+    private readonly authService;
+    private readonly machineTokenService;
+    private readonly tokenResolver;
+    constructor(metadataService: RuntimeAuthzMetadataService, authService: AuthService, machineTokenService: MachineTokenService, tokenResolver: TokenResolverService);
+    canActivate(context: ExecutionContext): boolean;
+    /**
+     * Populates {@link CURRENT_SESSION_KEY} from machine token, bearer, or access cookie.
+     * @param required When true, invalid/expired tokens throw; when false they are ignored.
+     * @returns false when no credentials are present (or invalid when not required).
+     */
+    private tryAttachSession;
+    private isQueryRoute;
+    /**
+     * Prefer URL forms (`invoke?name=` / `by-ref/:keyRef`) so input-only bodies
+     * that include a `name` field are not treated as the runtime key.
+     */
+    private resolveRuntimeKey;
+    /** Envelope body is `{ name, input }`; invoke/by-ref body is the input itself. */
+    private resolveRuntimeInput;
+    /**
+     * When `?entity=` is present (DevTools visibility for `Entity:*:Default`) and
+     * the input lacks `entity`, fill it for authz entity resolution.
+     */
+    private mergeEntityQueryParam;
+    private hasUrlRuntimeKey;
+}
+//# sourceMappingURL=runtime-authz.guard.d.ts.map

package/core/src/lib/runtime/runtime-authz.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-authz.guard.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-authz.guard.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EAGrB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAoB/E;;;GAGG;AACH,qBACa,iBAAkB,YAAW,WAAW;IAEjD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,eAAe,EAAE,2BAA2B,EAC5C,WAAW,EAAE,WAAW,EACxB,mBAAmB,EAAE,mBAAmB,EACxC,aAAa,EAAE,oBAAoB;IAGtD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;IA4B/C;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAoCxB,OAAO,CAAC,YAAY;IAKpB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAsBzB,kFAAkF;IAClF,OAAO,CAAC,mBAAmB;IAc3B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAmB7B,OAAO,CAAC,gBAAgB;CASzB"}

package/core/src/lib/runtime/runtime-authz.guard.js

@@ -0,0 +1,161 @@
+"use strict";
+//#region ---- Imports ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeAuthzGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const security_1 = require("@acorex-platform/framework-server/security");
+const runtime_authz_metadata_service_1 = require("./runtime-authz-metadata.service");
+const runtime_key_ref_util_1 = require("./utils/runtime-key-ref.util");
+//#endregion
+//#region ---- Runtime authz guard ----
+/**
+ * Key-aware JWT guard for runtime command/query HTTP endpoints.
+ * Skips authentication when handler metadata declares `auth: 'public'`.
+ */
+let RuntimeAuthzGuard = class RuntimeAuthzGuard {
+    constructor(metadataService, authService, machineTokenService, tokenResolver) {
+        this.metadataService = metadataService;
+        this.authService = authService;
+        this.machineTokenService = machineTokenService;
+        this.tokenResolver = tokenResolver;
+    }
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const runtimeKey = this.resolveRuntimeKey(request);
+        if (!runtimeKey) {
+            throw new common_1.UnauthorizedException('Runtime key is required');
+        }
+        const isQuery = this.isQueryRoute(request);
+        const input = this.resolveRuntimeInput(request);
+        const metadata = isQuery
+            ? this.metadataService.resolveQuery(runtimeKey, input)
+            : this.metadataService.resolveCommand(runtimeKey, input);
+        if (metadata.auth === 'public') {
+            // Public handlers stay reachable without credentials, but still attach a
+            // session when a valid token is present so handlers that optionally use
+            // BackendSessionService (e.g. ScopedSettings T/U) see the caller.
+            this.tryAttachSession(request, false);
+            return true;
+        }
+        if (!this.tryAttachSession(request, true)) {
+            throw new common_1.UnauthorizedException('Bearer access token is required');
+        }
+        return true;
+    }
+    /**
+     * Populates {@link CURRENT_SESSION_KEY} from machine token, bearer, or access cookie.
+     * @param required When true, invalid/expired tokens throw; when false they are ignored.
+     * @returns false when no credentials are present (or invalid when not required).
+     */
+    tryAttachSession(request, required) {
+        if (request[security_1.CURRENT_SESSION_KEY]?.userId) {
+            return true;
+        }
+        const machineSession = this.machineTokenService.resolveSession(request.headers);
+        if (machineSession) {
+            request[security_1.CURRENT_SESSION_KEY] = machineSession;
+            return true;
+        }
+        const resolved = this.tokenResolver.resolveAccessToken(request.headers, request.cookies);
+        if (!resolved) {
+            return false;
+        }
+        try {
+            const payload = this.authService.verifyAccessToken(resolved.token);
+            request[security_1.CURRENT_SESSION_KEY] = {
+                userId: payload.sub,
+                username: payload.username,
+                tenantId: payload.tid,
+                applicationId: payload.aid,
+            };
+            return true;
+        }
+        catch (error) {
+            if (required) {
+                if (error instanceof common_1.UnauthorizedException) {
+                    throw error;
+                }
+                throw new common_1.UnauthorizedException('Invalid or expired access token');
+            }
+            return false;
+        }
+    }
+    isQueryRoute(request) {
+        const path = request.path ?? request.url ?? '';
+        return path.includes('/runtime/queries');
+    }
+    /**
+     * Prefer URL forms (`invoke?name=` / `by-ref/:keyRef`) so input-only bodies
+     * that include a `name` field are not treated as the runtime key.
+     */
+    resolveRuntimeKey(request) {
+        const queryName = request.query?.name;
+        if (typeof queryName === 'string' && queryName.trim()) {
+            return queryName.trim();
+        }
+        const keyRef = request.params?.keyRef;
+        if (typeof keyRef === 'string' && keyRef.trim()) {
+            return (0, runtime_key_ref_util_1.decodeRuntimeKeyRef)(keyRef);
+        }
+        const body = request.body;
+        if (body != null && typeof body === 'object' && !Array.isArray(body)) {
+            const bodyName = body.name;
+            if (typeof bodyName === 'string' && bodyName.trim()) {
+                return bodyName.trim();
+            }
+        }
+        return null;
+    }
+    /** Envelope body is `{ name, input }`; invoke/by-ref body is the input itself. */
+    resolveRuntimeInput(request) {
+        let input;
+        if (this.hasUrlRuntimeKey(request)) {
+            input = request.body;
+        }
+        else {
+            const body = request.body;
+            if (body != null && typeof body === 'object' && !Array.isArray(body)) {
+                input = body.input;
+            }
+        }
+        return this.mergeEntityQueryParam(request, input);
+    }
+    /**
+     * When `?entity=` is present (DevTools visibility for `Entity:*:Default`) and
+     * the input lacks `entity`, fill it for authz entity resolution.
+     */
+    mergeEntityQueryParam(request, input) {
+        const entityFromQuery = request.query?.entity;
+        if (typeof entityFromQuery !== 'string' || !entityFromQuery.trim()) {
+            return input;
+        }
+        const entity = entityFromQuery.trim();
+        if (input == null || typeof input !== 'object' || Array.isArray(input)) {
+            return { entity };
+        }
+        const current = input.entity;
+        if (typeof current === 'string' && current.trim()) {
+            return input;
+        }
+        return { ...input, entity };
+    }
+    hasUrlRuntimeKey(request) {
+        const queryName = request.query?.name;
+        if (typeof queryName === 'string' && queryName.trim()) {
+            return true;
+        }
+        const keyRef = request.params?.keyRef;
+        return typeof keyRef === 'string' && Boolean(keyRef.trim());
+    }
+};
+exports.RuntimeAuthzGuard = RuntimeAuthzGuard;
+exports.RuntimeAuthzGuard = RuntimeAuthzGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [runtime_authz_metadata_service_1.RuntimeAuthzMetadataService,
+        security_1.AuthService,
+        security_1.MachineTokenService,
+        security_1.TokenResolverService])
+], RuntimeAuthzGuard);
+//#endregion
+//# sourceMappingURL=runtime-authz.guard.js.map

package/core/src/lib/runtime/runtime-authz.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-authz.guard.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-authz.guard.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAKwB;AAExB,yEAMoD;AAEpD,qFAA+E;AAC/E,uEAAmE;AAenE,YAAY;AAEZ,uCAAuC;AAEvC;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,eAA4C,EAC5C,WAAwB,EACxB,mBAAwC,EACxC,aAAmC;QAHnC,oBAAe,GAAf,eAAe,CAA6B;QAC5C,gBAAW,GAAX,WAAW,CAAa;QACxB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAsB,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO;YACtB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE3D,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,yEAAyE;YACzE,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,OAA2B,EAAE,QAAiB;QACrE,IAAI,OAAO,CAAC,8BAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,8BAAmB,CAAC,GAAG,cAAc,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,CAAC,8BAAmB,CAAC,GAAG;gBAC7B,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,aAAa,EAAE,OAAO,CAAC,GAAG;aAC3B,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC3C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAA2B;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,OAA2B;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;QACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,OAAO,IAAA,0CAAmB,EAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,QAAQ,GAAI,IAA2B,CAAC,IAAI,CAAC;YACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAC1E,mBAAmB,CAAC,OAA2B;QACrD,IAAI,KAAc,CAAC;QACnB,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAAC,OAA2B,EAAE,KAAc;QACvE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9C,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,OAAO,GAAI,KAA8B,CAAC,MAAM,CAAC;QACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,EAAE,GAAI,KAAiC,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;QACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;QACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AA3JY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;6CAGyB,4DAA2B;QAC/B,sBAAW;QACH,8BAAmB;QACzB,+BAAoB;GAL3C,iBAAiB,CA2J7B;AAED,YAAY"}

package/core/src/lib/runtime/runtime-authz.service.d.ts

@@ -0,0 +1,20 @@
+import { RuntimePermissionService } from '@acorex-platform/framework-server/security';
+import type { AXPRuntimeAuthzMetadata } from '@acorex-platform/framework-server/domain/abstract';
+import { RuntimeAuthzMetadataService } from './runtime-authz-metadata.service';
+/**
+ * Authoritative runtime authorization for commands and queries.
+ * Controllers use {@link RuntimeAuthzGuard} for transport-level JWT; this service
+ * re-validates session and enforces permission keys before handler execution.
+ */
+export declare class RuntimeAuthzService {
+    private readonly metadataService;
+    private readonly permissionService;
+    constructor(metadataService: RuntimeAuthzMetadataService, permissionService: RuntimePermissionService);
+    enforceCommand(key: string, input?: unknown): Promise<AXPRuntimeAuthzMetadata>;
+    enforceQuery(key: string, input?: unknown): Promise<AXPRuntimeAuthzMetadata>;
+    isPublicCommand(key: string, input?: unknown): boolean;
+    isPublicQuery(key: string, input?: unknown): boolean;
+    private getSession;
+    private enforce;
+}
+//# sourceMappingURL=runtime-authz.service.d.ts.map

package/core/src/lib/runtime/runtime-authz.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-authz.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-authz.service.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,wBAAwB,EAGzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAEjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAU/E;;;;GAIG;AACH,qBACa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBADjB,eAAe,EAAE,2BAA2B,EAC5C,iBAAiB,EAAE,wBAAwB;IAGxD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAM9E,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAMlF,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO;IAItD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO;IAIpD,OAAO,CAAC,UAAU;YAKJ,OAAO;CActB"}

package/core/src/lib/runtime/runtime-authz.service.js

@@ -0,0 +1,60 @@
+"use strict";
+//#region ---- Imports ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeAuthzService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const runtime_authz_metadata_service_1 = require("./runtime-authz-metadata.service");
+/**
+ * Authoritative runtime authorization for commands and queries.
+ * Controllers use {@link RuntimeAuthzGuard} for transport-level JWT; this service
+ * re-validates session and enforces permission keys before handler execution.
+ */
+let RuntimeAuthzService = class RuntimeAuthzService {
+    constructor(metadataService, permissionService) {
+        this.metadataService = metadataService;
+        this.permissionService = permissionService;
+    }
+    async enforceCommand(key, input) {
+        const metadata = this.metadataService.resolveCommand(key, input);
+        await this.enforce(metadata);
+        return metadata;
+    }
+    async enforceQuery(key, input) {
+        const metadata = this.metadataService.resolveQuery(key, input);
+        await this.enforce(metadata);
+        return metadata;
+    }
+    isPublicCommand(key, input) {
+        return this.metadataService.resolveCommand(key, input).auth === 'public';
+    }
+    isPublicQuery(key, input) {
+        return this.metadataService.resolveQuery(key, input).auth === 'public';
+    }
+    getSession() {
+        const request = (0, core_1.getEntityStorageRequest)();
+        return request?.[security_1.CURRENT_SESSION_KEY] ?? null;
+    }
+    async enforce(metadata) {
+        if (metadata.auth === 'public') {
+            return;
+        }
+        const session = this.getSession();
+        if (!session?.userId) {
+            throw new common_1.UnauthorizedException('Access token is required');
+        }
+        if (metadata.permissions.length > 0) {
+            await this.permissionService.requirePermissions(session.userId, ...metadata.permissions);
+        }
+    }
+};
+exports.RuntimeAuthzService = RuntimeAuthzService;
+exports.RuntimeAuthzService = RuntimeAuthzService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [runtime_authz_metadata_service_1.RuntimeAuthzMetadataService,
+        security_1.RuntimePermissionService])
+], RuntimeAuthzService);
+//#endregion
+//# sourceMappingURL=runtime-authz.service.js.map

package/core/src/lib/runtime/runtime-authz.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-authz.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-authz.service.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAAmE;AACnE,iEAAiF;AACjF,yEAIoD;AAGpD,qFAA+E;AAU/E;;;;GAIG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YACmB,eAA4C,EAC5C,iBAA2C;QAD3C,oBAAe,GAAf,eAAe,CAA6B;QAC5C,sBAAiB,GAAjB,iBAAiB,CAA0B;IAC3D,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,KAAe;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,KAAe;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,GAAW,EAAE,KAAe;QAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC3E,CAAC;IAED,aAAa,CAAC,GAAW,EAAE,KAAe;QACxC,OAAO,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;IACzE,CAAC;IAEO,UAAU;QAChB,MAAM,OAAO,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QAC5E,OAAO,OAAO,EAAE,CAAC,8BAAmB,CAAC,IAAI,IAAI,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,QAAiC;QACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF,CAAA;AA7CY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;6CAGyB,4DAA2B;QACzB,mCAAwB;GAHnD,mBAAmB,CA6C/B;AAED,YAAY"}

package/core/src/lib/runtime/runtime-bulk-command.service.d.ts

@@ -0,0 +1,17 @@
+import { type AXPBulkCommandRequest, type AXPBulkCommandResultData, type AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { EntityMutationEventEmitter } from '../entity-storage/entity-mutation-events';
+import { RuntimeDispatcherService } from './runtime-dispatcher.service';
+export declare class RuntimeBulkCommandService {
+    private readonly dispatcher;
+    private readonly mutationEvents;
+    constructor(dispatcher: RuntimeDispatcherService, mutationEvents: EntityMutationEventEmitter);
+    execute(body: AXPBulkCommandRequest): AXPCommandExecuteResultPromise<AXPBulkCommandResultData>;
+    private resolveIds;
+    private fanOut;
+    private executeOne;
+    private extractId;
+    private isUsableFilter;
+    private clampMaxItems;
+    private clampConcurrency;
+}
+//# sourceMappingURL=runtime-bulk-command.service.d.ts.map

package/core/src/lib/runtime/runtime-bulk-command.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-bulk-command.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-bulk-command.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAAE,KAAK,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAGxH,OAAO,EACL,0BAA0B,EAE3B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAmCxE,qBACa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,UAAU,EAAE,wBAAwB,EACpC,cAAc,EAAE,0BAA0B;IAGvD,OAAO,CACX,IAAI,EAAE,qBAAqB,GAC1B,8BAA8B,CAAC,wBAAwB,CAAC;YAwG7C,UAAU;YA0CV,MAAM;YAuBN,UAAU;IA6BxB,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,gBAAgB;CAOzB"}

package/core/src/lib/runtime/runtime-bulk-command.service.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeBulkCommandService = void 0;
+const tslib_1 = require("tslib");
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const runtime_1 = require("@acorex-platform/framework-shared/runtime");
+const map_unknown_to_command_failure_util_1 = require("../errors/map-unknown-to-command-failure.util");
+const entity_storage_request_context_1 = require("../entity-storage/entity-storage-request-context");
+const entity_mutation_events_1 = require("../entity-storage/entity-mutation-events");
+const bulk_realtime_context_1 = require("./bulk-realtime-context");
+const runtime_dispatcher_service_1 = require("./runtime-dispatcher.service");
+//#region ---- Session helpers ----
+const ACX_REQUEST_SESSION_KEY = 'acxRequestSession';
+function readRequestSession() {
+    const request = (0, entity_storage_request_context_1.getEntityStorageRequest)();
+    const session = request?.[ACX_REQUEST_SESSION_KEY];
+    if (!session || typeof session !== 'object') {
+        return undefined;
+    }
+    const record = session;
+    return {
+        tenantId: typeof record['tenantId'] === 'string' ? record['tenantId'] : undefined,
+        userId: typeof record['userId'] === 'string' ? record['userId'] : undefined,
+    };
+}
+function resolveBulkMutationOperation(commandName) {
+    const name = commandName.trim().toLowerCase();
+    if (name.endsWith(':delete')) {
+        return 'deleted';
+    }
+    if (name.endsWith(':create')) {
+        return 'created';
+    }
+    return 'updated';
+}
+//#endregion
+//#region ---- Runtime bulk command ----
+let RuntimeBulkCommandService = class RuntimeBulkCommandService {
+    constructor(dispatcher, mutationEvents) {
+        this.dispatcher = dispatcher;
+        this.mutationEvents = mutationEvents;
+    }
+    async execute(body) {
+        const name = body?.name?.trim();
+        const entity = body?.entity?.trim();
+        if (!name) {
+            throw new common_1.BadRequestException('name is required');
+        }
+        if (!entity) {
+            throw new common_1.BadRequestException('entity is required');
+        }
+        if (!this.isUsableFilter(body.filter)) {
+            throw new common_1.BadRequestException('filter is required and must target at least one constraint');
+        }
+        const idField = body.idField?.trim() || 'id';
+        const maxItems = this.clampMaxItems(body.maxItems);
+        const concurrency = this.clampConcurrency(body.concurrency);
+        const sharedInput = body.input != null && typeof body.input === 'object' && !Array.isArray(body.input)
+            ? { ...body.input }
+            : {};
+        // Envelope `entity` is the source of truth for filter + Entity:*:Default fan-out.
+        // Do not require clients to repeat it inside `input`.
+        if ((0, runtime_1.isDefaultEntityRuntimeKey)(name)) {
+            sharedInput['entity'] = entity;
+        }
+        else {
+            delete sharedInput['entity'];
+        }
+        const resolved = await this.resolveIds(entity, body.filter, maxItems);
+        if (!resolved.success) {
+            return {
+                success: false,
+                message: {
+                    type: 'error',
+                    text: resolved.error ?? 'Failed to resolve bulk filter.',
+                    details: { total: 0, succeeded: 0, failed: 0, results: [] },
+                },
+            };
+        }
+        if (resolved.ids.length === 0) {
+            return {
+                success: false,
+                message: {
+                    type: 'error',
+                    text: 'No items matched the bulk filter.',
+                    details: {
+                        total: 0,
+                        succeeded: 0,
+                        failed: 0,
+                        truncated: resolved.truncated,
+                        results: [],
+                    },
+                },
+            };
+        }
+        const bulkExecutionId = (0, node_crypto_1.randomUUID)();
+        const results = await (0, bulk_realtime_context_1.runWithBulkRealtimeSuppress)(() => this.fanOut(name, resolved.ids, idField, sharedInput, concurrency));
+        const succeeded = results.filter((r) => r.success).length;
+        const failed = results.length - succeeded;
+        if (succeeded > 0) {
+            const session = readRequestSession();
+            this.mutationEvents.emitBulkCompleted({
+                entityName: entity,
+                operation: resolveBulkMutationOperation(name),
+                succeeded,
+                failed,
+                total: results.length,
+                tenantId: session?.tenantId,
+                userId: session?.userId,
+                bulkExecutionId,
+                timestamp: new Date(),
+                source: 'entity-bulk-mutation',
+            });
+        }
+        const data = {
+            total: results.length,
+            succeeded,
+            failed,
+            truncated: resolved.truncated,
+            results,
+        };
+        // Completed bulk ops always carry aggregate `data` (clients read succeeded/failed there).
+        // Soft-fail semantics: success mirrors "no item failures"; message carries shared error info.
+        if (failed === 0) {
+            return { success: true, kind: 'object', data };
+        }
+        return {
+            success: false,
+            message: {
+                ...(0, runtime_1.buildBulkCommandFailureMessage)(succeeded, failed, results),
+                details: data,
+            },
+        };
+    }
+    async resolveIds(entity, filter, maxItems) {
+        const queryResult = await this.dispatcher.executeQuery(`${entity}:Query`, {
+            entity,
+            filter,
+            resultMode: 'all',
+            maxFetchRows: maxItems + 1,
+        });
+        if (!queryResult.success) {
+            const text = typeof queryResult.message?.text === 'string'
+                ? queryResult.message.text
+                : queryResult.message?.code || 'Bulk filter query failed.';
+            return { success: false, ids: [], error: text };
+        }
+        const page = queryResult.kind === 'collection'
+            ? queryResult.data
+            : { items: [], total: 0, truncated: false };
+        const items = Array.isArray(page.items) ? page.items : [];
+        const truncated = items.length > maxItems || page.truncated === true;
+        const slice = truncated ? items.slice(0, maxItems) : items;
+        const ids = [];
+        const seen = new Set();
+        for (const item of slice) {
+            const id = this.extractId(item);
+            if (!id || seen.has(id)) {
+                continue;
+            }
+            seen.add(id);
+            ids.push(id);
+        }
+        return { success: true, ids, truncated };
+    }
+    async fanOut(name, ids, idField, sharedInput, concurrency) {
+        const results = new Array(ids.length);
+        let nextIndex = 0;
+        const worker = async () => {
+            while (nextIndex < ids.length) {
+                const index = nextIndex++;
+                const id = ids[index];
+                results[index] = await this.executeOne(name, id, idField, sharedInput);
+            }
+        };
+        const workers = Array.from({ length: Math.min(concurrency, ids.length) }, () => worker());
+        await Promise.all(workers);
+        return results;
+    }
+    async executeOne(name, id, idField, sharedInput) {
+        try {
+            const result = await this.dispatcher.executeCommand(name, {
+                ...sharedInput,
+                [idField]: id,
+                ...(idField === 'id' ? {} : { id }),
+            });
+            return {
+                id,
+                success: result.success === true,
+                data: result.success ? result.data : undefined,
+                message: result.message,
+            };
+        }
+        catch (error) {
+            const failure = (0, map_unknown_to_command_failure_util_1.mapUnknownErrorToCommandFailure)(error);
+            return {
+                id,
+                success: false,
+                message: failure.message,
+            };
+        }
+    }
+    extractId(item) {
+        if (item == null || typeof item !== 'object') {
+            return null;
+        }
+        const id = item.id;
+        if (id == null) {
+            return null;
+        }
+        const text = String(id).trim();
+        return text || null;
+    }
+    isUsableFilter(filter) {
+        if (filter == null || typeof filter !== 'object') {
+            return false;
+        }
+        if (filter.field != null && String(filter.field).trim() !== '') {
+            return true;
+        }
+        if (Array.isArray(filter.filters) && filter.filters.some((child) => this.isUsableFilter(child))) {
+            return true;
+        }
+        return false;
+    }
+    clampMaxItems(value) {
+        const n = Number.isFinite(value) ? Math.floor(value) : runtime_1.AXP_BULK_COMMAND_DEFAULT_MAX_ITEMS;
+        if (n < 1) {
+            return 1;
+        }
+        return Math.min(n, runtime_1.AXP_BULK_COMMAND_HARD_MAX_ITEMS);
+    }
+    clampConcurrency(value) {
+        const n = Number.isFinite(value) ? Math.floor(value) : runtime_1.AXP_BULK_COMMAND_DEFAULT_CONCURRENCY;
+        if (n < 1) {
+            return 1;
+        }
+        return Math.min(n, 5);
+    }
+};
+exports.RuntimeBulkCommandService = RuntimeBulkCommandService;
+exports.RuntimeBulkCommandService = RuntimeBulkCommandService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [runtime_dispatcher_service_1.RuntimeDispatcherService,
+        entity_mutation_events_1.EntityMutationEventEmitter])
+], RuntimeBulkCommandService);
+//#endregion
+//# sourceMappingURL=runtime-bulk-command.service.js.map

package/core/src/lib/runtime/runtime-bulk-command.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-bulk-command.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-bulk-command.service.ts"],"names":[],"mappings":";;;;AAAA,6CAAyC;AAEzC,2CAAiE;AAEjE,uEAQwH;AACxH,uGAAgG;AAChG,qGAA2F;AAC3F,qFAGkD;AAClD,mEAAsE;AACtE,6EAAwE;AAExE,mCAAmC;AAEnC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAEpD,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,IAAA,wDAAuB,GAAyC,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,uBAAuB,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACjF,MAAM,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,WAAmB;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,YAAY;AAEZ,wCAAwC;AAGjC,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YACmB,UAAoC,EACpC,cAA0C;QAD1C,eAAU,GAAV,UAAU,CAA0B;QACpC,mBAAc,GAAd,cAAc,CAA4B;IAC1D,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,IAA2B;QAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,4DAA4D,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,WAAW,GACf,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAChF,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;YACnB,CAAC,CAAC,EAAE,CAAC;QAET,kFAAkF;QAClF,sDAAsD;QACtD,IAAI,IAAA,mCAAyB,EAAC,IAAI,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,QAAQ,CAAC,KAAK,IAAI,gCAAgC;oBACxD,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAqC;iBAC/F;aACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,mCAAmC;oBACzC,OAAO,EAAE;wBACP,KAAK,EAAE,CAAC;wBACR,SAAS,EAAE,CAAC;wBACZ,MAAM,EAAE,CAAC;wBACT,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,OAAO,EAAE,EAAE;qBACuB;iBACrC;aACF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,wBAAU,GAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,IAAA,mDAA2B,EAAC,GAAG,EAAE,CACrD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CACnE,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;QAE1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACpC,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,4BAA4B,CAAC,IAAI,CAAC;gBAC7C,SAAS;gBACT,MAAM;gBACN,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,eAAe;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,MAAM,EAAE,sBAAsB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAA6B;YACrC,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,SAAS;YACT,MAAM;YACN,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO;SACR,CAAC;QAEF,0FAA0F;QAC1F,8FAA8F;QAC9F,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE;gBACP,GAAG,IAAA,wCAA8B,EAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;gBAC7D,OAAO,EAAE,IAAI;aACd;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAc,EACd,MAAgC,EAChC,QAAgB;QAEhB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,MAAM,QAAQ,EAAE;YACxE,MAAM;YACN,MAAM;YACN,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,QAAQ,GAAG,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,GACR,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ;gBAC3C,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI;gBAC1B,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,IAAI,2BAA2B,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GACR,WAAW,CAAC,IAAI,KAAK,YAAY;YAC/B,CAAC,CAAC,WAAW,CAAC,IAAI;YAClB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAe,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;QACrE,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,IAAY,EACZ,GAAa,EACb,OAAe,EACf,WAAoC,EACpC,WAAmB;QAEnB,MAAM,OAAO,GAA+B,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,OAAO,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC1B,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,EAAU,EACV,OAAe,EACf,WAAoC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE;gBACxD,GAAG,WAAW;gBACd,CAAC,OAAO,CAAC,EAAE,EAAE;gBACb,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;aACpC,CAAC,CAAC;YAEH,OAAO;gBACL,EAAE;gBACF,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI;gBAChC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAA,qEAA+B,EAAC,KAAK,CAAC,CAAC;YACvD,OAAO;gBACL,EAAE;gBACF,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,IAAa;QAC7B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IAEO,cAAc,CAAC,MAA4C;QACjE,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,KAAyB;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAe,CAAC,CAAC,CAAC,CAAC,4CAAkC,CAAC;QACpG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,yCAA+B,CAAC,CAAC;IACtD,CAAC;IAEO,gBAAgB,CAAC,KAAyB;QAChD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAe,CAAC,CAAC,CAAC,CAAC,8CAAoC,CAAC;QACtG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;CACF,CAAA;AAtPY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;6CAGoB,qDAAwB;QACpB,mDAA0B;GAHlD,yBAAyB,CAsPrC;AAED,YAAY"}

package/core/src/lib/runtime/runtime-command-invoke.controller.d.ts

@@ -1,3 +1,4 @@
+import type { Request } from 'express';
 import { RuntimeDispatcherService } from './runtime-dispatcher.service';
 import type { RuntimeCommandResult } from './runtime.types';
 /**
@@ -7,7 +8,7 @@ import type { RuntimeCommandResult } from './runtime.types';
 export declare class RuntimeCommandInvokeController {
     private readonly dispatcher;
     constructor(dispatcher: RuntimeDispatcherService);
-    invokeByQuery(name: string, input: unknown): Promise<RuntimeCommandResult>;
-    invokeByRef(keyRef: string, input: unknown): Promise<RuntimeCommandResult>;
+    invokeByQuery(name: string, input: unknown, req: Request): Promise<RuntimeCommandResult>;
+    invokeByRef(keyRef: string, input: unknown, req: Request): Promise<RuntimeCommandResult>;
 }
 //# sourceMappingURL=runtime-command-invoke.controller.d.ts.map

package/core/src/lib/runtime/runtime-command-invoke.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-command-invoke.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-command-invoke.controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAO5D;;;GAGG;AACH,qBAKa,8BAA8B;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAK3D,aAAa,CACF,IAAI,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAO1B,WAAW,CACE,MAAM,EAAE,MAAM,EACvB,KAAK,EAAE,OAAO,GACrB,OAAO,CAAC,oBAAoB,CAAC;CAGjC"}
+{"version":3,"file":"runtime-command-invoke.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-command-invoke.controller.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAO5D;;;GAGG;AACH,qBAKa,8BAA8B;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAK3D,aAAa,CACF,IAAI,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACf,GAAG,EAAE,OAAO,GAClB,OAAO,CAAC,oBAAoB,CAAC;IAO1B,WAAW,CACE,MAAM,EAAE,MAAM,EACvB,KAAK,EAAE,OAAO,EACf,GAAG,EAAE,OAAO,GAClB,OAAO,CAAC,oBAAoB,CAAC;CAKjC"}