@acorex-platform/framework-server 0.0.18 → 0.0.20

package/security/src/lib/entity-storage/entity-access-policy.loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.loader.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/entity-access-policy.loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAWxF;;;GAGG;AACH,qBACa,wBAAyB,YAAW,YAAY;IAG/C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAEvC,aAAa,EAAE,8BAA8B;IAEpE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B9B"}

package/security/src/lib/entity-storage/entity-access-policy.loader.js

@@ -0,0 +1,56 @@
+"use strict";
+var EntityAccessPolicyLoader_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityAccessPolicyLoader = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+//#region ---- Entity access policy cache loader ----
+/**
+ * Loads PlatformManagement.EntityAccessPolicy into the in-memory cache at boot.
+ * Uses server-only scope bypass so the self-policy row does not block the load.
+ */
+let EntityAccessPolicyLoader = EntityAccessPolicyLoader_1 = class EntityAccessPolicyLoader {
+    constructor(entityStorage) {
+        this.entityStorage = entityStorage;
+        this.logger = new common_1.Logger(EntityAccessPolicyLoader_1.name);
+    }
+    async onModuleInit() {
+        await this.reload();
+        // Schemas often register after Nest OnModuleInit — retry like PlatformScopeBootstrap.
+        setTimeout(() => {
+            void this.reload();
+        }, 3000);
+    }
+    async reload() {
+        try {
+            const result = await this.entityStorage.query(abstract_1.ENTITY_ACCESS_POLICY_ENTITY, {
+                skip: 0,
+                take: 10_000,
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const items = (result?.items ?? []);
+            if (!items.length) {
+                this.logger.warn('Entity access policy query returned 0 rows — keeping existing cache');
+                return;
+            }
+            (0, abstract_1.setEntityAccessPolicyCache)(items);
+            this.logger.log(`Loaded ${items.length} entity access policies`);
+        }
+        catch (error) {
+            // Expected before first seed / schema registration — fail-closed fallback applies.
+            this.logger.warn(`Entity access policy cache not loaded yet: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+};
+exports.EntityAccessPolicyLoader = EntityAccessPolicyLoader;
+exports.EntityAccessPolicyLoader = EntityAccessPolicyLoader = EntityAccessPolicyLoader_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], EntityAccessPolicyLoader);
+//#endregion
+//# sourceMappingURL=entity-access-policy.loader.js.map

package/security/src/lib/entity-storage/entity-access-policy.loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.loader.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/entity-access-policy.loader.ts"],"names":[],"mappings":";;;;;AAAA,2CAAkE;AAClE,iEAAwF;AACxF,6EAMwD;AAExD,qDAAqD;AAErD;;;GAGG;AAEI,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAES,CAAC;IAE9E,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,sFAAsF;QACtF,UAAU,CAAC,GAAG,EAAE;YACd,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,sCAA2B,EAAE;gBACzE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,CAAC,8BAAmB,CAAC,EAAE,IAAI;oBAC3B,CAAC,mCAAwB,CAAC,EAAE,IAAI;iBACjC;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAkC,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,IAAA,qCAA0B,EAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,yBAAyB,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAvCY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,wBAAwB,CAuCpC;AAED,YAAY"}

package/security/src/lib/entity-storage/policy-enforce.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-enforce.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAOhD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAC9B,CAAC,CAAC;CACJ;AAuBD,qBACa,uBAAwB,YAAW,uBAAuB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,QAAQ,CAAC,MAAM;aAC6C,WAAW,EAAE;;MAEvE;IAEI,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqJlF,OAAO,CAAC,YAAY;YA4BN,YAAY;CAuB3B"}
+{"version":3,"file":"policy-enforce.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAOhD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAC9B,CAAC,CAAC;CACJ;AAuBD,qBACa,uBAAwB,YAAW,uBAAuB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,QAAQ,CAAC,MAAM;aAC6C,WAAW,EAAE;;MAEvE;IAEI,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA6JlF,OAAO,CAAC,YAAY;YA4BN,YAAY;CAuB3B"}

package/security/src/lib/entity-storage/policy-enforce.middleware.js

@@ -103,7 +103,11 @@ let PolicyEnforceMiddleware = class PolicyEnforceMiddleware {
             if (ctx.data && typeof ctx.data === 'object') {
                 const data = ctx.data;
                 if (immutableTargets.includes('*')) {
-                    throw new core_1.MiddlewareAbortError('Update forbidden by policy: Record is marked as system and cannot be modified', { status: 409, code: 'POLICY_IMMUTABLE_RECORD', details: { entity: ctx.entityName, id: ctx.id } });
+                    throw new core_1.MiddlewareAbortError('This record is marked as system and cannot be modified.', {
+                        status: 409,
+                        code: 'POLICY_IMMUTABLE_RECORD',
+                        details: { entity: ctx.entityName, id: ctx.id, operation: 'update' },
+                    });
                 }
                 const forbiddenPaths = [];
                 const addForbidden = (targets) => {
@@ -133,7 +137,11 @@ let PolicyEnforceMiddleware = class PolicyEnforceMiddleware {
             ({ readonlyTargets, immutableTargets, hiddenTargets, maskedTargets, editableTargets } =
                 deriveTargets(activeRules));
             if (immutableTargets.includes('*')) {
-                throw new core_1.MiddlewareAbortError('Delete forbidden by policy: Record is marked as system and cannot be deleted', { status: 409, code: 'POLICY_IMMUTABLE_RECORD', details: { entity: ctx.entityName, id: ctx.id } });
+                throw new core_1.MiddlewareAbortError('This record is marked as system and cannot be deleted.', {
+                    status: 409,
+                    code: 'POLICY_IMMUTABLE_RECORD',
+                    details: { entity: ctx.entityName, id: ctx.id, operation: 'delete' },
+                });
             }
         }
         await next();

package/security/src/lib/entity-storage/policy-enforce.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-enforce.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA8E;AAM9E,6EAAuF;AACvF,yFAAgF;AAChF,2DAAgF;AAmBhF,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,IAAI,WAAW,GAAgE,IAAI,CAAC;AACpF,IAAI,iBAAiB,GAAwC,IAAI,CAAC;AAElE,YAAY;AAEZ,6CAA6C;AAE7C,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,MAAoB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QACY,cAAS,GAAG,IAAI,6DAA0B,EAAE,CAAC;QAErD,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAkB;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;IA0MJ,CAAC;IAxMC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAuB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,gBAAgB,GAAa,EAAE,CAAC;QACpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,SAAoD,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,SAAS,EAAE,QAAQ;gBAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM;gBACvC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;aACxE;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA8B,EAA+B,EAAE;YAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBACrE,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;4BACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC;YACpD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;YAClD,gBAAgB,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/F,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;gBACjD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,2BAAoB,CAC5B,+EAA+E,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,CAAC,OAAiB,EAAE,EAAE;oBACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACzB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC9B,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,IAAA,sCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAoB,CAC5B,8EAA8E,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,MAAM,mBAAmB,GAAG,CAAC,GAA4B,EAAE,EAAE;gBAC3D,IAAA,sCAAkB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACvC,IAAA,yCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAA+C,CAAC;gBACnE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,mBAAmB,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,GAAyB,EAAE,QAAkB;QAC7E,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE;YACxD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAK,OAAkB,EAAE,CAAC;oBAC1E,OAAQ,OAAmC,CAAC,IAAI,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAwB,CAAC;oBACxD,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;CACF,CAAA;AAhNY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CAgNnC;AAED,YAAY"}
+{"version":3,"file":"policy-enforce.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/policy-enforce.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA8E;AAM9E,6EAAuF;AACvF,yFAAgF;AAChF,2DAAgF;AAmBhF,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,IAAI,WAAW,GAAgE,IAAI,CAAC;AACpF,IAAI,iBAAiB,GAAwC,IAAI,CAAC;AAElE,YAAY;AAEZ,6CAA6C;AAE7C,SAAS,aAAa,CAAC,MAAc,EAAE,UAAkB;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,MAAoB;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAA7B;QACY,cAAS,GAAG,IAAI,6DAA0B,EAAE,CAAC;QAErD,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAkB;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;IAkNJ,CAAC;IAhNC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAuB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,gBAAgB,GAAa,EAAE,CAAC;QACpC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,eAAe,GAAa,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,CAAC,SAAoD,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,SAAS,EAAE,QAAQ;gBAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM;gBACvC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC;aACxE;SACF,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA8B,EAA+B,EAAE;YAChG,MAAM,IAAI,GAAuB,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBACrE,IAAI,MAAM,EAAE,CAAC;wBACX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;4BACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC;YACpD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;YAClD,gBAAgB,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YACpD,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,aAAa,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/F,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;gBACjD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,2BAAoB,CAC5B,yDAAyD,EACzD;wBACE,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,yBAAyB;wBAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;qBACrE,CACF,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,CAAC,OAAiB,EAAE,EAAE;oBACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACzB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,eAAe,CAAC,CAAC;gBAC9B,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,IAAA,sCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,QAAiB,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,2BAAoB,CAC5B,wDAAwD,EACxD;oBACE,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;iBACrE,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE;gBACnF,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAE9B,MAAM,mBAAmB,GAAG,CAAC,GAA4B,EAAE,EAAE;gBAC3D,IAAA,sCAAkB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACvC,IAAA,yCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAA+C,CAAC;gBACnE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,mBAAmB,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,GAAyB,EAAE,QAAkB;QAC7E,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,IAAY,EAAW,EAAE;YACxD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBACvD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAK,OAAkB,EAAE,CAAC;oBAC1E,OAAQ,OAAmC,CAAC,IAAI,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAwB,CAAC;oBACxD,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;CACF,CAAA;AAxNY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CAwNnC;AAED,YAAY"}

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.d.ts

@@ -0,0 +1,16 @@
+import { OnModuleInit } from '@nestjs/common';
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { PolicyEnforceMiddleware } from './policy-enforce.middleware';
+import { VisibilityFilterMiddleware } from './visibility-filter.middleware';
+/**
+ * Ensures security entity-storage middlewares join the server pipeline.
+ * Mirrors domain/document-management bootstrap when webpack splits duplicate middleware tokens.
+ */
+export declare class SecurityEntityStorageBootstrap implements OnModuleInit {
+    private readonly storage;
+    private readonly visibilityFilter;
+    private readonly policyEnforce;
+    constructor(storage: EntityStorageMiddlewareService, visibilityFilter: VisibilityFilterMiddleware, policyEnforce: PolicyEnforceMiddleware);
+    onModuleInit(): void;
+}
+//# sourceMappingURL=security-entity-storage.bootstrap.d.ts.map

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-entity-storage.bootstrap.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/security-entity-storage.bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAI5E;;;GAGG;AACH,qBACa,8BAA+B,YAAW,YAAY;IAE/D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,OAAO,EAAE,8BAA8B,EACvC,gBAAgB,EAAE,0BAA0B,EAC5C,aAAa,EAAE,uBAAuB;IAGzD,YAAY,IAAI,IAAI;CAKrB"}

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityEntityStorageBootstrap = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const policy_enforce_middleware_1 = require("./policy-enforce.middleware");
+const visibility_filter_middleware_1 = require("./visibility-filter.middleware");
+//#region ---- Security entity-storage pipeline bootstrap ----
+/**
+ * Ensures security entity-storage middlewares join the server pipeline.
+ * Mirrors domain/document-management bootstrap when webpack splits duplicate middleware tokens.
+ */
+let SecurityEntityStorageBootstrap = class SecurityEntityStorageBootstrap {
+    constructor(storage, visibilityFilter, policyEnforce) {
+        this.storage = storage;
+        this.visibilityFilter = visibilityFilter;
+        this.policyEnforce = policyEnforce;
+    }
+    onModuleInit() {
+        for (const middleware of [this.visibilityFilter, this.policyEnforce]) {
+            this.storage.registerLateMiddleware(middleware);
+        }
+    }
+};
+exports.SecurityEntityStorageBootstrap = SecurityEntityStorageBootstrap;
+exports.SecurityEntityStorageBootstrap = SecurityEntityStorageBootstrap = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        visibility_filter_middleware_1.VisibilityFilterMiddleware,
+        policy_enforce_middleware_1.PolicyEnforceMiddleware])
+], SecurityEntityStorageBootstrap);
+//#endregion
+//# sourceMappingURL=security-entity-storage.bootstrap.js.map

package/security/src/lib/entity-storage/security-entity-storage.bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-entity-storage.bootstrap.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/security-entity-storage.bootstrap.ts"],"names":[],"mappings":";;;;AAAA,2CAA0D;AAC1D,iEAAwF;AACxF,2EAAsE;AACtE,iFAA4E;AAE5E,8DAA8D;AAE9D;;;GAGG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IACzC,YACmB,OAAuC,EACvC,gBAA4C,EAC5C,aAAsC;QAFtC,YAAO,GAAP,OAAO,CAAgC;QACvC,qBAAgB,GAAhB,gBAAgB,CAA4B;QAC5C,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;IAEJ,YAAY;QACV,KAAK,MAAM,UAAU,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;CACF,CAAA;AAZY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;6CAGiB,qCAA8B;QACrB,yDAA0B;QAC7B,mDAAuB;GAJ9C,8BAA8B,CAY1C;AAED,YAAY"}

package/security/src/lib/entity-storage/visibility-filter.middleware.d.ts

@@ -1,30 +1,31 @@
-import type { Request } from 'express';
 import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
-import { CURRENT_SESSION_KEY } from '../session/current-session.decorator';
-import type { BackendRequestSession } from '../session/backend-session.types';
-type RequestWithSession = Request & {
-    [CURRENT_SESSION_KEY]?: BackendRequestSession;
-};
 /**
-
- * Injects SQL/JQL-level visibility filters before query execution.
-
- * - Hides records with stateInfo.isHidden === true (unless bypassed)
-
- * - Scopes by ownershipInfo.tenantId / applicationId from session (unless bypassed)
-
- * - getOne is not filtered (direct access allowed, matching mock)
-
+ * Injects scope + visibility filters and authorizes getOne / update / delete.
+ *
+ * - Expression policies from PlatformManagement.EntityAccessPolicy
+ * - Strict attribute filters (no soft-null leak)
+ * - Platform-only write policies are readonly for non-platform sessions
+ * - HTTP clients cannot pass scope bypass (stripped at controller); server locals still can
+ *
+ * Singleton + ALS request (not Nest REQUEST DI). Registered via
+ * {@link SecurityEntityStorageBootstrap}.
  */
 export declare class VisibilityFilterMiddleware implements EntityStorageMiddleware {
-    private readonly request;
     readonly target: {
         ops: AXPEntityOp[];
         order: number;
     };
-    constructor(request: RequestWithSession);
     execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
-    private resolveUserTenantId;
+    private resolveSession;
+    private loadExisting;
+    /**
+     * identity-read: users with active TenantUser for session tenant AND
+     * active TenantUserAppAccess for session application (when configured).
+     * Always includes the signed-in user via expression self-check on getOne;
+     * list filter uses membership ids only (self still appears if they have membership).
+     */
+    private resolveIdentityMembershipUserIds;
+    private resolveSharedResourceIds;
+    private reloadPolicyCache;
 }
-export {};
 //# sourceMappingURL=visibility-filter.middleware.d.ts.map

package/security/src/lib/entity-storage/visibility-filter.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"visibility-filter.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIvC,OAAO,EAEL,WAAW,EAEX,oBAAoB,EAEpB,uBAAuB,EAExB,MAAM,wCAAwC,CAAC;AAgBhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAY9E,KAAK,kBAAkB,GAAG,OAAO,GAAG;IAElC,CAAC,mBAAmB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAE/C,CAAC;AAIF;;;;;;;;;;GAUG;AAEH,qBAEa,0BAA2B,YAAW,uBAAuB;IAY3C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAVrD,QAAQ,CAAC,MAAM;aAEK,WAAW,EAAE;;MAI/B;gBAI4C,OAAO,EAAE,kBAAkB;IAInE,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YA0FpE,mBAAmB;CAwBlC"}
+{"version":3,"file":"visibility-filter.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EAGxB,MAAM,wCAAwC,CAAC;AA8BhD;;;;;;;;;;GAUG;AACH,qBACa,0BAA2B,YAAW,uBAAuB;IACxE,QAAQ,CAAC,MAAM;aAC0D,WAAW,EAAE;;MAEpF;IAEI,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA6KlF,OAAO,CAAC,cAAc;YAKR,YAAY;IAc1B;;;;;OAKG;YACW,gCAAgC;YAmFhC,wBAAwB;YAoCxB,iBAAiB;CAgBhC"}

package/security/src/lib/entity-storage/visibility-filter.middleware.js

@@ -3,82 +3,328 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VisibilityFilterMiddleware = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
 const lodash_es_1 = require("lodash-es");
+const core_1 = require("@acorex-platform/framework-server/core");
 const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
 const current_session_decorator_1 = require("../session/current-session.decorator");
-//#region ---- Visibility filter middleware (server) ----
-const USER_ENTITY = 'SecurityManagement.User';
+const MUTATE_OPS = ['update', 'delete'];
+const READ_FILTER_OPS = ['query', 'aggregate'];
 /**
-
- * Injects SQL/JQL-level visibility filters before query execution.
-
- * - Hides records with stateInfo.isHidden === true (unless bypassed)
-
- * - Scopes by ownershipInfo.tenantId / applicationId from session (unless bypassed)
-
- * - getOne is not filtered (direct access allowed, matching mock)
-
+ * Injects scope + visibility filters and authorizes getOne / update / delete.
+ *
+ * - Expression policies from PlatformManagement.EntityAccessPolicy
+ * - Strict attribute filters (no soft-null leak)
+ * - Platform-only write policies are readonly for non-platform sessions
+ * - HTTP clients cannot pass scope bypass (stripped at controller); server locals still can
+ *
+ * Singleton + ALS request (not Nest REQUEST DI). Registered via
+ * {@link SecurityEntityStorageBootstrap}.
  */
 let VisibilityFilterMiddleware = class VisibilityFilterMiddleware {
-    constructor(request) {
-        this.request = request;
+    constructor() {
         this.target = {
-            ops: ['query'],
+            ops: ['query', 'aggregate', 'getOne', 'create', 'update', 'delete'],
             order: 8,
         };
     }
     async execute(ctx, next) {
-        if (!ctx.request) {
+        if (!ctx.request &&
+            READ_FILTER_OPS.includes(ctx.op) === false &&
+            ctx.op !== 'getOne' &&
+            ctx.op !== 'create' &&
+            !MUTATE_OPS.includes(ctx.op)) {
             await next();
             return;
         }
-        const params = ctx.request.params;
+        // Engine workers and trusted system-command writers (schedule sync, scanners)
+        // operate without an HTTP session tenant — do not apply scope gates.
+        if ((0, abstract_1.isEngineStorageBypass)(ctx.locals) || (0, abstract_1.isSystemCommandBypass)(ctx.locals)) {
+            await next();
+            if (ctx.entityName === abstract_1.ENTITY_ACCESS_POLICY_ENTITY && (ctx.op === 'create' || MUTATE_OPS.includes(ctx.op))) {
+                await this.reloadPolicyCache(ctx);
+            }
+            return;
+        }
+        const params = ctx.request?.params;
+        // Bypass is for trusted server callers (login, password-reset, nested lookups).
+        // HTTP no longer accepts these query params — see EntityStorageController.
         const bypassVisibility = (0, abstract_1.isFilterBypassed)(params, abstract_1.VISIBILITY_FILTER_BYPASS) ||
             ctx.locals.get(abstract_1.VISIBILITY_FILTER_BYPASS) === true;
-        const bypassOwnership = (0, abstract_1.isFilterBypassed)(params, abstract_1.OWNERSHIP_FILTER_BYPASS) ||
-            ctx.locals.get(abstract_1.OWNERSHIP_FILTER_BYPASS) === true;
-        if (bypassVisibility && bypassOwnership) {
+        const bypassScope = (0, abstract_1.isFilterBypassed)(params, abstract_1.SCOPE_FILTER_BYPASS) ||
+            ctx.locals.get(abstract_1.SCOPE_FILTER_BYPASS) === true;
+        if (bypassVisibility && bypassScope) {
             await next();
             return;
         }
-        const session = this.request?.[current_session_decorator_1.CURRENT_SESSION_KEY];
+        const session = this.resolveSession();
         const sessionTenantId = session?.tenantId;
         const sessionApplicationId = session?.applicationId;
-        let effectiveTenantId = sessionTenantId;
-        if (!bypassOwnership && !effectiveTenantId && session?.userId) {
-            effectiveTenantId = await this.resolveUserTenantId(ctx, session.userId);
-        }
-        const systemFilter = (0, abstract_1.buildEntityVisibilityAxpFilter)({
-            tenantId: effectiveTenantId,
-            applicationId: sessionApplicationId,
-            bypassVisibility,
-            bypassOwnership,
-        });
-        if (systemFilter) {
-            ctx.request = {
-                ...ctx.request,
-                filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, systemFilter),
-            };
+        const policy = (0, abstract_1.resolveEntityAccessPolicy)(ctx.entityName);
+        let membershipUserIds;
+        let sharedResourceIds;
+        if (!bypassScope && sessionTenantId) {
+            if (policy.read === 'identity-read') {
+                membershipUserIds = await this.resolveIdentityMembershipUserIds(ctx, sessionTenantId, sessionApplicationId);
+            }
+            if (policy.read === 'tenant-or-share-read') {
+                sharedResourceIds = await this.resolveSharedResourceIds(ctx, sessionTenantId, ctx.entityName);
+            }
+        }
+        if (READ_FILTER_OPS.includes(ctx.op) && ctx.request) {
+            const systemFilter = (0, abstract_1.buildEntityVisibilityAxpFilter)({
+                tenantId: sessionTenantId,
+                applicationId: sessionApplicationId,
+                userId: session?.userId,
+                bypassVisibility,
+                bypassScope,
+                policy,
+                membershipUserIds,
+                sharedResourceIds,
+            });
+            if (systemFilter) {
+                ctx.request = {
+                    ...ctx.request,
+                    filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, systemFilter),
+                };
+            }
+            await next();
+            return;
+        }
+        if (ctx.op === 'getOne') {
+            await next();
+            if (bypassScope) {
+                return;
+            }
+            const record = ctx.result;
+            if (!(0, abstract_1.evaluateRecordAccess)({
+                record,
+                policy,
+                mode: 'read',
+                session: {
+                    tenantId: sessionTenantId,
+                    applicationId: sessionApplicationId,
+                    userId: session?.userId,
+                },
+                membershipUserIds,
+                sharedResourceIds,
+            })) {
+                ctx.result = null;
+            }
+            return;
+        }
+        if (ctx.op === 'create') {
+            if (!bypassScope && (0, abstract_1.isPlatformOnlyWrite)(policy)) {
+                // Fail closed: missing session must not skip the platform-only gate.
+                if (!sessionTenantId || !(0, abstract_1.isPlatformSessionTenant)(sessionTenantId)) {
+                    throw new core_1.MiddlewareAbortError('Only the platform tenant may manage this resource.', {
+                        code: 'SCOPE_READONLY',
+                        status: 403,
+                    });
+                }
+            }
+            await next();
+            if (ctx.entityName === abstract_1.ENTITY_ACCESS_POLICY_ENTITY) {
+                await this.reloadPolicyCache(ctx);
+            }
+            return;
+        }
+        if (MUTATE_OPS.includes(ctx.op)) {
+            if (!bypassScope) {
+                const existing = await this.loadExisting(ctx);
+                if (!(0, abstract_1.evaluateRecordAccess)({
+                    record: existing,
+                    policy,
+                    mode: 'write',
+                    session: {
+                        tenantId: sessionTenantId,
+                        applicationId: sessionApplicationId,
+                        userId: session?.userId,
+                    },
+                    membershipUserIds,
+                    sharedResourceIds,
+                })) {
+                    throw new core_1.MiddlewareAbortError('Record not found or not accessible in current scope.', {
+                        code: 'SCOPE_ACCESS_DENIED',
+                        status: 404,
+                    });
+                }
+                const stateInfo = (0, lodash_es_1.get)(existing, 'stateInfo');
+                const platformWriter = (0, abstract_1.isPlatformSessionTenant)(sessionTenantId);
+                const platformManagedReadonly = (0, abstract_1.isPlatformOnlyWrite)(policy) && !platformWriter;
+                const immutableBlocked = stateInfo?.['isImmutable'] === true && !platformWriter;
+                if (immutableBlocked || platformManagedReadonly) {
+                    throw new core_1.MiddlewareAbortError('This record is readonly and cannot be modified.', {
+                        code: 'SCOPE_READONLY',
+                        status: 403,
+                    });
+                }
+                // Never trust client-supplied scopeInfo on update.
+                if (ctx.data && typeof ctx.data === 'object') {
+                    const data = { ...ctx.data };
+                    delete data['scopeInfo'];
+                    ctx.data = data;
+                }
+            }
+            await next();
+            if (ctx.entityName === abstract_1.ENTITY_ACCESS_POLICY_ENTITY) {
+                await this.reloadPolicyCache(ctx);
+            }
+            return;
         }
         await next();
     }
-    async resolveUserTenantId(ctx, userId) {
+    resolveSession() {
+        const req = (0, core_1.getEntityStorageRequest)();
+        return req?.[current_session_decorator_1.CURRENT_SESSION_KEY] ?? null;
+    }
+    async loadExisting(ctx) {
+        if (ctx.previous && typeof ctx.previous === 'object') {
+            return ctx.previous;
+        }
+        if (!ctx.id) {
+            return null;
+        }
+        try {
+            return (await ctx.backend.getOne(ctx.entityName, ctx.id));
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * identity-read: users with active TenantUser for session tenant AND
+     * active TenantUserAppAccess for session application (when configured).
+     * Always includes the signed-in user via expression self-check on getOne;
+     * list filter uses membership ids only (self still appears if they have membership).
+     */
+    async resolveIdentityMembershipUserIds(ctx, tenantId, applicationId) {
+        const runtime = (0, abstract_1.getIsolationRuntimeConfig)();
+        const membershipEntity = runtime.tenantUserEntityName;
+        if (!membershipEntity) {
+            return [];
+        }
+        try {
+            const result = await ctx.backend.query(membershipEntity, {
+                skip: 0,
+                take: 10_000,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        { field: 'tenantId', operator: { type: 'equal' }, value: tenantId },
+                        {
+                            logic: 'or',
+                            filters: [
+                                { field: 'statusId', operator: { type: 'equal' }, value: 'active' },
+                                { field: 'statusId', operator: { type: 'isNull' } },
+                                { field: 'statusId', operator: { type: 'isEmpty' } },
+                            ],
+                        },
+                    ],
+                },
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const tenantUsers = (result?.items ?? []);
+            let userIds = tenantUsers
+                .map((row) => row['userId'])
+                .filter((id) => typeof id === 'string' && !!id);
+            const appAccessEntity = runtime.tenantUserAppAccessEntityName;
+            if (applicationId && appAccessEntity && userIds.length) {
+                const tenantUserIds = tenantUsers
+                    .map((row) => row['id'])
+                    .filter((id) => typeof id === 'string' && !!id);
+                const appAccess = await ctx.backend.query(appAccessEntity, {
+                    skip: 0,
+                    take: 10_000,
+                    filter: {
+                        logic: 'and',
+                        filters: [
+                            { field: 'tenantUserId', operator: { type: 'in' }, value: tenantUserIds },
+                            { field: 'applicationId', operator: { type: 'equal' }, value: applicationId },
+                            {
+                                logic: 'or',
+                                filters: [
+                                    { field: 'statusId', operator: { type: 'equal' }, value: 'active' },
+                                    { field: 'statusId', operator: { type: 'isNull' } },
+                                    { field: 'statusId', operator: { type: 'isEmpty' } },
+                                ],
+                            },
+                        ],
+                    },
+                    params: {
+                        [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                        [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                    },
+                });
+                const allowedTenantUserIds = new Set((appAccess?.items ?? [])
+                    .map((row) => row['tenantUserId'])
+                    .filter((id) => typeof id === 'string' && !!id));
+                userIds = tenantUsers
+                    .filter((row) => allowedTenantUserIds.has(String(row['id'] ?? '')))
+                    .map((row) => row['userId'])
+                    .filter((id) => typeof id === 'string' && !!id);
+            }
+            return [...new Set(userIds)];
+        }
+        catch {
+            return [];
+        }
+    }
+    async resolveSharedResourceIds(ctx, tenantId, resourceType) {
+        const resourceShareEntityName = (0, abstract_1.getIsolationRuntimeConfig)().resourceShareEntityName;
+        if (!resourceShareEntityName) {
+            return [];
+        }
+        try {
+            const result = await ctx.backend.query(resourceShareEntityName, {
+                skip: 0,
+                take: 10_000,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        { field: 'resourceInfo.type', operator: { type: 'equal' }, value: resourceType },
+                        { field: 'shareInfo.sharedWithTenantId', operator: { type: 'equal' }, value: tenantId },
+                        { field: 'shareInfo.status', operator: { type: 'equal' }, value: 'active' },
+                    ],
+                },
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const items = (result?.items ?? []);
+            const ids = items
+                .map((row) => (0, lodash_es_1.get)(row, 'resourceInfo.id'))
+                .filter((id) => typeof id === 'string' && !!id);
+            return [...new Set(ids)];
+        }
+        catch {
+            return [];
+        }
+    }
+    async reloadPolicyCache(ctx) {
         try {
-            const user = (await ctx.backend.getOne(USER_ENTITY, userId));
-            const tenantId = (0, lodash_es_1.get)(user, 'ownershipInfo.tenantId');
-            return typeof tenantId === 'string' && tenantId ? tenantId : undefined;
+            const result = await ctx.backend.query(abstract_1.ENTITY_ACCESS_POLICY_ENTITY, {
+                skip: 0,
+                take: 10_000,
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const items = (result?.items ?? []);
+            (0, abstract_1.setEntityAccessPolicyCache)(items);
         }
         catch {
-            return undefined;
+            // Schema may not be registered yet during early boot.
         }
     }
 };
 exports.VisibilityFilterMiddleware = VisibilityFilterMiddleware;
 exports.VisibilityFilterMiddleware = VisibilityFilterMiddleware = tslib_1.__decorate([
-    (0, common_1.Injectable)({ scope: common_1.Scope.REQUEST }),
-    tslib_1.__param(0, (0, common_1.Inject)(core_1.REQUEST)),
-    tslib_1.__metadata("design:paramtypes", [Object])
+    (0, common_1.Injectable)()
 ], VisibilityFilterMiddleware);
 //#endregion
 //# sourceMappingURL=visibility-filter.middleware.js.map