@acorex-platform/framework-server 0.0.18 → 0.0.21

package/jql/abstract/src/lib/entity-store/entity-access-expression.engine.js

@@ -0,0 +1,284 @@
+"use strict";
+//#region ---- Access expression engine ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAccessRowView = buildAccessRowView;
+exports.buildAccessSession = buildAccessSession;
+exports.evaluateAccessExpression = evaluateAccessExpression;
+exports.buildDefaultAccessEvalContext = buildDefaultAccessEvalContext;
+const entity_access_expression_builtins_1 = require("./entity-access-expression.builtins");
+const entity_isolation_policy_1 = require("./entity-isolation-policy");
+/**
+ * Builds the flattened row view used by expressions.
+ * Prefer scopeInfo attributes; fall back to top-level domain fields (membership, SystemInsight).
+ */
+function buildAccessRowView(record) {
+    if (!record) {
+        return {};
+    }
+    const scopeInfo = record['scopeInfo'] ?? {};
+    const shareInfo = record['shareInfo'];
+    return {
+        ...record,
+        id: record['id'] != null ? String(record['id']) : undefined,
+        tenantId: (typeof scopeInfo['tenantId'] === 'string' && scopeInfo['tenantId']) ||
+            (typeof record['tenantId'] === 'string' ? record['tenantId'] : undefined),
+        applicationId: (typeof scopeInfo['applicationId'] === 'string' && scopeInfo['applicationId']) ||
+            (typeof record['applicationId'] === 'string' ? record['applicationId'] : undefined),
+        buId: (typeof scopeInfo['buId'] === 'string' && scopeInfo['buId']) ||
+            (typeof record['buId'] === 'string' ? record['buId'] : undefined),
+        shareInfo: shareInfo && typeof shareInfo === 'object' ? shareInfo : undefined,
+    };
+}
+function buildAccessSession(options) {
+    return {
+        userId: options.userId,
+        tenantId: options.tenantId,
+        applicationId: options.applicationId,
+        isPlatform: (0, entity_isolation_policy_1.isPlatformSessionTenant)(options.tenantId),
+    };
+}
+function readPath(root, path) {
+    const parts = path.split('.');
+    let cur = root;
+    for (const part of parts) {
+        if (cur == null || typeof cur !== 'object') {
+            return undefined;
+        }
+        cur = cur[part];
+    }
+    return cur;
+}
+function normalizeComparable(value) {
+    if (value === null || value === undefined || value === '') {
+        return undefined;
+    }
+    if (typeof value === 'boolean' || typeof value === 'number') {
+        return value;
+    }
+    return String(value);
+}
+/**
+ * Safe, limited expression evaluator for access policies.
+ * Supports: true/false, session/row paths, ==, !=, &&, ||, !, (),
+ * and helpers user.hasAppMembership() / user.inBu(x) / user.hasShare(x).
+ * Denies on parse/eval errors.
+ */
+function evaluateAccessExpression(builtinOrExpression, ctx) {
+    const expression = (0, entity_access_expression_builtins_1.resolveAccessExpression)(builtinOrExpression).trim();
+    if (!expression) {
+        return false;
+    }
+    if (expression === 'true') {
+        return true;
+    }
+    if (expression === 'false') {
+        return false;
+    }
+    // Unresolved kebab builtin names (e.g. stale webpack copy missing a map entry)
+    // must not be parsed as expressions — hyphens break the tokenizer and deny closed.
+    if (/^[a-z][a-z0-9]*(-[a-z0-9]+)+$/.test(expression)) {
+        return false;
+    }
+    try {
+        return evalBoolean(expression, ctx);
+    }
+    catch {
+        return false;
+    }
+}
+function evalBoolean(expression, ctx) {
+    // Tokenize a minimal boolean grammar.
+    const tokens = tokenize(expression);
+    let i = 0;
+    const peek = () => tokens[i];
+    const consume = () => tokens[i++];
+    const parsePrimary = () => {
+        const t = peek();
+        if (!t) {
+            throw new Error('unexpected end');
+        }
+        if (t === 'true') {
+            consume();
+            return true;
+        }
+        if (t === 'false') {
+            consume();
+            return false;
+        }
+        if (t === '!') {
+            consume();
+            return !parsePrimary();
+        }
+        if (t === '(') {
+            consume();
+            const inner = parseOr();
+            if (consume() !== ')') {
+                throw new Error('expected )');
+            }
+            return inner;
+        }
+        // path == path | path != path | helper()
+        if (t.startsWith('user.')) {
+            return parseHelper();
+        }
+        const leftTok = consume();
+        const op = peek();
+        if (op === '==' || op === '!=') {
+            consume();
+            const rightTok = consume();
+            const left = resolveToken(leftTok, ctx);
+            const right = resolveToken(rightTok, ctx);
+            const eq = normalizeComparable(left) === normalizeComparable(right);
+            return op === '==' ? eq : !eq;
+        }
+        // Bare path / helper treated as truthiness
+        const value = resolveToken(leftTok, ctx);
+        return !!normalizeComparable(value);
+    };
+    const parseHelper = () => {
+        const name = consume(); // user.hasAppMembership / user.inBu / user.hasShare
+        if (consume() !== '(') {
+            throw new Error('expected (');
+        }
+        const args = [];
+        if (peek() !== ')') {
+            args.push(consume());
+            while (peek() === ',') {
+                consume();
+                args.push(consume());
+            }
+        }
+        if (consume() !== ')') {
+            throw new Error('expected )');
+        }
+        if (name === 'user.hasAppMembership') {
+            return ctx.user.hasAppMembership();
+        }
+        if (name === 'user.inBu') {
+            const bu = args[0] ? resolveToken(args[0], ctx) : undefined;
+            return ctx.user.inBu(typeof bu === 'string' || bu === undefined ? bu : String(bu));
+        }
+        if (name === 'user.hasShare') {
+            const id = args[0] ? resolveToken(args[0], ctx) : undefined;
+            return ctx.user.hasShare(id == null ? undefined : String(id));
+        }
+        throw new Error(`unknown helper ${name}`);
+    };
+    const parseAnd = () => {
+        let value = parsePrimary();
+        while (peek() === '&&') {
+            consume();
+            const right = parsePrimary();
+            value = value && right;
+        }
+        return value;
+    };
+    const parseOr = () => {
+        let value = parseAnd();
+        while (peek() === '||') {
+            consume();
+            const right = parseAnd();
+            value = value || right;
+        }
+        return value;
+    };
+    const result = parseOr();
+    if (i !== tokens.length) {
+        throw new Error('trailing tokens');
+    }
+    return result;
+}
+function resolveToken(token, ctx) {
+    if (token === 'true') {
+        return true;
+    }
+    if (token === 'false') {
+        return false;
+    }
+    if ((token.startsWith('"') && token.endsWith('"')) ||
+        (token.startsWith("'") && token.endsWith("'"))) {
+        return token.slice(1, -1);
+    }
+    if (token.startsWith('session.')) {
+        return readPath(ctx.session, token.slice('session.'.length));
+    }
+    if (token.startsWith('row.')) {
+        return readPath(ctx.row, token.slice('row.'.length));
+    }
+    // Bare identifiers are invalid
+    throw new Error(`unresolved token ${token}`);
+}
+function tokenize(expression) {
+    const tokens = [];
+    let i = 0;
+    while (i < expression.length) {
+        const ch = expression[i];
+        if (/\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        if (expression.startsWith('&&', i)) {
+            tokens.push('&&');
+            i += 2;
+            continue;
+        }
+        if (expression.startsWith('||', i)) {
+            tokens.push('||');
+            i += 2;
+            continue;
+        }
+        if (expression.startsWith('==', i)) {
+            tokens.push('==');
+            i += 2;
+            continue;
+        }
+        if (expression.startsWith('!=', i)) {
+            tokens.push('!=');
+            i += 2;
+            continue;
+        }
+        if (ch === '!' || ch === '(' || ch === ')' || ch === ',') {
+            tokens.push(ch);
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            const quote = ch;
+            let j = i + 1;
+            while (j < expression.length && expression[j] !== quote) {
+                j++;
+            }
+            tokens.push(expression.slice(i, j + 1));
+            i = j + 1;
+            continue;
+        }
+        // identifier / path / helper name / true|false
+        let j = i;
+        while (j < expression.length && /[A-Za-z0-9_$.]/.test(expression[j])) {
+            j++;
+        }
+        if (j === i) {
+            throw new Error(`bad char ${ch}`);
+        }
+        tokens.push(expression.slice(i, j));
+        i = j;
+    }
+    return tokens;
+}
+function buildDefaultAccessEvalContext(options) {
+    const membershipUserIds = options.membershipUserIds ?? [];
+    const sharedResourceIds = options.sharedResourceIds ?? [];
+    return {
+        session: options.session,
+        row: options.row,
+        membershipUserIds,
+        sharedResourceIds,
+        user: {
+            hasAppMembership: () => !!options.row.id && membershipUserIds.includes(String(options.row.id)),
+            inBu: (_buId) => false,
+            hasShare: (resourceId) => !!resourceId && sharedResourceIds.includes(resourceId),
+        },
+    };
+}
+//#endregion
+//# sourceMappingURL=entity-access-expression.engine.js.map

package/jql/abstract/src/lib/entity-store/entity-access-expression.engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-expression.engine.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-expression.engine.ts"],"names":[],"mappings":";AAAA,4CAA4C;;AAc5C,gDAsBC;AAED,gDAWC;AA8BD,4DAyBC;AAyMD,sEAqBC;AApUD,2FAA8E;AAM9E,uEAAoE;AAEpE;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,MAAkD;IAElD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,SAAS,GAAI,MAAM,CAAC,WAAW,CAAyC,IAAI,EAAE,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,MAAM;QACT,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,QAAQ,EACN,CAAC,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;YACpE,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,aAAa,EACX,CAAC,OAAO,SAAS,CAAC,eAAe,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,eAAe,CAAC,CAAC;YAC9E,CAAC,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,EACF,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,SAAS,EAAE,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAC9E,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAIlC;IACC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,UAAU,EAAE,IAAA,iDAAuB,EAAC,OAAO,CAAC,QAAQ,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAY,IAAI,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CACtC,mBAA2B,EAC3B,GAAyB;IAEzB,MAAM,UAAU,GAAG,IAAA,2DAAuB,EAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,GAAyB;IAChE,sCAAsC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAElC,MAAM,YAAY,GAAG,GAAY,EAAE;QACjC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;QAClB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,GACN,mBAAmB,CAAC,IAAI,CAAC,KAAK,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,2CAA2C;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,GAAY,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,CAAC,oDAAoD;QAC5E,IAAI,OAAO,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrB,OAAO,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAClB,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAE,EAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CACtB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CACpC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAY,EAAE;QAC7B,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;QAC3B,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAY,EAAE;QAC5B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACvB,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,GAAyB;IAC5D,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,+BAA+B;IAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBACxD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,CAAC,EAAE,CAAC;QACN,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,GAAG,CAAC,CAAC;IACR,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,6BAA6B,CAAC,OAK7C;IACC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,iBAAiB;QACjB,iBAAiB;QACjB,IAAI,EAAE;YACJ,gBAAgB,EAAE,GAAG,EAAE,CACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACtB,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE,CACvB,CAAC,CAAC,UAAU,IAAI,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC;SACzD;KACF,CAAC;AACJ,CAAC;AAED,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.d.ts

@@ -0,0 +1,12 @@
+import type { AXPEntityAccessPolicyRecord } from './entity-access-policy.types';
+export declare const ENTITY_ACCESS_POLICY_ENTITY = "PlatformManagement.EntityAccessPolicy";
+export declare function setEntityAccessPolicyCache(policies: readonly AXPEntityAccessPolicyRecord[]): void;
+export declare function clearEntityAccessPolicyCache(): void;
+export declare function isEntityAccessPolicyCacheLoaded(): boolean;
+export declare function getEntityAccessPolicyCache(): readonly AXPEntityAccessPolicyRecord[];
+/**
+ * Match order: exact entityName → longest wildcard pattern → `*` → code fallback.
+ */
+export declare function resolveEntityAccessPolicy(entityName: string): AXPEntityAccessPolicyRecord;
+export declare function entityMatchesPattern(entityName: string, pattern: string): boolean;
+//# sourceMappingURL=entity-access-policy.cache.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.cache.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.cache.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF,eAAO,MAAM,2BAA2B,0CAA0C,CAAC;AA4BnF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,GAC/C,IAAI,CAaN;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAInD;AAED,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED,wBAAgB,0BAA0B,IAAI,SAAS,2BAA2B,EAAE,CAEnF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,GACjB,2BAA2B,CA0B7B;AAOD,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAYjF"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.js

@@ -0,0 +1,97 @@
+"use strict";
+//#region ---- Entity access policy cache ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTITY_ACCESS_POLICY_ENTITY = void 0;
+exports.setEntityAccessPolicyCache = setEntityAccessPolicyCache;
+exports.clearEntityAccessPolicyCache = clearEntityAccessPolicyCache;
+exports.isEntityAccessPolicyCacheLoaded = isEntityAccessPolicyCacheLoaded;
+exports.getEntityAccessPolicyCache = getEntityAccessPolicyCache;
+exports.resolveEntityAccessPolicy = resolveEntityAccessPolicy;
+exports.entityMatchesPattern = entityMatchesPattern;
+exports.ENTITY_ACCESS_POLICY_ENTITY = 'PlatformManagement.EntityAccessPolicy';
+const DEFAULT_FALLBACK_POLICY = {
+    id: '__fallback-tenant-owner__',
+    entityName: '*',
+    read: 'tenant-owner',
+    write: 'tenant-owner',
+    enabled: true,
+    description: 'Fail-closed code fallback when no policy row is seeded.',
+};
+const GLOBAL_KEY = '__AXP_ENTITY_ACCESS_POLICY_CACHE__';
+function cacheState() {
+    const g = globalThis;
+    if (!g[GLOBAL_KEY]) {
+        g[GLOBAL_KEY] = { cachedPolicies: [], loaded: false };
+    }
+    return g[GLOBAL_KEY];
+}
+function setEntityAccessPolicyCache(policies) {
+    const state = cacheState();
+    state.cachedPolicies = policies
+        .filter((p) => p && p.enabled !== false && typeof p.entityName === 'string' && !!p.entityName)
+        .map((p) => ({
+        id: String(p.id),
+        entityName: p.entityName,
+        read: p.read || 'tenant-owner',
+        write: p.write || 'tenant-owner',
+        enabled: p.enabled !== false,
+        description: p.description,
+    }));
+    state.loaded = true;
+}
+function clearEntityAccessPolicyCache() {
+    const state = cacheState();
+    state.cachedPolicies = [];
+    state.loaded = false;
+}
+function isEntityAccessPolicyCacheLoaded() {
+    return cacheState().loaded;
+}
+function getEntityAccessPolicyCache() {
+    return cacheState().cachedPolicies;
+}
+/**
+ * Match order: exact entityName → longest wildcard pattern → `*` → code fallback.
+ */
+function resolveEntityAccessPolicy(entityName) {
+    const cachedPolicies = cacheState().cachedPolicies;
+    const exact = cachedPolicies.find((p) => p.entityName === entityName);
+    if (exact) {
+        return exact;
+    }
+    const patterns = cachedPolicies
+        .filter((p) => p.entityName.includes('*') && p.entityName !== '*')
+        .map((p) => ({
+        policy: p,
+        rank: patternRank(p.entityName),
+    }))
+        .filter((x) => entityMatchesPattern(entityName, x.policy.entityName))
+        .sort((a, b) => b.rank - a.rank);
+    if (patterns.length) {
+        return patterns[0].policy;
+    }
+    const star = cachedPolicies.find((p) => p.entityName === '*');
+    if (star) {
+        return star;
+    }
+    return DEFAULT_FALLBACK_POLICY;
+}
+function patternRank(pattern) {
+    // Longer / more specific patterns win (SystemInsight.* before *).
+    return pattern.replace(/\*/g, '').length;
+}
+function entityMatchesPattern(entityName, pattern) {
+    if (pattern === '*') {
+        return true;
+    }
+    if (!pattern.includes('*')) {
+        return entityName === pattern;
+    }
+    // Support prefix.* and exact-ish globs with a single trailing/segment wildcard.
+    const escaped = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*/g, '.*');
+    return new RegExp(`^${escaped}$`).test(entityName);
+}
+//#endregion
+//# sourceMappingURL=entity-access-policy.cache.js.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.cache.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.cache.ts"],"names":[],"mappings":";AAAA,8CAA8C;;;AAgC9C,gEAeC;AAED,oEAIC;AAED,0EAEC;AAED,gEAEC;AAKD,8DA4BC;AAOD,oDAYC;AA7GY,QAAA,2BAA2B,GAAG,uCAAuC,CAAC;AAEnF,MAAM,uBAAuB,GAAgC;IAC3D,EAAE,EAAE,2BAA2B;IAC/B,UAAU,EAAE,GAAG;IACf,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,yDAAyD;CACvE,CAAC;AAOF,MAAM,UAAU,GAAG,oCAAoC,CAAC;AAExD,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAE,CAAC;AACxB,CAAC;AAED,SAAgB,0BAA0B,CACxC,QAAgD;IAEhD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,KAAK,CAAC,cAAc,GAAG,QAAQ;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;SAC7F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,cAAc;QAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,cAAc;QAChC,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK;QAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CAAC;IACN,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,SAAgB,4BAA4B;IAC1C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;IAC1B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAgB,+BAA+B;IAC7C,OAAO,UAAU,EAAE,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,SAAgB,0BAA0B;IACxC,OAAO,UAAU,EAAE,CAAC,cAAc,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CACvC,UAAkB;IAElB,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC,cAAc,CAAC;IACnD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IACtE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;KAChC,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;SACpE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAC9D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,kEAAkE;IAClE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED,SAAgB,oBAAoB,CAAC,UAAkB,EAAE,OAAe;IACtE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,KAAK,OAAO,CAAC;IAChC,CAAC;IACD,gFAAgF;IAChF,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.d.ts

@@ -0,0 +1,44 @@
+/** Stored policy row shape (PlatformManagement.EntityAccessPolicy). */
+export interface AXPEntityAccessPolicyRecord {
+    id: string;
+    /** Exact name or pattern: `ReportManagement.Report` | `SystemInsight.*` | `*`. */
+    entityName: string;
+    /** Builtin name or inline expression. */
+    read: string;
+    /** Builtin name or inline expression. */
+    write: string;
+    enabled?: boolean;
+    description?: string;
+}
+export interface AXPAccessSession {
+    userId?: string;
+    tenantId?: string;
+    applicationId?: string;
+    isPlatform: boolean;
+}
+/** Flattened row view for expression evaluation. */
+export interface AXPAccessRowView {
+    id?: string;
+    tenantId?: string;
+    applicationId?: string;
+    buId?: string;
+    [key: string]: unknown;
+}
+export interface AXPAccessEvalContext {
+    session: AXPAccessSession;
+    row: AXPAccessRowView;
+    /** Pre-resolved identity-read membership user ids. */
+    membershipUserIds?: string[];
+    /** Pre-resolved ResourceShare resource ids. */
+    sharedResourceIds?: string[];
+    /** Helpers (sync predicates for record checks). */
+    user: {
+        hasAppMembership: () => boolean;
+        inBu: (buId: string | undefined) => boolean;
+        hasShare: (resourceId: string | undefined) => boolean;
+    };
+}
+export type AXPAccessMode = 'read' | 'write';
+/** How create middleware should stamp scopeInfo. */
+export type AXPCreateScopeStamp = 'empty' | 'tenant' | 'app' | 'none';
+//# sourceMappingURL=entity-access-policy.types.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.types.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.types.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,GAAG,EAAE,gBAAgB,CAAC;IACtB,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,mDAAmD;IACnD,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAM,OAAO,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;QAC5C,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;KACvD,CAAC;CACH;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7C,oDAAoD;AACpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC"}

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- Entity access policy types ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=entity-access-policy.types.js.map

package/jql/abstract/src/lib/entity-store/entity-access-policy.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-access-policy.types.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-access-policy.types.ts"],"names":[],"mappings":";AAAA,8CAA8C;;AAmD9C,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-isolation-policy.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Runtime platform-operator tenant detection and small isolation hooks.
+ * Entity access policies live in PlatformManagement.EntityAccessPolicy
+ * (DB + expression cache) — this leaf holds only configure APIs with empty defaults.
+ *
+ * Uses globalThis so Nest/webpack duplicate module instances share one runtime set.
+ */
+export interface AXPIsolationRuntimeConfig {
+    /** Entity used to resolve ResourceShare grants. */
+    resourceShareEntityName?: string;
+    /** Membership entity for identity-read (TenantUser). */
+    tenantUserEntityName?: string;
+    /** App-access membership entity for identity-read. */
+    tenantUserAppAccessEntityName?: string;
+}
+/**
+ * Sets platform operator tenant ids (from Tenant.isPlatform query / seed).
+ * Empty set → no session is treated as platform (safe default).
+ */
+export declare function configurePlatformTenantIds(tenantIds: readonly string[]): void;
+export declare function getPlatformTenantIds(): readonly string[];
+export declare function getPrimaryPlatformTenantId(): string | undefined;
+export declare function isPlatformSessionTenant(tenantId: string | undefined): boolean;
+export declare function configureIsolationRuntime(config: AXPIsolationRuntimeConfig): void;
+export declare function getIsolationRuntimeConfig(): Readonly<AXPIsolationRuntimeConfig>;
+//# sourceMappingURL=entity-isolation-policy.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-isolation-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-isolation-policy.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-isolation-policy.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,MAAM,WAAW,yBAAyB;IACxC,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wDAAwD;IACxD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sDAAsD;IACtD,6BAA6B,CAAC,EAAE,MAAM,CAAC;CACxC;AA0BD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAI7E;AAED,wBAAgB,oBAAoB,IAAI,SAAS,MAAM,EAAE,CAExD;AAED,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,SAAS,CAE/D;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAGjF;AAED,wBAAgB,yBAAyB,IAAI,QAAQ,CAAC,yBAAyB,CAAC,CAE/E"}

package/jql/abstract/src/lib/entity-store/entity-isolation-policy.js

@@ -0,0 +1,49 @@
+"use strict";
+//#region ---- Platform tenant config (leaf) ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configurePlatformTenantIds = configurePlatformTenantIds;
+exports.getPlatformTenantIds = getPlatformTenantIds;
+exports.getPrimaryPlatformTenantId = getPrimaryPlatformTenantId;
+exports.isPlatformSessionTenant = isPlatformSessionTenant;
+exports.configureIsolationRuntime = configureIsolationRuntime;
+exports.getIsolationRuntimeConfig = getIsolationRuntimeConfig;
+const GLOBAL_KEY = '__AXP_ISOLATION_RUNTIME__';
+function isolationState() {
+    const g = globalThis;
+    if (!g[GLOBAL_KEY]) {
+        g[GLOBAL_KEY] = {
+            platformTenantIds: new Set(),
+            runtimeConfig: {
+                resourceShareEntityName: 'TenantManagement.ResourceShare',
+                tenantUserEntityName: 'TenantManagement.TenantUser',
+                tenantUserAppAccessEntityName: 'TenantManagement.TenantUserAppAccess',
+            },
+        };
+    }
+    return g[GLOBAL_KEY];
+}
+/**
+ * Sets platform operator tenant ids (from Tenant.isPlatform query / seed).
+ * Empty set → no session is treated as platform (safe default).
+ */
+function configurePlatformTenantIds(tenantIds) {
+    isolationState().platformTenantIds = new Set(tenantIds.filter((id) => typeof id === 'string' && !!id));
+}
+function getPlatformTenantIds() {
+    return [...isolationState().platformTenantIds];
+}
+function getPrimaryPlatformTenantId() {
+    return getPlatformTenantIds()[0];
+}
+function isPlatformSessionTenant(tenantId) {
+    return !!tenantId && isolationState().platformTenantIds.has(tenantId);
+}
+function configureIsolationRuntime(config) {
+    const state = isolationState();
+    state.runtimeConfig = { ...state.runtimeConfig, ...config };
+}
+function getIsolationRuntimeConfig() {
+    return isolationState().runtimeConfig;
+}
+//#endregion
+//# sourceMappingURL=entity-isolation-policy.js.map

package/jql/abstract/src/lib/entity-store/entity-isolation-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-isolation-policy.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-isolation-policy.ts"],"names":[],"mappings":";AAAA,iDAAiD;;AA+CjD,gEAIC;AAED,oDAEC;AAED,gEAEC;AAED,0DAEC;AAED,8DAGC;AAED,8DAEC;AAhDD,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,SAAS,cAAc;IACrB,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,GAAG;YACd,iBAAiB,EAAE,IAAI,GAAG,EAAU;YACpC,aAAa,EAAE;gBACb,uBAAuB,EAAE,gCAAgC;gBACzD,oBAAoB,EAAE,6BAA6B;gBACnD,6BAA6B,EAAE,sCAAsC;aACtE;SACF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,SAA4B;IACrE,cAAc,EAAE,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAC1C,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB;IAClC,OAAO,CAAC,GAAG,cAAc,EAAE,CAAC,iBAAiB,CAAC,CAAC;AACjD,CAAC;AAED,SAAgB,0BAA0B;IACxC,OAAO,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAgB,uBAAuB,CAAC,QAA4B;IAClE,OAAO,CAAC,CAAC,QAAQ,IAAI,cAAc,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,KAAK,CAAC,aAAa,GAAG,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO,cAAc,EAAE,CAAC,aAAa,CAAC;AACxC,CAAC;AAED,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-relation-join.planner.d.ts

@@ -0,0 +1,12 @@
+import type { JqlJoin } from '../jql.types';
+/**
+ * Plans engine-level relation joins from the host entity definition.
+ * Implemented in domain providers; entity storage only executes the result.
+ */
+export interface EntityRelationJoinPlanner {
+    plan(entityName: string, fields?: string[]): Promise<JqlJoin[]>;
+}
+/** Domain boot registers the planner; entity storage reads it at query time. */
+export declare function configureEntityRelationJoinPlanner(planner: EntityRelationJoinPlanner): void;
+export declare function getEntityRelationJoinPlanner(): EntityRelationJoinPlanner | undefined;
+//# sourceMappingURL=entity-relation-join.planner.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-relation-join.planner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-relation-join.planner.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-relation-join.planner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAI5C;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACjE;AAQD,gFAAgF;AAChF,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAE3F;AAED,wBAAgB,4BAA4B,IAAI,yBAAyB,GAAG,SAAS,CAEpF"}

package/jql/abstract/src/lib/entity-store/entity-relation-join.planner.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureEntityRelationJoinPlanner = configureEntityRelationJoinPlanner;
+exports.getEntityRelationJoinPlanner = getEntityRelationJoinPlanner;
+const GLOBAL_PLANNER_KEY = '__AXP_ENTITY_RELATION_JOIN_PLANNER__';
+/** Domain boot registers the planner; entity storage reads it at query time. */
+function configureEntityRelationJoinPlanner(planner) {
+    globalThis[GLOBAL_PLANNER_KEY] = planner;
+}
+function getEntityRelationJoinPlanner() {
+    return globalThis[GLOBAL_PLANNER_KEY];
+}
+//#endregion
+//# sourceMappingURL=entity-relation-join.planner.js.map

package/jql/abstract/src/lib/entity-store/entity-relation-join.planner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-relation-join.planner.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-relation-join.planner.ts"],"names":[],"mappings":";;AAmBA,gFAEC;AAED,oEAEC;AAbD,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAMlE,gFAAgF;AAChF,SAAgB,kCAAkC,CAAC,OAAkC;IAClF,UAA4B,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC;AAC9D,CAAC;AAED,SAAgB,4BAA4B;IAC1C,OAAQ,UAA4B,CAAC,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,YAAY"}

package/jql/abstract/src/lib/entity-store/entity-seed-storage.adapter.d.ts

@@ -1,4 +1,8 @@
 import type { AXPEntitySeedStorage } from './entity-seed-storage.interface';
 import type { EntityStorageBackend } from './entity-store-backend.interface';
+export declare function configureEntitySeedDataTenantId(tenantId: string | undefined): void;
+export declare function getEntitySeedDataTenantId(): string | undefined;
+export declare function configureEntitySeedDataApplicationId(applicationId: string | undefined): void;
+export declare function getEntitySeedDataApplicationId(): string | undefined;
 export declare function createEntitySeedStorageAdapter(backend: EntityStorageBackend): AXPEntitySeedStorage;
 //# sourceMappingURL=entity-seed-storage.adapter.d.ts.map

package/jql/abstract/src/lib/entity-store/entity-seed-storage.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-seed-storage.adapter.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-seed-storage.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAU7E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAuBlG"}
+{"version":3,"file":"entity-seed-storage.adapter.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/jql/abstract/src/lib/entity-store/entity-seed-storage.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAwB7E,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAElF;AAED,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAE9D;AAED,wBAAgB,oCAAoC,CAClD,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,IAAI,CAGN;AAED,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,SAAS,CAEnE;AAoFD,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAuBlG"}