@acorex-platform/module-security-management-client 0.0.15 → 0.0.21

package/types/acorex-platform-module-security-management-client-contracts.d.ts

@@ -1,10 +1,7 @@
-import { AXPEntity, AXPEntityModel } from '@acorex-platform/framework-shared/entity';
-import { AXPExpression } from '@acorex-platform/framework-shared/core';
+import { AXPContextDefinition, AXPExpression } from '@acorex-platform/framework-shared/core';
+import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';
 
-/** Security Management datasource registry names. */
-declare const AXMSecurityManagementDataSourceKeys: {
-    readonly Users: "users";
-};
+declare const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[];
 
 /**
  * Security Management Module Feature Keys.
@@ -16,6 +13,8 @@ declare const AXPSecurityManagementFeatureKeys: {
     readonly MaxTotalUsers: "SecurityManagement:Feature:MaxTotalUsers";
     readonly ManageSessions: "SecurityManagement:Feature:ManageSessions";
     readonly ManagePolicies: "SecurityManagement:Feature:ManagePolicies";
+    /** Platform Console only — Identity Provider management menu + CRUD. */
+    readonly ManageIdentityProviders: "SecurityManagement:Feature:ManageIdentityProviders";
 };
 
 declare const AXPSecurityManagementMenuKeys: {
@@ -24,38 +23,74 @@ declare const AXPSecurityManagementMenuKeys: {
     readonly Roles: "SecurityManagement:Menu:Roles";
     readonly DeviceSessions: "SecurityManagement:Menu:DeviceSessions";
     readonly Policy: "SecurityManagement:Menu:Policy";
+    readonly IdentityProviders: "SecurityManagement:Menu:IdentityProviders";
     readonly MyProfile: "SecurityManagement:Menu:MyProfile";
 };
 
+/**
+ * Administration capabilities used by this module.
+ * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).
+ */
+declare const AXPAdministrationPermissionKeys: {
+    readonly Access: "Administration:Permission:Access";
+    /** Create and maintain users, roles, role assignments, and related security-access reports. */
+    readonly MaintainUsersAndRoles: "Administration:Permission:MaintainUsersAndRoles";
+    readonly ManageSessions: "Administration:Permission:ManageSessions";
+    readonly MaintainPolicies: "Administration:Permission:MaintainPolicies";
+    readonly ViewIntegrations: "Administration:Permission:ViewIntegrations";
+    readonly MaintainConnections: "Administration:Permission:MaintainConnections";
+    readonly ManageIntegrationActions: "Administration:Permission:ManageIntegrationActions";
+    readonly MaintainWorkflows: "Administration:Permission:MaintainWorkflows";
+    readonly ManageWorkflowActions: "Administration:Permission:ManageWorkflowActions";
+    readonly ViewRules: "Administration:Permission:ViewRules";
+    readonly MaintainRules: "Administration:Permission:MaintainRules";
+    readonly ManageRuleActions: "Administration:Permission:ManageRuleActions";
+    readonly MaintainAi: "Administration:Permission:MaintainAi";
+    readonly UseAiAssist: "Administration:Permission:UseAiAssist";
+    readonly MaintainDashboards: "Administration:Permission:MaintainDashboards";
+    readonly ViewJobs: "Administration:Permission:ViewJobs";
+    readonly ManageJobActions: "Administration:Permission:ManageJobActions";
+    readonly ViewObservability: "Administration:Permission:ViewObservability";
+    readonly MaintainObservability: "Administration:Permission:MaintainObservability";
+};
+/**
+ * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.
+ * Legacy nested shape kept so existing imports compile during migration.
+ */
 declare const AXPSecurityManagementPermissionKeys: {
     readonly User: {
-        readonly Management: "SecurityManagement:Permission:User.Management";
-        readonly View: "SecurityManagement:Permission:User.View";
-        readonly Edit: "SecurityManagement:Permission:User.Edit";
-        readonly Delete: "SecurityManagement:Permission:User.Delete";
-        readonly Create: "SecurityManagement:Permission:User.Create";
+        readonly Management: "Administration:Permission:MaintainUsersAndRoles";
+        readonly View: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Edit: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Delete: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Create: "Administration:Permission:MaintainUsersAndRoles";
     };
     readonly Role: {
-        readonly Management: "SecurityManagement:Permission:Role.Management";
-        readonly View: "SecurityManagement:Permission:Role.View";
-        readonly Edit: "SecurityManagement:Permission:Role.Edit";
-        readonly Delete: "SecurityManagement:Permission:Role.Delete";
-        readonly Create: "SecurityManagement:Permission:Role.Create";
+        readonly Management: "Administration:Permission:MaintainUsersAndRoles";
+        readonly View: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Edit: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Delete: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Create: "Administration:Permission:MaintainUsersAndRoles";
     };
     readonly DeviceSession: {
-        readonly Management: "SecurityManagement:Permission:DeviceSession.Management";
-        readonly View: "SecurityManagement:Permission:DeviceSession.View";
-        readonly Terminate: "SecurityManagement:Permission:DeviceSession.Terminate";
+        readonly Management: "Administration:Permission:ManageSessions";
+        readonly View: "Administration:Permission:ManageSessions";
+        readonly Terminate: "Administration:Permission:ManageSessions";
     };
     readonly Policy: {
-        readonly Management: "SecurityManagement:Permission:Policy.Management";
-        readonly View: "SecurityManagement:Permission:Policy.View";
-        readonly Edit: "SecurityManagement:Permission:Policy.Edit";
-        readonly Delete: "SecurityManagement:Permission:Policy.Delete";
-        readonly Create: "SecurityManagement:Permission:Policy.Create";
+        readonly Management: "Administration:Permission:MaintainPolicies";
+        readonly View: "Administration:Permission:MaintainPolicies";
+        readonly Edit: "Administration:Permission:MaintainPolicies";
+        readonly Delete: "Administration:Permission:MaintainPolicies";
+        readonly Create: "Administration:Permission:MaintainPolicies";
     };
 };
 
+/** Component key for the Role permissions page tab. Register via AXP_PAGE_COMPONENT_PROVIDER. */
+declare const ROLE_PERMISSIONS_PAGE_COMPONENT_KEY = "role-permissions-page";
+
+declare const USER_ROLES_PAGE_COMPONENT_KEY = "user-roles-page";
+
 declare const RootConfig: {
     readonly config: {
         i18n: string;
@@ -92,12 +127,39 @@ declare const RootConfig: {
             readonly titlePlural: `@${string}:roles.entities.role.plural`;
             readonly icon: "fa-light fa-user-tag";
         };
+        readonly rolePermission: {
+            readonly name: "RolePermission";
+            readonly title: `@${string}:role-permissions.entities.role-permission.title`;
+            readonly titlePlural: `@${string}:role-permissions.entities.role-permission.plural`;
+            readonly icon: "fa-light fa-key";
+        };
+        readonly userRole: {
+            readonly name: "UserRole";
+            readonly title: `@${string}:user-roles.entities.user-role.title`;
+            readonly titlePlural: `@${string}:user-roles.entities.user-role.plural`;
+            readonly icon: "fa-light fa-user-tag";
+        };
         readonly profile: {
             readonly name: "Profile";
             readonly title: `@${string}:profile.entities.profile.title`;
             readonly titlePlural: `@${string}:profile.entities.profile.plural`;
             readonly icon: "fa-light fa-user";
         };
+        readonly identityProvider: {
+            readonly name: "IdentityProvider";
+            readonly title: `@${string}:identity-providers.entities.identity-provider.title`;
+            readonly titlePlural: `@${string}:identity-providers.entities.identity-provider.plural`;
+            readonly icon: "fa-light fa-id-badge";
+        };
+    };
+    readonly queries: {
+        readonly reports: {
+            readonly getUserEffectiveRolesHistory: "SecurityManagement:Reports:GetUserEffectiveRolesHistory";
+            readonly getUserEffectivePermissionsHistory: "SecurityManagement:Reports:GetUserEffectivePermissionsHistory";
+            readonly getRoleHoldersHistory: "SecurityManagement:Reports:GetRoleHoldersHistory";
+            readonly getPermissionHoldersHistory: "SecurityManagement:Reports:GetPermissionHoldersHistory";
+            readonly getUserPasswordChangeHistory: "SecurityManagement:Reports:GetUserPasswordChangeHistory";
+        };
     };
 };
 
@@ -130,7 +192,58 @@ declare enum AXMUserEffectiveState {
     CredentialExpired = "credential-expired"
 }
 
-declare function deviceSessionsFactory(): Promise<AXPEntity | null>;
+/**
+ * Derives the unified operational state from account lifecycle and sign-in gate.
+ * Used for persisted `effectiveState` on SecurityManagement.User.
+ */
+declare function resolveAXMUserEffectiveState(input: {
+    accountState: string | undefined;
+    accessState: AXMUserAccessState | string | undefined;
+}): AXMUserEffectiveState;
+
+/**
+ * One-time password-reset token state stored as JSON on SecurityManagement.User.
+ * The raw token is never persisted — only a SHA-256 hash.
+ */
+interface AXMUserPasswordResetInfo {
+    tokenHash: string;
+    expiresAt: string;
+    sentAt: string;
+}
+
+declare const AXMSecurityManagementServerCommands: {
+    readonly SendPasswordResetEmail: "SecurityManagement:Server:SendPasswordResetEmail";
+    readonly CompletePasswordReset: "SecurityManagement:Server:CompletePasswordReset";
+    readonly ChangeOwnPassword: "SecurityManagement:Server:ChangeOwnPassword";
+};
+/** Stable codes for self-service password change (client maps to i18n). */
+declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
+    readonly NotSignedIn: "CHANGE_OWN_PASSWORD_NOT_SIGNED_IN";
+    readonly IncorrectCurrent: "CHANGE_OWN_PASSWORD_INCORRECT_CURRENT";
+    readonly SameAsCurrent: "CHANGE_OWN_PASSWORD_SAME_AS_CURRENT";
+    readonly InvalidInput: "CHANGE_OWN_PASSWORD_INVALID_INPUT";
+};
+/** Client/UI action key (confirm dialog → server send). */
+declare const AXM_USER_SEND_PASSWORD_RESET_COMMAND = "SecurityManagement:User:SendPasswordResetEmail";
+interface AXMSendPasswordResetEmailInput {
+    /** Admin path: target user id. */
+    userId?: string;
+    /** Forgot path: email or username. */
+    login?: string;
+    /** Optional absolute web origin for reset link (defaults to env / localhost). */
+    webOrigin?: string;
+}
+interface AXMCompletePasswordResetInput {
+    token: string;
+    newPassword: string;
+}
+interface AXMChangeOwnPasswordInput {
+    currentPassword: string;
+    newPassword: string;
+}
+interface AXMChangeOwnPasswordResult {
+    passwordChangedAt: string;
+}
 
 declare enum AXMSessionStatusTypes {
     revoked = "revoked",
@@ -164,9 +277,37 @@ interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<
     browser: string;
     location: string;
     lastLoginDate: Date;
+    /** When the session was revoked / logged out (null while still active). */
+    loggedOutAt?: Date | string | null;
 }
 
-declare function policyFactory(): Promise<AXPEntity | null>;
+/**
+ * Platform login IdP row (SecurityManagement.IdentityProvider).
+ * Active/inactive uses the disable plugin field `isDisabled`.
+ * Broker routing uses `key` as OAuth `acr_values`.
+ */
+interface AXMIdentityProviderEntityModel {
+    id: string;
+    /** Stable key used by ListProviders and `/connect` (`google`, `okta-hr`, …). */
+    key: string;
+    title: string;
+    icon?: string | null;
+    /** External IdP authorize URL (e.g. Google accounts endpoint). */
+    authorizationUrl?: string | null;
+    /** External IdP token URL. */
+    tokenUrl?: string | null;
+    /** Optional userinfo URL when id_token is absent. */
+    userInfoUrl?: string | null;
+    /** Space-separated scopes requested from the external IdP. */
+    scopes?: string | null;
+    issuerUrl?: string | null;
+    clientId?: string | null;
+    /** Platform broker client secret (admin / seed). */
+    clientSecret?: string | null;
+    /** From disable plugin — `true` means not offered on login. */
+    isDisabled?: boolean;
+    priority: number;
+}
 
 interface AXMSecurityManagementPolicyEntityModel extends AXPEntityModel<string> {
     name: string;
@@ -190,39 +331,73 @@ interface AXMPolicyEffectRule {
     target: string;
 }
 
-declare function profileFactory(): Promise<AXPEntity | null>;
-
 interface AXMSecurityManagementProfileEntityModel extends AXPEntityModel<string> {
     name: string;
     title: string;
 }
 
-declare function rolesFactory(): Promise<AXPEntity | null>;
+/**
+ * Scoped permission grants for a Role.
+ * Role rows are identity-only; all capability keys live here.
+ */
+interface AXMSecurityManagementRolePermissionEntityModel extends AXPEntityModel<string> {
+    /** Target {@link SecurityManagement.Role} id. */
+    roleId: string;
+    /** Capability keys granted for this scope. */
+    permissions: string[];
+}
 
+/**
+ * Role identity only. Capability grants live on
+ * {@link AXMSecurityManagementRolePermissionEntityModel}.
+ */
 interface AXMSecurityManagementRolesEntityModel extends AXPEntityModel<string> {
     name: string;
     title: string;
     description?: string;
-    permissions?: string[];
 }
 
-declare function usersFactory(): Promise<AXPEntity | null>;
+/**
+ * Scoped role assignments for a User.
+ * User rows are identity-only for roles; all role memberships live here.
+ */
+interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string> {
+    /** Target {@link SecurityManagement.User} id. */
+    userId: string;
+    /** Role ids granted for this scope. */
+    roleIds: string[];
+}
 
 interface AXMSecurityManagementUsersEntityModel extends AXPEntityModel<string> {
     id: string;
     username: string;
     displayName: string;
+    /** Globally unique login email (required for password-reset email). */
+    email?: string;
     password: string;
     /** Profile photo file storage id or external URL. */
     avatar?: string | null;
     pinCode?: string;
+    /** ISO timestamp of last successful security PIN change. */
+    pinChangedAt?: string | null;
+    /**
+     * Directory-owning tenant for soft profile admin (display name, avatar, email).
+     * Initialized from the creating/inviting tenant; not the same as membership scope.
+     */
+    homeTenantId?: string;
     /** Account lifecycle: `security-management.account-state.user`. */
     accountState?: string;
     /** Derived operational state: `security-management.effective-state.user` (persisted snapshot in demo/mock). */
     effectiveState?: AXMUserEffectiveState | string;
     /** Sign-in gate (read-only in UI); lockout and credential expiry map here, not to `accountState`. */
     accessState?: AXMUserAccessState;
+    /** ISO timestamp of last successful password change. */
+    passwordChangedAt?: string | null;
+    /** ISO timestamp of last successful sign-in. */
+    lastSignInAt?: string | null;
+    /** Active password-reset challenge (hidden from UI). */
+    passwordReset?: AXMUserPasswordResetInfo | null;
 }
 
-export { AXMSecurityManagementDataSourceKeys, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, RootConfig, deviceSessionsFactory, policyFactory, profileFactory, rolesFactory, usersFactory };
-export type { AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUsersEntityModel };
+export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState };
+export type { AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMIdentityProviderEntityModel, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMUserPasswordResetInfo };

package/types/acorex-platform-module-security-management-client.d.ts

@@ -4,8 +4,10 @@ import { AXPValueWidgetComponent, AXPColumnWidgetComponent } from '@acorex-platf
 import { AXBasePageComponent } from '@acorex/components/page';
 import { AXPPermissionGroupDefinition, AXPPermissionDefinition } from '@acorex-platform/framework-client/auth';
 import { AXValueChangedEvent } from '@acorex/cdk/common';
-import { AXPCommand } from '@acorex-platform/framework-shared/runtime';
-import { AXPExecuteCommandResult } from '@acorex-platform/framework-shared/core';
+import { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { AXPActionMenuItem, AXPExecuteCommand } from '@acorex-platform/framework-shared/core';
+import { AXPPageLayoutBaseComponent } from '@acorex-platform/framework-client/layout/views';
+import { AXPPageComponentProvider, AXPPageComponentDefinition } from '@acorex-platform/framework-client/layout/components';
 import { AXPWidgetConfig } from '@acorex-platform/framework-shared/widget-core';
 
 /**
@@ -35,17 +37,21 @@ interface MappedPermission extends Omit<AXPPermissionDefinition, 'children'> {
     isSelected: boolean;
     children: MappedPermission[] | null;
 }
+/** Right-panel section (optional nested group) or a flat unsectioned block. */
+interface PermissionPanelSection {
+    name: string;
+    title: string | null;
+    items: MappedPermission[];
+}
 interface PermissionSearchGroupResult {
     group: AXPPermissionGroupDefinition & {
         badge: string;
     };
-    items: MappedPermission[];
+    sections: PermissionPanelSection[];
 }
 declare class AXPPermissionsEditorComponent extends AXBasePageComponent {
     /** Service for fetching permission groups and definitions */
     private permissionService;
-    /** Session service for checking module access */
-    private sessionService;
     /** Translation service for resolving permission labels during search */
     private translationService;
     /** Currently selected permission group */
@@ -60,6 +66,9 @@ declare class AXPPermissionsEditorComponent extends AXBasePageComponent {
     readOnly: _angular_core.InputSignal<boolean>;
     /** Whether popup footer actions (Cancel / Select) are shown */
     showActions: _angular_core.InputSignal<boolean>;
+    /** When true, fills the host (detail page) without the dialog max-height cap. */
+    fillHeight: _angular_core.InputSignal<boolean>;
+    protected readonly hostClass: _angular_core.Signal<"axm-permissions-editor axm-permissions-editor--fill-height flex h-full min-h-0 flex-col overflow-hidden" | "axm-permissions-editor axm-permissions-editor--dialog flex h-full max-h-[75vh] min-h-0 flex-col overflow-hidden p-4 gap-3">;
     /** List of selected permission names */
     protected selectedPermissions: _angular_core.WritableSignal<string[]>;
     /** Event emitted when permissions selection changes */
@@ -81,22 +90,29 @@ declare class AXPPermissionsEditorComponent extends AXBasePageComponent {
     protected getInitialPermissions(): string[];
     /**
      * Recursively maps permissions to include selection state and children.
+     * Sorted alphabetically by translated title.
      */
     private mapPermissions;
     /**
-     * Computed: Returns mapped permissions for the selected group.
+     * Locale-aware label comparison using the resolved translation when available.
      */
-    protected items: _angular_core.Signal<MappedPermission[]>;
+    private compareByTitle;
     /**
-     * Computed: Returns groups with badge counts, sorted by title.
+     * Computed: Left-nav roots only (groups without a parent), sorted by title.
      */
     protected groupsWithBadge: _angular_core.Signal<{
         badge: string;
         name: string;
         title: string;
         description?: string;
+        parent?: string;
+        order?: number;
         permissions: AXPPermissionDefinition[];
     }[]>;
+    /**
+     * Computed: Right-panel sections for the selected root (or one flat block).
+     */
+    protected selectedSections: _angular_core.Signal<PermissionPanelSection[]>;
     /** Sidebar group placeholders for the loading skeleton */
     protected readonly groupSkeletonPlaceholders: _angular_core.Signal<string[]>;
     /** Permission group placeholders (parent + child rows) for the loading skeleton */
@@ -107,28 +123,33 @@ declare class AXPPermissionsEditorComponent extends AXBasePageComponent {
     protected readonly childSkeletonPlaceholders: (count: number) => number[];
     /** Whether the user is actively searching permissions */
     protected isSearchActive: _angular_core.Signal<boolean>;
-    /** Grouped search results across all permission groups */
+    /** Grouped search results across all root permission groups */
     protected searchResultsGrouped: _angular_core.Signal<PermissionSearchGroupResult[]>;
     /** Whether the active search returned any permission groups */
     protected hasSearchResults: _angular_core.Signal<boolean>;
     /**
-     * Extracts module name from a permission group name.
-     * Handles multiple formats:
-     * - Permission key format: 'SecurityManagement:Permission:SecurityManagement.Management' -> 'SecurityManagement'
-     * - PascalCase: 'TenantManagement' -> 'TenantManagement'
-     * - kebab-case: 'tenant-management' -> 'TenantManagement' (converts to PascalCase)
+     * Drops empty roots/sections after session feature filtering in
+     * {@link AXPPermissionDefinitionService}. Keeps a root only when it or a child
+     * section still has at least one permission.
      */
-    private extractModuleNameFromGroupName;
+    private filterGroupsByEnabledModules;
+    /** Permission keys still visible after edition/feature filtering. */
+    private collectAvailablePermissionNames;
     /**
-     * Filters permission groups to only include those from enabled modules.
+     * Child section groups under a root, sorted alphabetically by translated title.
      */
-    private filterGroupsByEnabledModules;
+    private getChildSections;
+    /**
+     * Builds right-panel sections for a root. When `normalizedQuery` is set, keeps
+     * only matching permissions/sections (and sections whose title matches).
+     */
+    private buildPanelSections;
     /**
      * Recursively collects all permission names (parents and children) from an array.
      */
     private collectAllPermissionNames;
     /**
-     * Returns the badge count for a group (all selected permissions, including parents).
+     * Returns the badge count for a root (own permissions + child section permissions).
      */
     private getBadge;
     /**
@@ -139,6 +160,10 @@ declare class AXPPermissionsEditorComponent extends AXBasePageComponent {
      * Checks if a permission is selected.
      */
     protected badgeToNumber(value: unknown): number;
+    /** Looks up a left-nav root group by tab key (group name). */
+    protected getGroupByKey(key: string | undefined): (AXPPermissionGroupDefinition & {
+        badge: string;
+    }) | undefined;
     /**
      * Returns true when searchable text contains the query.
      */
@@ -201,37 +226,116 @@ declare class AXPPermissionsEditorComponent extends AXBasePageComponent {
      */
     protected handleSelectClick(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXPPermissionsEditorComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<AXPPermissionsEditorComponent, "axm-permissions-editor", never, { "initialPermissions": { "alias": "initialPermissions"; "required": false; "isSignal": true; }; "readOnly": { "alias": "readOnly"; "required": false; "isSignal": true; }; "showActions": { "alias": "showActions"; "required": false; "isSignal": true; }; }, { "permissionsChanged": "permissionsChanged"; "permissionsSelected": "permissionsSelected"; }, never, never, true, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<AXPPermissionsEditorComponent, "axm-permissions-editor", never, { "initialPermissions": { "alias": "initialPermissions"; "required": false; "isSignal": true; }; "readOnly": { "alias": "readOnly"; "required": false; "isSignal": true; }; "showActions": { "alias": "showActions"; "required": false; "isSignal": true; }; "fillHeight": { "alias": "fillHeight"; "required": false; "isSignal": true; }; }, { "permissionsChanged": "permissionsChanged"; "permissionsSelected": "permissionsSelected"; }, never, never, true, never>;
 }
 
 interface AXMAssignPermissionsCommandInput {
-    __context__?: {
-        data?: Record<string, unknown>;
-        entity?: string;
-        entityInfo?: {
-            name?: string;
-            module?: string;
-            title?: string;
-            parentKey?: string;
-            source?: string;
-        };
-        options?: unknown;
-    };
+    data?: Record<string, unknown>;
 }
 declare class AXMAssignPermissionsCommand implements AXPCommand<AXMAssignPermissionsCommandInput, string[] | null> {
     private readonly popupService;
     private readonly translationService;
-    private readonly entityRegistry;
     private readonly toastService;
     private readonly settingsService;
-    private readonly workflowEventService;
-    execute(input: AXMAssignPermissionsCommandInput): Promise<AXPExecuteCommandResult<string[] | null>>;
+    private readonly grantService;
+    execute(input: AXMAssignPermissionsCommandInput): AXPCommandExecuteResultPromise<string[] | null>;
     private resolveRoleTitle;
     private showSuccessToast;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXMAssignPermissionsCommand, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AXMAssignPermissionsCommand>;
 }
 
+interface RolePermissionGrantRow {
+    id: string;
+    roleId: string;
+    permissions: string[];
+    scopeInfo?: {
+        kind?: string;
+        tenantId?: string;
+        applicationId?: string;
+    };
+    stateInfo?: {
+        isSystem?: boolean;
+        isImmutable?: boolean;
+        isHidden?: boolean;
+    };
+}
+interface SaveRolePermissionGrantOptions {
+    existing: RolePermissionGrantRow | null;
+    roleId: string;
+    permissions: string[];
+    tenantId: string;
+    applicationId: string | undefined;
+}
+
+/**
+ * Loads and persists scoped RolePermission grants for a role.
+ * Shared by the Assign Permissions dialog and the Role permissions detail page.
+ */
+declare class AXMRolePermissionGrantService {
+    private readonly entityRegistry;
+    private readonly entityService;
+    private readonly sessionService;
+    private readonly entityEvents;
+    resolveSessionScope(): {
+        tenantId: string;
+        applicationId: string | undefined;
+    } | null;
+    private rolePermissionData;
+    findGrant(roleId: string, tenantId: string, applicationId: string | undefined): Promise<RolePermissionGrantRow | null>;
+    saveGrant(options: SaveRolePermissionGrantOptions): Promise<Record<string, unknown>>;
+    notifyGrantModified(saved: Record<string, unknown>): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXMRolePermissionGrantService, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AXMRolePermissionGrantService>;
+}
+
+/**
+ * Role detail/create wizard page that edits scoped RolePermission grants.
+ * Extends AXPPageLayoutBaseComponent for Save/Discard footer actions and dirty tracking.
+ */
+declare class AXMRolePermissionsPageComponent extends AXPPageLayoutBaseComponent {
+    rootContext: _angular_core.InputSignal<Record<string, unknown> | undefined>;
+    /** Optional page config set by the page-component-renderer. */
+    pageConfig: _angular_core.InputSignal<Record<string, unknown> | undefined>;
+    private readonly grantService;
+    private readonly hostPageLayout;
+    private readonly loadedRoleId;
+    private readonly existingGrant;
+    private readonly baselinePermissions;
+    private readonly currentPermissions;
+    protected readonly isLoading: _angular_core.WritableSignal<boolean>;
+    /** Bumps when the editor should remount with a new initialPermissions snapshot (e.g. after discard). */
+    protected readonly editorResetToken: _angular_core.WritableSignal<number>;
+    protected readonly roleId: _angular_core.Signal<string | undefined>;
+    protected readonly editorPermissions: _angular_core.Signal<string[]>;
+    protected readonly isDirty: _angular_core.Signal<boolean>;
+    /** System RolePermission grants are seeded and not editable in product/platform UI. */
+    protected readonly isGrantReadonly: _angular_core.Signal<boolean>;
+    constructor();
+    hasUnsavedChanges(): boolean;
+    getPrimaryMenuItems(): Promise<AXPActionMenuItem[]>;
+    execute(command: AXPExecuteCommand): void | Promise<void>;
+    private handleSaveExecute;
+    protected onPermissionsChanged(permissions: string[]): void;
+    private handleDiscard;
+    /**
+     * Do not merge permissions into the Role create/update payload.
+     * Grants live on SecurityManagement.RolePermission only.
+     */
+    getWizardStepContext(): Record<string, unknown> | null;
+    private loadGrantForRole;
+    private arePermissionSetsEqual;
+    protected recompute(): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXMRolePermissionsPageComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<AXMRolePermissionsPageComponent, "axm-role-permissions-page", never, { "rootContext": { "alias": "rootContext"; "required": false; "isSignal": true; }; "pageConfig": { "alias": "pageConfig"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
+}
+
+declare class AXMRolePermissionsPageComponentProvider implements AXPPageComponentProvider {
+    components(): Promise<AXPPageComponentDefinition[]>;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXMRolePermissionsPageComponentProvider, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AXMRolePermissionsPageComponentProvider>;
+}
+
 interface PermissionPath {
     group: AXPPermissionGroupDefinition;
     path: AXPPermissionDefinition[];
@@ -268,4 +372,4 @@ declare class AXPPermissionsWidgetColumnComponent extends AXPColumnWidgetCompone
 
 declare const AXPPermissionsWidget: AXPWidgetConfig;
 
-export { AXMAssignPermissionsCommand, AXMDeviceSessionsService, AXMPermissionsModule, AXMSecurityManagementModule, AXPPermissionsEditorComponent, AXPPermissionsWidget, AXPPermissionsWidgetColumnComponent, AXPPermissionsWidgetEditComponent, AXPPermissionsWidgetViewComponent };
+export { AXMAssignPermissionsCommand, AXMDeviceSessionsService, AXMPermissionsModule, AXMRolePermissionGrantService, AXMRolePermissionsPageComponent, AXMRolePermissionsPageComponentProvider, AXMSecurityManagementModule, AXPPermissionsEditorComponent, AXPPermissionsWidget, AXPPermissionsWidgetColumnComponent, AXPPermissionsWidgetEditComponent, AXPPermissionsWidgetViewComponent };

package/fesm2022/acorex-platform-module-security-management-client-terminate-session.command-CKq-4Z4O.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-terminate-session.command-CKq-4Z4O.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/terminate-session.command.ts"],"sourcesContent":["import { AXDialogService } from '@acorex/components/dialog';\nimport { AXLoadingDialogService } from '@acorex/components/loading-dialog';\nimport { AXToastService } from '@acorex/components/toast';\nimport { AXTranslationService } from '@acorex/core/translation';\nimport {\n  AXPCommonSettings,\n  AXPRefreshEvent,\n  AXPSettingsService,\n} from '@acorex-platform/framework-client/common';\nimport { AXPEntityDefinitionRegistryService, AXPEntityService } from '@acorex-platform/framework-client/layout/entity';\nimport { AXPWorkflowEventService } from '@acorex-platform/framework-client/workflow';\nimport { AXPExecuteCommandResult } from '@acorex-platform/framework-shared/core';\nimport { AXPCommand } from '@acorex-platform/framework-shared/runtime';\nimport { RootConfig } from '@acorex-platform/module-security-management-client/contracts';\nimport { inject, Injectable } from '@angular/core';\n\n//#region ----   Types   ----\n\nexport interface AXPTerminateSessionCommandContext {\n  data: unknown;\n  entity: string;\n  entityInfo?: { parentKey?: string };\n  options?: unknown;\n  meta?: Record<string, unknown>;\n}\n\nexport interface AXPTerminateSessionCommandInput {\n  __context__?: AXPTerminateSessionCommandContext;\n  __metadata__?: unknown;\n}\n\n//#endregion\n\n//#region ----   Terminate session command   ----\n\n/**\n * Terminates one or more device sessions (entity list / detail actions).\n * Replaces the former `terminate-entity` workflow (loading + terminate loop + success toast).\n */\n@Injectable({ providedIn: 'root' })\nexport class AXPTerminateSessionCommand implements AXPCommand<AXPTerminateSessionCommandInput, AXPExecuteCommandResult> {\n  private readonly entityRegistry = inject(AXPEntityDefinitionRegistryService);\n  private readonly entityService = inject(AXPEntityService);\n  private readonly dialogService = inject(AXDialogService);\n  private readonly loadingDialog = inject(AXLoadingDialogService);\n  private readonly translationService = inject(AXTranslationService);\n  private readonly toastService = inject(AXToastService);\n  private readonly settingsService = inject(AXPSettingsService);\n  private readonly workflowEventService = inject(AXPWorkflowEventService);\n  private readonly deviceSessionsDataAccessor = this.entityService\n    .withEntity(RootConfig.module.name, RootConfig.entities.deviceSessions.name)\n    .data<string, { id: string }>();\n\n  async execute(input: AXPTerminateSessionCommandInput = {}): Promise<AXPExecuteCommandResult> {\n    const context = input.__context__;\n    if (!context?.entity || context.data == null) {\n      return { success: false };\n    }\n\n    const moduleEntity = context.entity;\n    const [moduleName, entityName] = moduleEntity.split('.');\n    const data = context.data as Record<string, unknown> | Record<string, unknown>[];\n    const meta = { ...(context.meta ?? {}) };\n\n    const ids = Array.isArray(data) ? data.map((item) => String(item['id'])) : [String(data['id'])];\n    const entity = await this.entityRegistry.resolve(moduleName, entityName);\n\n    if (entity.parentKey && !Array.isArray(data) && data[entity.parentKey]) {\n      meta['refreshTargetId'] = data[entity.parentKey];\n    }\n\n    const dialog = this.loadingDialog.show({\n      title: await this.translationService.translateAsync('workflow.terminating'),\n      mode: 'determinate',\n      status: 'Terminating...',\n      progressValue: 0,\n      text: `0/${ids.length}`,\n      buttons: [\n        {\n          text: await this.translationService.translateAsync('cancel'),\n          color: 'danger',\n          onClick: () => {\n            dialog.close();\n          },\n        },\n      ],\n    });\n\n    let failedCounter = 0;\n    for (const id of ids) {\n      try {\n        await this.deviceSessionsDataAccessor.update(id, { status: 'revoked' });\n      } catch {\n        failedCounter++;\n        await this.dialogService.alert(\n          await this.translationService.translateAsync('workflow.fail-delete-title'),\n          await this.translationService.translateAsync('workflow.fail-delete-body', {\n            params: { item: 1 },\n          }),\n          'danger',\n        );\n      }\n    }\n\n    const success = failedCounter === 0;\n    setTimeout(() => {\n      dialog.close();\n      this.workflowEventService.dispatch(AXPRefreshEvent({ entity: moduleEntity, meta }));\n    }, 300);\n\n    if (success) {\n      await this.showSuccessToast();\n    }\n\n    return { success };\n  }\n\n  private async showSuccessToast(): Promise<void> {\n    const showResult = await this.settingsService.get(AXPCommonSettings.EnableOperationToasts);\n    if (!showResult) {\n      return;\n    }\n\n    this.toastService.show({\n      color: 'success',\n      title: await this.translationService.translateAsync('workflow.session-terminated'),\n      content: await this.translationService.translateAsync('workflow.session-terminated-body'),\n      closeButton: true,\n      timeOut: 3000,\n      timeOutProgress: true,\n    });\n  }\n}\n\n//#endregion\n"],"names":[],"mappings":";;;;;;;;;;;AA+BA;AAEA;AAEA;;;AAGG;MAEU,0BAA0B,CAAA;AADvC,IAAA,WAAA,GAAA;AAEmB,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,kCAAkC,CAAC;AAC3D,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;AACxC,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;AACvC,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,sBAAsB,CAAC;AAC9C,QAAA,IAAA,CAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AACjD,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AACrC,QAAA,IAAA,CAAA,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5C,QAAA,IAAA,CAAA,oBAAoB,GAAG,MAAM,CAAC,uBAAuB,CAAC;QACtD,IAAA,CAAA,0BAA0B,GAAG,IAAI,CAAC;AAChD,aAAA,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI;AAC1E,aAAA,IAAI,EAA0B;AAiFlC,IAAA;AA/EC,IAAA,MAAM,OAAO,CAAC,KAAA,GAAyC,EAAE,EAAA;AACvD,QAAA,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QACjC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE;AAC5C,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3B;AAEA,QAAA,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM;AACnC,QAAA,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;AACxD,QAAA,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2D;AAChF,QAAA,MAAM,IAAI,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE;AAExC,QAAA,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/F,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC;AAExE,QAAA,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;YACtE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAClD;AAEA,QAAA,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,sBAAsB,CAAC;AAC3E,YAAA,IAAI,EAAE,aAAa;AACnB,YAAA,MAAM,EAAE,gBAAgB;AACxB,YAAA,aAAa,EAAE,CAAC;AAChB,YAAA,IAAI,EAAE,CAAA,EAAA,EAAK,GAAG,CAAC,MAAM,CAAA,CAAE;AACvB,YAAA,OAAO,EAAE;AACP,gBAAA;oBACE,IAAI,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC;AAC5D,oBAAA,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,MAAK;wBACZ,MAAM,CAAC,KAAK,EAAE;oBAChB,CAAC;AACF,iBAAA;AACF,aAAA;AACF,SAAA,CAAC;QAEF,IAAI,aAAa,GAAG,CAAC;AACrB,QAAA,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE;AACpB,YAAA,IAAI;AACF,gBAAA,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzE;AAAE,YAAA,MAAM;AACN,gBAAA,aAAa,EAAE;gBACf,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC5B,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAC1E,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,2BAA2B,EAAE;AACxE,oBAAA,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;iBACpB,CAAC,EACF,QAAQ,CACT;YACH;QACF;AAEA,QAAA,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC;QACnC,UAAU,CAAC,MAAK;YACd,MAAM,CAAC,KAAK,EAAE;AACd,YAAA,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC,EAAE,GAAG,CAAC;QAEP,IAAI,OAAO,EAAE;AACX,YAAA,MAAM,IAAI,CAAC,gBAAgB,EAAE;QAC/B;QAEA,OAAO,EAAE,OAAO,EAAE;IACpB;AAEQ,IAAA,MAAM,gBAAgB,GAAA;AAC5B,QAAA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,qBAAqB,CAAC;QAC1F,IAAI,CAAC,UAAU,EAAE;YACf;QACF;AAEA,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;AACrB,YAAA,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,6BAA6B,CAAC;YAClF,OAAO,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,kCAAkC,CAAC;AACzF,YAAA,WAAW,EAAE,IAAI;AACjB,YAAA,OAAO,EAAE,IAAI;AACb,YAAA,eAAe,EAAE,IAAI;AACtB,SAAA,CAAC;IACJ;8GA3FW,0BAA0B,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAA1B,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,0BAA0B,cADb,MAAM,EAAA,CAAA,CAAA;;2FACnB,0BAA0B,EAAA,UAAA,EAAA,CAAA;kBADtC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;;;"}