@acorex-platform/module-security-management-client 0.0.37 → 0.0.46

package/fesm2022/acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs

@@ -0,0 +1,96 @@
+import { AXDialogService } from '@acorex/components/dialog';
+import { AXToastService } from '@acorex/components/toast';
+import { AXTranslationService } from '@acorex/core/translation';
+import { AXPCommandService } from '@acorex-platform/framework-client/runtime';
+import { AXM_TWO_FACTOR_ERROR_CODES, AXMSecurityManagementServerCommands } from '@acorex-platform/module-security-management-client/contracts';
+export { AXM_USER_RESET_TWO_FACTOR_COMMAND } from '@acorex-platform/module-security-management-client/contracts';
+import * as i0 from '@angular/core';
+import { inject, Injectable } from '@angular/core';
+
+//#endregion
+//#region ----- Constants -----
+const I18N = '@security-management:users.entities.user.actions.reset-two-factor';
+const TWO_FACTOR_ERROR_I18N = {
+    [AXM_TWO_FACTOR_ERROR_CODES.InvalidInput]: `${I18N}.errors.invalid-input`,
+    [AXM_TWO_FACTOR_ERROR_CODES.UserNotFound]: `${I18N}.errors.user-not-found`,
+    [AXM_TWO_FACTOR_ERROR_CODES.Forbidden]: `${I18N}.errors.forbidden`,
+    [AXM_TWO_FACTOR_ERROR_CODES.NotEnabled]: `${I18N}.errors.not-enabled`,
+};
+//#endregion
+//#region ----- Client command -----
+/**
+ * Admin Action on User detail: if 2FA is not enabled, warn and stop;
+ * otherwise confirm, then call server AdminResetTwoFactor.
+ */
+class AXPResetTwoFactorCommand {
+    constructor() {
+        //#region ----- Services & Dependencies -----
+        this.dialogService = inject(AXDialogService);
+        this.toastService = inject(AXToastService);
+        this.translationService = inject(AXTranslationService);
+        this.commandService = inject(AXPCommandService);
+    }
+    //#endregion
+    //#region ----- Command -----
+    async execute(input = {}) {
+        const userId = input.userId ?? input.data?.id;
+        if (!userId) {
+            return { success: false, message: { text: `${I18N}.errors.invalid-input` } };
+        }
+        const who = input.data?.displayName ||
+            input.data?.username ||
+            input.data?.email ||
+            String(userId);
+        // Preflight: stop before confirm when 2FA was never enabled for this user.
+        const preflight = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.AdminResetTwoFactor, { userId: String(userId), dryRun: true });
+        if (!preflight?.success) {
+            await this.showFailureToast(preflight?.message?.code);
+            return { success: false };
+        }
+        const confirmTitle = await this.translationService.translateAsync(`${I18N}.confirm-title`);
+        const confirmMessage = await this.translationService.translateAsync(`${I18N}.confirm-message`, {
+            params: { user: who },
+        });
+        const confirmed = await this.dialogService.confirm(confirmTitle, confirmMessage, 'danger', 'horizontal');
+        if (!confirmed.result) {
+            return { success: false };
+        }
+        const result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.AdminResetTwoFactor, { userId: String(userId) });
+        if (result?.success) {
+            const [toastTitle, toastContent] = await Promise.all([
+                this.translationService.translateAsync(`${I18N}.success.title`),
+                this.translationService.translateAsync(`${I18N}.success.description`),
+            ]);
+            this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });
+            return { success: true, kind: 'object', data: undefined };
+        }
+        await this.showFailureToast(result?.message?.code);
+        return { success: false };
+    }
+    //#endregion
+    //#region ----- Helpers -----
+    async showFailureToast(code) {
+        const codeKey = typeof code === 'string' ? code : '';
+        const errorKey = TWO_FACTOR_ERROR_I18N[codeKey] || `${I18N}.error.description`;
+        const isNotEnabled = codeKey === AXM_TWO_FACTOR_ERROR_CODES.NotEnabled;
+        const [toastTitle, toastContent] = await Promise.all([
+            this.translationService.translateAsync(isNotEnabled ? `${I18N}.errors.not-enabled-title` : `${I18N}.error.title`),
+            this.translationService.translateAsync(errorKey),
+        ]);
+        this.toastService.show({
+            color: isNotEnabled ? 'warning' : 'danger',
+            title: toastTitle,
+            content: toastContent,
+            timeOut: 4000,
+        });
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResetTwoFactorCommand, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResetTwoFactorCommand, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResetTwoFactorCommand, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+export { AXPResetTwoFactorCommand };
+//# sourceMappingURL=acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs.map

package/fesm2022/acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/reset-two-factor.command.ts"],"sourcesContent":["import { AXDialogService } from '@acorex/components/dialog';\nimport { AXToastService } from '@acorex/components/toast';\nimport { AXTranslationService } from '@acorex/core/translation';\nimport { AXPCommandService } from '@acorex-platform/framework-client/runtime';\nimport { AXPCommand, type AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';\nimport {\n  AXM_TWO_FACTOR_ERROR_CODES,\n  AXM_USER_RESET_TWO_FACTOR_COMMAND,\n  AXMSecurityManagementServerCommands,\n} from '@acorex-platform/module-security-management-client/contracts';\nimport { inject, Injectable } from '@angular/core';\n\n//#region ----- Types -----\n\nexport interface AXPResetTwoFactorCommandInput {\n  userId?: string;\n  data?: {\n    id?: string;\n    displayName?: string;\n    username?: string;\n    email?: string;\n  };\n}\n\n//#endregion\n\n//#region ----- Constants -----\n\nconst I18N = '@security-management:users.entities.user.actions.reset-two-factor';\n\nconst TWO_FACTOR_ERROR_I18N: Record<string, string> = {\n  [AXM_TWO_FACTOR_ERROR_CODES.InvalidInput]: `${I18N}.errors.invalid-input`,\n  [AXM_TWO_FACTOR_ERROR_CODES.UserNotFound]: `${I18N}.errors.user-not-found`,\n  [AXM_TWO_FACTOR_ERROR_CODES.Forbidden]: `${I18N}.errors.forbidden`,\n  [AXM_TWO_FACTOR_ERROR_CODES.NotEnabled]: `${I18N}.errors.not-enabled`,\n};\n\n//#endregion\n\n//#region ----- Client command -----\n\n/**\n * Admin Action on User detail: if 2FA is not enabled, warn and stop;\n * otherwise confirm, then call server AdminResetTwoFactor.\n */\n@Injectable({ providedIn: 'root' })\nexport class AXPResetTwoFactorCommand implements AXPCommand<AXPResetTwoFactorCommandInput> {\n  //#region ----- Services & Dependencies -----\n\n  private readonly dialogService = inject(AXDialogService);\n  private readonly toastService = inject(AXToastService);\n  private readonly translationService = inject(AXTranslationService);\n  private readonly commandService = inject(AXPCommandService);\n\n  //#endregion\n\n  //#region ----- Command -----\n\n  async execute(input: AXPResetTwoFactorCommandInput = {}): AXPCommandExecuteResultPromise {\n    const userId = input.userId ?? input.data?.id;\n    if (!userId) {\n      return { success: false, message: { text: `${I18N}.errors.invalid-input` } };\n    }\n\n    const who =\n      input.data?.displayName ||\n      input.data?.username ||\n      input.data?.email ||\n      String(userId);\n\n    // Preflight: stop before confirm when 2FA was never enabled for this user.\n    const preflight = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.AdminResetTwoFactor,\n      { userId: String(userId), dryRun: true },\n    );\n    if (!preflight?.success) {\n      await this.showFailureToast(preflight?.message?.code);\n      return { success: false };\n    }\n\n    const confirmTitle = await this.translationService.translateAsync(`${I18N}.confirm-title`);\n    const confirmMessage = await this.translationService.translateAsync(`${I18N}.confirm-message`, {\n      params: { user: who },\n    });\n\n    const confirmed = await this.dialogService.confirm(confirmTitle, confirmMessage, 'danger', 'horizontal');\n    if (!confirmed.result) {\n      return { success: false };\n    }\n\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.AdminResetTwoFactor,\n      { userId: String(userId) },\n    );\n\n    if (result?.success) {\n      const [toastTitle, toastContent] = await Promise.all([\n        this.translationService.translateAsync(`${I18N}.success.title`),\n        this.translationService.translateAsync(`${I18N}.success.description`),\n      ]);\n      this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });\n      return { success: true, kind: 'object', data: undefined };\n    }\n\n    await this.showFailureToast(result?.message?.code);\n    return { success: false };\n  }\n\n  //#endregion\n\n  //#region ----- Helpers -----\n\n  private async showFailureToast(code: unknown): Promise<void> {\n    const codeKey = typeof code === 'string' ? code : '';\n    const errorKey = TWO_FACTOR_ERROR_I18N[codeKey] || `${I18N}.error.description`;\n    const isNotEnabled = codeKey === AXM_TWO_FACTOR_ERROR_CODES.NotEnabled;\n    const [toastTitle, toastContent] = await Promise.all([\n      this.translationService.translateAsync(\n        isNotEnabled ? `${I18N}.errors.not-enabled-title` : `${I18N}.error.title`,\n      ),\n      this.translationService.translateAsync(errorKey),\n    ]);\n    this.toastService.show({\n      color: isNotEnabled ? 'warning' : 'danger',\n      title: toastTitle,\n      content: toastContent,\n      timeOut: 4000,\n    });\n  }\n\n  //#endregion\n}\n\nexport { AXM_USER_RESET_TWO_FACTOR_COMMAND };\n\n//#endregion\n"],"names":[],"mappings":";;;;;;;;;AAwBA;AAEA;AAEA,MAAM,IAAI,GAAG,mEAAmE;AAEhF,MAAM,qBAAqB,GAA2B;AACpD,IAAA,CAAC,0BAA0B,CAAC,YAAY,GAAG,CAAA,EAAG,IAAI,CAAA,qBAAA,CAAuB;AACzE,IAAA,CAAC,0BAA0B,CAAC,YAAY,GAAG,CAAA,EAAG,IAAI,CAAA,sBAAA,CAAwB;AAC1E,IAAA,CAAC,0BAA0B,CAAC,SAAS,GAAG,CAAA,EAAG,IAAI,CAAA,iBAAA,CAAmB;AAClE,IAAA,CAAC,0BAA0B,CAAC,UAAU,GAAG,CAAA,EAAG,IAAI,CAAA,mBAAA,CAAqB;CACtE;AAED;AAEA;AAEA;;;AAGG;MAEU,wBAAwB,CAAA;AADrC,IAAA,WAAA,GAAA;;AAImB,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;AACvC,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AACrC,QAAA,IAAA,CAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AACjD,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AA+E5D,IAAA;;;AAzEC,IAAA,MAAM,OAAO,CAAC,KAAA,GAAuC,EAAE,EAAA;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE;QAC7C,IAAI,CAAC,MAAM,EAAE;AACX,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAA,EAAG,IAAI,CAAA,qBAAA,CAAuB,EAAE,EAAE;QAC9E;AAEA,QAAA,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,EAAE,WAAW;YACvB,KAAK,CAAC,IAAI,EAAE,QAAQ;YACpB,KAAK,CAAC,IAAI,EAAE,KAAK;YACjB,MAAM,CAAC,MAAM,CAAC;;QAGhB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACvD,mCAAmC,CAAC,mBAAmB,EACvD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CACzC;AACD,QAAA,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE;YACvB,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AACrD,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3B;AAEA,QAAA,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,CAAA,cAAA,CAAgB,CAAC;AAC1F,QAAA,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,CAAA,gBAAA,CAAkB,EAAE;AAC7F,YAAA,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB,SAAA,CAAC;AAEF,QAAA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC;AACxG,QAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;AACrB,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3B;QAEA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,mBAAmB,EACvD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAC3B;AAED,QAAA,IAAI,MAAM,EAAE,OAAO,EAAE;YACnB,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnD,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,gBAAgB,CAAC;gBAC/D,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,sBAAsB,CAAC;AACtE,aAAA,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrG,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3D;QAEA,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAClD,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;;;IAMQ,MAAM,gBAAgB,CAAC,IAAa,EAAA;AAC1C,QAAA,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAA,EAAG,IAAI,CAAA,kBAAA,CAAoB;AAC9E,QAAA,MAAM,YAAY,GAAG,OAAO,KAAK,0BAA0B,CAAC,UAAU;QACtE,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACnD,YAAA,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACpC,YAAY,GAAG,CAAA,EAAG,IAAI,2BAA2B,GAAG,CAAA,EAAG,IAAI,cAAc,CAC1E;AACD,YAAA,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC;AACjD,SAAA,CAAC;AACF,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,QAAQ;AAC1C,YAAA,KAAK,EAAE,UAAU;AACjB,YAAA,OAAO,EAAE,YAAY;AACrB,YAAA,OAAO,EAAE,IAAI;AACd,SAAA,CAAC;IACJ;8GAlFW,wBAAwB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAxB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,cADX,MAAM,EAAA,CAAA,CAAA;;2FACnB,wBAAwB,EAAA,UAAA,EAAA,CAAA;kBADpC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;"}

package/fesm2022/acorex-platform-module-security-management-client.mjs

@@ -1,2 +1,2 @@
-export { A as AXMAssignPermissionsCommand, a as AXMDeviceSessionsService, b as AXMPermissionsModule, c as AXMRolePermissionGrantService, d as AXMRolePermissionsPageComponent, e as AXMRolePermissionsPageComponentProvider, f as AXMSecurityManagementModule, g as AXPPermissionsEditorComponent, h as AXPPermissionsWidget, i as AXPPermissionsWidgetColumnComponent, j as AXPPermissionsWidgetEditComponent, k as AXPPermissionsWidgetViewComponent } from './acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-Ddzg9VYV.mjs';
+export { A as AXMAssignPermissionsCommand, a as AXMDeviceSessionsService, b as AXMPermissionsModule, c as AXMRolePermissionGrantService, d as AXMRolePermissionsPageComponent, e as AXMRolePermissionsPageComponentProvider, f as AXMSecurityManagementModule, g as AXPPermissionsEditorComponent, h as AXPPermissionsWidget, i as AXPPermissionsWidgetColumnComponent, j as AXPPermissionsWidgetEditComponent, k as AXPPermissionsWidgetViewComponent } from './acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-D-VISihP.mjs';
 //# sourceMappingURL=acorex-platform-module-security-management-client.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acorex-platform/module-security-management-client",
-  "version": "0.0.37",
+  "version": "0.0.46",
   "sideEffects": false,
   "peerDependencies": {
     "@angular/common": "^21.0.0 || ^22.0.0",
@@ -51,6 +51,10 @@
       "types": "./types/acorex-platform-module-security-management-client-contracts-entities-user-role.d.ts",
       "default": "./fesm2022/acorex-platform-module-security-management-client-contracts-entities-user-role.mjs"
     },
+    "./contracts/entities/user-two-factor": {
+      "types": "./types/acorex-platform-module-security-management-client-contracts-entities-user-two-factor.d.ts",
+      "default": "./fesm2022/acorex-platform-module-security-management-client-contracts-entities-user-two-factor.mjs"
+    },
     "./contracts/entities/users": {
       "types": "./types/acorex-platform-module-security-management-client-contracts-entities-users.d.ts",
       "default": "./fesm2022/acorex-platform-module-security-management-client-contracts-entities-users.mjs"

package/types/acorex-platform-module-security-management-client-contracts-entities-user-two-factor.d.ts

@@ -0,0 +1,9 @@
+import { AXPEntity } from '@acorex-platform/framework-shared/entity';
+
+/**
+ * Schema-only entity for authenticator enrollment.
+ * No secret fields in UI; all mutations go through dedicated 2FA commands.
+ */
+declare function userTwoFactorFactory(): Promise<AXPEntity | null>;
+
+export { userTwoFactorFactory };

package/types/acorex-platform-module-security-management-client-contracts.d.ts

@@ -1,5 +1,5 @@
-import { AXPContextDefinition, AXPExpression } from '@acorex-platform/framework-shared/core';
-import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';
+import { AXPContextDefinition, AXPModuleManifest, AXPExpression } from '@acorex-platform/framework-shared/core';
+import { AXPEntityModel, AXPEntity } from '@acorex-platform/framework-shared/entity';
 
 declare const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[];
 
@@ -153,6 +153,12 @@ declare const RootConfig: {
             readonly titlePlural: `@${string}:identity-providers.entities.identity-provider.plural`;
             readonly icon: "fa-light fa-id-badge";
         };
+        readonly userTwoFactor: {
+            readonly name: "UserTwoFactor";
+            readonly title: `@${string}:user-two-factor.entities.user-two-factor.title`;
+            readonly titlePlural: `@${string}:user-two-factor.entities.user-two-factor.plural`;
+            readonly icon: "fa-light fa-shield-keyhole";
+        };
     };
     readonly queries: {
         readonly reports: {
@@ -165,6 +171,12 @@ declare const RootConfig: {
     };
 };
 
+/**
+ * Security Management Module Manifest.
+ * Defines module metadata, features, and provider references.
+ */
+declare const SecurityManagementManifest: AXPModuleManifest;
+
 /** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */
 declare const AXM_USER_ACCESS_STATE_DEFINITION_KEY = "security-management.access-state.user";
 
@@ -213,10 +225,51 @@ interface AXMUserPasswordResetInfo {
     sentAt: string;
 }
 
+/**
+ * Invitation challenge / audit metadata on TenantManagement.TenantUser.
+ * The raw token is never persisted — only a SHA-256 hash while the invite is pending.
+ */
+interface AXMUserInvitationInfo {
+    /** Present only while `TenantUser.statusId` is pending; cleared after resolve. */
+    tokenHash?: string;
+    expiresAt: string;
+    sentAt: string;
+    invitedByUserId: string;
+    applicationIds?: string[];
+    /** Always `invite` for rows created/updated by Invite (not create-in-tenant). */
+    source: 'invite';
+    /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */
+    acceptedAt?: string;
+}
+/** How a User identity row was created (directory provenance). */
+type AXMUserCreatedVia = 'invite' | 'create-in-tenant' | 'register' | 'seed' | 'idp';
+/**
+ * In-app inbox definition for membership invites to users who already have a tenant.
+ * Inbox row action opens the auth waiting room (Approve/Decline live there).
+ */
+declare const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY: "security-management.membership-invitation";
+/** Query `source` value when opening waiting room from a membership-invite notification. */
+declare const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE: "membership-invite";
+
 declare const AXMSecurityManagementServerCommands: {
     readonly SendPasswordResetEmail: "SecurityManagement:Server:SendPasswordResetEmail";
     readonly CompletePasswordReset: "SecurityManagement:Server:CompletePasswordReset";
     readonly ChangeOwnPassword: "SecurityManagement:Server:ChangeOwnPassword";
+    readonly InviteUser: "SecurityManagement:Server:InviteUser";
+    readonly ResendInvitation: "SecurityManagement:Server:ResendInvitation";
+    readonly CancelInvitation: "SecurityManagement:Server:CancelInvitation";
+    readonly AcceptInvitation: "SecurityManagement:Server:AcceptInvitation";
+    readonly ListMyPendingInvitations: "SecurityManagement:Server:ListMyPendingInvitations";
+    readonly DeclineInvitation: "SecurityManagement:Server:DeclineInvitation";
+    readonly AcceptMyInvitation: "SecurityManagement:Server:AcceptMyInvitation";
+    readonly StartTwoFactorEnrollment: "SecurityManagement:Server:StartTwoFactorEnrollment";
+    readonly ConfirmTwoFactorEnrollment: "SecurityManagement:Server:ConfirmTwoFactorEnrollment";
+    readonly DisableTwoFactor: "SecurityManagement:Server:DisableTwoFactor";
+    readonly GenerateTwoFactorRecoveryCodes: "SecurityManagement:Server:GenerateTwoFactorRecoveryCodes";
+    readonly GetTwoFactorStatus: "SecurityManagement:Server:GetTwoFactorStatus";
+    readonly AdminResetTwoFactor: "SecurityManagement:Server:AdminResetTwoFactor";
+    /** Public — completes login after password challenge (TOTP or recovery). */
+    readonly VerifyTwoFactorLogin: "SecurityManagement:Server:VerifyTwoFactorLogin";
 };
 /** Stable codes for self-service password change (client maps to i18n). */
 declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
@@ -227,6 +280,12 @@ declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
 };
 /** Client/UI action key (confirm dialog → server send). */
 declare const AXM_USER_SEND_PASSWORD_RESET_COMMAND = "SecurityManagement:User:SendPasswordResetEmail";
+/** Client/UI action key (confirm dialog → server admin reset 2FA). */
+declare const AXM_USER_RESET_TWO_FACTOR_COMMAND = "SecurityManagement:User:ResetTwoFactor";
+/** Client/UI action keys for invite flows. */
+declare const AXM_USER_INVITE_COMMAND = "SecurityManagement:User:Invite";
+declare const AXM_USER_RESEND_INVITATION_COMMAND = "SecurityManagement:User:ResendInvitation";
+declare const AXM_USER_CANCEL_INVITATION_COMMAND = "SecurityManagement:User:CancelInvitation";
 interface AXMSendPasswordResetEmailInput {
     /** Admin path: target user id. */
     userId?: string;
@@ -246,6 +305,137 @@ interface AXMChangeOwnPasswordInput {
 interface AXMChangeOwnPasswordResult {
     passwordChangedAt: string;
 }
+interface AXMInviteUserInput {
+    email: string;
+    displayName?: string;
+    applicationIds?: string[];
+    /** Client sets true after warning that the identity already exists. */
+    confirmExisting?: boolean;
+    webOrigin?: string;
+}
+interface AXMInviteUserResult {
+    userId: string;
+    tenantUserId: string;
+    userAlreadyExists: boolean;
+    sent: boolean;
+}
+interface AXMResendInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+    webOrigin?: string;
+}
+interface AXMCancelInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+}
+/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */
+declare const AXM_ACCEPT_INVITATION_ERROR_CODES: {
+    readonly Invalid: "ACCEPT_INVITATION_INVALID";
+    readonly Expired: "ACCEPT_INVITATION_EXPIRED";
+    readonly PasswordRequired: "ACCEPT_INVITATION_PASSWORD_REQUIRED";
+};
+type AXMAcceptInvitationReason = 'valid' | 'invalid' | 'expired';
+interface AXMAcceptInvitationInput {
+    token: string;
+    newPassword?: string;
+    /** Check the token only. Does not set a password or consume the link. */
+    preview?: boolean;
+}
+interface AXMAcceptInvitationPreviewResult {
+    usable: boolean;
+    reason: AXMAcceptInvitationReason;
+}
+interface AXMPendingInvitationItem {
+    tenantUserId: string;
+    tenantId: string;
+    tenantTitle?: string;
+    invitedByUserId?: string;
+    expiresAt?: string;
+    sentAt?: string;
+    applicationIds?: string[];
+}
+interface AXMListMyPendingInvitationsResult {
+    items: AXMPendingInvitationItem[];
+}
+interface AXMAcceptMyInvitationInput {
+    tenantUserId: string;
+    newPassword?: string;
+}
+interface AXMDeclineInvitationInput {
+    tenantUserId: string;
+}
+/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
+declare const AXM_TWO_FACTOR_ERROR_CODES: {
+    readonly NotSignedIn: "TWO_FACTOR_NOT_SIGNED_IN";
+    readonly InvalidInput: "TWO_FACTOR_INVALID_INPUT";
+    readonly IncorrectPassword: "TWO_FACTOR_INCORRECT_PASSWORD";
+    readonly IncorrectCode: "TWO_FACTOR_INCORRECT_CODE";
+    readonly AlreadyEnabled: "TWO_FACTOR_ALREADY_ENABLED";
+    readonly NotEnabled: "TWO_FACTOR_NOT_ENABLED";
+    readonly EnrollmentExpired: "TWO_FACTOR_ENROLLMENT_EXPIRED";
+    readonly ChallengeExpired: "TWO_FACTOR_CHALLENGE_EXPIRED";
+    readonly RateLimited: "TWO_FACTOR_RATE_LIMITED";
+    readonly InvalidConfiguration: "TWO_FACTOR_INVALID_CONFIGURATION";
+    readonly ProofRequired: "TWO_FACTOR_PROOF_REQUIRED";
+    readonly UserNotFound: "TWO_FACTOR_USER_NOT_FOUND";
+    readonly Forbidden: "TWO_FACTOR_FORBIDDEN";
+};
+interface AXMStartTwoFactorEnrollmentInput {
+    password: string;
+}
+interface AXMStartTwoFactorEnrollmentResult {
+    enrollmentId: string;
+    otpauthUri: string;
+    /** Base32 secret for manual entry (client renders QR via ax-qrcode). */
+    secretBase32: string;
+    expiresAt: string;
+}
+interface AXMConfirmTwoFactorEnrollmentInput {
+    enrollmentId: string;
+    code: string;
+}
+interface AXMConfirmTwoFactorEnrollmentResult {
+    enabled: true;
+    verifiedAt: string;
+}
+interface AXMDisableTwoFactorInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+interface AXMDisableTwoFactorResult {
+    enabled: false;
+}
+interface AXMGenerateTwoFactorRecoveryCodesInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+interface AXMGenerateTwoFactorRecoveryCodesResult {
+    /** Plaintext codes shown once only (display format ABCD-EFGH). */
+    codes: string[];
+}
+interface AXMGetTwoFactorStatusResult {
+    enabled: boolean;
+    enrolled: boolean;
+    verifiedAt?: string | null;
+    hasRecoveryCodes: boolean;
+    unusedRecoveryCodeCount: number;
+}
+interface AXMAdminResetTwoFactorInput {
+    userId: string;
+    /** When true, only validates that 2FA is enabled; does not wipe or revoke sessions. */
+    dryRun?: boolean;
+}
+interface AXMAdminResetTwoFactorResult {
+    reset: boolean;
+}
+interface AXMVerifyTwoFactorLoginInput {
+    challengeId: string;
+    /** TOTP (6 digits) or recovery code. */
+    code: string;
+    rememberMe?: boolean;
+}
 
 declare enum AXMSessionStatusTypes {
     revoked = "revoked",
@@ -288,10 +478,19 @@ interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<
     loggedOutAt?: Date | string | null;
 }
 
+/**
+ * Login protocol for {@link AXMIdentityProviderEntityModel}.
+ * `directory` covers LDAP, Active Directory, and similar bind-based directories.
+ */
+declare const AXM_IDENTITY_PROVIDER_PROTOCOL: {
+    readonly Oidc: "oidc";
+    readonly Directory: "directory";
+};
+type AXMIdentityProviderProtocol = (typeof AXM_IDENTITY_PROVIDER_PROTOCOL)[keyof typeof AXM_IDENTITY_PROVIDER_PROTOCOL];
 /**
  * Platform login IdP row (SecurityManagement.IdentityProvider).
  * Active/inactive uses the disable plugin field `isDisabled`.
- * Broker routing uses `key` as OAuth `acr_values`.
+ * Broker routing uses `key` as OAuth `acr_values` (OIDC only).
  */
 interface AXMIdentityProviderEntityModel {
     id: string;
@@ -299,18 +498,43 @@ interface AXMIdentityProviderEntityModel {
     key: string;
     title: string;
     icon?: string | null;
-    /** External IdP authorize URL (e.g. Google accounts endpoint). */
+    /**
+     * `oidc` = external OAuth/OIDC broker; `directory` = LDAP/AD-style bind login.
+     * Missing/legacy rows are treated as `oidc`.
+     */
+    protocol?: AXMIdentityProviderProtocol | null;
+    /** External IdP authorize URL (OIDC). */
     authorizationUrl?: string | null;
-    /** External IdP token URL. */
+    /** External IdP token URL (OIDC). */
     tokenUrl?: string | null;
-    /** Optional userinfo URL when id_token is absent. */
+    /** Optional userinfo URL when id_token is absent (OIDC). */
     userInfoUrl?: string | null;
-    /** Space-separated scopes requested from the external IdP. */
+    /** Space-separated scopes requested from the external IdP (OIDC). */
     scopes?: string | null;
+    /**
+     * OIDC issuer URL, or stable directory issuer label stored on provisioned identities.
+     */
     issuerUrl?: string | null;
+    /**
+     * OAuth client id (OIDC), or directory service-account Bind DN when using search bind.
+     */
     clientId?: string | null;
-    /** Platform broker client secret (admin / seed). */
+    /**
+     * OAuth client secret (OIDC), or directory Bind Password when using search bind.
+     */
     clientSecret?: string | null;
+    /** Directory server URL, e.g. `ldap://directory.example.com:389`. */
+    directoryUrl?: string | null;
+    /** Directory search base DN, e.g. `DC=example,DC=com`. */
+    directoryBaseDn?: string | null;
+    /** Direct bind template with `{{username}}`, e.g. `{{username}}@example.com`. */
+    directoryUserDnTemplate?: string | null;
+    /** Optional search filter with `{{username}}` when using a service bind account. */
+    directoryUserSearchFilter?: string | null;
+    /** Start TLS when connecting to the directory server. */
+    directoryUseTls?: boolean | null;
+    /** Reject connections when the directory TLS certificate is untrusted. */
+    directoryTlsRejectUnauthorized?: boolean | null;
     /** From disable plugin — `true` means not offered on login. */
     isDisabled?: boolean;
     priority: number;
@@ -375,6 +599,36 @@ interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string
     roleIds: string[];
 }
 
+type AXMUserTwoFactorMethod = 'authenticator';
+interface AXMUserTwoFactorRecoveryCode {
+    hash: string;
+    /** Salt / hashing metadata (e.g. full pbkdf2 encoded string already embeds salt — optional extra). */
+    salt?: string;
+    usedAt?: string | null;
+}
+/**
+ * Persisted authenticator enrollment for one user.
+ * Secrets must never be returned on client/entity APIs.
+ */
+interface AXMSecurityManagementUserTwoFactorEntityModel extends AXPEntityModel<string> {
+    userId: string;
+    method: AXMUserTwoFactorMethod;
+    encryptedSecret: string;
+    iv: string;
+    authTag: string;
+    keyVersion: number;
+    verifiedAt: string;
+    /** Last accepted TOTP time-step (floor(unix/period)); replay guard. */
+    lastAcceptedStep?: number | null;
+    recoveryCodes?: AXMUserTwoFactorRecoveryCode[];
+}
+
+/**
+ * Schema-only entity for authenticator enrollment.
+ * No secret fields in UI; all mutations go through dedicated 2FA commands.
+ */
+declare function userTwoFactorFactory(): Promise<AXPEntity | null>;
+
 interface AXMSecurityManagementUsersEntityModel extends AXPEntityModel<string> {
     id: string;
     username: string;
@@ -414,5 +668,5 @@ interface AXMSecurityManagementUsersEntityModel extends AXPEntityModel<string> {
     passwordReset?: AXMUserPasswordResetInfo | null;
 }
 
-export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState };
-export type { AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMIdentityProviderEntityModel, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMUserPasswordResetInfo };
+export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_ACCEPT_INVITATION_ERROR_CODES, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY, AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_TWO_FACTOR_ERROR_CODES, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_CANCEL_INVITATION_COMMAND, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_INVITE_COMMAND, AXM_USER_RESEND_INVITATION_COMMAND, AXM_USER_RESET_TWO_FACTOR_COMMAND, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, SecurityManagementManifest, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState, userTwoFactorFactory };
+export type { AXMAcceptInvitationInput, AXMAcceptInvitationPreviewResult, AXMAcceptInvitationReason, AXMAcceptMyInvitationInput, AXMAdminResetTwoFactorInput, AXMAdminResetTwoFactorResult, AXMCancelInvitationInput, AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMConfirmTwoFactorEnrollmentInput, AXMConfirmTwoFactorEnrollmentResult, AXMDeclineInvitationInput, AXMDisableTwoFactorInput, AXMDisableTwoFactorResult, AXMGenerateTwoFactorRecoveryCodesInput, AXMGenerateTwoFactorRecoveryCodesResult, AXMGetTwoFactorStatusResult, AXMIdentityProviderEntityModel, AXMIdentityProviderProtocol, AXMInviteUserInput, AXMInviteUserResult, AXMListMyPendingInvitationsResult, AXMPendingInvitationItem, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMResendInvitationInput, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUserTwoFactorEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMStartTwoFactorEnrollmentInput, AXMStartTwoFactorEnrollmentResult, AXMUserCreatedVia, AXMUserInvitationInfo, AXMUserPasswordResetInfo, AXMUserTwoFactorMethod, AXMUserTwoFactorRecoveryCode, AXMVerifyTwoFactorLoginInput };