@acorex-platform/module-security-management-client 0.0.38 → 0.0.46

package/fesm2022/acorex-platform-module-security-management-client-invite-user.command-kFXjLdxy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"acorex-platform-module-security-management-client-invite-user.command-kFXjLdxy.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/invite-user.command.ts"],"sourcesContent":["import { AXDialogService } from '@acorex/components/dialog';\nimport { AXToastService } from '@acorex/components/toast';\nimport { AXTranslationService } from '@acorex/core/translation';\nimport {\n  AXPLayoutBuilderService,\n  resolveLayoutBuilderDialogResult,\n} from '@acorex-platform/framework-client/layout/builder';\nimport { AXPCommandService } from '@acorex-platform/framework-client/runtime';\nimport type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';\nimport {\n  AXM_USER_INVITE_COMMAND,\n  AXMSecurityManagementServerCommands,\n  type AXMInviteUserResult,\n} from '@acorex-platform/module-security-management-client/contracts';\nimport { inject, Injectable } from '@angular/core';\n\n//#region ---- Types ----\n\ninterface InviteFormResult {\n  email: string;\n  displayName?: string;\n  applicationIds?: string[];\n}\n\n//#endregion\n\n//#region ---- Invite user command ----\n\n@Injectable({ providedIn: 'root' })\nexport class AXPInviteUserCommand implements AXPCommand {\n  private readonly layoutBuilder = inject(AXPLayoutBuilderService);\n  private readonly commandService = inject(AXPCommandService);\n  private readonly dialogService = inject(AXDialogService);\n  private readonly toastService = inject(AXToastService);\n  private readonly translationService = inject(AXTranslationService);\n\n  async execute(): AXPCommandExecuteResultPromise {\n    const form = await this.openInviteDialog();\n    if (!form) {\n      return { success: true, kind: 'object', data: { outcome: 'cancelled' } };\n    }\n\n    const webOrigin = typeof window !== 'undefined' ? window.location.origin : undefined;\n    // Nested server call must skip toast middleware — this command owns UX toasts.\n    let result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.InviteUser, {\n      email: form.email,\n      displayName: form.displayName,\n      applicationIds: form.applicationIds,\n      webOrigin,\n    });\n\n    const payload = (result as { data?: AXMInviteUserResult })?.data;\n    if (result?.success && payload?.userAlreadyExists && !payload.sent) {\n      const title = await this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.invite.existing-warning-title')\n        .catch(() => 'User Already Exists');\n      const message = await this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.invite.existing-warning-message', {\n          params: { email: form.email },\n        })\n        .catch(() => `A user with email ${form.email} already exists. Send an invitation to join this tenant?`);\n      const confirmed = await this.dialogService.confirm(title, message, 'warning', 'horizontal');\n      if (!confirmed.result) {\n        return { success: true, kind: 'object', data: { outcome: 'cancelled' } };\n      }\n      result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.InviteUser, {\n        email: form.email,\n        displayName: form.displayName,\n        applicationIds: form.applicationIds,\n        confirmExisting: true,\n        webOrigin,\n      });\n    }\n\n    if (result?.success) {\n      const [toastTitle, toastContent] = await Promise.all([\n        this.translationService\n          .translateAsync('@security-management:users.entities.user.actions.invite.success.title')\n          .catch(() => 'Invitation Sent'),\n        this.translationService\n          .translateAsync('@security-management:users.entities.user.actions.invite.success.description')\n          .catch(() => 'The invitation email was sent.'),\n      ]);\n      this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });\n      return { success: true, kind: 'object', data: result.data };\n    }\n\n    const [toastTitle, fallback] = await Promise.all([\n      this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.invite.error.title')\n        .catch(() => 'Invite Failed'),\n      this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.invite.error.description')\n        .catch(() => 'Failed to invite user.'),\n    ]);\n    const toastContent =\n      (typeof result?.message?.text === 'string' && result.message.text) || fallback;\n    this.toastService.show({ color: 'danger', title: toastTitle, content: toastContent, timeOut: 4000 });\n    // No `message` — outer command toast middleware would duplicate this toast.\n    return { success: false };\n  }\n\n  private async openInviteDialog(): Promise<InviteFormResult | null> {\n    const result = await this.layoutBuilder\n      .create()\n      .dialog<InviteFormResult | null>((dialog) => {\n        dialog\n          .setTitle('@security-management:users.entities.user.actions.invite.dialog.title')\n          .setSize('md')\n          .setCloseButton(true)\n          .setContext({ email: '', displayName: '', applicationIds: [] })\n          .content((flex) => {\n            flex\n              .setDirection('column')\n              .setGap('12px')\n              .formField('@security-management:users.entities.user.actions.invite.fields.email', (field) => {\n                field.path('email');\n                field.textBox({ validations: [{ rule: 'required' }, { rule: 'email' }] });\n              })\n              .formField('@security-management:users.entities.user.actions.invite.fields.display-name', (field) => {\n                field.path('displayName');\n                field.textBox({});\n              })\n              .formField('@security-management:users.entities.user.actions.invite.fields.applications', (field) => {\n                field.path('applicationIds');\n                field.lookupBox({\n                  entity: 'ApplicationManagement.Application',\n                  multiple: true,\n                  look: 'select',\n                });\n              });\n          })\n          .setActions((actions) => {\n            actions.cancel('@general:actions.cancel.title');\n            actions.submit('@security-management:users.entities.user.actions.invite.dialog.submit');\n          })\n          .onAction(async (dialogRef) => {\n            if (dialogRef.action() === 'cancel') {\n              return null;\n            }\n            const ctx = dialogRef.context() as InviteFormResult;\n            const email = (ctx.email ?? '').trim();\n            if (!email) {\n              throw new Error('@security-management:users.entities.user.actions.invite.errors.email-required');\n            }\n            return {\n              email,\n              displayName: (ctx.displayName ?? '').trim() || undefined,\n              applicationIds: Array.isArray(ctx.applicationIds) ? ctx.applicationIds : undefined,\n            };\n          });\n      })\n      .show();\n\n    return resolveLayoutBuilderDialogResult<InviteFormResult>(result);\n  }\n}\n\nexport { AXM_USER_INVITE_COMMAND };\n\n//#endregion\n"],"names":[],"mappings":";;;;;;;;;;AAwBA;AAEA;MAGa,oBAAoB,CAAA;AADjC,IAAA,WAAA,GAAA;AAEmB,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,uBAAuB,CAAC;AAC/C,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1C,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;AACvC,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AACrC,QAAA,IAAA,CAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AA0HnE,IAAA;AAxHC,IAAA,MAAM,OAAO,GAAA;AACX,QAAA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE;QAC1C,IAAI,CAAC,IAAI,EAAE;AACT,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;QAC1E;AAEA,QAAA,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,SAAS;;AAEpF,QAAA,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,mCAAmC,CAAC,UAAU,EAAE;YACnG,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS;AACV,SAAA,CAAC;AAEF,QAAA,MAAM,OAAO,GAAI,MAAyC,EAAE,IAAI;AAChE,QAAA,IAAI,MAAM,EAAE,OAAO,IAAI,OAAO,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;AAClE,YAAA,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC;iBACtB,cAAc,CAAC,gFAAgF;AAC/F,iBAAA,KAAK,CAAC,MAAM,qBAAqB,CAAC;AACrC,YAAA,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC;iBACxB,cAAc,CAAC,kFAAkF,EAAE;AAClG,gBAAA,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;aAC9B;iBACA,KAAK,CAAC,MAAM,CAAA,kBAAA,EAAqB,IAAI,CAAC,KAAK,CAAA,wDAAA,CAA0D,CAAC;AACzG,YAAA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;AAC3F,YAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;AACrB,gBAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;YAC1E;YACA,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,mCAAmC,CAAC,UAAU,EAAE;gBAC/F,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;AACnC,gBAAA,eAAe,EAAE,IAAI;gBACrB,SAAS;AACV,aAAA,CAAC;QACJ;AAEA,QAAA,IAAI,MAAM,EAAE,OAAO,EAAE;YACnB,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACnD,gBAAA,IAAI,CAAC;qBACF,cAAc,CAAC,uEAAuE;AACtF,qBAAA,KAAK,CAAC,MAAM,iBAAiB,CAAC;AACjC,gBAAA,IAAI,CAAC;qBACF,cAAc,CAAC,6EAA6E;AAC5F,qBAAA,KAAK,CAAC,MAAM,gCAAgC,CAAC;AACjD,aAAA,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrG,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC7D;QAEA,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC/C,YAAA,IAAI,CAAC;iBACF,cAAc,CAAC,qEAAqE;AACpF,iBAAA,KAAK,CAAC,MAAM,eAAe,CAAC;AAC/B,YAAA,IAAI,CAAC;iBACF,cAAc,CAAC,2EAA2E;AAC1F,iBAAA,KAAK,CAAC,MAAM,wBAAwB,CAAC;AACzC,SAAA,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,OAAO,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;QAChF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;AAEpG,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;AAEQ,IAAA,MAAM,gBAAgB,GAAA;AAC5B,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;AACvB,aAAA,MAAM;AACN,aAAA,MAAM,CAA0B,CAAC,MAAM,KAAI;YAC1C;iBACG,QAAQ,CAAC,sEAAsE;iBAC/E,OAAO,CAAC,IAAI;iBACZ,cAAc,CAAC,IAAI;AACnB,iBAAA,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;AAC7D,iBAAA,OAAO,CAAC,CAAC,IAAI,KAAI;gBAChB;qBACG,YAAY,CAAC,QAAQ;qBACrB,MAAM,CAAC,MAAM;AACb,qBAAA,SAAS,CAAC,sEAAsE,EAAE,CAAC,KAAK,KAAI;AAC3F,oBAAA,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;oBACnB,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC3E,gBAAA,CAAC;AACA,qBAAA,SAAS,CAAC,6EAA6E,EAAE,CAAC,KAAK,KAAI;AAClG,oBAAA,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;AACzB,oBAAA,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACnB,gBAAA,CAAC;AACA,qBAAA,SAAS,CAAC,6EAA6E,EAAE,CAAC,KAAK,KAAI;AAClG,oBAAA,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;oBAC5B,KAAK,CAAC,SAAS,CAAC;AACd,wBAAA,MAAM,EAAE,mCAAmC;AAC3C,wBAAA,QAAQ,EAAE,IAAI;AACd,wBAAA,IAAI,EAAE,QAAQ;AACf,qBAAA,CAAC;AACJ,gBAAA,CAAC,CAAC;AACN,YAAA,CAAC;AACA,iBAAA,UAAU,CAAC,CAAC,OAAO,KAAI;AACtB,gBAAA,OAAO,CAAC,MAAM,CAAC,+BAA+B,CAAC;AAC/C,gBAAA,OAAO,CAAC,MAAM,CAAC,uEAAuE,CAAC;AACzF,YAAA,CAAC;AACA,iBAAA,QAAQ,CAAC,OAAO,SAAS,KAAI;AAC5B,gBAAA,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,QAAQ,EAAE;AACnC,oBAAA,OAAO,IAAI;gBACb;AACA,gBAAA,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAsB;AACnD,gBAAA,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE;gBACtC,IAAI,CAAC,KAAK,EAAE;AACV,oBAAA,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC;gBAClG;gBACA,OAAO;oBACL,KAAK;AACL,oBAAA,WAAW,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,SAAS;AACxD,oBAAA,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,GAAG,CAAC,cAAc,GAAG,SAAS;iBACnF;AACH,YAAA,CAAC,CAAC;AACN,QAAA,CAAC;AACA,aAAA,IAAI,EAAE;AAET,QAAA,OAAO,gCAAgC,CAAmB,MAAM,CAAC;IACnE;8GA9HW,oBAAoB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAApB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,oBAAoB,cADP,MAAM,EAAA,CAAA,CAAA;;2FACnB,oBAAoB,EAAA,UAAA,EAAA,CAAA;kBADhC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;"}

package/fesm2022/acorex-platform-module-security-management-client-local-entities.mjs

@@ -23,6 +23,7 @@ function provideSecurityManagementLocalEntities() {
             [RootConfig.entities.roles.name]: () => import('@acorex-platform/module-security-management-client/contracts/entities/roles').then((m) => m.rolesFactory()),
             [RootConfig.entities.userRole.name]: () => import('@acorex-platform/module-security-management-client/contracts/entities/user-role').then((m) => m.userRoleFactory()),
             [RootConfig.entities.users.name]: () => import('@acorex-platform/module-security-management-client/contracts/entities/users').then((m) => m.usersFactory()),
+            [RootConfig.entities.userTwoFactor.name]: () => import('@acorex-platform/module-security-management-client/contracts/entities/user-two-factor').then((m) => m.userTwoFactorFactory()),
         },
     });
 }

package/fesm2022/acorex-platform-module-security-management-client-local-entities.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-local-entities.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/provide-local-entities.ts","../../../../libs/modules/security-management/client/src/lib/acorex-platform-module-security-management-client-local-entities.ts"],"sourcesContent":["//#region ----- Imports -----\n\nimport { provideLocalEntityCatalog } from '@acorex-platform/framework-client/layout/entity';\nimport { RootConfig } from '@acorex-platform/module-security-management-client/contracts';\n\n//#endregion\n\n//#region ----- Provide local entities -----\n\n/**\n * Registers security-management layouts on the client from packaged factories.\n * Each `import()` targets a secondary entry so unused entities stay out of the\n * bundle. Do not add this to the demo app; demo continues to load layouts via\n * `Domain:GetEntityLayout`.\n */\nexport function provideSecurityManagementLocalEntities() {\n  return provideLocalEntityCatalog({\n    moduleName: RootConfig.module.name,\n    loaders: {\n      [RootConfig.entities.deviceSessions.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/device-sessions').then((m) => m.deviceSessionsFactory()),\n      [RootConfig.entities.identityProvider.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/identity-provider').then((m) => m.identityProviderFactory()),\n      [RootConfig.entities.policy.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/policy').then((m) => m.policyFactory()),\n      [RootConfig.entities.profile.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/profile').then((m) => m.profileFactory()),\n      [RootConfig.entities.rolePermission.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/role-permission').then((m) => m.rolePermissionFactory()),\n      [RootConfig.entities.roles.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/roles').then((m) => m.rolesFactory()),\n      [RootConfig.entities.userRole.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/user-role').then((m) => m.userRoleFactory()),\n      [RootConfig.entities.users.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/users').then((m) => m.usersFactory()),\n    },\n  });\n}\n\nexport { securityManagementLocalEntityCatalog } from '@acorex-platform/module-security-management-client/contracts/entity-catalog';\n\n//#endregion\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './provide-local-entities';\n"],"names":[],"mappings":";;;;AAAA;AAKA;AAEA;AAEA;;;;;AAKG;SACa,sCAAsC,GAAA;AACpD,IAAA,OAAO,yBAAyB,CAAC;AAC/B,QAAA,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAClC,QAAA,OAAO,EAAE;AACP,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,MACzC,OAAO,uFAAuF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC;AACxI,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,MAC3C,OAAO,yFAAyF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC;AAC5I,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,MACjC,OAAO,8EAA8E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;AACvH,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,MAClC,OAAO,+EAA+E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;AACzH,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,MACzC,OAAO,uFAAuF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC;AACxI,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,MAChC,OAAO,6EAA6E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;AACrH,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,MACnC,OAAO,iFAAiF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;AAC5H,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,MAChC,OAAO,6EAA6E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;AACtH,SAAA;AACF,KAAA,CAAC;AACJ;AAIA;;ACzCA;;AAEG;;"}
+{"version":3,"file":"acorex-platform-module-security-management-client-local-entities.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/provide-local-entities.ts","../../../../libs/modules/security-management/client/src/lib/acorex-platform-module-security-management-client-local-entities.ts"],"sourcesContent":["//#region ----- Imports -----\n\nimport { provideLocalEntityCatalog } from '@acorex-platform/framework-client/layout/entity';\nimport { RootConfig } from '@acorex-platform/module-security-management-client/contracts';\n\n//#endregion\n\n//#region ----- Provide local entities -----\n\n/**\n * Registers security-management layouts on the client from packaged factories.\n * Each `import()` targets a secondary entry so unused entities stay out of the\n * bundle. Do not add this to the demo app; demo continues to load layouts via\n * `Domain:GetEntityLayout`.\n */\nexport function provideSecurityManagementLocalEntities() {\n  return provideLocalEntityCatalog({\n    moduleName: RootConfig.module.name,\n    loaders: {\n      [RootConfig.entities.deviceSessions.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/device-sessions').then((m) => m.deviceSessionsFactory()),\n      [RootConfig.entities.identityProvider.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/identity-provider').then((m) => m.identityProviderFactory()),\n      [RootConfig.entities.policy.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/policy').then((m) => m.policyFactory()),\n      [RootConfig.entities.profile.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/profile').then((m) => m.profileFactory()),\n      [RootConfig.entities.rolePermission.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/role-permission').then((m) => m.rolePermissionFactory()),\n      [RootConfig.entities.roles.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/roles').then((m) => m.rolesFactory()),\n      [RootConfig.entities.userRole.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/user-role').then((m) => m.userRoleFactory()),\n      [RootConfig.entities.users.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/users').then((m) => m.usersFactory()),\n      [RootConfig.entities.userTwoFactor.name]: () =>\n        import('@acorex-platform/module-security-management-client/contracts/entities/user-two-factor').then(\n          (m) => m.userTwoFactorFactory(),\n        ),\n    },\n  });\n}\n\nexport { securityManagementLocalEntityCatalog } from '@acorex-platform/module-security-management-client/contracts/entity-catalog';\n\n//#endregion\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './provide-local-entities';\n"],"names":[],"mappings":";;;;AAAA;AAKA;AAEA;AAEA;;;;;AAKG;SACa,sCAAsC,GAAA;AACpD,IAAA,OAAO,yBAAyB,CAAC;AAC/B,QAAA,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAClC,QAAA,OAAO,EAAE;AACP,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,MACzC,OAAO,uFAAuF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC;AACxI,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,MAC3C,OAAO,yFAAyF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC;AAC5I,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,MACjC,OAAO,8EAA8E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;AACvH,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,MAClC,OAAO,+EAA+E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;AACzH,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,MACzC,OAAO,uFAAuF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC;AACxI,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,MAChC,OAAO,6EAA6E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;AACrH,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,MACnC,OAAO,iFAAiF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;AAC5H,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,MAChC,OAAO,6EAA6E,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;AACrH,YAAA,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,MACxC,OAAO,uFAAuF,CAAC,CAAC,IAAI,CAClG,CAAC,CAAC,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAChC;AACJ,SAAA;AACF,KAAA,CAAC;AACJ;AAIA;;AC7CA;;AAEG;;"}

package/fesm2022/acorex-platform-module-security-management-client-resend-invitation.command-D9Ijk565.mjs

@@ -0,0 +1,76 @@
+import { AXDialogService } from '@acorex/components/dialog';
+import { AXToastService } from '@acorex/components/toast';
+import { AXTranslationService } from '@acorex/core/translation';
+import { AXPCommandService } from '@acorex-platform/framework-client/runtime';
+import { AXMSecurityManagementServerCommands } from '@acorex-platform/module-security-management-client/contracts';
+export { AXM_USER_RESEND_INVITATION_COMMAND } from '@acorex-platform/module-security-management-client/contracts';
+import * as i0 from '@angular/core';
+import { inject, Injectable } from '@angular/core';
+import { r as resolveInvitationCommandTargets } from './acorex-platform-module-security-management-client-invitation-target.util-BAXQZwLW.mjs';
+
+//#region ---- AXPResendInvitationCommand ----
+class AXPResendInvitationCommand {
+    constructor() {
+        this.dialogService = inject(AXDialogService);
+        this.toastService = inject(AXToastService);
+        this.translationService = inject(AXTranslationService);
+        this.commandService = inject(AXPCommandService);
+    }
+    async execute(input = {}) {
+        const { tenantUserId, userId } = resolveInvitationCommandTargets(input);
+        if (!tenantUserId && !userId) {
+            return { success: false, message: { text: 'Tenant user id is required.' } };
+        }
+        const who = input.data?.displayName || input.data?.email || String(tenantUserId || userId);
+        const confirmTitle = await this.translationService
+            .translateAsync('@security-management:users.entities.user.actions.resend-invitation.confirm-title')
+            .catch(() => 'resend-invitation');
+        const confirmMessage = await this.translationService
+            .translateAsync('@security-management:users.entities.user.actions.resend-invitation.confirm-message', {
+            params: { user: who },
+        })
+            .catch(() => `Continue for ${who}?`);
+        const confirmed = await this.dialogService.confirm(confirmTitle, confirmMessage, 'primary', 'horizontal');
+        if (!confirmed.result) {
+            return { success: false };
+        }
+        const webOrigin = typeof window !== 'undefined' ? window.location.origin : undefined;
+        const result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.ResendInvitation, {
+            tenantUserId,
+            userId,
+            webOrigin,
+        });
+        if (result?.success) {
+            const [toastTitle, toastContent] = await Promise.all([
+                this.translationService
+                    .translateAsync('@security-management:users.entities.user.actions.resend-invitation.success.title')
+                    .catch(() => 'Success'),
+                this.translationService
+                    .translateAsync('@security-management:users.entities.user.actions.resend-invitation.success.description')
+                    .catch(() => 'Done.'),
+            ]);
+            this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });
+            return { success: true, kind: 'object', data: undefined };
+        }
+        const [toastTitle, fallback] = await Promise.all([
+            this.translationService
+                .translateAsync('@security-management:users.entities.user.actions.resend-invitation.error.title')
+                .catch(() => 'Failed'),
+            this.translationService
+                .translateAsync('@security-management:users.entities.user.actions.resend-invitation.error.description')
+                .catch(() => 'The action failed.'),
+        ]);
+        const toastContent = (typeof result?.message?.text === 'string' && result.message.text) || fallback;
+        this.toastService.show({ color: 'danger', title: toastTitle, content: toastContent, timeOut: 4000 });
+        return { success: false };
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResendInvitationCommand, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResendInvitationCommand, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResendInvitationCommand, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+export { AXPResendInvitationCommand };
+//# sourceMappingURL=acorex-platform-module-security-management-client-resend-invitation.command-D9Ijk565.mjs.map

package/fesm2022/acorex-platform-module-security-management-client-resend-invitation.command-D9Ijk565.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"acorex-platform-module-security-management-client-resend-invitation.command-D9Ijk565.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/resend-invitation.command.ts"],"sourcesContent":["import { AXDialogService } from '@acorex/components/dialog';\nimport { AXToastService } from '@acorex/components/toast';\nimport { AXTranslationService } from '@acorex/core/translation';\nimport { AXPCommandService } from '@acorex-platform/framework-client/runtime';\nimport type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';\nimport {\n  AXM_USER_RESEND_INVITATION_COMMAND,\n  AXMSecurityManagementServerCommands,\n} from '@acorex-platform/module-security-management-client/contracts';\nimport { inject, Injectable } from '@angular/core';\nimport {\n  resolveInvitationCommandTargets,\n  type AXPInvitationTargetCommandInput,\n} from './invitation-target.util';\n\nexport type { AXPInvitationTargetCommandInput };\n\n//#region ---- AXPResendInvitationCommand ----\n\n@Injectable({ providedIn: 'root' })\nexport class AXPResendInvitationCommand implements AXPCommand<AXPInvitationTargetCommandInput> {\n  private readonly dialogService = inject(AXDialogService);\n  private readonly toastService = inject(AXToastService);\n  private readonly translationService = inject(AXTranslationService);\n  private readonly commandService = inject(AXPCommandService);\n\n  async execute(input: AXPInvitationTargetCommandInput = {}): AXPCommandExecuteResultPromise {\n    const { tenantUserId, userId } = resolveInvitationCommandTargets(input);\n    if (!tenantUserId && !userId) {\n      return { success: false, message: { text: 'Tenant user id is required.' } };\n    }\n\n    const who = input.data?.displayName || input.data?.email || String(tenantUserId || userId);\n    const confirmTitle = await this.translationService\n      .translateAsync('@security-management:users.entities.user.actions.resend-invitation.confirm-title')\n      .catch(() => 'resend-invitation');\n    const confirmMessage = await this.translationService\n      .translateAsync('@security-management:users.entities.user.actions.resend-invitation.confirm-message', {\n        params: { user: who },\n      })\n      .catch(() => `Continue for ${who}?`);\n\n    const confirmed = await this.dialogService.confirm(confirmTitle, confirmMessage, 'primary', 'horizontal');\n    if (!confirmed.result) {\n      return { success: false };\n    }\n\n    const webOrigin = typeof window !== 'undefined' ? window.location.origin : undefined;\n    const result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.ResendInvitation, {\n      tenantUserId,\n      userId,\n      webOrigin,\n    });\n\n    if (result?.success) {\n      const [toastTitle, toastContent] = await Promise.all([\n        this.translationService\n          .translateAsync('@security-management:users.entities.user.actions.resend-invitation.success.title')\n          .catch(() => 'Success'),\n        this.translationService\n          .translateAsync('@security-management:users.entities.user.actions.resend-invitation.success.description')\n          .catch(() => 'Done.'),\n      ]);\n      this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });\n      return { success: true, kind: 'object', data: undefined };\n    }\n\n    const [toastTitle, fallback] = await Promise.all([\n      this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.resend-invitation.error.title')\n        .catch(() => 'Failed'),\n      this.translationService\n        .translateAsync('@security-management:users.entities.user.actions.resend-invitation.error.description')\n        .catch(() => 'The action failed.'),\n    ]);\n    const toastContent =\n      (typeof result?.message?.text === 'string' && result.message.text) || fallback;\n    this.toastService.show({ color: 'danger', title: toastTitle, content: toastContent, timeOut: 4000 });\n    return { success: false };\n  }\n}\n\nexport { AXM_USER_RESEND_INVITATION_COMMAND };\n\n//#endregion\n"],"names":[],"mappings":";;;;;;;;;;AAiBA;MAGa,0BAA0B,CAAA;AADvC,IAAA,WAAA,GAAA;AAEmB,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;AACvC,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AACrC,QAAA,IAAA,CAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AACjD,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAwD5D,IAAA;AAtDC,IAAA,MAAM,OAAO,CAAC,KAAA,GAAyC,EAAE,EAAA;QACvD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,+BAA+B,CAAC,KAAK,CAAC;AACvE,QAAA,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE;AAC5B,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE;QAC7E;QAEA,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC;AAC1F,QAAA,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC;aAC7B,cAAc,CAAC,kFAAkF;AACjG,aAAA,KAAK,CAAC,MAAM,mBAAmB,CAAC;AACnC,QAAA,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC;aAC/B,cAAc,CAAC,oFAAoF,EAAE;AACpG,YAAA,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;SACtB;aACA,KAAK,CAAC,MAAM,gBAAgB,GAAG,CAAA,CAAA,CAAG,CAAC;AAEtC,QAAA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC;AACzG,QAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;AACrB,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3B;AAEA,QAAA,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,SAAS;AACpF,QAAA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,mCAAmC,CAAC,gBAAgB,EAAE;YAC3G,YAAY;YACZ,MAAM;YACN,SAAS;AACV,SAAA,CAAC;AAEF,QAAA,IAAI,MAAM,EAAE,OAAO,EAAE;YACnB,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACnD,gBAAA,IAAI,CAAC;qBACF,cAAc,CAAC,kFAAkF;AACjG,qBAAA,KAAK,CAAC,MAAM,SAAS,CAAC;AACzB,gBAAA,IAAI,CAAC;qBACF,cAAc,CAAC,wFAAwF;AACvG,qBAAA,KAAK,CAAC,MAAM,OAAO,CAAC;AACxB,aAAA,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrG,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3D;QAEA,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC/C,YAAA,IAAI,CAAC;iBACF,cAAc,CAAC,gFAAgF;AAC/F,iBAAA,KAAK,CAAC,MAAM,QAAQ,CAAC;AACxB,YAAA,IAAI,CAAC;iBACF,cAAc,CAAC,sFAAsF;AACrG,iBAAA,KAAK,CAAC,MAAM,oBAAoB,CAAC;AACrC,SAAA,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,OAAO,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;QAChF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpG,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;8GA3DW,0BAA0B,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAA1B,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,0BAA0B,cADb,MAAM,EAAA,CAAA,CAAA;;2FACnB,0BAA0B,EAAA,UAAA,EAAA,CAAA;kBADtC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;"}

package/fesm2022/acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs

@@ -0,0 +1,96 @@
+import { AXDialogService } from '@acorex/components/dialog';
+import { AXToastService } from '@acorex/components/toast';
+import { AXTranslationService } from '@acorex/core/translation';
+import { AXPCommandService } from '@acorex-platform/framework-client/runtime';
+import { AXM_TWO_FACTOR_ERROR_CODES, AXMSecurityManagementServerCommands } from '@acorex-platform/module-security-management-client/contracts';
+export { AXM_USER_RESET_TWO_FACTOR_COMMAND } from '@acorex-platform/module-security-management-client/contracts';
+import * as i0 from '@angular/core';
+import { inject, Injectable } from '@angular/core';
+
+//#endregion
+//#region ----- Constants -----
+const I18N = '@security-management:users.entities.user.actions.reset-two-factor';
+const TWO_FACTOR_ERROR_I18N = {
+    [AXM_TWO_FACTOR_ERROR_CODES.InvalidInput]: `${I18N}.errors.invalid-input`,
+    [AXM_TWO_FACTOR_ERROR_CODES.UserNotFound]: `${I18N}.errors.user-not-found`,
+    [AXM_TWO_FACTOR_ERROR_CODES.Forbidden]: `${I18N}.errors.forbidden`,
+    [AXM_TWO_FACTOR_ERROR_CODES.NotEnabled]: `${I18N}.errors.not-enabled`,
+};
+//#endregion
+//#region ----- Client command -----
+/**
+ * Admin Action on User detail: if 2FA is not enabled, warn and stop;
+ * otherwise confirm, then call server AdminResetTwoFactor.
+ */
+class AXPResetTwoFactorCommand {
+    constructor() {
+        //#region ----- Services & Dependencies -----
+        this.dialogService = inject(AXDialogService);
+        this.toastService = inject(AXToastService);
+        this.translationService = inject(AXTranslationService);
+        this.commandService = inject(AXPCommandService);
+    }
+    //#endregion
+    //#region ----- Command -----
+    async execute(input = {}) {
+        const userId = input.userId ?? input.data?.id;
+        if (!userId) {
+            return { success: false, message: { text: `${I18N}.errors.invalid-input` } };
+        }
+        const who = input.data?.displayName ||
+            input.data?.username ||
+            input.data?.email ||
+            String(userId);
+        // Preflight: stop before confirm when 2FA was never enabled for this user.
+        const preflight = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.AdminResetTwoFactor, { userId: String(userId), dryRun: true });
+        if (!preflight?.success) {
+            await this.showFailureToast(preflight?.message?.code);
+            return { success: false };
+        }
+        const confirmTitle = await this.translationService.translateAsync(`${I18N}.confirm-title`);
+        const confirmMessage = await this.translationService.translateAsync(`${I18N}.confirm-message`, {
+            params: { user: who },
+        });
+        const confirmed = await this.dialogService.confirm(confirmTitle, confirmMessage, 'danger', 'horizontal');
+        if (!confirmed.result) {
+            return { success: false };
+        }
+        const result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.AdminResetTwoFactor, { userId: String(userId) });
+        if (result?.success) {
+            const [toastTitle, toastContent] = await Promise.all([
+                this.translationService.translateAsync(`${I18N}.success.title`),
+                this.translationService.translateAsync(`${I18N}.success.description`),
+            ]);
+            this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });
+            return { success: true, kind: 'object', data: undefined };
+        }
+        await this.showFailureToast(result?.message?.code);
+        return { success: false };
+    }
+    //#endregion
+    //#region ----- Helpers -----
+    async showFailureToast(code) {
+        const codeKey = typeof code === 'string' ? code : '';
+        const errorKey = TWO_FACTOR_ERROR_I18N[codeKey] || `${I18N}.error.description`;
+        const isNotEnabled = codeKey === AXM_TWO_FACTOR_ERROR_CODES.NotEnabled;
+        const [toastTitle, toastContent] = await Promise.all([
+            this.translationService.translateAsync(isNotEnabled ? `${I18N}.errors.not-enabled-title` : `${I18N}.error.title`),
+            this.translationService.translateAsync(errorKey),
+        ]);
+        this.toastService.show({
+            color: isNotEnabled ? 'warning' : 'danger',
+            title: toastTitle,
+            content: toastContent,
+            timeOut: 4000,
+        });
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResetTwoFactorCommand, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResetTwoFactorCommand, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPResetTwoFactorCommand, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+export { AXPResetTwoFactorCommand };
+//# sourceMappingURL=acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs.map

package/fesm2022/acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"acorex-platform-module-security-management-client-reset-two-factor.command-psTDKoNf.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/reset-two-factor.command.ts"],"sourcesContent":["import { AXDialogService } from '@acorex/components/dialog';\nimport { AXToastService } from '@acorex/components/toast';\nimport { AXTranslationService } from '@acorex/core/translation';\nimport { AXPCommandService } from '@acorex-platform/framework-client/runtime';\nimport { AXPCommand, type AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';\nimport {\n  AXM_TWO_FACTOR_ERROR_CODES,\n  AXM_USER_RESET_TWO_FACTOR_COMMAND,\n  AXMSecurityManagementServerCommands,\n} from '@acorex-platform/module-security-management-client/contracts';\nimport { inject, Injectable } from '@angular/core';\n\n//#region ----- Types -----\n\nexport interface AXPResetTwoFactorCommandInput {\n  userId?: string;\n  data?: {\n    id?: string;\n    displayName?: string;\n    username?: string;\n    email?: string;\n  };\n}\n\n//#endregion\n\n//#region ----- Constants -----\n\nconst I18N = '@security-management:users.entities.user.actions.reset-two-factor';\n\nconst TWO_FACTOR_ERROR_I18N: Record<string, string> = {\n  [AXM_TWO_FACTOR_ERROR_CODES.InvalidInput]: `${I18N}.errors.invalid-input`,\n  [AXM_TWO_FACTOR_ERROR_CODES.UserNotFound]: `${I18N}.errors.user-not-found`,\n  [AXM_TWO_FACTOR_ERROR_CODES.Forbidden]: `${I18N}.errors.forbidden`,\n  [AXM_TWO_FACTOR_ERROR_CODES.NotEnabled]: `${I18N}.errors.not-enabled`,\n};\n\n//#endregion\n\n//#region ----- Client command -----\n\n/**\n * Admin Action on User detail: if 2FA is not enabled, warn and stop;\n * otherwise confirm, then call server AdminResetTwoFactor.\n */\n@Injectable({ providedIn: 'root' })\nexport class AXPResetTwoFactorCommand implements AXPCommand<AXPResetTwoFactorCommandInput> {\n  //#region ----- Services & Dependencies -----\n\n  private readonly dialogService = inject(AXDialogService);\n  private readonly toastService = inject(AXToastService);\n  private readonly translationService = inject(AXTranslationService);\n  private readonly commandService = inject(AXPCommandService);\n\n  //#endregion\n\n  //#region ----- Command -----\n\n  async execute(input: AXPResetTwoFactorCommandInput = {}): AXPCommandExecuteResultPromise {\n    const userId = input.userId ?? input.data?.id;\n    if (!userId) {\n      return { success: false, message: { text: `${I18N}.errors.invalid-input` } };\n    }\n\n    const who =\n      input.data?.displayName ||\n      input.data?.username ||\n      input.data?.email ||\n      String(userId);\n\n    // Preflight: stop before confirm when 2FA was never enabled for this user.\n    const preflight = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.AdminResetTwoFactor,\n      { userId: String(userId), dryRun: true },\n    );\n    if (!preflight?.success) {\n      await this.showFailureToast(preflight?.message?.code);\n      return { success: false };\n    }\n\n    const confirmTitle = await this.translationService.translateAsync(`${I18N}.confirm-title`);\n    const confirmMessage = await this.translationService.translateAsync(`${I18N}.confirm-message`, {\n      params: { user: who },\n    });\n\n    const confirmed = await this.dialogService.confirm(confirmTitle, confirmMessage, 'danger', 'horizontal');\n    if (!confirmed.result) {\n      return { success: false };\n    }\n\n    const result = await this.commandService.executeRemote(\n      AXMSecurityManagementServerCommands.AdminResetTwoFactor,\n      { userId: String(userId) },\n    );\n\n    if (result?.success) {\n      const [toastTitle, toastContent] = await Promise.all([\n        this.translationService.translateAsync(`${I18N}.success.title`),\n        this.translationService.translateAsync(`${I18N}.success.description`),\n      ]);\n      this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });\n      return { success: true, kind: 'object', data: undefined };\n    }\n\n    await this.showFailureToast(result?.message?.code);\n    return { success: false };\n  }\n\n  //#endregion\n\n  //#region ----- Helpers -----\n\n  private async showFailureToast(code: unknown): Promise<void> {\n    const codeKey = typeof code === 'string' ? code : '';\n    const errorKey = TWO_FACTOR_ERROR_I18N[codeKey] || `${I18N}.error.description`;\n    const isNotEnabled = codeKey === AXM_TWO_FACTOR_ERROR_CODES.NotEnabled;\n    const [toastTitle, toastContent] = await Promise.all([\n      this.translationService.translateAsync(\n        isNotEnabled ? `${I18N}.errors.not-enabled-title` : `${I18N}.error.title`,\n      ),\n      this.translationService.translateAsync(errorKey),\n    ]);\n    this.toastService.show({\n      color: isNotEnabled ? 'warning' : 'danger',\n      title: toastTitle,\n      content: toastContent,\n      timeOut: 4000,\n    });\n  }\n\n  //#endregion\n}\n\nexport { AXM_USER_RESET_TWO_FACTOR_COMMAND };\n\n//#endregion\n"],"names":[],"mappings":";;;;;;;;;AAwBA;AAEA;AAEA,MAAM,IAAI,GAAG,mEAAmE;AAEhF,MAAM,qBAAqB,GAA2B;AACpD,IAAA,CAAC,0BAA0B,CAAC,YAAY,GAAG,CAAA,EAAG,IAAI,CAAA,qBAAA,CAAuB;AACzE,IAAA,CAAC,0BAA0B,CAAC,YAAY,GAAG,CAAA,EAAG,IAAI,CAAA,sBAAA,CAAwB;AAC1E,IAAA,CAAC,0BAA0B,CAAC,SAAS,GAAG,CAAA,EAAG,IAAI,CAAA,iBAAA,CAAmB;AAClE,IAAA,CAAC,0BAA0B,CAAC,UAAU,GAAG,CAAA,EAAG,IAAI,CAAA,mBAAA,CAAqB;CACtE;AAED;AAEA;AAEA;;;AAGG;MAEU,wBAAwB,CAAA;AADrC,IAAA,WAAA,GAAA;;AAImB,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;AACvC,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AACrC,QAAA,IAAA,CAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC;AACjD,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AA+E5D,IAAA;;;AAzEC,IAAA,MAAM,OAAO,CAAC,KAAA,GAAuC,EAAE,EAAA;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE;QAC7C,IAAI,CAAC,MAAM,EAAE;AACX,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAA,EAAG,IAAI,CAAA,qBAAA,CAAuB,EAAE,EAAE;QAC9E;AAEA,QAAA,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,EAAE,WAAW;YACvB,KAAK,CAAC,IAAI,EAAE,QAAQ;YACpB,KAAK,CAAC,IAAI,EAAE,KAAK;YACjB,MAAM,CAAC,MAAM,CAAC;;QAGhB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACvD,mCAAmC,CAAC,mBAAmB,EACvD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CACzC;AACD,QAAA,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE;YACvB,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AACrD,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3B;AAEA,QAAA,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,CAAA,cAAA,CAAgB,CAAC;AAC1F,QAAA,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,CAAA,gBAAA,CAAkB,EAAE;AAC7F,YAAA,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB,SAAA,CAAC;AAEF,QAAA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC;AACxG,QAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;AACrB,YAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3B;QAEA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CACpD,mCAAmC,CAAC,mBAAmB,EACvD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAC3B;AAED,QAAA,IAAI,MAAM,EAAE,OAAO,EAAE;YACnB,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnD,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,gBAAgB,CAAC;gBAC/D,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA,EAAG,IAAI,sBAAsB,CAAC;AACtE,aAAA,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrG,YAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3D;QAEA,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAClD,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;;;IAMQ,MAAM,gBAAgB,CAAC,IAAa,EAAA;AAC1C,QAAA,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAA,EAAG,IAAI,CAAA,kBAAA,CAAoB;AAC9E,QAAA,MAAM,YAAY,GAAG,OAAO,KAAK,0BAA0B,CAAC,UAAU;QACtE,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACnD,YAAA,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACpC,YAAY,GAAG,CAAA,EAAG,IAAI,2BAA2B,GAAG,CAAA,EAAG,IAAI,cAAc,CAC1E;AACD,YAAA,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC;AACjD,SAAA,CAAC;AACF,QAAA,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,QAAQ;AAC1C,YAAA,KAAK,EAAE,UAAU;AACjB,YAAA,OAAO,EAAE,YAAY;AACrB,YAAA,OAAO,EAAE,IAAI;AACd,SAAA,CAAC;IACJ;8GAlFW,wBAAwB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAxB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,wBAAwB,cADX,MAAM,EAAA,CAAA,CAAA;;2FACnB,wBAAwB,EAAA,UAAA,EAAA,CAAA;kBADpC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;"}

package/fesm2022/acorex-platform-module-security-management-client.mjs

@@ -1,2 +1,2 @@
-export { A as AXMAssignPermissionsCommand, a as AXMDeviceSessionsService, b as AXMPermissionsModule, c as AXMRolePermissionGrantService, d as AXMRolePermissionsPageComponent, e as AXMRolePermissionsPageComponentProvider, f as AXMSecurityManagementModule, g as AXPPermissionsEditorComponent, h as AXPPermissionsWidget, i as AXPPermissionsWidgetColumnComponent, j as AXPPermissionsWidgetEditComponent, k as AXPPermissionsWidgetViewComponent } from './acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-Ddzg9VYV.mjs';
+export { A as AXMAssignPermissionsCommand, a as AXMDeviceSessionsService, b as AXMPermissionsModule, c as AXMRolePermissionGrantService, d as AXMRolePermissionsPageComponent, e as AXMRolePermissionsPageComponentProvider, f as AXMSecurityManagementModule, g as AXPPermissionsEditorComponent, h as AXPPermissionsWidget, i as AXPPermissionsWidgetColumnComponent, j as AXPPermissionsWidgetEditComponent, k as AXPPermissionsWidgetViewComponent } from './acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-D-VISihP.mjs';
 //# sourceMappingURL=acorex-platform-module-security-management-client.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acorex-platform/module-security-management-client",
-  "version": "0.0.38",
+  "version": "0.0.46",
   "sideEffects": false,
   "peerDependencies": {
     "@angular/common": "^21.0.0 || ^22.0.0",
@@ -51,6 +51,10 @@
       "types": "./types/acorex-platform-module-security-management-client-contracts-entities-user-role.d.ts",
       "default": "./fesm2022/acorex-platform-module-security-management-client-contracts-entities-user-role.mjs"
     },
+    "./contracts/entities/user-two-factor": {
+      "types": "./types/acorex-platform-module-security-management-client-contracts-entities-user-two-factor.d.ts",
+      "default": "./fesm2022/acorex-platform-module-security-management-client-contracts-entities-user-two-factor.mjs"
+    },
     "./contracts/entities/users": {
       "types": "./types/acorex-platform-module-security-management-client-contracts-entities-users.d.ts",
       "default": "./fesm2022/acorex-platform-module-security-management-client-contracts-entities-users.mjs"

package/types/acorex-platform-module-security-management-client-contracts-entities-user-two-factor.d.ts

@@ -0,0 +1,9 @@
+import { AXPEntity } from '@acorex-platform/framework-shared/entity';
+
+/**
+ * Schema-only entity for authenticator enrollment.
+ * No secret fields in UI; all mutations go through dedicated 2FA commands.
+ */
+declare function userTwoFactorFactory(): Promise<AXPEntity | null>;
+
+export { userTwoFactorFactory };

package/types/acorex-platform-module-security-management-client-contracts.d.ts

@@ -1,5 +1,5 @@
-import { AXPContextDefinition, AXPExpression } from '@acorex-platform/framework-shared/core';
-import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';
+import { AXPContextDefinition, AXPModuleManifest, AXPExpression } from '@acorex-platform/framework-shared/core';
+import { AXPEntityModel, AXPEntity } from '@acorex-platform/framework-shared/entity';
 
 declare const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[];
 
@@ -153,6 +153,12 @@ declare const RootConfig: {
             readonly titlePlural: `@${string}:identity-providers.entities.identity-provider.plural`;
             readonly icon: "fa-light fa-id-badge";
         };
+        readonly userTwoFactor: {
+            readonly name: "UserTwoFactor";
+            readonly title: `@${string}:user-two-factor.entities.user-two-factor.title`;
+            readonly titlePlural: `@${string}:user-two-factor.entities.user-two-factor.plural`;
+            readonly icon: "fa-light fa-shield-keyhole";
+        };
     };
     readonly queries: {
         readonly reports: {
@@ -165,6 +171,12 @@ declare const RootConfig: {
     };
 };
 
+/**
+ * Security Management Module Manifest.
+ * Defines module metadata, features, and provider references.
+ */
+declare const SecurityManagementManifest: AXPModuleManifest;
+
 /** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */
 declare const AXM_USER_ACCESS_STATE_DEFINITION_KEY = "security-management.access-state.user";
 
@@ -213,10 +225,51 @@ interface AXMUserPasswordResetInfo {
     sentAt: string;
 }
 
+/**
+ * Invitation challenge / audit metadata on TenantManagement.TenantUser.
+ * The raw token is never persisted — only a SHA-256 hash while the invite is pending.
+ */
+interface AXMUserInvitationInfo {
+    /** Present only while `TenantUser.statusId` is pending; cleared after resolve. */
+    tokenHash?: string;
+    expiresAt: string;
+    sentAt: string;
+    invitedByUserId: string;
+    applicationIds?: string[];
+    /** Always `invite` for rows created/updated by Invite (not create-in-tenant). */
+    source: 'invite';
+    /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */
+    acceptedAt?: string;
+}
+/** How a User identity row was created (directory provenance). */
+type AXMUserCreatedVia = 'invite' | 'create-in-tenant' | 'register' | 'seed' | 'idp';
+/**
+ * In-app inbox definition for membership invites to users who already have a tenant.
+ * Inbox row action opens the auth waiting room (Approve/Decline live there).
+ */
+declare const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY: "security-management.membership-invitation";
+/** Query `source` value when opening waiting room from a membership-invite notification. */
+declare const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE: "membership-invite";
+
 declare const AXMSecurityManagementServerCommands: {
     readonly SendPasswordResetEmail: "SecurityManagement:Server:SendPasswordResetEmail";
     readonly CompletePasswordReset: "SecurityManagement:Server:CompletePasswordReset";
     readonly ChangeOwnPassword: "SecurityManagement:Server:ChangeOwnPassword";
+    readonly InviteUser: "SecurityManagement:Server:InviteUser";
+    readonly ResendInvitation: "SecurityManagement:Server:ResendInvitation";
+    readonly CancelInvitation: "SecurityManagement:Server:CancelInvitation";
+    readonly AcceptInvitation: "SecurityManagement:Server:AcceptInvitation";
+    readonly ListMyPendingInvitations: "SecurityManagement:Server:ListMyPendingInvitations";
+    readonly DeclineInvitation: "SecurityManagement:Server:DeclineInvitation";
+    readonly AcceptMyInvitation: "SecurityManagement:Server:AcceptMyInvitation";
+    readonly StartTwoFactorEnrollment: "SecurityManagement:Server:StartTwoFactorEnrollment";
+    readonly ConfirmTwoFactorEnrollment: "SecurityManagement:Server:ConfirmTwoFactorEnrollment";
+    readonly DisableTwoFactor: "SecurityManagement:Server:DisableTwoFactor";
+    readonly GenerateTwoFactorRecoveryCodes: "SecurityManagement:Server:GenerateTwoFactorRecoveryCodes";
+    readonly GetTwoFactorStatus: "SecurityManagement:Server:GetTwoFactorStatus";
+    readonly AdminResetTwoFactor: "SecurityManagement:Server:AdminResetTwoFactor";
+    /** Public — completes login after password challenge (TOTP or recovery). */
+    readonly VerifyTwoFactorLogin: "SecurityManagement:Server:VerifyTwoFactorLogin";
 };
 /** Stable codes for self-service password change (client maps to i18n). */
 declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
@@ -227,6 +280,12 @@ declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
 };
 /** Client/UI action key (confirm dialog → server send). */
 declare const AXM_USER_SEND_PASSWORD_RESET_COMMAND = "SecurityManagement:User:SendPasswordResetEmail";
+/** Client/UI action key (confirm dialog → server admin reset 2FA). */
+declare const AXM_USER_RESET_TWO_FACTOR_COMMAND = "SecurityManagement:User:ResetTwoFactor";
+/** Client/UI action keys for invite flows. */
+declare const AXM_USER_INVITE_COMMAND = "SecurityManagement:User:Invite";
+declare const AXM_USER_RESEND_INVITATION_COMMAND = "SecurityManagement:User:ResendInvitation";
+declare const AXM_USER_CANCEL_INVITATION_COMMAND = "SecurityManagement:User:CancelInvitation";
 interface AXMSendPasswordResetEmailInput {
     /** Admin path: target user id. */
     userId?: string;
@@ -246,6 +305,137 @@ interface AXMChangeOwnPasswordInput {
 interface AXMChangeOwnPasswordResult {
     passwordChangedAt: string;
 }
+interface AXMInviteUserInput {
+    email: string;
+    displayName?: string;
+    applicationIds?: string[];
+    /** Client sets true after warning that the identity already exists. */
+    confirmExisting?: boolean;
+    webOrigin?: string;
+}
+interface AXMInviteUserResult {
+    userId: string;
+    tenantUserId: string;
+    userAlreadyExists: boolean;
+    sent: boolean;
+}
+interface AXMResendInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+    webOrigin?: string;
+}
+interface AXMCancelInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+}
+/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */
+declare const AXM_ACCEPT_INVITATION_ERROR_CODES: {
+    readonly Invalid: "ACCEPT_INVITATION_INVALID";
+    readonly Expired: "ACCEPT_INVITATION_EXPIRED";
+    readonly PasswordRequired: "ACCEPT_INVITATION_PASSWORD_REQUIRED";
+};
+type AXMAcceptInvitationReason = 'valid' | 'invalid' | 'expired';
+interface AXMAcceptInvitationInput {
+    token: string;
+    newPassword?: string;
+    /** Check the token only. Does not set a password or consume the link. */
+    preview?: boolean;
+}
+interface AXMAcceptInvitationPreviewResult {
+    usable: boolean;
+    reason: AXMAcceptInvitationReason;
+}
+interface AXMPendingInvitationItem {
+    tenantUserId: string;
+    tenantId: string;
+    tenantTitle?: string;
+    invitedByUserId?: string;
+    expiresAt?: string;
+    sentAt?: string;
+    applicationIds?: string[];
+}
+interface AXMListMyPendingInvitationsResult {
+    items: AXMPendingInvitationItem[];
+}
+interface AXMAcceptMyInvitationInput {
+    tenantUserId: string;
+    newPassword?: string;
+}
+interface AXMDeclineInvitationInput {
+    tenantUserId: string;
+}
+/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
+declare const AXM_TWO_FACTOR_ERROR_CODES: {
+    readonly NotSignedIn: "TWO_FACTOR_NOT_SIGNED_IN";
+    readonly InvalidInput: "TWO_FACTOR_INVALID_INPUT";
+    readonly IncorrectPassword: "TWO_FACTOR_INCORRECT_PASSWORD";
+    readonly IncorrectCode: "TWO_FACTOR_INCORRECT_CODE";
+    readonly AlreadyEnabled: "TWO_FACTOR_ALREADY_ENABLED";
+    readonly NotEnabled: "TWO_FACTOR_NOT_ENABLED";
+    readonly EnrollmentExpired: "TWO_FACTOR_ENROLLMENT_EXPIRED";
+    readonly ChallengeExpired: "TWO_FACTOR_CHALLENGE_EXPIRED";
+    readonly RateLimited: "TWO_FACTOR_RATE_LIMITED";
+    readonly InvalidConfiguration: "TWO_FACTOR_INVALID_CONFIGURATION";
+    readonly ProofRequired: "TWO_FACTOR_PROOF_REQUIRED";
+    readonly UserNotFound: "TWO_FACTOR_USER_NOT_FOUND";
+    readonly Forbidden: "TWO_FACTOR_FORBIDDEN";
+};
+interface AXMStartTwoFactorEnrollmentInput {
+    password: string;
+}
+interface AXMStartTwoFactorEnrollmentResult {
+    enrollmentId: string;
+    otpauthUri: string;
+    /** Base32 secret for manual entry (client renders QR via ax-qrcode). */
+    secretBase32: string;
+    expiresAt: string;
+}
+interface AXMConfirmTwoFactorEnrollmentInput {
+    enrollmentId: string;
+    code: string;
+}
+interface AXMConfirmTwoFactorEnrollmentResult {
+    enabled: true;
+    verifiedAt: string;
+}
+interface AXMDisableTwoFactorInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+interface AXMDisableTwoFactorResult {
+    enabled: false;
+}
+interface AXMGenerateTwoFactorRecoveryCodesInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+interface AXMGenerateTwoFactorRecoveryCodesResult {
+    /** Plaintext codes shown once only (display format ABCD-EFGH). */
+    codes: string[];
+}
+interface AXMGetTwoFactorStatusResult {
+    enabled: boolean;
+    enrolled: boolean;
+    verifiedAt?: string | null;
+    hasRecoveryCodes: boolean;
+    unusedRecoveryCodeCount: number;
+}
+interface AXMAdminResetTwoFactorInput {
+    userId: string;
+    /** When true, only validates that 2FA is enabled; does not wipe or revoke sessions. */
+    dryRun?: boolean;
+}
+interface AXMAdminResetTwoFactorResult {
+    reset: boolean;
+}
+interface AXMVerifyTwoFactorLoginInput {
+    challengeId: string;
+    /** TOTP (6 digits) or recovery code. */
+    code: string;
+    rememberMe?: boolean;
+}
 
 declare enum AXMSessionStatusTypes {
     revoked = "revoked",
@@ -409,6 +599,36 @@ interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string
     roleIds: string[];
 }
 
+type AXMUserTwoFactorMethod = 'authenticator';
+interface AXMUserTwoFactorRecoveryCode {
+    hash: string;
+    /** Salt / hashing metadata (e.g. full pbkdf2 encoded string already embeds salt — optional extra). */
+    salt?: string;
+    usedAt?: string | null;
+}
+/**
+ * Persisted authenticator enrollment for one user.
+ * Secrets must never be returned on client/entity APIs.
+ */
+interface AXMSecurityManagementUserTwoFactorEntityModel extends AXPEntityModel<string> {
+    userId: string;
+    method: AXMUserTwoFactorMethod;
+    encryptedSecret: string;
+    iv: string;
+    authTag: string;
+    keyVersion: number;
+    verifiedAt: string;
+    /** Last accepted TOTP time-step (floor(unix/period)); replay guard. */
+    lastAcceptedStep?: number | null;
+    recoveryCodes?: AXMUserTwoFactorRecoveryCode[];
+}
+
+/**
+ * Schema-only entity for authenticator enrollment.
+ * No secret fields in UI; all mutations go through dedicated 2FA commands.
+ */
+declare function userTwoFactorFactory(): Promise<AXPEntity | null>;
+
 interface AXMSecurityManagementUsersEntityModel extends AXPEntityModel<string> {
     id: string;
     username: string;
@@ -448,5 +668,5 @@ interface AXMSecurityManagementUsersEntityModel extends AXPEntityModel<string> {
     passwordReset?: AXMUserPasswordResetInfo | null;
 }
 
-export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState };
-export type { AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMIdentityProviderEntityModel, AXMIdentityProviderProtocol, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMUserPasswordResetInfo };
+export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_ACCEPT_INVITATION_ERROR_CODES, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY, AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_TWO_FACTOR_ERROR_CODES, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_CANCEL_INVITATION_COMMAND, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_INVITE_COMMAND, AXM_USER_RESEND_INVITATION_COMMAND, AXM_USER_RESET_TWO_FACTOR_COMMAND, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, SecurityManagementManifest, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState, userTwoFactorFactory };
+export type { AXMAcceptInvitationInput, AXMAcceptInvitationPreviewResult, AXMAcceptInvitationReason, AXMAcceptMyInvitationInput, AXMAdminResetTwoFactorInput, AXMAdminResetTwoFactorResult, AXMCancelInvitationInput, AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMConfirmTwoFactorEnrollmentInput, AXMConfirmTwoFactorEnrollmentResult, AXMDeclineInvitationInput, AXMDisableTwoFactorInput, AXMDisableTwoFactorResult, AXMGenerateTwoFactorRecoveryCodesInput, AXMGenerateTwoFactorRecoveryCodesResult, AXMGetTwoFactorStatusResult, AXMIdentityProviderEntityModel, AXMIdentityProviderProtocol, AXMInviteUserInput, AXMInviteUserResult, AXMListMyPendingInvitationsResult, AXMPendingInvitationItem, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMResendInvitationInput, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUserTwoFactorEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMStartTwoFactorEnrollmentInput, AXMStartTwoFactorEnrollmentResult, AXMUserCreatedVia, AXMUserInvitationInfo, AXMUserPasswordResetInfo, AXMUserTwoFactorMethod, AXMUserTwoFactorRecoveryCode, AXMVerifyTwoFactorLoginInput };