@acorex-platform/module-security-management-client 0.0.38 → 0.0.48

package/fesm2022/acorex-platform-module-security-management-client-contracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-contracts.mjs","sources":["../../../../libs/modules/security-management/contracts/src/lib/context.definitions.ts","../../../../libs/modules/security-management/contracts/src/features.keys.ts","../../../../libs/modules/security-management/contracts/src/menu.keys.ts","../../../../libs/modules/security-management/contracts/src/permission.keys.ts","../../../../libs/modules/security-management/contracts/src/ROLE_PERMISSIONS_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/USER_ROLES_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/root-config.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_ACCESS_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/user-access-state.ts","../../../../libs/modules/security-management/contracts/src/user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/resolve-user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/user-password-reset.ts","../../../../libs/modules/security-management/contracts/src/server-commands.ts","../../../../libs/modules/security-management/contracts/src/entities/device-sessions/device-sessions.types.ts","../../../../libs/modules/security-management/contracts/src/entities/identity-provider/identity-provider.types.ts","../../../../libs/modules/security-management/contracts/src/entities/policy/policy.types.ts","../../../../libs/modules/security-management/contracts/src/entities/role-permission/role-permission.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-role/user-role.types.ts","../../../../libs/modules/security-management/contracts/src/index.ts","../../../../libs/modules/security-management/contracts/src/acorex-platform-module-security-management-client-contracts.ts"],"sourcesContent":["import type { AXPContextDefinition } from '@acorex-platform/framework-shared/core';\n\n//#region ---- User context definitions ----\n\nexport const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[] = [\n  {\n    name: 'userDisplayName',\n    title: 'User display name',\n    description:\n      'Human-readable name of the signed-in user (name or title from session). Used for personalized responses.',\n    order: 11,\n    capabilities: ['ai'],\n  },\n];\n\n//#endregion\n","//#region ----   Feature Keys   ----\n\n/**\n * Security Management Module Feature Keys.\n * Defines all available features for the Security Management module.\n */\nexport const AXPSecurityManagementFeatureKeys = {\n  ManageRoles: 'SecurityManagement:Feature:ManageRoles',\n  ManageUsers: 'SecurityManagement:Feature:ManageUsers',\n  MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',\n  ManageSessions: 'SecurityManagement:Feature:ManageSessions',\n  ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',\n  /** Platform Console only — Identity Provider management menu + CRUD. */\n  ManageIdentityProviders: 'SecurityManagement:Feature:ManageIdentityProviders',\n  /** Self-service account deletion on the profile page. Off unless the edition enables it. */\n  DeleteAccount: 'SecurityManagement:Feature:DeleteAccount',\n} as const;\n\n//#endregion\n\n","export const AXPSecurityManagementMenuKeys = {\n  Root: 'SecurityManagement:Menu',\n  Users: 'SecurityManagement:Menu:Users',\n  Roles: 'SecurityManagement:Menu:Roles',\n  DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',\n  Policy: 'SecurityManagement:Menu:Policy',\n  IdentityProviders: 'SecurityManagement:Menu:IdentityProviders',\n  MyProfile: 'SecurityManagement:Menu:MyProfile',\n} as const;\n","/**\n * Administration capabilities used by this module.\n * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).\n */\nexport const AXPAdministrationPermissionKeys = {\n  Access: 'Administration:Permission:Access',\n  /** Create and maintain users, roles, role assignments, and related security-access reports. */\n  MaintainUsersAndRoles: 'Administration:Permission:MaintainUsersAndRoles',\n  ManageSessions: 'Administration:Permission:ManageSessions',\n  MaintainPolicies: 'Administration:Permission:MaintainPolicies',\n  ViewIntegrations: 'Administration:Permission:ViewIntegrations',\n  MaintainConnections: 'Administration:Permission:MaintainConnections',\n  ManageIntegrationActions: 'Administration:Permission:ManageIntegrationActions',\n  MaintainWorkflows: 'Administration:Permission:MaintainWorkflows',\n  ManageWorkflowActions: 'Administration:Permission:ManageWorkflowActions',\n  ViewRules: 'Administration:Permission:ViewRules',\n  MaintainRules: 'Administration:Permission:MaintainRules',\n  ManageRuleActions: 'Administration:Permission:ManageRuleActions',\n  MaintainAi: 'Administration:Permission:MaintainAi',\n  UseAiAssist: 'Administration:Permission:UseAiAssist',\n  MaintainDashboards: 'Administration:Permission:MaintainDashboards',\n  ViewJobs: 'Administration:Permission:ViewJobs',\n  ManageJobActions: 'Administration:Permission:ManageJobActions',\n  ViewObservability: 'Administration:Permission:ViewObservability',\n  MaintainObservability: 'Administration:Permission:MaintainObservability',\n} as const;\n\n/**\n * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.\n * Legacy nested shape kept so existing imports compile during migration.\n */\nexport const AXPSecurityManagementPermissionKeys = {\n  User: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  Role: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  DeviceSession: {\n    Management: AXPAdministrationPermissionKeys.ManageSessions,\n    View: AXPAdministrationPermissionKeys.ManageSessions,\n    Terminate: AXPAdministrationPermissionKeys.ManageSessions,\n  },\n  Policy: {\n    Management: AXPAdministrationPermissionKeys.MaintainPolicies,\n    View: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Edit: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Delete: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Create: AXPAdministrationPermissionKeys.MaintainPolicies,\n  },\n} as const;\n","/** Component key for the Role permissions page tab. Register via AXP_PAGE_COMPONENT_PROVIDER. */\nexport const ROLE_PERMISSIONS_PAGE_COMPONENT_KEY = 'role-permissions-page';\n","export const USER_ROLES_PAGE_COMPONENT_KEY = 'user-roles-page';\n","const config = {\n  i18n: 'security-management',\n  profileEntity: 'Profile',\n};\nexport const RootConfig = {\n  config,\n  module: {\n    route: 'security-management',\n    name: 'SecurityManagement',\n    title: `@${config.i18n}:module.title`,\n    icon: 'fa-light fa-shield-halved',\n  },\n  entities: {\n    policy: {\n      name: 'Policy',\n      title: `@${config.i18n}:policies.entities.policy.title`,\n      titlePlural: `@${config.i18n}:policies.entities.policy.plural`,\n      icon: 'fa-light fa-clipboard-list',\n    },\n    deviceSessions: {\n      name: 'DeviceSessions',\n      title: `@${config.i18n}:sessions.entities.session.title`,\n      titlePlural: `@${config.i18n}:sessions.entities.session.plural`,\n      icon: 'fa-light fa-laptop',\n    },\n    users: {\n      name: 'User',\n      title: `@${config.i18n}:users.entities.user.title`,\n      titlePlural: `@${config.i18n}:users.entities.user.plural`,\n      icon: 'fa-light fa-users',\n    },\n    roles: {\n      name: 'Role',\n      title: `@${config.i18n}:roles.entities.role.title`,\n      titlePlural: `@${config.i18n}:roles.entities.role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    rolePermission: {\n      name: 'RolePermission',\n      title: `@${config.i18n}:role-permissions.entities.role-permission.title`,\n      titlePlural: `@${config.i18n}:role-permissions.entities.role-permission.plural`,\n      icon: 'fa-light fa-key',\n    },\n    userRole: {\n      name: 'UserRole',\n      title: `@${config.i18n}:user-roles.entities.user-role.title`,\n      titlePlural: `@${config.i18n}:user-roles.entities.user-role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    profile: {\n      name: 'Profile',\n      title: `@${config.i18n}:profile.entities.profile.title`,\n      titlePlural: `@${config.i18n}:profile.entities.profile.plural`,\n      icon: 'fa-light fa-user',\n    },\n    identityProvider: {\n      name: 'IdentityProvider',\n      title: `@${config.i18n}:identity-providers.entities.identity-provider.title`,\n      titlePlural: `@${config.i18n}:identity-providers.entities.identity-provider.plural`,\n      icon: 'fa-light fa-id-badge',\n    },\n  },\n  queries: {\n    reports: {\n      getUserEffectiveRolesHistory: 'SecurityManagement:Reports:GetUserEffectiveRolesHistory',\n      getUserEffectivePermissionsHistory:\n        'SecurityManagement:Reports:GetUserEffectivePermissionsHistory',\n      getRoleHoldersHistory: 'SecurityManagement:Reports:GetRoleHoldersHistory',\n      getPermissionHoldersHistory: 'SecurityManagement:Reports:GetPermissionHoldersHistory',\n      getUserPasswordChangeHistory: 'SecurityManagement:Reports:GetUserPasswordChangeHistory',\n    },\n  },\n} as const;\n","/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */\nexport const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';\n","/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */\nexport const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';\n","//#region ---- User access state ----\n\n/**\n * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).\n * Persisted as the enum string value (e.g. `allowed`).\n */\nexport enum AXMUserAccessState {\n  Allowed = 'allowed',\n  Blocked = 'blocked',\n  Expired = 'expired',\n}\n\n//#endregion\n","//#region ---- User effective (unified) state ----\n\n/**\n * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).\n */\nexport enum AXMUserEffectiveState {\n  Pending = 'pending',\n  Active = 'active',\n  Suspended = 'suspended',\n  Inactive = 'inactive',\n  Archived = 'archived',\n  SignInBlocked = 'sign-in-blocked',\n  CredentialExpired = 'credential-expired',\n}\n\n//#endregion\n","import { AXMUserAccessState } from './user-access-state';\nimport { AXMUserEffectiveState } from './user-effective-state';\n\n//#region ---- Resolve effective state ----\n\nconst AccountLifecycleState = {\n  Active: 'active',\n  Archived: 'archived',\n  Pending: 'pending',\n  Inactive: 'inactive',\n  Suspended: 'suspended',\n} as const;\n\n/**\n * Derives the unified operational state from account lifecycle and sign-in gate.\n * Used for persisted `effectiveState` on SecurityManagement.User.\n */\nexport function resolveAXMUserEffectiveState(input: {\n  accountState: string | undefined;\n  accessState: AXMUserAccessState | string | undefined;\n}): AXMUserEffectiveState {\n  const lifecycle = input.accountState;\n  const auth = (input.accessState ?? AXMUserAccessState.Allowed) as string;\n\n  if (lifecycle === AccountLifecycleState.Archived) {\n    return AXMUserEffectiveState.Archived;\n  }\n  if (lifecycle === AccountLifecycleState.Pending) {\n    return AXMUserEffectiveState.Pending;\n  }\n  if (lifecycle === AccountLifecycleState.Inactive) {\n    return AXMUserEffectiveState.Inactive;\n  }\n  if (lifecycle === AccountLifecycleState.Suspended) {\n    return AXMUserEffectiveState.Suspended;\n  }\n  if (auth === AXMUserAccessState.Expired) {\n    return AXMUserEffectiveState.CredentialExpired;\n  }\n  if (auth === AXMUserAccessState.Blocked) {\n    return AXMUserEffectiveState.SignInBlocked;\n  }\n  if (lifecycle === AccountLifecycleState.Active) {\n    return AXMUserEffectiveState.Active;\n  }\n  return AXMUserEffectiveState.Active;\n}\n\n//#endregion\n","//#region ---- Password reset payload on User ----\n\n/**\n * One-time password-reset token state stored as JSON on SecurityManagement.User.\n * The raw token is never persisted — only a SHA-256 hash.\n */\nexport interface AXMUserPasswordResetInfo {\n  tokenHash: string;\n  expiresAt: string;\n  sentAt: string;\n}\n\n//#endregion\n","//#region ---- Security management server command keys ----\n\nexport const AXMSecurityManagementServerCommands = {\n  SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',\n  CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',\n  ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',\n} as const;\n\n/** Stable codes for self-service password change (client maps to i18n). */\nexport const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {\n  NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',\n  IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',\n  SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',\n  InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',\n} as const;\n\n/** Client/UI action key (confirm dialog → server send). */\nexport const AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';\n\nexport interface AXMSendPasswordResetEmailInput {\n  /** Admin path: target user id. */\n  userId?: string;\n  /** Forgot path: email or username. */\n  login?: string;\n  /** Optional absolute web origin for reset link (defaults to env / localhost). */\n  webOrigin?: string;\n}\n\nexport interface AXMCompletePasswordResetInput {\n  token: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordInput {\n  currentPassword: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordResult {\n  passwordChangedAt: string;\n}\n\n//#endregion\n","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport enum AXMSessionStatusTypes {\n  revoked = 'revoked',\n  expired = 'expired',\n  active = 'active',\n}\n\nexport interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<string> {\n  clientName: string;\n  ipAddress: string;\n  userAgent: string;\n  authorizationId: string;\n  status: string;\n  userId: string;\n  user: {\n    id: string;\n    name: string;\n  };\n  applicationId: string;\n  application: {\n    id: string;\n    name: string;\n  };\n  tenantId: string;\n  tenant: {\n    id: string;\n    name: string;\n  };\n  /** True only for the caller's current login (`sid`); stamped on read. */\n  isActiveSession: boolean;\n  /** Login/session id matching access-token `sid`. */\n  sessionId?: string;\n  /** Stable per-device fingerprint (one active row per user+device). */\n  deviceKey?: string;\n\n  deviceName: string;\n  operatingSystem: string;\n  browser: string;\n  location: string;\n  lastLoginDate: Date;\n  /** When the session was revoked / logged out (null while still active). */\n  loggedOutAt?: Date | string | null;\n}\n","//#region ---- Identity provider entity model ----\n\n/**\n * Login protocol for {@link AXMIdentityProviderEntityModel}.\n * `directory` covers LDAP, Active Directory, and similar bind-based directories.\n */\nexport const AXM_IDENTITY_PROVIDER_PROTOCOL = {\n  Oidc: 'oidc',\n  Directory: 'directory',\n} as const;\n\nexport type AXMIdentityProviderProtocol =\n  (typeof AXM_IDENTITY_PROVIDER_PROTOCOL)[keyof typeof AXM_IDENTITY_PROVIDER_PROTOCOL];\n\n/**\n * Platform login IdP row (SecurityManagement.IdentityProvider).\n * Active/inactive uses the disable plugin field `isDisabled`.\n * Broker routing uses `key` as OAuth `acr_values` (OIDC only).\n */\nexport interface AXMIdentityProviderEntityModel {\n  id: string;\n  /** Stable key used by ListProviders and `/connect` (`google`, `okta-hr`, …). */\n  key: string;\n  title: string;\n  icon?: string | null;\n  /**\n   * `oidc` = external OAuth/OIDC broker; `directory` = LDAP/AD-style bind login.\n   * Missing/legacy rows are treated as `oidc`.\n   */\n  protocol?: AXMIdentityProviderProtocol | null;\n  /** External IdP authorize URL (OIDC). */\n  authorizationUrl?: string | null;\n  /** External IdP token URL (OIDC). */\n  tokenUrl?: string | null;\n  /** Optional userinfo URL when id_token is absent (OIDC). */\n  userInfoUrl?: string | null;\n  /** Space-separated scopes requested from the external IdP (OIDC). */\n  scopes?: string | null;\n  /**\n   * OIDC issuer URL, or stable directory issuer label stored on provisioned identities.\n   */\n  issuerUrl?: string | null;\n  /**\n   * OAuth client id (OIDC), or directory service-account Bind DN when using search bind.\n   */\n  clientId?: string | null;\n  /**\n   * OAuth client secret (OIDC), or directory Bind Password when using search bind.\n   */\n  clientSecret?: string | null;\n  /** Directory server URL, e.g. `ldap://directory.example.com:389`. */\n  directoryUrl?: string | null;\n  /** Directory search base DN, e.g. `DC=example,DC=com`. */\n  directoryBaseDn?: string | null;\n  /** Direct bind template with `{{username}}`, e.g. `{{username}}@example.com`. */\n  directoryUserDnTemplate?: string | null;\n  /** Optional search filter with `{{username}}` when using a service bind account. */\n  directoryUserSearchFilter?: string | null;\n  /** Start TLS when connecting to the directory server. */\n  directoryUseTls?: boolean | null;\n  /** Reject connections when the directory TLS certificate is untrusted. */\n  directoryTlsRejectUnauthorized?: boolean | null;\n  /** From disable plugin — `true` means not offered on login. */\n  isDisabled?: boolean;\n  priority: number;\n}\n\n//#endregion\n","import { AXPExpression } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport interface AXMSecurityManagementPolicyEntityModel extends AXPEntityModel<string> {\n  name: string;\n  title: string;\n  description?: string;\n\n  rules: {\n    conditions: AXPExpression;\n    effects: AXMPolicyEffectRule[]; // list of effect rules\n  }[];\n\n  permission: string; // related permission\n  scope: AXMPolicyScope;\n\n  resource: {\n    type: string;\n    target: string;\n  };\n}\n\nexport type AXMPolicyScope = 'system' | 'tenant' | 'user';\n\nexport type AXMPolicyEffect = 'editable' | 'readonly' | 'hidden' | 'immutable' | 'masked';\n\nexport interface AXMPolicyEffectRule {\n  effect: AXMPolicyEffect;\n  target: string;\n}\n\n// const glocbal_readonly_policy = {\n//   name: 'readonly',\n//   resource: {\n//     reference: '*',\n//     type: 'entity',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ isHidden==true }}',\n//       effects: [\n//         {\n//           target: '*',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n\n// const readonly_file_by_role_policy = {\n//   name: 'readonly_file_by_role_policy',\n//   resource: {\n//     type: 'entity',\n//     reference: 'COntentManagement.Promotion',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ createdDate > 2025-01-01 && user.role!=\"admin\"}}',\n//       effects: [\n//         {\n//           target: 'imageId',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n","//#region ----- RolePermission types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped permission grants for a Role.\n * Role rows are identity-only; all capability keys live here.\n */\nexport interface AXMSecurityManagementRolePermissionEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.Role} id. */\n  roleId: string;\n  /** Capability keys granted for this scope. */\n  permissions: string[];\n}\n\n//#endregion\n","//#region ----- UserRole types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped role assignments for a User.\n * User rows are identity-only for roles; all role memberships live here.\n */\nexport interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.User} id. */\n  userId: string;\n  /** Role ids granted for this scope. */\n  roleIds: string[];\n}\n\n//#endregion\n","//#region ---- Contracts barrel ----\n\nexport * from './lib/context.definitions';\nexport * from './features.keys';\nexport * from './menu.keys';\nexport * from './permission.keys';\nexport * from './ROLE_PERMISSIONS_PAGE_COMPONENT_KEY';\nexport * from './USER_ROLES_PAGE_COMPONENT_KEY';\n\nexport * from './root-config';\n\nexport * from './AXM_USER_ACCESS_STATE_DEFINITION_KEY';\nexport * from './AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY';\nexport * from './user-access-state';\nexport * from './user-effective-state';\nexport * from './resolve-user-effective-state';\nexport * from './user-password-reset';\nexport * from './server-commands';\n//#endregion\n\nexport * from './entities';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":"AAEA;AAEO,MAAM,gCAAgC,GAA2B;AACtE,IAAA;AACE,QAAA,IAAI,EAAE,iBAAiB;AACvB,QAAA,KAAK,EAAE,mBAAmB;AAC1B,QAAA,WAAW,EACT,0GAA0G;AAC5G,QAAA,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,CAAC,IAAI,CAAC;AACrB,KAAA;;AAGH;;ACfA;AAEA;;;AAGG;AACI,MAAM,gCAAgC,GAAG;AAC9C,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,aAAa,EAAE,0CAA0C;AACzD,IAAA,cAAc,EAAE,2CAA2C;AAC3D,IAAA,cAAc,EAAE,2CAA2C;;AAE3D,IAAA,uBAAuB,EAAE,oDAAoD;;AAE7E,IAAA,aAAa,EAAE,0CAA0C;;AAG3D;;AClBO,MAAM,6BAA6B,GAAG;AAC3C,IAAA,IAAI,EAAE,yBAAyB;AAC/B,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,cAAc,EAAE,wCAAwC;AACxD,IAAA,MAAM,EAAE,gCAAgC;AACxC,IAAA,iBAAiB,EAAE,2CAA2C;AAC9D,IAAA,SAAS,EAAE,mCAAmC;;;ACPhD;;;AAGG;AACI,MAAM,+BAA+B,GAAG;AAC7C,IAAA,MAAM,EAAE,kCAAkC;;AAE1C,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,cAAc,EAAE,0CAA0C;AAC1D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,SAAS,EAAE,qCAAqC;AAChD,IAAA,aAAa,EAAE,yCAAyC;AACxD,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,WAAW,EAAE,uCAAuC;AACpD,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,QAAQ,EAAE,oCAAoC;AAC9C,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;;AAG1E;;;AAGG;AACI,MAAM,mCAAmC,GAAG;AACjD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,aAAa,EAAE;QACb,UAAU,EAAE,+BAA+B,CAAC,cAAc;QAC1D,IAAI,EAAE,+BAA+B,CAAC,cAAc;QACpD,SAAS,EAAE,+BAA+B,CAAC,cAAc;AAC1D,KAAA;AACD,IAAA,MAAM,EAAE;QACN,UAAU,EAAE,+BAA+B,CAAC,gBAAgB;QAC5D,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;QACxD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;AACzD,KAAA;;;ACzDH;AACO,MAAM,mCAAmC,GAAG;;ACD5C,MAAM,6BAA6B,GAAG;;ACA7C,MAAM,MAAM,GAAG;AACb,IAAA,IAAI,EAAE,qBAAqB;AAC3B,IAAA,aAAa,EAAE,SAAS;CACzB;AACM,MAAM,UAAU,GAAG;IACxB,MAAM;AACN,IAAA,MAAM,EAAE;AACN,QAAA,KAAK,EAAE,qBAAqB;AAC5B,QAAA,IAAI,EAAE,oBAAoB;AAC1B,QAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,aAAA,CAAe;AACrC,QAAA,IAAI,EAAE,2BAA2B;AAClC,KAAA;AACD,IAAA,QAAQ,EAAE;AACR,QAAA,MAAM,EAAE;AACN,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AACxD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iCAAA,CAAmC;AAC/D,YAAA,IAAI,EAAE,oBAAoB;AAC3B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,mBAAmB;AAC1B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AACxE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iDAAA,CAAmD;AAC/E,YAAA,IAAI,EAAE,iBAAiB;AACxB,SAAA;AACD,QAAA,QAAQ,EAAE;AACR,YAAA,IAAI,EAAE,UAAU;AAChB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oCAAA,CAAsC;AAC5D,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qCAAA,CAAuC;AACnE,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE;AACP,YAAA,IAAI,EAAE,SAAS;AACf,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,kBAAkB;AACzB,SAAA;AACD,QAAA,gBAAgB,EAAE;AAChB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oDAAA,CAAsD;AAC5E,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qDAAA,CAAuD;AACnF,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACF,KAAA;AACD,IAAA,OAAO,EAAE;AACP,QAAA,OAAO,EAAE;AACP,YAAA,4BAA4B,EAAE,yDAAyD;AACvF,YAAA,kCAAkC,EAChC,+DAA+D;AACjE,YAAA,qBAAqB,EAAE,kDAAkD;AACzE,YAAA,2BAA2B,EAAE,wDAAwD;AACrF,YAAA,4BAA4B,EAAE,yDAAyD;AACxF,SAAA;AACF,KAAA;;;ACvEH;AACO,MAAM,oCAAoC,GAAG;;ACDpD;AACO,MAAM,uCAAuC,GAAG;;ACDvD;AAEA;;;AAGG;IACS;AAAZ,CAAA,UAAY,kBAAkB,EAAA;AAC5B,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,GAAA,EAAA,CAAA,CAAA;AAM9B;;ACZA;AAEA;;AAEG;IACS;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACjB,IAAA,qBAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,eAAA,CAAA,GAAA,iBAAiC;AACjC,IAAA,qBAAA,CAAA,mBAAA,CAAA,GAAA,oBAAwC;AAC1C,CAAC,EARW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;AAUjC;;ACZA;AAEA,MAAM,qBAAqB,GAAG;AAC5B,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,OAAO,EAAE,SAAS;AAClB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,SAAS,EAAE,WAAW;CACd;AAEV;;;AAGG;AACG,SAAU,4BAA4B,CAAC,KAG5C,EAAA;AACC,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY;IACpC,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAW;AAExE,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE;QAC/C,OAAO,qBAAqB,CAAC,OAAO;IACtC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE;QACjD,OAAO,qBAAqB,CAAC,SAAS;IACxC;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,iBAAiB;IAChD;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,aAAa;IAC5C;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE;QAC9C,OAAO,qBAAqB,CAAC,MAAM;IACrC;IACA,OAAO,qBAAqB,CAAC,MAAM;AACrC;AAEA;;AChDA;AAYA;;ACZA;AAEO,MAAM,mCAAmC,GAAG;AACjD,IAAA,sBAAsB,EAAE,kDAAkD;AAC1E,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,iBAAiB,EAAE,6CAA6C;;AAGlE;AACO,MAAM,mCAAmC,GAAG;AACjD,IAAA,WAAW,EAAE,mCAAmC;AAChD,IAAA,gBAAgB,EAAE,uCAAuC;AACzD,IAAA,aAAa,EAAE,qCAAqC;AACpD,IAAA,YAAY,EAAE,mCAAmC;;AAGnD;AACO,MAAM,oCAAoC,GAAG;AAyBpD;;ICzCY;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;;ACDjC;AAEA;;;AAGG;AACI,MAAM,8BAA8B,GAAG;AAC5C,IAAA,IAAI,EAAE,MAAM;AACZ,IAAA,SAAS,EAAE,WAAW;;AA2DxB;;ACrCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;ACtEA;AAeA;;ACfA;AAeA;;ACfA;;ACAA;;AAEG;;"}
+{"version":3,"file":"acorex-platform-module-security-management-client-contracts.mjs","sources":["../../../../libs/modules/security-management/contracts/src/lib/context.definitions.ts","../../../../libs/modules/security-management/contracts/src/features.keys.ts","../../../../libs/modules/security-management/contracts/src/menu.keys.ts","../../../../libs/modules/security-management/contracts/src/permission.keys.ts","../../../../libs/modules/security-management/contracts/src/ROLE_PERMISSIONS_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/USER_ROLES_PAGE_COMPONENT_KEY.ts","../../../../libs/modules/security-management/contracts/src/root-config.ts","../../../../libs/modules/security-management/contracts/src/manifest.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_ACCESS_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY.ts","../../../../libs/modules/security-management/contracts/src/user-access-state.ts","../../../../libs/modules/security-management/contracts/src/user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/resolve-user-effective-state.ts","../../../../libs/modules/security-management/contracts/src/user-password-reset.ts","../../../../libs/modules/security-management/contracts/src/user-invitation.ts","../../../../libs/modules/security-management/contracts/src/server-commands.ts","../../../../libs/modules/security-management/contracts/src/entities/device-sessions/device-sessions.types.ts","../../../../libs/modules/security-management/contracts/src/entities/identity-provider/identity-provider.types.ts","../../../../libs/modules/security-management/contracts/src/entities/policy/policy.types.ts","../../../../libs/modules/security-management/contracts/src/entities/role-permission/role-permission.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-role/user-role.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-two-factor/user-two-factor.types.ts","../../../../libs/modules/security-management/contracts/src/entities/user-two-factor/user-two-factor.entity.ts","../../../../libs/modules/security-management/contracts/src/index.ts","../../../../libs/modules/security-management/contracts/src/acorex-platform-module-security-management-client-contracts.ts"],"sourcesContent":["import type { AXPContextDefinition } from '@acorex-platform/framework-shared/core';\n\n//#region ---- User context definitions ----\n\nexport const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[] = [\n  {\n    name: 'userDisplayName',\n    title: 'User display name',\n    description:\n      'Human-readable name of the signed-in user (name or title from session). Used for personalized responses.',\n    order: 11,\n    capabilities: ['ai'],\n  },\n];\n\n//#endregion\n","//#region ----   Feature Keys   ----\n\n/**\n * Security Management Module Feature Keys.\n * Defines all available features for the Security Management module.\n */\nexport const AXPSecurityManagementFeatureKeys = {\n  ManageRoles: 'SecurityManagement:Feature:ManageRoles',\n  ManageUsers: 'SecurityManagement:Feature:ManageUsers',\n  MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',\n  ManageSessions: 'SecurityManagement:Feature:ManageSessions',\n  ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',\n  /** Platform Console only — Identity Provider management menu + CRUD. */\n  ManageIdentityProviders: 'SecurityManagement:Feature:ManageIdentityProviders',\n  /** Self-service account deletion on the profile page. Off unless the edition enables it. */\n  DeleteAccount: 'SecurityManagement:Feature:DeleteAccount',\n} as const;\n\n//#endregion\n\n","export const AXPSecurityManagementMenuKeys = {\n  Root: 'SecurityManagement:Menu',\n  Users: 'SecurityManagement:Menu:Users',\n  Roles: 'SecurityManagement:Menu:Roles',\n  DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',\n  Policy: 'SecurityManagement:Menu:Policy',\n  IdentityProviders: 'SecurityManagement:Menu:IdentityProviders',\n  MyProfile: 'SecurityManagement:Menu:MyProfile',\n} as const;\n","/**\n * Administration capabilities used by this module.\n * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).\n */\nexport const AXPAdministrationPermissionKeys = {\n  Access: 'Administration:Permission:Access',\n  /** Create and maintain users, roles, role assignments, and related security-access reports. */\n  MaintainUsersAndRoles: 'Administration:Permission:MaintainUsersAndRoles',\n  ManageSessions: 'Administration:Permission:ManageSessions',\n  MaintainPolicies: 'Administration:Permission:MaintainPolicies',\n  ViewIntegrations: 'Administration:Permission:ViewIntegrations',\n  MaintainConnections: 'Administration:Permission:MaintainConnections',\n  ManageIntegrationActions: 'Administration:Permission:ManageIntegrationActions',\n  MaintainWorkflows: 'Administration:Permission:MaintainWorkflows',\n  ManageWorkflowActions: 'Administration:Permission:ManageWorkflowActions',\n  ViewRules: 'Administration:Permission:ViewRules',\n  MaintainRules: 'Administration:Permission:MaintainRules',\n  ManageRuleActions: 'Administration:Permission:ManageRuleActions',\n  MaintainAi: 'Administration:Permission:MaintainAi',\n  UseAiAssist: 'Administration:Permission:UseAiAssist',\n  MaintainDashboards: 'Administration:Permission:MaintainDashboards',\n  ViewJobs: 'Administration:Permission:ViewJobs',\n  ManageJobActions: 'Administration:Permission:ManageJobActions',\n  ViewObservability: 'Administration:Permission:ViewObservability',\n  MaintainObservability: 'Administration:Permission:MaintainObservability',\n} as const;\n\n/**\n * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.\n * Legacy nested shape kept so existing imports compile during migration.\n */\nexport const AXPSecurityManagementPermissionKeys = {\n  User: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  Role: {\n    Management: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    View: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Edit: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Delete: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n    Create: AXPAdministrationPermissionKeys.MaintainUsersAndRoles,\n  },\n  DeviceSession: {\n    Management: AXPAdministrationPermissionKeys.ManageSessions,\n    View: AXPAdministrationPermissionKeys.ManageSessions,\n    Terminate: AXPAdministrationPermissionKeys.ManageSessions,\n  },\n  Policy: {\n    Management: AXPAdministrationPermissionKeys.MaintainPolicies,\n    View: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Edit: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Delete: AXPAdministrationPermissionKeys.MaintainPolicies,\n    Create: AXPAdministrationPermissionKeys.MaintainPolicies,\n  },\n} as const;\n","/** Component key for the Role permissions page tab. Register via AXP_PAGE_COMPONENT_PROVIDER. */\nexport const ROLE_PERMISSIONS_PAGE_COMPONENT_KEY = 'role-permissions-page';\n","export const USER_ROLES_PAGE_COMPONENT_KEY = 'user-roles-page';\n","const config = {\n  i18n: 'security-management',\n  profileEntity: 'Profile',\n};\nexport const RootConfig = {\n  config,\n  module: {\n    route: 'security-management',\n    name: 'SecurityManagement',\n    title: `@${config.i18n}:module.title`,\n    icon: 'fa-light fa-shield-halved',\n  },\n  entities: {\n    policy: {\n      name: 'Policy',\n      title: `@${config.i18n}:policies.entities.policy.title`,\n      titlePlural: `@${config.i18n}:policies.entities.policy.plural`,\n      icon: 'fa-light fa-clipboard-list',\n    },\n    deviceSessions: {\n      name: 'DeviceSessions',\n      title: `@${config.i18n}:sessions.entities.session.title`,\n      titlePlural: `@${config.i18n}:sessions.entities.session.plural`,\n      icon: 'fa-light fa-laptop',\n    },\n    users: {\n      name: 'User',\n      title: `@${config.i18n}:users.entities.user.title`,\n      titlePlural: `@${config.i18n}:users.entities.user.plural`,\n      icon: 'fa-light fa-users',\n    },\n    roles: {\n      name: 'Role',\n      title: `@${config.i18n}:roles.entities.role.title`,\n      titlePlural: `@${config.i18n}:roles.entities.role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    rolePermission: {\n      name: 'RolePermission',\n      title: `@${config.i18n}:role-permissions.entities.role-permission.title`,\n      titlePlural: `@${config.i18n}:role-permissions.entities.role-permission.plural`,\n      icon: 'fa-light fa-key',\n    },\n    userRole: {\n      name: 'UserRole',\n      title: `@${config.i18n}:user-roles.entities.user-role.title`,\n      titlePlural: `@${config.i18n}:user-roles.entities.user-role.plural`,\n      icon: 'fa-light fa-user-tag',\n    },\n    profile: {\n      name: 'Profile',\n      title: `@${config.i18n}:profile.entities.profile.title`,\n      titlePlural: `@${config.i18n}:profile.entities.profile.plural`,\n      icon: 'fa-light fa-user',\n    },\n    identityProvider: {\n      name: 'IdentityProvider',\n      title: `@${config.i18n}:identity-providers.entities.identity-provider.title`,\n      titlePlural: `@${config.i18n}:identity-providers.entities.identity-provider.plural`,\n      icon: 'fa-light fa-id-badge',\n    },\n    userTwoFactor: {\n      name: 'UserTwoFactor',\n      title: `@${config.i18n}:user-two-factor.entities.user-two-factor.title`,\n      titlePlural: `@${config.i18n}:user-two-factor.entities.user-two-factor.plural`,\n      icon: 'fa-light fa-shield-keyhole',\n    },\n  },\n  queries: {\n    reports: {\n      getUserEffectiveRolesHistory: 'SecurityManagement:Reports:GetUserEffectiveRolesHistory',\n      getUserEffectivePermissionsHistory:\n        'SecurityManagement:Reports:GetUserEffectivePermissionsHistory',\n      getRoleHoldersHistory: 'SecurityManagement:Reports:GetRoleHoldersHistory',\n      getPermissionHoldersHistory: 'SecurityManagement:Reports:GetPermissionHoldersHistory',\n      getUserPasswordChangeHistory: 'SecurityManagement:Reports:GetUserPasswordChangeHistory',\n    },\n  },\n} as const;\n","//#region ----   Imports   ----\n\nimport { AXPModuleManifest } from '@acorex-platform/framework-shared/core';\nimport { RootConfig } from './root-config';\n\n//#endregion\n\n//#region ----   Manifest Definition   ----\n\n/**\n * Security Management Module Manifest.\n * Defines module metadata, features, and provider references.\n */\nexport const SecurityManagementManifest: AXPModuleManifest = {\n  name: RootConfig.module.name,\n  version: '1.0.0',\n  title: RootConfig.module.title,\n  icon: RootConfig.module.icon,\n  i18n: RootConfig.config.i18n,\n  type: 'platform',\n  domain: 'platform',\n  required: true,\n\n  // Module dependencies (optional)\n};\n\n//#endregion\n\n","/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */\nexport const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';\n","/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */\nexport const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';\n","//#region ---- User access state ----\n\n/**\n * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).\n * Persisted as the enum string value (e.g. `allowed`).\n */\nexport enum AXMUserAccessState {\n  Allowed = 'allowed',\n  Blocked = 'blocked',\n  Expired = 'expired',\n}\n\n//#endregion\n","//#region ---- User effective (unified) state ----\n\n/**\n * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).\n */\nexport enum AXMUserEffectiveState {\n  Pending = 'pending',\n  Active = 'active',\n  Suspended = 'suspended',\n  Inactive = 'inactive',\n  Archived = 'archived',\n  SignInBlocked = 'sign-in-blocked',\n  CredentialExpired = 'credential-expired',\n}\n\n//#endregion\n","import { AXMUserAccessState } from './user-access-state';\nimport { AXMUserEffectiveState } from './user-effective-state';\n\n//#region ---- Resolve effective state ----\n\nconst AccountLifecycleState = {\n  Active: 'active',\n  Archived: 'archived',\n  Pending: 'pending',\n  Inactive: 'inactive',\n  Suspended: 'suspended',\n} as const;\n\n/**\n * Derives the unified operational state from account lifecycle and sign-in gate.\n * Used for persisted `effectiveState` on SecurityManagement.User.\n */\nexport function resolveAXMUserEffectiveState(input: {\n  accountState: string | undefined;\n  accessState: AXMUserAccessState | string | undefined;\n}): AXMUserEffectiveState {\n  const lifecycle = input.accountState;\n  const auth = (input.accessState ?? AXMUserAccessState.Allowed) as string;\n\n  if (lifecycle === AccountLifecycleState.Archived) {\n    return AXMUserEffectiveState.Archived;\n  }\n  if (lifecycle === AccountLifecycleState.Pending) {\n    return AXMUserEffectiveState.Pending;\n  }\n  if (lifecycle === AccountLifecycleState.Inactive) {\n    return AXMUserEffectiveState.Inactive;\n  }\n  if (lifecycle === AccountLifecycleState.Suspended) {\n    return AXMUserEffectiveState.Suspended;\n  }\n  if (auth === AXMUserAccessState.Expired) {\n    return AXMUserEffectiveState.CredentialExpired;\n  }\n  if (auth === AXMUserAccessState.Blocked) {\n    return AXMUserEffectiveState.SignInBlocked;\n  }\n  if (lifecycle === AccountLifecycleState.Active) {\n    return AXMUserEffectiveState.Active;\n  }\n  return AXMUserEffectiveState.Active;\n}\n\n//#endregion\n","//#region ---- Password reset payload on User ----\n\n/**\n * One-time password-reset token state stored as JSON on SecurityManagement.User.\n * The raw token is never persisted — only a SHA-256 hash.\n */\nexport interface AXMUserPasswordResetInfo {\n  tokenHash: string;\n  expiresAt: string;\n  sentAt: string;\n}\n\n//#endregion\n","//#region ---- User invitation payload on TenantUser ----\n\n/**\n * Invitation challenge / audit metadata on TenantManagement.TenantUser.\n * The raw token is never persisted — only a SHA-256 hash while the invite is pending.\n */\nexport interface AXMUserInvitationInfo {\n  /** Present only while `TenantUser.statusId` is pending; cleared after resolve. */\n  tokenHash?: string;\n  expiresAt: string; // ISO\n  sentAt: string;\n  invitedByUserId: string;\n  applicationIds?: string[];\n  /** Always `invite` for rows created/updated by Invite (not create-in-tenant). */\n  source: 'invite';\n  /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */\n  acceptedAt?: string;\n}\n\n/** How a User identity row was created (directory provenance). */\nexport type AXMUserCreatedVia =\n  | 'invite'\n  | 'create-in-tenant'\n  | 'register'\n  | 'seed'\n  | 'idp';\n\n/**\n * In-app inbox definition for membership invites to users who already have a tenant.\n * Inbox row action opens the auth waiting room (Approve/Decline live there).\n */\nexport const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY =\n  'security-management.membership-invitation' as const;\n\n/** Query `source` value when opening waiting room from a membership-invite notification. */\nexport const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = 'membership-invite' as const;\n\n//#endregion\n","//#region ---- Security management server command keys ----\n\nexport const AXMSecurityManagementServerCommands = {\n  SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',\n  CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',\n  ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',\n  InviteUser: 'SecurityManagement:Server:InviteUser',\n  ResendInvitation: 'SecurityManagement:Server:ResendInvitation',\n  CancelInvitation: 'SecurityManagement:Server:CancelInvitation',\n  AcceptInvitation: 'SecurityManagement:Server:AcceptInvitation',\n  ListMyPendingInvitations: 'SecurityManagement:Server:ListMyPendingInvitations',\n  DeclineInvitation: 'SecurityManagement:Server:DeclineInvitation',\n  AcceptMyInvitation: 'SecurityManagement:Server:AcceptMyInvitation',\n  StartTwoFactorEnrollment: 'SecurityManagement:Server:StartTwoFactorEnrollment',\n  ConfirmTwoFactorEnrollment: 'SecurityManagement:Server:ConfirmTwoFactorEnrollment',\n  DisableTwoFactor: 'SecurityManagement:Server:DisableTwoFactor',\n  GenerateTwoFactorRecoveryCodes: 'SecurityManagement:Server:GenerateTwoFactorRecoveryCodes',\n  GetTwoFactorStatus: 'SecurityManagement:Server:GetTwoFactorStatus',\n  AdminResetTwoFactor: 'SecurityManagement:Server:AdminResetTwoFactor',\n  /** Public — completes login after password challenge (TOTP or recovery). */\n  VerifyTwoFactorLogin: 'SecurityManagement:Server:VerifyTwoFactorLogin',\n} as const;\n\n/** Stable codes for self-service password change (client maps to i18n). */\nexport const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {\n  NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',\n  IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',\n  SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',\n  InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',\n} as const;\n\n/** Client/UI action key (confirm dialog → server send). */\nexport const AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';\n\n/** Client/UI action key (confirm dialog → server admin reset 2FA). */\nexport const AXM_USER_RESET_TWO_FACTOR_COMMAND = 'SecurityManagement:User:ResetTwoFactor';\n\n/** Client/UI action keys for invite flows. */\nexport const AXM_USER_INVITE_COMMAND = 'SecurityManagement:User:Invite';\nexport const AXM_USER_RESEND_INVITATION_COMMAND = 'SecurityManagement:User:ResendInvitation';\nexport const AXM_USER_CANCEL_INVITATION_COMMAND = 'SecurityManagement:User:CancelInvitation';\n\nexport interface AXMSendPasswordResetEmailInput {\n  /** Admin path: target user id. */\n  userId?: string;\n  /** Forgot path: email or username. */\n  login?: string;\n  /** Optional absolute web origin for reset link (defaults to env / localhost). */\n  webOrigin?: string;\n}\n\nexport interface AXMCompletePasswordResetInput {\n  token: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordInput {\n  currentPassword: string;\n  newPassword: string;\n}\n\nexport interface AXMChangeOwnPasswordResult {\n  passwordChangedAt: string;\n}\n\nexport interface AXMInviteUserInput {\n  email: string;\n  displayName?: string;\n  applicationIds?: string[];\n  /** Client sets true after warning that the identity already exists. */\n  confirmExisting?: boolean;\n  webOrigin?: string;\n}\n\nexport interface AXMInviteUserResult {\n  userId: string;\n  tenantUserId: string;\n  userAlreadyExists: boolean;\n  sent: boolean;\n}\n\nexport interface AXMResendInvitationInput {\n  tenantUserId?: string;\n  userId?: string;\n  webOrigin?: string;\n}\n\nexport interface AXMCancelInvitationInput {\n  tenantUserId?: string;\n  userId?: string;\n}\n\n/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */\nexport const AXM_ACCEPT_INVITATION_ERROR_CODES = {\n  Invalid: 'ACCEPT_INVITATION_INVALID',\n  Expired: 'ACCEPT_INVITATION_EXPIRED',\n  PasswordRequired: 'ACCEPT_INVITATION_PASSWORD_REQUIRED',\n} as const;\n\nexport type AXMAcceptInvitationReason = 'valid' | 'invalid' | 'expired';\n\nexport interface AXMAcceptInvitationInput {\n  token: string;\n  newPassword?: string;\n  /** Check the token only. Does not set a password or consume the link. */\n  preview?: boolean;\n}\n\nexport interface AXMAcceptInvitationPreviewResult {\n  usable: boolean;\n  reason: AXMAcceptInvitationReason;\n}\n\nexport interface AXMPendingInvitationItem {\n  tenantUserId: string;\n  tenantId: string;\n  tenantTitle?: string;\n  invitedByUserId?: string;\n  expiresAt?: string;\n  sentAt?: string;\n  applicationIds?: string[];\n}\n\nexport interface AXMListMyPendingInvitationsResult {\n  items: AXMPendingInvitationItem[];\n}\n\nexport interface AXMAcceptMyInvitationInput {\n  tenantUserId: string;\n  newPassword?: string;\n}\n\nexport interface AXMDeclineInvitationInput {\n  tenantUserId: string;\n}\n\n/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */\nexport const AXM_TWO_FACTOR_ERROR_CODES = {\n  NotSignedIn: 'TWO_FACTOR_NOT_SIGNED_IN',\n  InvalidInput: 'TWO_FACTOR_INVALID_INPUT',\n  IncorrectPassword: 'TWO_FACTOR_INCORRECT_PASSWORD',\n  IncorrectCode: 'TWO_FACTOR_INCORRECT_CODE',\n  AlreadyEnabled: 'TWO_FACTOR_ALREADY_ENABLED',\n  NotEnabled: 'TWO_FACTOR_NOT_ENABLED',\n  EnrollmentExpired: 'TWO_FACTOR_ENROLLMENT_EXPIRED',\n  ChallengeExpired: 'TWO_FACTOR_CHALLENGE_EXPIRED',\n  RateLimited: 'TWO_FACTOR_RATE_LIMITED',\n  InvalidConfiguration: 'TWO_FACTOR_INVALID_CONFIGURATION',\n  ProofRequired: 'TWO_FACTOR_PROOF_REQUIRED',\n  UserNotFound: 'TWO_FACTOR_USER_NOT_FOUND',\n  Forbidden: 'TWO_FACTOR_FORBIDDEN',\n} as const;\n\nexport interface AXMStartTwoFactorEnrollmentInput {\n  password: string;\n}\n\nexport interface AXMStartTwoFactorEnrollmentResult {\n  enrollmentId: string;\n  otpauthUri: string;\n  /** Base32 secret for manual entry (client renders QR via ax-qrcode). */\n  secretBase32: string;\n  expiresAt: string;\n}\n\nexport interface AXMConfirmTwoFactorEnrollmentInput {\n  enrollmentId: string;\n  code: string;\n}\n\nexport interface AXMConfirmTwoFactorEnrollmentResult {\n  enabled: true;\n  verifiedAt: string;\n}\n\nexport interface AXMDisableTwoFactorInput {\n  /** At least one of password or totpCode is required. */\n  password?: string;\n  totpCode?: string;\n}\n\nexport interface AXMDisableTwoFactorResult {\n  enabled: false;\n}\n\nexport interface AXMGenerateTwoFactorRecoveryCodesInput {\n  /** At least one of password or totpCode is required. */\n  password?: string;\n  totpCode?: string;\n}\n\nexport interface AXMGenerateTwoFactorRecoveryCodesResult {\n  /** Plaintext codes shown once only (display format ABCD-EFGH). */\n  codes: string[];\n}\n\nexport interface AXMGetTwoFactorStatusResult {\n  enabled: boolean;\n  enrolled: boolean;\n  verifiedAt?: string | null;\n  hasRecoveryCodes: boolean;\n  unusedRecoveryCodeCount: number;\n}\n\nexport interface AXMAdminResetTwoFactorInput {\n  userId: string;\n  /** When true, only validates that 2FA is enabled; does not wipe or revoke sessions. */\n  dryRun?: boolean;\n}\n\nexport interface AXMAdminResetTwoFactorResult {\n  reset: boolean;\n}\n\nexport interface AXMVerifyTwoFactorLoginInput {\n  challengeId: string;\n  /** TOTP (6 digits) or recovery code. */\n  code: string;\n  rememberMe?: boolean;\n}\n\n//#endregion\n","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport enum AXMSessionStatusTypes {\n  revoked = 'revoked',\n  expired = 'expired',\n  active = 'active',\n}\n\nexport interface AXMSecurityManagementDeviceSessionsEntityModel extends AXPEntityModel<string> {\n  clientName: string;\n  ipAddress: string;\n  userAgent: string;\n  authorizationId: string;\n  status: string;\n  userId: string;\n  user: {\n    id: string;\n    name: string;\n  };\n  applicationId: string;\n  application: {\n    id: string;\n    name: string;\n  };\n  tenantId: string;\n  tenant: {\n    id: string;\n    name: string;\n  };\n  /** True only for the caller's current login (`sid`); stamped on read. */\n  isActiveSession: boolean;\n  /** Login/session id matching access-token `sid`. */\n  sessionId?: string;\n  /** Stable per-device fingerprint (one active row per user+device). */\n  deviceKey?: string;\n\n  deviceName: string;\n  operatingSystem: string;\n  browser: string;\n  location: string;\n  lastLoginDate: Date;\n  /** When the session was revoked / logged out (null while still active). */\n  loggedOutAt?: Date | string | null;\n}\n","//#region ---- Identity provider entity model ----\n\n/**\n * Login protocol for {@link AXMIdentityProviderEntityModel}.\n * `directory` covers LDAP, Active Directory, and similar bind-based directories.\n */\nexport const AXM_IDENTITY_PROVIDER_PROTOCOL = {\n  Oidc: 'oidc',\n  Directory: 'directory',\n} as const;\n\nexport type AXMIdentityProviderProtocol =\n  (typeof AXM_IDENTITY_PROVIDER_PROTOCOL)[keyof typeof AXM_IDENTITY_PROVIDER_PROTOCOL];\n\n/**\n * Platform login IdP row (SecurityManagement.IdentityProvider).\n * Active/inactive uses the disable plugin field `isDisabled`.\n * Broker routing uses `key` as OAuth `acr_values` (OIDC only).\n */\nexport interface AXMIdentityProviderEntityModel {\n  id: string;\n  /** Stable key used by ListProviders and `/connect` (`google`, `okta-hr`, …). */\n  key: string;\n  title: string;\n  icon?: string | null;\n  /**\n   * `oidc` = external OAuth/OIDC broker; `directory` = LDAP/AD-style bind login.\n   * Missing/legacy rows are treated as `oidc`.\n   */\n  protocol?: AXMIdentityProviderProtocol | null;\n  /** External IdP authorize URL (OIDC). */\n  authorizationUrl?: string | null;\n  /** External IdP token URL (OIDC). */\n  tokenUrl?: string | null;\n  /** Optional userinfo URL when id_token is absent (OIDC). */\n  userInfoUrl?: string | null;\n  /** Space-separated scopes requested from the external IdP (OIDC). */\n  scopes?: string | null;\n  /**\n   * OIDC issuer URL, or stable directory issuer label stored on provisioned identities.\n   */\n  issuerUrl?: string | null;\n  /**\n   * OAuth client id (OIDC), or directory service-account Bind DN when using search bind.\n   */\n  clientId?: string | null;\n  /**\n   * OAuth client secret (OIDC), or directory Bind Password when using search bind.\n   */\n  clientSecret?: string | null;\n  /** Directory server URL, e.g. `ldap://directory.example.com:389`. */\n  directoryUrl?: string | null;\n  /** Directory search base DN, e.g. `DC=example,DC=com`. */\n  directoryBaseDn?: string | null;\n  /** Direct bind template with `{{username}}`, e.g. `{{username}}@example.com`. */\n  directoryUserDnTemplate?: string | null;\n  /** Optional search filter with `{{username}}` when using a service bind account. */\n  directoryUserSearchFilter?: string | null;\n  /** Start TLS when connecting to the directory server. */\n  directoryUseTls?: boolean | null;\n  /** Reject connections when the directory TLS certificate is untrusted. */\n  directoryTlsRejectUnauthorized?: boolean | null;\n  /** From disable plugin — `true` means not offered on login. */\n  isDisabled?: boolean;\n  priority: number;\n}\n\n//#endregion\n","import { AXPExpression } from '@acorex-platform/framework-shared/core';\nimport { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\nexport interface AXMSecurityManagementPolicyEntityModel extends AXPEntityModel<string> {\n  name: string;\n  title: string;\n  description?: string;\n\n  rules: {\n    conditions: AXPExpression;\n    effects: AXMPolicyEffectRule[]; // list of effect rules\n  }[];\n\n  permission: string; // related permission\n  scope: AXMPolicyScope;\n\n  resource: {\n    type: string;\n    target: string;\n  };\n}\n\nexport type AXMPolicyScope = 'system' | 'tenant' | 'user';\n\nexport type AXMPolicyEffect = 'editable' | 'readonly' | 'hidden' | 'immutable' | 'masked';\n\nexport interface AXMPolicyEffectRule {\n  effect: AXMPolicyEffect;\n  target: string;\n}\n\n// const glocbal_readonly_policy = {\n//   name: 'readonly',\n//   resource: {\n//     reference: '*',\n//     type: 'entity',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ isHidden==true }}',\n//       effects: [\n//         {\n//           target: '*',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n\n// const readonly_file_by_role_policy = {\n//   name: 'readonly_file_by_role_policy',\n//   resource: {\n//     type: 'entity',\n//     reference: 'COntentManagement.Promotion',\n//   },\n//   permission: 'readonly-policy',\n//   scope: 'system',\n//   rules: [\n//     {\n//       conditions: '{{ createdDate > 2025-01-01 && user.role!=\"admin\"}}',\n//       effects: [\n//         {\n//           target: 'imageId',\n//           effect: 'readonly',\n//         },\n//       ],\n//     },\n//   ],\n// } as AXMSecurityManagementPolicyEntityModel;\n","//#region ----- RolePermission types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped permission grants for a Role.\n * Role rows are identity-only; all capability keys live here.\n */\nexport interface AXMSecurityManagementRolePermissionEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.Role} id. */\n  roleId: string;\n  /** Capability keys granted for this scope. */\n  permissions: string[];\n}\n\n//#endregion\n","//#region ----- UserRole types -----\n\nimport type { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n/**\n * Scoped role assignments for a User.\n * User rows are identity-only for roles; all role memberships live here.\n */\nexport interface AXMSecurityManagementUserRoleEntityModel extends AXPEntityModel<string> {\n  /** Target {@link SecurityManagement.User} id. */\n  userId: string;\n  /** Role ids granted for this scope. */\n  roleIds: string[];\n}\n\n//#endregion\n","import { AXPEntityModel } from '@acorex-platform/framework-shared/entity';\n\n//#region ----- Types -----\n\nexport type AXMUserTwoFactorMethod = 'authenticator';\n\nexport interface AXMUserTwoFactorRecoveryCode {\n  hash: string;\n  /** Salt / hashing metadata (e.g. full pbkdf2 encoded string already embeds salt — optional extra). */\n  salt?: string;\n  usedAt?: string | null;\n}\n\n/**\n * Persisted authenticator enrollment for one user.\n * Secrets must never be returned on client/entity APIs.\n */\nexport interface AXMSecurityManagementUserTwoFactorEntityModel extends AXPEntityModel<string> {\n  userId: string;\n  method: AXMUserTwoFactorMethod;\n  encryptedSecret: string;\n  iv: string;\n  authTag: string;\n  keyVersion: number;\n  verifiedAt: string;\n  /** Last accepted TOTP time-step (floor(unix/period)); replay guard. */\n  lastAcceptedStep?: number | null;\n  recoveryCodes?: AXMUserTwoFactorRecoveryCode[];\n}\n\n//#endregion\n","import { AXPWidgetsCatalog } from '@acorex-platform/framework-shared/core';\nimport { AXPEntity, createAllQueryView, entityMasterCrudActions } from '@acorex-platform/framework-shared/entity';\nimport { RootConfig } from '../../root-config';\n\n/**\n * Schema-only entity for authenticator enrollment.\n * No secret fields in UI; all mutations go through dedicated 2FA commands.\n */\nexport async function userTwoFactorFactory(): Promise<AXPEntity | null> {\n  const i18n = RootConfig.config.i18n;\n\n  const entityDef: AXPEntity = {\n    module: RootConfig.module.name,\n    name: RootConfig.entities.userTwoFactor.name,\n    title: RootConfig.entities.userTwoFactor.title,\n    icon: RootConfig.entities.userTwoFactor.icon,\n    searchTags: ['two-factor', '2fa', 'totp', 'authenticator', 'احراز هویت دو مرحله‌ای'],\n    formats: {\n      individual: RootConfig.entities.userTwoFactor.title,\n      plural: RootConfig.entities.userTwoFactor.titlePlural,\n      searchResult: {\n        title: '{{ userId }}',\n        description: RootConfig.module.title,\n      },\n    },\n    groups: [\n      {\n        id: 'basic-info',\n        title: `@general:terms.interface.basic-info`,\n      },\n    ],\n    properties: [\n      {\n        name: 'userId',\n        title: `@${i18n}:user-two-factor.fields.user-id.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'string',\n          interface: {\n            type: AXPWidgetsCatalog.text,\n            options: { readOnly: true },\n          },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'method',\n        title: `@${i18n}:user-two-factor.fields.method.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'string',\n          interface: {\n            type: AXPWidgetsCatalog.text,\n            options: { readOnly: true },\n          },\n        },\n        validations: [{ rule: 'required' }],\n      },\n      {\n        name: 'verifiedAt',\n        title: `@${i18n}:user-two-factor.fields.verified-at.title`,\n        groupId: 'basic-info',\n        schema: {\n          dataType: 'dateTime',\n          interface: {\n            type: AXPWidgetsCatalog.dateTime,\n            options: { readOnly: true },\n          },\n        },\n      },\n    ],\n    columns: [{ name: 'userId' }, { name: 'method' }, { name: 'verifiedAt' }],\n    interfaces: {\n      master: {\n        single: {\n          title: '{{ userId }}',\n          sections: [\n            {\n              id: 'basic-info',\n              layout: { positions: { lg: { colSpan: 12 } } },\n            },\n          ],\n          properties: [\n            { name: 'userId', layout: { positions: { lg: { colSpan: 6 } } } },\n            { name: 'method', layout: { positions: { lg: { colSpan: 6 } } } },\n            { name: 'verifiedAt', layout: { positions: { lg: { colSpan: 6 } } } },\n          ],\n          actions: [],\n        },\n        list: {\n          actions: [...entityMasterCrudActions({ create: false, delete: false, edit: false })],\n          views: [createAllQueryView({ sorts: [{ name: 'verifiedAt', dir: 'desc' }] })],\n        },\n      },\n    },\n  };\n\n  return entityDef;\n}\n","//#region ---- Contracts barrel ----\n\nexport * from './lib/context.definitions';\nexport * from './features.keys';\nexport * from './menu.keys';\nexport * from './permission.keys';\nexport * from './ROLE_PERMISSIONS_PAGE_COMPONENT_KEY';\nexport * from './USER_ROLES_PAGE_COMPONENT_KEY';\n\nexport * from './root-config';\nexport * from './manifest';\n\nexport * from './AXM_USER_ACCESS_STATE_DEFINITION_KEY';\nexport * from './AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY';\nexport * from './user-access-state';\nexport * from './user-effective-state';\nexport * from './resolve-user-effective-state';\nexport * from './user-password-reset';\nexport * from './user-invitation';\nexport * from './server-commands';\n//#endregion\n\nexport * from './entities';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":[],"mappings":";;;AAEA;AAEO,MAAM,gCAAgC,GAA2B;AACtE,IAAA;AACE,QAAA,IAAI,EAAE,iBAAiB;AACvB,QAAA,KAAK,EAAE,mBAAmB;AAC1B,QAAA,WAAW,EACT,0GAA0G;AAC5G,QAAA,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,CAAC,IAAI,CAAC;AACrB,KAAA;;AAGH;;ACfA;AAEA;;;AAGG;AACI,MAAM,gCAAgC,GAAG;AAC9C,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,WAAW,EAAE,wCAAwC;AACrD,IAAA,aAAa,EAAE,0CAA0C;AACzD,IAAA,cAAc,EAAE,2CAA2C;AAC3D,IAAA,cAAc,EAAE,2CAA2C;;AAE3D,IAAA,uBAAuB,EAAE,oDAAoD;;AAE7E,IAAA,aAAa,EAAE,0CAA0C;;AAG3D;;AClBO,MAAM,6BAA6B,GAAG;AAC3C,IAAA,IAAI,EAAE,yBAAyB;AAC/B,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,KAAK,EAAE,+BAA+B;AACtC,IAAA,cAAc,EAAE,wCAAwC;AACxD,IAAA,MAAM,EAAE,gCAAgC;AACxC,IAAA,iBAAiB,EAAE,2CAA2C;AAC9D,IAAA,SAAS,EAAE,mCAAmC;;;ACPhD;;;AAGG;AACI,MAAM,+BAA+B,GAAG;AAC7C,IAAA,MAAM,EAAE,kCAAkC;;AAE1C,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,cAAc,EAAE,0CAA0C;AAC1D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,mBAAmB,EAAE,+CAA+C;AACpE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,SAAS,EAAE,qCAAqC;AAChD,IAAA,aAAa,EAAE,yCAAyC;AACxD,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,WAAW,EAAE,uCAAuC;AACpD,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,QAAQ,EAAE,oCAAoC;AAC9C,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,qBAAqB,EAAE,iDAAiD;;AAG1E;;;AAGG;AACI,MAAM,mCAAmC,GAAG;AACjD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,IAAI,EAAE;QACJ,UAAU,EAAE,+BAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,+BAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,+BAA+B,CAAC,qBAAqB;AAC9D,KAAA;AACD,IAAA,aAAa,EAAE;QACb,UAAU,EAAE,+BAA+B,CAAC,cAAc;QAC1D,IAAI,EAAE,+BAA+B,CAAC,cAAc;QACpD,SAAS,EAAE,+BAA+B,CAAC,cAAc;AAC1D,KAAA;AACD,IAAA,MAAM,EAAE;QACN,UAAU,EAAE,+BAA+B,CAAC,gBAAgB;QAC5D,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,IAAI,EAAE,+BAA+B,CAAC,gBAAgB;QACtD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;QACxD,MAAM,EAAE,+BAA+B,CAAC,gBAAgB;AACzD,KAAA;;;ACzDH;AACO,MAAM,mCAAmC,GAAG;;ACD5C,MAAM,6BAA6B,GAAG;;ACA7C,MAAM,MAAM,GAAG;AACb,IAAA,IAAI,EAAE,qBAAqB;AAC3B,IAAA,aAAa,EAAE,SAAS;CACzB;AACM,MAAM,UAAU,GAAG;IACxB,MAAM;AACN,IAAA,MAAM,EAAE;AACN,QAAA,KAAK,EAAE,qBAAqB;AAC5B,QAAA,IAAI,EAAE,oBAAoB;AAC1B,QAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,aAAA,CAAe;AACrC,QAAA,IAAI,EAAE,2BAA2B;AAClC,KAAA;AACD,IAAA,QAAQ,EAAE;AACR,QAAA,MAAM,EAAE;AACN,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AACxD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iCAAA,CAAmC;AAC/D,YAAA,IAAI,EAAE,oBAAoB;AAC3B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,mBAAmB;AAC1B,SAAA;AACD,QAAA,KAAK,EAAE;AACL,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,0BAAA,CAA4B;AAClD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,2BAAA,CAA6B;AACzD,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,cAAc,EAAE;AACd,YAAA,IAAI,EAAE,gBAAgB;AACtB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AACxE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,iDAAA,CAAmD;AAC/E,YAAA,IAAI,EAAE,iBAAiB;AACxB,SAAA;AACD,QAAA,QAAQ,EAAE;AACR,YAAA,IAAI,EAAE,UAAU;AAChB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oCAAA,CAAsC;AAC5D,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qCAAA,CAAuC;AACnE,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,OAAO,EAAE;AACP,YAAA,IAAI,EAAE,SAAS;AACf,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+BAAA,CAAiC;AACvD,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gCAAA,CAAkC;AAC9D,YAAA,IAAI,EAAE,kBAAkB;AACzB,SAAA;AACD,QAAA,gBAAgB,EAAE;AAChB,YAAA,IAAI,EAAE,kBAAkB;AACxB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,oDAAA,CAAsD;AAC5E,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,qDAAA,CAAuD;AACnF,YAAA,IAAI,EAAE,sBAAsB;AAC7B,SAAA;AACD,QAAA,aAAa,EAAE;AACb,YAAA,IAAI,EAAE,eAAe;AACrB,YAAA,KAAK,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,+CAAA,CAAiD;AACvE,YAAA,WAAW,EAAE,CAAA,CAAA,EAAI,MAAM,CAAC,IAAI,CAAA,gDAAA,CAAkD;AAC9E,YAAA,IAAI,EAAE,4BAA4B;AACnC,SAAA;AACF,KAAA;AACD,IAAA,OAAO,EAAE;AACP,QAAA,OAAO,EAAE;AACP,YAAA,4BAA4B,EAAE,yDAAyD;AACvF,YAAA,kCAAkC,EAChC,+DAA+D;AACjE,YAAA,qBAAqB,EAAE,kDAAkD;AACzE,YAAA,2BAA2B,EAAE,wDAAwD;AACrF,YAAA,4BAA4B,EAAE,yDAAyD;AACxF,SAAA;AACF,KAAA;;;AC7EH;AAKA;AAEA;AAEA;;;AAGG;AACI,MAAM,0BAA0B,GAAsB;AAC3D,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,OAAO,EAAE,OAAO;AAChB,IAAA,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;AAC9B,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC5B,IAAA,IAAI,EAAE,UAAU;AAChB,IAAA,MAAM,EAAE,UAAU;AAClB,IAAA,QAAQ,EAAE,IAAI;;;AAKhB;;AC1BA;AACO,MAAM,oCAAoC,GAAG;;ACDpD;AACO,MAAM,uCAAuC,GAAG;;ACDvD;AAEA;;;AAGG;IACS;AAAZ,CAAA,UAAY,kBAAkB,EAAA;AAC5B,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,kBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,GAAA,EAAA,CAAA,CAAA;AAM9B;;ACZA;AAEA;;AAEG;IACS;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACjB,IAAA,qBAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,UAAA,CAAA,GAAA,UAAqB;AACrB,IAAA,qBAAA,CAAA,eAAA,CAAA,GAAA,iBAAiC;AACjC,IAAA,qBAAA,CAAA,mBAAA,CAAA,GAAA,oBAAwC;AAC1C,CAAC,EARW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;AAUjC;;ACZA;AAEA,MAAM,qBAAqB,GAAG;AAC5B,IAAA,MAAM,EAAE,QAAQ;AAChB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,OAAO,EAAE,SAAS;AAClB,IAAA,QAAQ,EAAE,UAAU;AACpB,IAAA,SAAS,EAAE,WAAW;CACd;AAEV;;;AAGG;AACG,SAAU,4BAA4B,CAAC,KAG5C,EAAA;AACC,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY;IACpC,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAW;AAExE,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE;QAC/C,OAAO,qBAAqB,CAAC,OAAO;IACtC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE;QAChD,OAAO,qBAAqB,CAAC,QAAQ;IACvC;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE;QACjD,OAAO,qBAAqB,CAAC,SAAS;IACxC;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,iBAAiB;IAChD;AACA,IAAA,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE;QACvC,OAAO,qBAAqB,CAAC,aAAa;IAC5C;AACA,IAAA,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE;QAC9C,OAAO,qBAAqB,CAAC,MAAM;IACrC;IACA,OAAO,qBAAqB,CAAC,MAAM;AACrC;AAEA;;AChDA;AAYA;;ACZA;AA2BA;;;AAGG;AACI,MAAM,qDAAqD,GAChE;AAEF;AACO,MAAM,yCAAyC,GAAG;AAEzD;;ACrCA;AAEO,MAAM,mCAAmC,GAAG;AACjD,IAAA,sBAAsB,EAAE,kDAAkD;AAC1E,IAAA,qBAAqB,EAAE,iDAAiD;AACxE,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,UAAU,EAAE,sCAAsC;AAClD,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,iBAAiB,EAAE,6CAA6C;AAChE,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,wBAAwB,EAAE,oDAAoD;AAC9E,IAAA,0BAA0B,EAAE,sDAAsD;AAClF,IAAA,gBAAgB,EAAE,4CAA4C;AAC9D,IAAA,8BAA8B,EAAE,0DAA0D;AAC1F,IAAA,kBAAkB,EAAE,8CAA8C;AAClE,IAAA,mBAAmB,EAAE,+CAA+C;;AAEpE,IAAA,oBAAoB,EAAE,gDAAgD;;AAGxE;AACO,MAAM,mCAAmC,GAAG;AACjD,IAAA,WAAW,EAAE,mCAAmC;AAChD,IAAA,gBAAgB,EAAE,uCAAuC;AACzD,IAAA,aAAa,EAAE,qCAAqC;AACpD,IAAA,YAAY,EAAE,mCAAmC;;AAGnD;AACO,MAAM,oCAAoC,GAAG;AAEpD;AACO,MAAM,iCAAiC,GAAG;AAEjD;AACO,MAAM,uBAAuB,GAAG;AAChC,MAAM,kCAAkC,GAAG;AAC3C,MAAM,kCAAkC,GAAG;AAoDlD;AACO,MAAM,iCAAiC,GAAG;AAC/C,IAAA,OAAO,EAAE,2BAA2B;AACpC,IAAA,OAAO,EAAE,2BAA2B;AACpC,IAAA,gBAAgB,EAAE,qCAAqC;;AAwCzD;AACO,MAAM,0BAA0B,GAAG;AACxC,IAAA,WAAW,EAAE,0BAA0B;AACvC,IAAA,YAAY,EAAE,0BAA0B;AACxC,IAAA,iBAAiB,EAAE,+BAA+B;AAClD,IAAA,aAAa,EAAE,2BAA2B;AAC1C,IAAA,cAAc,EAAE,4BAA4B;AAC5C,IAAA,UAAU,EAAE,wBAAwB;AACpC,IAAA,iBAAiB,EAAE,+BAA+B;AAClD,IAAA,gBAAgB,EAAE,8BAA8B;AAChD,IAAA,WAAW,EAAE,yBAAyB;AACtC,IAAA,oBAAoB,EAAE,kCAAkC;AACxD,IAAA,aAAa,EAAE,2BAA2B;AAC1C,IAAA,YAAY,EAAE,2BAA2B;AACzC,IAAA,SAAS,EAAE,sBAAsB;;AAuEnC;;IC5NY;AAAZ,CAAA,UAAY,qBAAqB,EAAA;AAC/B,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,SAAA,CAAA,GAAA,SAAmB;AACnB,IAAA,qBAAA,CAAA,QAAA,CAAA,GAAA,QAAiB;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,GAAA,EAAA,CAAA,CAAA;;ACDjC;AAEA;;;AAGG;AACI,MAAM,8BAA8B,GAAG;AAC5C,IAAA,IAAI,EAAE,MAAM;AACZ,IAAA,SAAS,EAAE,WAAW;;AA2DxB;;ACrCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;ACtEA;AAeA;;ACfA;AAeA;;ACeA;;AC1BA;;;AAGG;AACI,eAAe,oBAAoB,GAAA;AACxC,IAAA,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI;AAEnC,IAAA,MAAM,SAAS,GAAc;AAC3B,QAAA,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;AAC9B,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI;AAC5C,QAAA,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK;AAC9C,QAAA,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI;QAC5C,UAAU,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,wBAAwB,CAAC;AACpF,QAAA,OAAO,EAAE;AACP,YAAA,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK;AACnD,YAAA,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW;AACrD,YAAA,YAAY,EAAE;AACZ,gBAAA,KAAK,EAAE,cAAc;AACrB,gBAAA,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK;AACrC,aAAA;AACF,SAAA;AACD,QAAA,MAAM,EAAE;AACN,YAAA;AACE,gBAAA,EAAE,EAAE,YAAY;AAChB,gBAAA,KAAK,EAAE,CAAA,mCAAA,CAAqC;AAC7C,aAAA;AACF,SAAA;AACD,QAAA,UAAU,EAAE;AACV,YAAA;AACE,gBAAA,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,qCAAA,CAAuC;AACtD,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI;AAC5B,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,oCAAA,CAAsC;AACrD,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,QAAQ;AAClB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,IAAI;AAC5B,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACD,gBAAA,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpC,aAAA;AACD,YAAA;AACE,gBAAA,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,CAAA,CAAA,EAAI,IAAI,CAAA,yCAAA,CAA2C;AAC1D,gBAAA,OAAO,EAAE,YAAY;AACrB,gBAAA,MAAM,EAAE;AACN,oBAAA,QAAQ,EAAE,UAAU;AACpB,oBAAA,SAAS,EAAE;wBACT,IAAI,EAAE,iBAAiB,CAAC,QAAQ;AAChC,wBAAA,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC5B,qBAAA;AACF,iBAAA;AACF,aAAA;AACF,SAAA;AACD,QAAA,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACzE,QAAA,UAAU,EAAE;AACV,YAAA,MAAM,EAAE;AACN,gBAAA,MAAM,EAAE;AACN,oBAAA,KAAK,EAAE,cAAc;AACrB,oBAAA,QAAQ,EAAE;AACR,wBAAA;AACE,4BAAA,EAAE,EAAE,YAAY;AAChB,4BAAA,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE;AAC/C,yBAAA;AACF,qBAAA;AACD,oBAAA,UAAU,EAAE;AACV,wBAAA,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACjE,wBAAA,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACjE,wBAAA,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;AACtE,qBAAA;AACD,oBAAA,OAAO,EAAE,EAAE;AACZ,iBAAA;AACD,gBAAA,IAAI,EAAE;AACJ,oBAAA,OAAO,EAAE,CAAC,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpF,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9E,iBAAA;AACF,aAAA;AACF,SAAA;KACF;AAED,IAAA,OAAO,SAAS;AAClB;;AClGA;;ACAA;;AAEG;;"}

package/fesm2022/{acorex-platform-module-security-management-client-index-C1rCxs2K.mjs → acorex-platform-module-security-management-client-index-CT-N83bV.mjs}

@@ -12,7 +12,7 @@ import { inject, Injectable, input, signal, computed, effect, untracked, ChangeD
 import * as i2 from '@angular/forms';
 import { FormsModule } from '@angular/forms';
 import { isEqual } from 'lodash-es';
-import { r as resolvePersistedEntityId } from './acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-Ddzg9VYV.mjs';
+import { r as resolvePersistedEntityId } from './acorex-platform-module-security-management-client-acorex-platform-module-security-management-client-D-VISihP.mjs';
 import { AXPSessionService } from '@acorex-platform/framework-client/auth';
 import { AXPEntityBroadcastService } from '@acorex-platform/framework-client/core';
 import { AXPEntityDefinitionRegistryService, AXPEntityService, dispatchEntityModifiedSideEffects } from '@acorex-platform/framework-client/layout/entity';
@@ -459,4 +459,4 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImpor
         }] });
 
 export { AXMUserRolesPageComponent, AXMUserRolesPageComponentProvider };
-//# sourceMappingURL=acorex-platform-module-security-management-client-index-C1rCxs2K.mjs.map
+//# sourceMappingURL=acorex-platform-module-security-management-client-index-CT-N83bV.mjs.map

package/fesm2022/{acorex-platform-module-security-management-client-index-C1rCxs2K.mjs.map → acorex-platform-module-security-management-client-index-CT-N83bV.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"acorex-platform-module-security-management-client-index-C1rCxs2K.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/features/user-roles/user-role-grant.service.ts","../../../../libs/modules/security-management/client/src/lib/features/user-roles/pages/user-roles-page/user-roles-page.component.ts","../../../../libs/modules/security-management/client/src/lib/features/user-roles/pages/user-roles-page/user-roles-page.component.html","../../../../libs/modules/security-management/client/src/lib/features/user-roles/pages/user-roles-page/user-roles-page-component.provider.ts"],"sourcesContent":["//#region ----- Imports -----\n\nimport { AXPSessionService } from '@acorex-platform/framework-client/auth';\nimport { AXPEntityBroadcastService } from '@acorex-platform/framework-client/core';\nimport {\n  AXPEntityDefinitionRegistryService,\n  AXPEntityService,\n  dispatchEntityModifiedSideEffects,\n} from '@acorex-platform/framework-client/layout/entity';\nimport { RootConfig } from '@acorex-platform/module-security-management-client/contracts';\nimport { Injectable, inject } from '@angular/core';\nimport type {\n  SaveUserRoleGrantOptions,\n  UserRoleGrantRow,\n  UserRoleOption,\n} from './user-role-grant.types';\n\n//#endregion\n\n//#region ----- Service -----\n\n/**\n * Loads and persists scoped UserRole assignments for a user.\n * Shared by the User roles detail page.\n */\n@Injectable({ providedIn: 'root' })\nexport class AXMUserRoleGrantService {\n  //#region ----- Services & Dependencies -----\n\n  private readonly entityRegistry = inject(AXPEntityDefinitionRegistryService);\n  private readonly entityService = inject(AXPEntityService);\n  private readonly sessionService = inject(AXPSessionService);\n  private readonly entityEvents = inject(AXPEntityBroadcastService);\n\n  //#endregion\n\n  //#region ----- Scope -----\n\n  resolveSessionScope(): { tenantId: string; applicationId: string | undefined } | null {\n    const tenantId = this.sessionService.tenant?.id;\n    if (!tenantId) {\n      return null;\n    }\n    return {\n      tenantId,\n      applicationId: this.sessionService.application?.id,\n    };\n  }\n\n  //#endregion\n\n  //#region ----- Query -----\n\n  private userRoleData() {\n    return this.entityService\n      .withEntity(RootConfig.module.name, RootConfig.entities.userRole.name)\n      .data<string, UserRoleGrantRow, UserRoleGrantRow>();\n  }\n\n  /**\n   * Roles available to assign in the current workspace.\n   * Also loads any already-assigned role ids that list queries hide (`stateInfo.isHidden`).\n   */\n  async listRoleOptions(includeRoleIds: readonly string[] = []): Promise<UserRoleOption[]> {\n    const roleData = this.entityService\n      .withEntity(RootConfig.module.name, RootConfig.entities.roles.name)\n      .data<string, UserRoleOption, UserRoleOption>();\n\n    const result = await roleData.query({\n      skip: 0,\n      take: 500,\n    } as never);\n\n    const byId = new Map<string, UserRoleOption>();\n    const items = (result?.items ?? []) as unknown as Array<Record<string, unknown>>;\n    for (const item of items) {\n      const id = String(item['id'] ?? '');\n      if (!id) {\n        continue;\n      }\n      byId.set(id, {\n        id,\n        title: String(item['title'] ?? item['name'] ?? ''),\n        name: typeof item['name'] === 'string' ? item['name'] : undefined,\n      });\n    }\n\n    const missingIds = includeRoleIds.filter((id) => id && !byId.has(id));\n    await Promise.all(\n      missingIds.map(async (id) => {\n        try {\n          const row = (await roleData.byKey(id)) as Record<string, unknown> | null;\n          if (!row?.['id']) {\n            return;\n          }\n          byId.set(String(row['id']), {\n            id: String(row['id']),\n            title: String(row['title'] ?? row['name'] ?? row['id']),\n            name: typeof row['name'] === 'string' ? row['name'] : undefined,\n          });\n        } catch {\n          /* role missing or inaccessible */\n        }\n      }),\n    );\n\n    return [...byId.values()].sort((a, b) => a.title.localeCompare(b.title));\n  }\n\n  async findGrant(\n    userId: string,\n    tenantId: string,\n    applicationId: string | undefined,\n  ): Promise<UserRoleGrantRow | null> {\n    const result = await this.userRoleData().query({\n      skip: 0,\n      take: 50,\n      filter: {\n        logic: 'and',\n        filters: [\n          { field: 'userId', operator: { type: 'equal' }, value: userId },\n          { field: 'scopeInfo.tenantId', operator: { type: 'equal' }, value: tenantId },\n        ],\n      },\n    } as never);\n\n    const items = (result?.items ?? []) as UserRoleGrantRow[];\n    if (items.length === 0) {\n      return null;\n    }\n\n    if (applicationId) {\n      const appMatch = items.find((item) => item.scopeInfo?.applicationId === applicationId);\n      if (appMatch) {\n        return appMatch;\n      }\n    }\n\n    const tenantWide = items.find((item) => !item.scopeInfo?.applicationId);\n    return tenantWide ?? items[0] ?? null;\n  }\n\n  //#endregion\n\n  //#region ----- Persist -----\n\n  async saveGrant(options: SaveUserRoleGrantOptions): Promise<Record<string, unknown>> {\n    const existingState = options.existing?.stateInfo;\n    if (existingState?.isSystem === true || existingState?.isImmutable === true) {\n      throw new Error('System user role grants are readonly.');\n    }\n\n    const entityKey = `${RootConfig.module.name}.${RootConfig.entities.userRole.name}`;\n    const [moduleName, entityName] = entityKey.split('.');\n    const entityRef = await this.entityRegistry.resolve(moduleName, entityName);\n\n    const scopeInfo = {\n      tenantId: options.tenantId,\n      ...(options.existing?.scopeInfo?.applicationId\n        ? { applicationId: options.existing.scopeInfo.applicationId }\n        : options.applicationId\n          ? { applicationId: options.applicationId }\n          : {}),\n    };\n\n    if (options.existing?.id) {\n      const updatePayload = {\n        ...options.existing,\n        userId: options.userId,\n        roleIds: options.roleIds,\n        scopeInfo,\n      };\n      return (\n        entityRef.commands?.update?.execute as (data: Record<string, unknown>) => Promise<Record<string, unknown>>\n      )(updatePayload);\n    }\n\n    const createPayload = {\n      userId: options.userId,\n      roleIds: options.roleIds,\n      scopeInfo,\n    };\n    return (\n      entityRef.commands?.create?.execute as (data: Record<string, unknown>) => Promise<Record<string, unknown>>\n    )(createPayload);\n  }\n\n  notifyGrantModified(saved: Record<string, unknown>): void {\n    const entityKey = `${RootConfig.module.name}.${RootConfig.entities.userRole.name}`;\n    dispatchEntityModifiedSideEffects(this.entityEvents, entityKey, saved);\n  }\n\n  //#endregion\n}\n\n//#endregion\n","//#region ----- Imports -----\n\nimport {\n  AXPActionMenuItem,\n  AXPExecuteCommand,\n  type AXPRuntimeCommandResult,\n} from '@acorex-platform/framework-shared/core';\nimport type { AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';\nimport type { AXPLayoutDetailsViewAction } from '@acorex-platform/framework-client/layout/views';\nimport { AXPPageLayoutBase, AXPPageLayoutBaseComponent } from '@acorex-platform/framework-client/layout/views';\nimport { AXPStateMessageComponent } from '@acorex-platform/framework-client/layout/components';\nimport { AXValueChangedEvent } from '@acorex/cdk/common';\nimport { AXSelectionListModule } from '@acorex/components/selection-list';\nimport { AXSkeletonModule } from '@acorex/components/skeleton';\nimport { AXTranslationModule } from '@acorex/core/translation';\nimport { AsyncPipe } from '@angular/common';\nimport {\n  ChangeDetectionStrategy,\n  Component,\n  computed,\n  effect,\n  inject,\n  input,\n  signal,\n  untracked,\n} from '@angular/core';\nimport { FormsModule } from '@angular/forms';\nimport { isEqual } from 'lodash-es';\nimport { resolvePersistedEntityId } from '../../../permissions/resolve-persisted-entity-id.util';\nimport { AXMUserRoleGrantService } from '../../user-role-grant.service';\nimport type { UserRoleGrantRow, UserRoleOption } from '../../user-role-grant.types';\n\n//#endregion\n\n//#region ----- Constants -----\n\nconst USER_ROLES_DISCARD_COMMAND = 'User:Roles:Discard';\nconst USER_ROLES_SAVE_COMMAND = 'User:Roles:Save';\n\n//#endregion\n\n//#region ----- Component -----\n\n/**\n * User detail/create wizard page that edits scoped UserRole assignments.\n */\n@Component({\n  selector: 'axm-user-roles-page',\n  standalone: true,\n  imports: [\n    AXPStateMessageComponent,\n    AXSelectionListModule,\n    AXSkeletonModule,\n    AXTranslationModule,\n    AsyncPipe,\n    FormsModule,\n  ],\n  templateUrl: './user-roles-page.component.html',\n  changeDetection: ChangeDetectionStrategy.OnPush,\n  providers: [\n    {\n      provide: AXPPageLayoutBase,\n      useExisting: AXMUserRolesPageComponent,\n    },\n  ],\n  host: {\n    class: 'flex h-full min-h-0 flex-1 flex-col overflow-hidden',\n  },\n})\nexport class AXMUserRolesPageComponent extends AXPPageLayoutBaseComponent {\n  //#region ----- Inputs -----\n\n  rootContext = input<Record<string, unknown>>();\n  pageConfig = input<Record<string, unknown>>();\n\n  //#endregion\n\n  //#region ----- Services & Dependencies -----\n\n  private readonly grantService = inject(AXMUserRoleGrantService);\n  private readonly hostPageLayout = inject(AXPPageLayoutBase, { optional: true, skipSelf: true });\n\n  //#endregion\n\n  //#region ----- State Signals -----\n\n  private readonly loadedUserId = signal<string | undefined>(undefined);\n  private readonly existingGrant = signal<UserRoleGrantRow | null>(null);\n  private readonly baselineRoleIds = signal<string[]>([]);\n  protected readonly currentRoleIds = signal<string[]>([]);\n  protected readonly roleOptions = signal<UserRoleOption[]>([]);\n  protected readonly isLoading = signal(true);\n\n  //#endregion\n\n  //#region ----- Computed Properties -----\n\n  protected readonly userId = computed(() => resolvePersistedEntityId(this.rootContext()));\n\n  protected readonly isDirty = computed(() => {\n    return !this.areRoleSetsEqual(this.baselineRoleIds(), this.currentRoleIds());\n  });\n\n  /** System UserRole grants are seeded and not editable in product/platform UI. */\n  protected readonly isGrantReadonly = computed(() => {\n    const state = this.existingGrant()?.stateInfo;\n    return state?.isSystem === true || state?.isImmutable === true;\n  });\n\n  /** Checkbox + label row placeholders for the loading skeleton */\n  protected readonly roleSkeletonPlaceholders = computed(() => [\n    'w-40',\n    'w-28',\n    'w-48',\n    'w-32',\n    'w-44',\n    'w-36',\n    'w-40',\n    'w-52',\n  ]);\n\n  //#endregion\n\n  //#region ----- Lifecycle -----\n\n  constructor() {\n    super();\n    effect(() => {\n      const id = this.userId();\n      untracked(() => {\n        void this.loadGrantForUser(id);\n      });\n    });\n  }\n\n  //#endregion\n\n  //#region ----- Unsaved Changes -----\n\n  override hasUnsavedChanges(): boolean {\n    return this.isDirty();\n  }\n\n  //#endregion\n\n  //#region ----- Page Actions -----\n\n  override async getPrimaryMenuItems(): Promise<AXPActionMenuItem[]> {\n    const discardTitle = (await this.translateService.translateAsync('@general:actions.discard.title')) || 'Discard';\n    const saveTitle = (await this.translateService.translateAsync('@general:actions.save.title')) || 'Save';\n    const canEdit = !!this.userId() && !this.isLoading() && !this.isGrantReadonly();\n\n    const discardAction: AXPLayoutDetailsViewAction = {\n      title: discardTitle,\n      icon: 'fa-light fa-rotate-left',\n      zone: 'footer',\n      priority: 'secondary',\n      color: 'default',\n      visible: canEdit && this.isDirty(),\n      command: { name: USER_ROLES_DISCARD_COMMAND, options: {} },\n    };\n\n    const saveAction: AXPLayoutDetailsViewAction = {\n      title: saveTitle,\n      icon: 'fa-light fa-floppy-disk',\n      zone: 'footer',\n      priority: 'primary',\n      color: 'primary',\n      visible: canEdit && this.isDirty(),\n      command: { name: USER_ROLES_SAVE_COMMAND, options: {} },\n    };\n\n    return [discardAction, saveAction];\n  }\n\n  //#endregion\n\n  //#region ----- Command Handling -----\n\n  override execute(command: AXPExecuteCommand): void | Promise<void> {\n    if (command.name === USER_ROLES_DISCARD_COMMAND) {\n      this.handleDiscard();\n      return;\n    }\n    if (command.name !== USER_ROLES_SAVE_COMMAND) {\n      return;\n    }\n    return this.handleSaveExecute() as unknown as Promise<void>;\n  }\n\n  private async handleSaveExecute(): AXPCommandExecuteResultPromise {\n    const userId = this.userId();\n    const scope = this.grantService.resolveSessionScope();\n\n    if (!userId || !scope) {\n      return {\n        success: false,\n        message: {\n          text: await this.translateService.translateAsync('@general:messages.entity.invalid-data'),\n        },\n      };\n    }\n\n    try {\n      const roleIds = [...this.currentRoleIds()];\n      const saved = await this.grantService.saveGrant({\n        existing: this.existingGrant(),\n        userId,\n        roleIds,\n        tenantId: scope.tenantId,\n        applicationId: scope.applicationId,\n      });\n\n      const nextGrant: UserRoleGrantRow = {\n        id: String(saved['id'] ?? this.existingGrant()?.id ?? ''),\n        userId,\n        roleIds,\n        scopeInfo: (saved['scopeInfo'] as UserRoleGrantRow['scopeInfo']) ?? this.existingGrant()?.scopeInfo,\n      };\n      this.existingGrant.set(nextGrant.id ? nextGrant : this.existingGrant());\n      this.baselineRoleIds.set([...roleIds]);\n      this.currentRoleIds.set([...roleIds]);\n      this.grantService.notifyGrantModified(saved);\n      this.recompute();\n\n      return {\n        success: true,\n        kind: 'object',\n        data: roleIds,\n      } as AXPRuntimeCommandResult;\n    } catch (error: unknown) {\n      const message = error instanceof Error ? error.message : 'Failed to save roles.';\n      return {\n        success: false,\n        message: { text: message },\n      };\n    }\n  }\n\n  //#endregion\n\n  //#region ----- Event Handlers -----\n\n  protected onRolesValueChanged(event: AXValueChangedEvent): void {\n    if (!event.isUserInteraction || this.isGrantReadonly()) {\n      return;\n    }\n\n    const next = Array.isArray(event.value)\n      ? event.value.map(String)\n      : event.value != null\n        ? [String(event.value)]\n        : [];\n\n    this.currentRoleIds.set(next);\n    this.recompute();\n  }\n\n  private handleDiscard(): void {\n    this.currentRoleIds.set([...this.baselineRoleIds()]);\n    this.recompute();\n  }\n\n  //#endregion\n\n  //#region ----- Wizard step context -----\n\n  override getWizardStepContext(): Record<string, unknown> | null {\n    return null;\n  }\n\n  //#endregion\n\n  //#region ----- Data Loading -----\n\n  private async loadGrantForUser(userId: string | undefined): Promise<void> {\n    if (!userId) {\n      this.loadedUserId.set(undefined);\n      this.existingGrant.set(null);\n      this.baselineRoleIds.set([]);\n      this.currentRoleIds.set([]);\n      this.roleOptions.set([]);\n      this.isLoading.set(false);\n      this.recompute();\n      return;\n    }\n\n    if (userId === this.loadedUserId() && !this.isLoading()) {\n      return;\n    }\n\n    this.isLoading.set(true);\n    this.recompute();\n\n    const scope = this.grantService.resolveSessionScope();\n    if (!scope) {\n      this.loadedUserId.set(userId);\n      this.existingGrant.set(null);\n      this.baselineRoleIds.set([]);\n      this.currentRoleIds.set([]);\n      this.isLoading.set(false);\n      this.recompute();\n      return;\n    }\n\n    try {\n      const grant = await this.grantService.findGrant(userId, scope.tenantId, scope.applicationId);\n      const roleIds = [...(grant?.roleIds ?? [])];\n      const options = await this.grantService.listRoleOptions(roleIds);\n      this.loadedUserId.set(userId);\n      this.existingGrant.set(grant);\n      this.baselineRoleIds.set(roleIds);\n      this.currentRoleIds.set([...roleIds]);\n      this.roleOptions.set(options);\n    } catch {\n      this.loadedUserId.set(userId);\n      this.existingGrant.set(null);\n      this.baselineRoleIds.set([]);\n      this.currentRoleIds.set([]);\n      this.roleOptions.set([]);\n    } finally {\n      this.isLoading.set(false);\n      this.recompute();\n    }\n  }\n\n  //#endregion\n\n  //#region ----- Utility Methods -----\n\n  private areRoleSetsEqual(a: string[], b: string[]): boolean {\n    return isEqual([...a].sort(), [...b].sort());\n  }\n\n  protected override recompute(): void {\n    super.recompute();\n    const maybeLayout = this.hostPageLayout as unknown as { recompute?: () => void };\n    maybeLayout?.recompute?.();\n  }\n\n  //#endregion\n}\n\n//#endregion\n","@if (isLoading()) {\n  <!-- ----- Skeleton while UserRole grant loads for the current workspace ----- -->\n  <div class=\"flex h-full min-h-0 flex-1 flex-col overflow-auto p-4\" aria-hidden=\"true\">\n    <div class=\"user-roles-frame rounded border border-default bg-lightest p-4\">\n      <div class=\"mb-4 h-4 w-3/5 max-w-md rounded-md overflow-hidden\">\n        <ax-skeleton\n          [animated]=\"true\"\n          style=\"display: block; width: 100%; height: 100%\"\n        ></ax-skeleton>\n      </div>\n      <div class=\"flex flex-col gap-3\">\n        @for (widthClass of roleSkeletonPlaceholders(); track $index) {\n          <!-- ----- One checkbox + label row placeholder ----- -->\n          <div class=\"flex items-center gap-3\">\n            <div class=\"h-4 w-4 shrink-0 rounded-sm overflow-hidden\">\n              <ax-skeleton\n                [animated]=\"true\"\n                style=\"display: block; width: 100%; height: 100%\"\n              ></ax-skeleton>\n            </div>\n            <div class=\"h-4 max-w-full rounded-md overflow-hidden\" [class]=\"widthClass\">\n              <ax-skeleton\n                [animated]=\"true\"\n                style=\"display: block; width: 100%; height: 100%\"\n              ></ax-skeleton>\n            </div>\n          </div>\n        }\n      </div>\n    </div>\n  </div>\n}\n<!-- ----- User must be persisted before role grants can be edited ----- -->\n@else if (!userId()) {\n  <div class=\"flex h-full min-h-[20rem] items-center justify-center p-6\">\n    <axp-state-message\n      [title]=\"'@security-management:users.entities.user.pages.roles.save-user-first.title'\"\n      [description]=\"'@security-management:users.entities.user.pages.roles.save-user-first.description'\"\n    ></axp-state-message>\n  </div>\n}\n<!-- ----- Scoped role checklist for the current tenant/application ----- -->\n@else {\n  <div class=\"flex h-full min-h-0 flex-1 flex-col overflow-auto p-4\">\n    <div class=\"user-roles-frame rounded border border-default bg-lightest p-4\">\n      <p class=\"mb-4 text-sm opacity-70\">\n        {{ '@security-management:users.entities.user.pages.roles.description' | translate | async }}\n      </p>\n      <ax-selection-list\n        class=\"w-full\"\n        valueField=\"id\"\n        textField=\"title\"\n        look=\"solid\"\n        direction=\"vertical\"\n        [multiple]=\"true\"\n        [showControl]=\"true\"\n        [items]=\"roleOptions()\"\n        [ngModel]=\"currentRoleIds()\"\n        [disabled]=\"isGrantReadonly()\"\n        [readonly]=\"isGrantReadonly()\"\n        (onValueChanged)=\"onRolesValueChanged($event)\"\n      ></ax-selection-list>\n    </div>\n  </div>\n}\n","//#region ----- Imports -----\n\nimport {\n  AXPPageComponentDefinition,\n  AXPPageComponentProvider,\n} from '@acorex-platform/framework-client/layout/components';\nimport { USER_ROLES_PAGE_COMPONENT_KEY } from '@acorex-platform/module-security-management-client/contracts';\nimport { Injectable } from '@angular/core';\n\n//#endregion\n\n//#region ----- Provider -----\n\n@Injectable()\nexport class AXMUserRolesPageComponentProvider implements AXPPageComponentProvider {\n  async components(): Promise<AXPPageComponentDefinition[]> {\n    return [\n      {\n        key: USER_ROLES_PAGE_COMPONENT_KEY,\n        loader: () =>\n          import('./user-roles-page.component').then((m) => m.AXMUserRolesPageComponent),\n      },\n    ];\n  }\n}\n\n//#endregion\n"],"names":["i2","i3","i4"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAiBA;AAEA;AAEA;;;AAGG;MAEU,uBAAuB,CAAA;AADpC,IAAA,WAAA,GAAA;;AAImB,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,kCAAkC,CAAC;AAC3D,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;AACxC,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1C,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAiKlE,IAAA;;;IA3JC,mBAAmB,GAAA;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE;QAC/C,IAAI,CAAC,QAAQ,EAAE;AACb,YAAA,OAAO,IAAI;QACb;QACA,OAAO;YACL,QAAQ;AACR,YAAA,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE;SACnD;IACH;;;IAMQ,YAAY,GAAA;QAClB,OAAO,IAAI,CAAC;AACT,aAAA,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI;AACpE,aAAA,IAAI,EAA8C;IACvD;AAEA;;;AAGG;AACH,IAAA,MAAM,eAAe,CAAC,cAAA,GAAoC,EAAE,EAAA;AAC1D,QAAA,MAAM,QAAQ,GAAG,IAAI,CAAC;AACnB,aAAA,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;AACjE,aAAA,IAAI,EAA0C;AAEjD,QAAA,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC;AAClC,YAAA,IAAI,EAAE,CAAC;AACP,YAAA,IAAI,EAAE,GAAG;AACD,SAAA,CAAC;AAEX,QAAA,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B;QAC9C,MAAM,KAAK,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAA8C;AAChF,QAAA,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YACxB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE,EAAE;gBACP;YACF;AACA,YAAA,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;gBACX,EAAE;AACF,gBAAA,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,gBAAA,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,SAAS;AAClE,aAAA,CAAC;QACJ;QAEA,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACrE,QAAA,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAI;AAC1B,YAAA,IAAI;gBACF,MAAM,GAAG,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAmC;AACxE,gBAAA,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE;oBAChB;gBACF;gBACA,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE;AAC1B,oBAAA,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,oBAAA,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,oBAAA,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;AAChE,iBAAA,CAAC;YACJ;AAAE,YAAA,MAAM;;YAER;QACF,CAAC,CAAC,CACH;AAED,QAAA,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E;AAEA,IAAA,MAAM,SAAS,CACb,MAAc,EACd,QAAgB,EAChB,aAAiC,EAAA;QAEjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC;AAC7C,YAAA,IAAI,EAAE,CAAC;AACP,YAAA,IAAI,EAAE,EAAE;AACR,YAAA,MAAM,EAAE;AACN,gBAAA,KAAK,EAAE,KAAK;AACZ,gBAAA,OAAO,EAAE;AACP,oBAAA,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;AAC/D,oBAAA,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;AAC9E,iBAAA;AACF,aAAA;AACO,SAAA,CAAC;QAEX,MAAM,KAAK,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAAuB;AACzD,QAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,YAAA,OAAO,IAAI;QACb;QAEA,IAAI,aAAa,EAAE;AACjB,YAAA,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,aAAa,KAAK,aAAa,CAAC;YACtF,IAAI,QAAQ,EAAE;AACZ,gBAAA,OAAO,QAAQ;YACjB;QACF;AAEA,QAAA,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;QACvE,OAAO,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI;IACvC;;;IAMA,MAAM,SAAS,CAAC,OAAiC,EAAA;AAC/C,QAAA,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;AACjD,QAAA,IAAI,aAAa,EAAE,QAAQ,KAAK,IAAI,IAAI,aAAa,EAAE,WAAW,KAAK,IAAI,EAAE;AAC3E,YAAA,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;QAC1D;AAEA,QAAA,MAAM,SAAS,GAAG,CAAA,EAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAA,CAAA,EAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;AAClF,QAAA,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;AACrD,QAAA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC;AAE3E,QAAA,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;AAC1B,YAAA,IAAI,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE;kBAC7B,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa;kBACzD,OAAO,CAAC;AACR,sBAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa;sBACtC,EAAE,CAAC;SACV;AAED,QAAA,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE;AACxB,YAAA,MAAM,aAAa,GAAG;gBACpB,GAAG,OAAO,CAAC,QAAQ;gBACnB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS;aACV;AACD,YAAA,OAAO,CACL,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAC7B,EAAC,aAAa,CAAC;QAClB;AAEA,QAAA,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS;SACV;AACD,QAAA,OAAO,CACL,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAC7B,EAAC,aAAa,CAAC;IAClB;AAEA,IAAA,mBAAmB,CAAC,KAA8B,EAAA;AAChD,QAAA,MAAM,SAAS,GAAG,CAAA,EAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAA,CAAA,EAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClF,iCAAiC,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC;IACxE;8GApKW,uBAAuB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAvB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,cADV,MAAM,EAAA,CAAA,CAAA;;2FACnB,uBAAuB,EAAA,UAAA,EAAA,CAAA;kBADnC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACOlC;AAEA;AAEA,MAAM,0BAA0B,GAAG,oBAAoB;AACvD,MAAM,uBAAuB,GAAG,iBAAiB;AAEjD;AAEA;AAEA;;AAEG;AAwBG,MAAO,yBAA0B,SAAQ,0BAA0B,CAAA;;;AAwDvE,IAAA,WAAA,GAAA;AACE,QAAA,KAAK,EAAE;;AAtDT,QAAA,IAAA,CAAA,WAAW,GAAG,KAAK;mGAA2B;AAC9C,QAAA,IAAA,CAAA,UAAU,GAAG,KAAK;kGAA2B;;;AAM5B,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,uBAAuB,CAAC;AAC9C,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;;QAM9E,IAAA,CAAA,YAAY,GAAG,MAAM,CAAqB,SAAS;yFAAC;QACpD,IAAA,CAAA,aAAa,GAAG,MAAM,CAA0B,IAAI;0FAAC;QACrD,IAAA,CAAA,eAAe,GAAG,MAAM,CAAW,EAAE;4FAAC;QACpC,IAAA,CAAA,cAAc,GAAG,MAAM,CAAW,EAAE;2FAAC;QACrC,IAAA,CAAA,WAAW,GAAG,MAAM,CAAmB,EAAE;wFAAC;QAC1C,IAAA,CAAA,SAAS,GAAG,MAAM,CAAC,IAAI;sFAAC;;;AAMxB,QAAA,IAAA,CAAA,MAAM,GAAG,QAAQ,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;mFAAC;AAErE,QAAA,IAAA,CAAA,OAAO,GAAG,QAAQ,CAAC,MAAK;AACzC,YAAA,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9E,CAAC;oFAAC;;AAGiB,QAAA,IAAA,CAAA,eAAe,GAAG,QAAQ,CAAC,MAAK;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS;YAC7C,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,IAAI,KAAK,EAAE,WAAW,KAAK,IAAI;QAChE,CAAC;4FAAC;;AAGiB,QAAA,IAAA,CAAA,wBAAwB,GAAG,QAAQ,CAAC,MAAM;YAC3D,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;AACP,SAAA;qGAAC;QAQA,MAAM,CAAC,MAAK;AACV,YAAA,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;YACxB,SAAS,CAAC,MAAK;AACb,gBAAA,KAAK,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAChC,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CAAC;IACJ;;;IAMS,iBAAiB,GAAA;AACxB,QAAA,OAAO,IAAI,CAAC,OAAO,EAAE;IACvB;;;AAMS,IAAA,MAAM,mBAAmB,GAAA;AAChC,QAAA,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,gCAAgC,CAAC,KAAK,SAAS;AAChH,QAAA,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,6BAA6B,CAAC,KAAK,MAAM;QACvG,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;AAE/E,QAAA,MAAM,aAAa,GAA+B;AAChD,YAAA,KAAK,EAAE,YAAY;AACnB,YAAA,IAAI,EAAE,yBAAyB;AAC/B,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,QAAQ,EAAE,WAAW;AACrB,YAAA,KAAK,EAAE,SAAS;AAChB,YAAA,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,EAAE;SAC3D;AAED,QAAA,MAAM,UAAU,GAA+B;AAC7C,YAAA,KAAK,EAAE,SAAS;AAChB,YAAA,IAAI,EAAE,yBAAyB;AAC/B,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,QAAQ,EAAE,SAAS;AACnB,YAAA,KAAK,EAAE,SAAS;AAChB,YAAA,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,EAAE;SACxD;AAED,QAAA,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;IACpC;;;AAMS,IAAA,OAAO,CAAC,OAA0B,EAAA;AACzC,QAAA,IAAI,OAAO,CAAC,IAAI,KAAK,0BAA0B,EAAE;YAC/C,IAAI,CAAC,aAAa,EAAE;YACpB;QACF;AACA,QAAA,IAAI,OAAO,CAAC,IAAI,KAAK,uBAAuB,EAAE;YAC5C;QACF;AACA,QAAA,OAAO,IAAI,CAAC,iBAAiB,EAA8B;IAC7D;AAEQ,IAAA,MAAM,iBAAiB,GAAA;AAC7B,QAAA,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE;AAErD,QAAA,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE;YACrB,OAAO;AACL,gBAAA,OAAO,EAAE,KAAK;AACd,gBAAA,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,uCAAuC,CAAC;AAC1F,iBAAA;aACF;QACH;AAEA,QAAA,IAAI;YACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;AAC9C,gBAAA,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE;gBAC9B,MAAM;gBACN,OAAO;gBACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,aAAa,EAAE,KAAK,CAAC,aAAa;AACnC,aAAA,CAAC;AAEF,YAAA,MAAM,SAAS,GAAqB;AAClC,gBAAA,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM;gBACN,OAAO;gBACP,SAAS,EAAG,KAAK,CAAC,WAAW,CAAmC,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS;aACpG;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACvE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;AACrC,YAAA,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC5C,IAAI,CAAC,SAAS,EAAE;YAEhB,OAAO;AACL,gBAAA,OAAO,EAAE,IAAI;AACb,gBAAA,IAAI,EAAE,QAAQ;AACd,gBAAA,IAAI,EAAE,OAAO;aACa;QAC9B;QAAE,OAAO,KAAc,EAAE;AACvB,YAAA,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,uBAAuB;YAChF,OAAO;AACL,gBAAA,OAAO,EAAE,KAAK;AACd,gBAAA,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC3B;QACH;IACF;;;AAMU,IAAA,mBAAmB,CAAC,KAA0B,EAAA;QACtD,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE;YACtD;QACF;QAEA,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;cAClC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;AACxB,cAAE,KAAK,CAAC,KAAK,IAAI;kBACb,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;kBACpB,EAAE;AAER,QAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,EAAE;IAClB;IAEQ,aAAa,GAAA;AACnB,QAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE;IAClB;;;IAMS,oBAAoB,GAAA;AAC3B,QAAA,OAAO,IAAI;IACb;;;IAMQ,MAAM,gBAAgB,CAAC,MAA0B,EAAA;QACvD,IAAI,CAAC,MAAM,EAAE;AACX,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AAChC,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5B,YAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3B,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;AACxB,YAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,SAAS,EAAE;YAChB;QACF;AAEA,QAAA,IAAI,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YACvD;QACF;AAEA,QAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,SAAS,EAAE;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE;QACrD,IAAI,CAAC,KAAK,EAAE;AACV,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC7B,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5B,YAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3B,YAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,SAAS,EAAE;YAChB;QACF;AAEA,QAAA,IAAI;AACF,YAAA,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC;AAC5F,YAAA,MAAM,OAAO,GAAG,CAAC,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;AAChE,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC7B,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;AACrC,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAC/B;AAAE,QAAA,MAAM;AACN,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC7B,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5B,YAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3B,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B;gBAAU;AACR,YAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,SAAS,EAAE;QAClB;IACF;;;IAMQ,gBAAgB,CAAC,CAAW,EAAE,CAAW,EAAA;AAC/C,QAAA,OAAO,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C;IAEmB,SAAS,GAAA;QAC1B,KAAK,CAAC,SAAS,EAAE;AACjB,QAAA,MAAM,WAAW,GAAG,IAAI,CAAC,cAAuD;AAChF,QAAA,WAAW,EAAE,SAAS,IAAI;IAC5B;8GA7QW,yBAAyB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA,CAAA;AAAzB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,yBAAyB,EAAA,YAAA,EAAA,IAAA,EAAA,QAAA,EAAA,qBAAA,EAAA,MAAA,EAAA,EAAA,WAAA,EAAA,EAAA,iBAAA,EAAA,aAAA,EAAA,UAAA,EAAA,aAAA,EAAA,QAAA,EAAA,IAAA,EAAA,UAAA,EAAA,KAAA,EAAA,iBAAA,EAAA,IAAA,EAAA,EAAA,UAAA,EAAA,EAAA,iBAAA,EAAA,YAAA,EAAA,UAAA,EAAA,YAAA,EAAA,QAAA,EAAA,IAAA,EAAA,UAAA,EAAA,KAAA,EAAA,iBAAA,EAAA,IAAA,EAAA,EAAA,EAAA,IAAA,EAAA,EAAA,cAAA,EAAA,qDAAA,EAAA,EAAA,SAAA,EAVzB;AACT,YAAA;AACE,gBAAA,OAAO,EAAE,iBAAiB;AAC1B,gBAAA,WAAW,EAAE,yBAAyB;AACvC,aAAA;AACF,SAAA,EAAA,eAAA,EAAA,IAAA,EAAA,QAAA,EAAA,EAAA,EAAA,QAAA,EChEH,gpFAiEA,EAAA,YAAA,EAAA,CAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EDfI,wBAAwB,EAAA,QAAA,EAAA,mBAAA,EAAA,MAAA,EAAA,CAAA,MAAA,EAAA,MAAA,EAAA,OAAA,EAAA,aAAA,EAAA,aAAA,EAAA,mBAAA,EAAA,MAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EACxB,qBAAqB,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAA,EAAA,CAAA,wBAAA,EAAA,QAAA,EAAA,mBAAA,EAAA,MAAA,EAAA,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EAAA,UAAA,EAAA,UAAA,EAAA,OAAA,EAAA,YAAA,EAAA,WAAA,EAAA,eAAA,EAAA,eAAA,EAAA,UAAA,EAAA,WAAA,EAAA,gBAAA,EAAA,aAAA,EAAA,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA,EAAA,CAAA,gBAAA,EAAA,QAAA,EAAA,SAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EACrB,gBAAgB,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAAA,GAAA,CAAA,mBAAA,EAAA,QAAA,EAAA,aAAA,EAAA,MAAA,EAAA,CAAA,UAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EAChB,mBAAmB,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EAEnB,WAAW,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAAC,EAAA,CAAA,eAAA,EAAA,QAAA,EAAA,2CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAAA,EAAA,CAAA,OAAA,EAAA,QAAA,EAAA,qDAAA,EAAA,MAAA,EAAA,CAAA,MAAA,EAAA,UAAA,EAAA,SAAA,EAAA,gBAAA,CAAA,EAAA,OAAA,EAAA,CAAA,eAAA,CAAA,EAAA,QAAA,EAAA,CAAA,SAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,MAAA,EAAA,IAAA,EAAAC,GAAA,CAAA,gBAAA,EAAA,IAAA,EAAA,WAAA,EAAA,EAAA,EAAA,IAAA,EAAA,MAAA,EAAA,IAAA,EADX,SAAS,EAAA,IAAA,EAAA,OAAA,EAAA,CAAA,EAAA,eAAA,EAAA,EAAA,CAAA,uBAAA,CAAA,MAAA,EAAA,CAAA,CAAA;;2FAeA,yBAAyB,EAAA,UAAA,EAAA,CAAA;kBAvBrC,SAAS;+BACE,qBAAqB,EAAA,UAAA,EACnB,IAAI,EAAA,OAAA,EACP;wBACP,wBAAwB;wBACxB,qBAAqB;wBACrB,gBAAgB;wBAChB,mBAAmB;wBACnB,SAAS;wBACT,WAAW;qBACZ,EAAA,eAAA,EAEgB,uBAAuB,CAAC,MAAM,EAAA,SAAA,EACpC;AACT,wBAAA;AACE,4BAAA,OAAO,EAAE,iBAAiB;AAC1B,4BAAA,WAAW,EAAA,yBAA2B;AACvC,yBAAA;qBACF,EAAA,IAAA,EACK;AACJ,wBAAA,KAAK,EAAE,qDAAqD;AAC7D,qBAAA,EAAA,QAAA,EAAA,gpFAAA,EAAA;;;;;;;;AE1DH;AAEA;MAGa,iCAAiC,CAAA;AAC5C,IAAA,MAAM,UAAU,GAAA;QACd,OAAO;AACL,YAAA;AACE,gBAAA,GAAG,EAAE,6BAA6B;AAClC,gBAAA,MAAM,EAAE,MACN,uEAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,yBAAyB,CAAC;AACjF,aAAA;SACF;IACH;8GATW,iCAAiC,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;kHAAjC,iCAAiC,EAAA,CAAA,CAAA;;2FAAjC,iCAAiC,EAAA,UAAA,EAAA,CAAA;kBAD7C;;;"}
+{"version":3,"file":"acorex-platform-module-security-management-client-index-CT-N83bV.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/features/user-roles/user-role-grant.service.ts","../../../../libs/modules/security-management/client/src/lib/features/user-roles/pages/user-roles-page/user-roles-page.component.ts","../../../../libs/modules/security-management/client/src/lib/features/user-roles/pages/user-roles-page/user-roles-page.component.html","../../../../libs/modules/security-management/client/src/lib/features/user-roles/pages/user-roles-page/user-roles-page-component.provider.ts"],"sourcesContent":["//#region ----- Imports -----\n\nimport { AXPSessionService } from '@acorex-platform/framework-client/auth';\nimport { AXPEntityBroadcastService } from '@acorex-platform/framework-client/core';\nimport {\n  AXPEntityDefinitionRegistryService,\n  AXPEntityService,\n  dispatchEntityModifiedSideEffects,\n} from '@acorex-platform/framework-client/layout/entity';\nimport { RootConfig } from '@acorex-platform/module-security-management-client/contracts';\nimport { Injectable, inject } from '@angular/core';\nimport type {\n  SaveUserRoleGrantOptions,\n  UserRoleGrantRow,\n  UserRoleOption,\n} from './user-role-grant.types';\n\n//#endregion\n\n//#region ----- Service -----\n\n/**\n * Loads and persists scoped UserRole assignments for a user.\n * Shared by the User roles detail page.\n */\n@Injectable({ providedIn: 'root' })\nexport class AXMUserRoleGrantService {\n  //#region ----- Services & Dependencies -----\n\n  private readonly entityRegistry = inject(AXPEntityDefinitionRegistryService);\n  private readonly entityService = inject(AXPEntityService);\n  private readonly sessionService = inject(AXPSessionService);\n  private readonly entityEvents = inject(AXPEntityBroadcastService);\n\n  //#endregion\n\n  //#region ----- Scope -----\n\n  resolveSessionScope(): { tenantId: string; applicationId: string | undefined } | null {\n    const tenantId = this.sessionService.tenant?.id;\n    if (!tenantId) {\n      return null;\n    }\n    return {\n      tenantId,\n      applicationId: this.sessionService.application?.id,\n    };\n  }\n\n  //#endregion\n\n  //#region ----- Query -----\n\n  private userRoleData() {\n    return this.entityService\n      .withEntity(RootConfig.module.name, RootConfig.entities.userRole.name)\n      .data<string, UserRoleGrantRow, UserRoleGrantRow>();\n  }\n\n  /**\n   * Roles available to assign in the current workspace.\n   * Also loads any already-assigned role ids that list queries hide (`stateInfo.isHidden`).\n   */\n  async listRoleOptions(includeRoleIds: readonly string[] = []): Promise<UserRoleOption[]> {\n    const roleData = this.entityService\n      .withEntity(RootConfig.module.name, RootConfig.entities.roles.name)\n      .data<string, UserRoleOption, UserRoleOption>();\n\n    const result = await roleData.query({\n      skip: 0,\n      take: 500,\n    } as never);\n\n    const byId = new Map<string, UserRoleOption>();\n    const items = (result?.items ?? []) as unknown as Array<Record<string, unknown>>;\n    for (const item of items) {\n      const id = String(item['id'] ?? '');\n      if (!id) {\n        continue;\n      }\n      byId.set(id, {\n        id,\n        title: String(item['title'] ?? item['name'] ?? ''),\n        name: typeof item['name'] === 'string' ? item['name'] : undefined,\n      });\n    }\n\n    const missingIds = includeRoleIds.filter((id) => id && !byId.has(id));\n    await Promise.all(\n      missingIds.map(async (id) => {\n        try {\n          const row = (await roleData.byKey(id)) as Record<string, unknown> | null;\n          if (!row?.['id']) {\n            return;\n          }\n          byId.set(String(row['id']), {\n            id: String(row['id']),\n            title: String(row['title'] ?? row['name'] ?? row['id']),\n            name: typeof row['name'] === 'string' ? row['name'] : undefined,\n          });\n        } catch {\n          /* role missing or inaccessible */\n        }\n      }),\n    );\n\n    return [...byId.values()].sort((a, b) => a.title.localeCompare(b.title));\n  }\n\n  async findGrant(\n    userId: string,\n    tenantId: string,\n    applicationId: string | undefined,\n  ): Promise<UserRoleGrantRow | null> {\n    const result = await this.userRoleData().query({\n      skip: 0,\n      take: 50,\n      filter: {\n        logic: 'and',\n        filters: [\n          { field: 'userId', operator: { type: 'equal' }, value: userId },\n          { field: 'scopeInfo.tenantId', operator: { type: 'equal' }, value: tenantId },\n        ],\n      },\n    } as never);\n\n    const items = (result?.items ?? []) as UserRoleGrantRow[];\n    if (items.length === 0) {\n      return null;\n    }\n\n    if (applicationId) {\n      const appMatch = items.find((item) => item.scopeInfo?.applicationId === applicationId);\n      if (appMatch) {\n        return appMatch;\n      }\n    }\n\n    const tenantWide = items.find((item) => !item.scopeInfo?.applicationId);\n    return tenantWide ?? items[0] ?? null;\n  }\n\n  //#endregion\n\n  //#region ----- Persist -----\n\n  async saveGrant(options: SaveUserRoleGrantOptions): Promise<Record<string, unknown>> {\n    const existingState = options.existing?.stateInfo;\n    if (existingState?.isSystem === true || existingState?.isImmutable === true) {\n      throw new Error('System user role grants are readonly.');\n    }\n\n    const entityKey = `${RootConfig.module.name}.${RootConfig.entities.userRole.name}`;\n    const [moduleName, entityName] = entityKey.split('.');\n    const entityRef = await this.entityRegistry.resolve(moduleName, entityName);\n\n    const scopeInfo = {\n      tenantId: options.tenantId,\n      ...(options.existing?.scopeInfo?.applicationId\n        ? { applicationId: options.existing.scopeInfo.applicationId }\n        : options.applicationId\n          ? { applicationId: options.applicationId }\n          : {}),\n    };\n\n    if (options.existing?.id) {\n      const updatePayload = {\n        ...options.existing,\n        userId: options.userId,\n        roleIds: options.roleIds,\n        scopeInfo,\n      };\n      return (\n        entityRef.commands?.update?.execute as (data: Record<string, unknown>) => Promise<Record<string, unknown>>\n      )(updatePayload);\n    }\n\n    const createPayload = {\n      userId: options.userId,\n      roleIds: options.roleIds,\n      scopeInfo,\n    };\n    return (\n      entityRef.commands?.create?.execute as (data: Record<string, unknown>) => Promise<Record<string, unknown>>\n    )(createPayload);\n  }\n\n  notifyGrantModified(saved: Record<string, unknown>): void {\n    const entityKey = `${RootConfig.module.name}.${RootConfig.entities.userRole.name}`;\n    dispatchEntityModifiedSideEffects(this.entityEvents, entityKey, saved);\n  }\n\n  //#endregion\n}\n\n//#endregion\n","//#region ----- Imports -----\n\nimport {\n  AXPActionMenuItem,\n  AXPExecuteCommand,\n  type AXPRuntimeCommandResult,\n} from '@acorex-platform/framework-shared/core';\nimport type { AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';\nimport type { AXPLayoutDetailsViewAction } from '@acorex-platform/framework-client/layout/views';\nimport { AXPPageLayoutBase, AXPPageLayoutBaseComponent } from '@acorex-platform/framework-client/layout/views';\nimport { AXPStateMessageComponent } from '@acorex-platform/framework-client/layout/components';\nimport { AXValueChangedEvent } from '@acorex/cdk/common';\nimport { AXSelectionListModule } from '@acorex/components/selection-list';\nimport { AXSkeletonModule } from '@acorex/components/skeleton';\nimport { AXTranslationModule } from '@acorex/core/translation';\nimport { AsyncPipe } from '@angular/common';\nimport {\n  ChangeDetectionStrategy,\n  Component,\n  computed,\n  effect,\n  inject,\n  input,\n  signal,\n  untracked,\n} from '@angular/core';\nimport { FormsModule } from '@angular/forms';\nimport { isEqual } from 'lodash-es';\nimport { resolvePersistedEntityId } from '../../../permissions/resolve-persisted-entity-id.util';\nimport { AXMUserRoleGrantService } from '../../user-role-grant.service';\nimport type { UserRoleGrantRow, UserRoleOption } from '../../user-role-grant.types';\n\n//#endregion\n\n//#region ----- Constants -----\n\nconst USER_ROLES_DISCARD_COMMAND = 'User:Roles:Discard';\nconst USER_ROLES_SAVE_COMMAND = 'User:Roles:Save';\n\n//#endregion\n\n//#region ----- Component -----\n\n/**\n * User detail/create wizard page that edits scoped UserRole assignments.\n */\n@Component({\n  selector: 'axm-user-roles-page',\n  standalone: true,\n  imports: [\n    AXPStateMessageComponent,\n    AXSelectionListModule,\n    AXSkeletonModule,\n    AXTranslationModule,\n    AsyncPipe,\n    FormsModule,\n  ],\n  templateUrl: './user-roles-page.component.html',\n  changeDetection: ChangeDetectionStrategy.OnPush,\n  providers: [\n    {\n      provide: AXPPageLayoutBase,\n      useExisting: AXMUserRolesPageComponent,\n    },\n  ],\n  host: {\n    class: 'flex h-full min-h-0 flex-1 flex-col overflow-hidden',\n  },\n})\nexport class AXMUserRolesPageComponent extends AXPPageLayoutBaseComponent {\n  //#region ----- Inputs -----\n\n  rootContext = input<Record<string, unknown>>();\n  pageConfig = input<Record<string, unknown>>();\n\n  //#endregion\n\n  //#region ----- Services & Dependencies -----\n\n  private readonly grantService = inject(AXMUserRoleGrantService);\n  private readonly hostPageLayout = inject(AXPPageLayoutBase, { optional: true, skipSelf: true });\n\n  //#endregion\n\n  //#region ----- State Signals -----\n\n  private readonly loadedUserId = signal<string | undefined>(undefined);\n  private readonly existingGrant = signal<UserRoleGrantRow | null>(null);\n  private readonly baselineRoleIds = signal<string[]>([]);\n  protected readonly currentRoleIds = signal<string[]>([]);\n  protected readonly roleOptions = signal<UserRoleOption[]>([]);\n  protected readonly isLoading = signal(true);\n\n  //#endregion\n\n  //#region ----- Computed Properties -----\n\n  protected readonly userId = computed(() => resolvePersistedEntityId(this.rootContext()));\n\n  protected readonly isDirty = computed(() => {\n    return !this.areRoleSetsEqual(this.baselineRoleIds(), this.currentRoleIds());\n  });\n\n  /** System UserRole grants are seeded and not editable in product/platform UI. */\n  protected readonly isGrantReadonly = computed(() => {\n    const state = this.existingGrant()?.stateInfo;\n    return state?.isSystem === true || state?.isImmutable === true;\n  });\n\n  /** Checkbox + label row placeholders for the loading skeleton */\n  protected readonly roleSkeletonPlaceholders = computed(() => [\n    'w-40',\n    'w-28',\n    'w-48',\n    'w-32',\n    'w-44',\n    'w-36',\n    'w-40',\n    'w-52',\n  ]);\n\n  //#endregion\n\n  //#region ----- Lifecycle -----\n\n  constructor() {\n    super();\n    effect(() => {\n      const id = this.userId();\n      untracked(() => {\n        void this.loadGrantForUser(id);\n      });\n    });\n  }\n\n  //#endregion\n\n  //#region ----- Unsaved Changes -----\n\n  override hasUnsavedChanges(): boolean {\n    return this.isDirty();\n  }\n\n  //#endregion\n\n  //#region ----- Page Actions -----\n\n  override async getPrimaryMenuItems(): Promise<AXPActionMenuItem[]> {\n    const discardTitle = (await this.translateService.translateAsync('@general:actions.discard.title')) || 'Discard';\n    const saveTitle = (await this.translateService.translateAsync('@general:actions.save.title')) || 'Save';\n    const canEdit = !!this.userId() && !this.isLoading() && !this.isGrantReadonly();\n\n    const discardAction: AXPLayoutDetailsViewAction = {\n      title: discardTitle,\n      icon: 'fa-light fa-rotate-left',\n      zone: 'footer',\n      priority: 'secondary',\n      color: 'default',\n      visible: canEdit && this.isDirty(),\n      command: { name: USER_ROLES_DISCARD_COMMAND, options: {} },\n    };\n\n    const saveAction: AXPLayoutDetailsViewAction = {\n      title: saveTitle,\n      icon: 'fa-light fa-floppy-disk',\n      zone: 'footer',\n      priority: 'primary',\n      color: 'primary',\n      visible: canEdit && this.isDirty(),\n      command: { name: USER_ROLES_SAVE_COMMAND, options: {} },\n    };\n\n    return [discardAction, saveAction];\n  }\n\n  //#endregion\n\n  //#region ----- Command Handling -----\n\n  override execute(command: AXPExecuteCommand): void | Promise<void> {\n    if (command.name === USER_ROLES_DISCARD_COMMAND) {\n      this.handleDiscard();\n      return;\n    }\n    if (command.name !== USER_ROLES_SAVE_COMMAND) {\n      return;\n    }\n    return this.handleSaveExecute() as unknown as Promise<void>;\n  }\n\n  private async handleSaveExecute(): AXPCommandExecuteResultPromise {\n    const userId = this.userId();\n    const scope = this.grantService.resolveSessionScope();\n\n    if (!userId || !scope) {\n      return {\n        success: false,\n        message: {\n          text: await this.translateService.translateAsync('@general:messages.entity.invalid-data'),\n        },\n      };\n    }\n\n    try {\n      const roleIds = [...this.currentRoleIds()];\n      const saved = await this.grantService.saveGrant({\n        existing: this.existingGrant(),\n        userId,\n        roleIds,\n        tenantId: scope.tenantId,\n        applicationId: scope.applicationId,\n      });\n\n      const nextGrant: UserRoleGrantRow = {\n        id: String(saved['id'] ?? this.existingGrant()?.id ?? ''),\n        userId,\n        roleIds,\n        scopeInfo: (saved['scopeInfo'] as UserRoleGrantRow['scopeInfo']) ?? this.existingGrant()?.scopeInfo,\n      };\n      this.existingGrant.set(nextGrant.id ? nextGrant : this.existingGrant());\n      this.baselineRoleIds.set([...roleIds]);\n      this.currentRoleIds.set([...roleIds]);\n      this.grantService.notifyGrantModified(saved);\n      this.recompute();\n\n      return {\n        success: true,\n        kind: 'object',\n        data: roleIds,\n      } as AXPRuntimeCommandResult;\n    } catch (error: unknown) {\n      const message = error instanceof Error ? error.message : 'Failed to save roles.';\n      return {\n        success: false,\n        message: { text: message },\n      };\n    }\n  }\n\n  //#endregion\n\n  //#region ----- Event Handlers -----\n\n  protected onRolesValueChanged(event: AXValueChangedEvent): void {\n    if (!event.isUserInteraction || this.isGrantReadonly()) {\n      return;\n    }\n\n    const next = Array.isArray(event.value)\n      ? event.value.map(String)\n      : event.value != null\n        ? [String(event.value)]\n        : [];\n\n    this.currentRoleIds.set(next);\n    this.recompute();\n  }\n\n  private handleDiscard(): void {\n    this.currentRoleIds.set([...this.baselineRoleIds()]);\n    this.recompute();\n  }\n\n  //#endregion\n\n  //#region ----- Wizard step context -----\n\n  override getWizardStepContext(): Record<string, unknown> | null {\n    return null;\n  }\n\n  //#endregion\n\n  //#region ----- Data Loading -----\n\n  private async loadGrantForUser(userId: string | undefined): Promise<void> {\n    if (!userId) {\n      this.loadedUserId.set(undefined);\n      this.existingGrant.set(null);\n      this.baselineRoleIds.set([]);\n      this.currentRoleIds.set([]);\n      this.roleOptions.set([]);\n      this.isLoading.set(false);\n      this.recompute();\n      return;\n    }\n\n    if (userId === this.loadedUserId() && !this.isLoading()) {\n      return;\n    }\n\n    this.isLoading.set(true);\n    this.recompute();\n\n    const scope = this.grantService.resolveSessionScope();\n    if (!scope) {\n      this.loadedUserId.set(userId);\n      this.existingGrant.set(null);\n      this.baselineRoleIds.set([]);\n      this.currentRoleIds.set([]);\n      this.isLoading.set(false);\n      this.recompute();\n      return;\n    }\n\n    try {\n      const grant = await this.grantService.findGrant(userId, scope.tenantId, scope.applicationId);\n      const roleIds = [...(grant?.roleIds ?? [])];\n      const options = await this.grantService.listRoleOptions(roleIds);\n      this.loadedUserId.set(userId);\n      this.existingGrant.set(grant);\n      this.baselineRoleIds.set(roleIds);\n      this.currentRoleIds.set([...roleIds]);\n      this.roleOptions.set(options);\n    } catch {\n      this.loadedUserId.set(userId);\n      this.existingGrant.set(null);\n      this.baselineRoleIds.set([]);\n      this.currentRoleIds.set([]);\n      this.roleOptions.set([]);\n    } finally {\n      this.isLoading.set(false);\n      this.recompute();\n    }\n  }\n\n  //#endregion\n\n  //#region ----- Utility Methods -----\n\n  private areRoleSetsEqual(a: string[], b: string[]): boolean {\n    return isEqual([...a].sort(), [...b].sort());\n  }\n\n  protected override recompute(): void {\n    super.recompute();\n    const maybeLayout = this.hostPageLayout as unknown as { recompute?: () => void };\n    maybeLayout?.recompute?.();\n  }\n\n  //#endregion\n}\n\n//#endregion\n","@if (isLoading()) {\n  <!-- ----- Skeleton while UserRole grant loads for the current workspace ----- -->\n  <div class=\"flex h-full min-h-0 flex-1 flex-col overflow-auto p-4\" aria-hidden=\"true\">\n    <div class=\"user-roles-frame rounded border border-default bg-lightest p-4\">\n      <div class=\"mb-4 h-4 w-3/5 max-w-md rounded-md overflow-hidden\">\n        <ax-skeleton\n          [animated]=\"true\"\n          style=\"display: block; width: 100%; height: 100%\"\n        ></ax-skeleton>\n      </div>\n      <div class=\"flex flex-col gap-3\">\n        @for (widthClass of roleSkeletonPlaceholders(); track $index) {\n          <!-- ----- One checkbox + label row placeholder ----- -->\n          <div class=\"flex items-center gap-3\">\n            <div class=\"h-4 w-4 shrink-0 rounded-sm overflow-hidden\">\n              <ax-skeleton\n                [animated]=\"true\"\n                style=\"display: block; width: 100%; height: 100%\"\n              ></ax-skeleton>\n            </div>\n            <div class=\"h-4 max-w-full rounded-md overflow-hidden\" [class]=\"widthClass\">\n              <ax-skeleton\n                [animated]=\"true\"\n                style=\"display: block; width: 100%; height: 100%\"\n              ></ax-skeleton>\n            </div>\n          </div>\n        }\n      </div>\n    </div>\n  </div>\n}\n<!-- ----- User must be persisted before role grants can be edited ----- -->\n@else if (!userId()) {\n  <div class=\"flex h-full min-h-[20rem] items-center justify-center p-6\">\n    <axp-state-message\n      [title]=\"'@security-management:users.entities.user.pages.roles.save-user-first.title'\"\n      [description]=\"'@security-management:users.entities.user.pages.roles.save-user-first.description'\"\n    ></axp-state-message>\n  </div>\n}\n<!-- ----- Scoped role checklist for the current tenant/application ----- -->\n@else {\n  <div class=\"flex h-full min-h-0 flex-1 flex-col overflow-auto p-4\">\n    <div class=\"user-roles-frame rounded border border-default bg-lightest p-4\">\n      <p class=\"mb-4 text-sm opacity-70\">\n        {{ '@security-management:users.entities.user.pages.roles.description' | translate | async }}\n      </p>\n      <ax-selection-list\n        class=\"w-full\"\n        valueField=\"id\"\n        textField=\"title\"\n        look=\"solid\"\n        direction=\"vertical\"\n        [multiple]=\"true\"\n        [showControl]=\"true\"\n        [items]=\"roleOptions()\"\n        [ngModel]=\"currentRoleIds()\"\n        [disabled]=\"isGrantReadonly()\"\n        [readonly]=\"isGrantReadonly()\"\n        (onValueChanged)=\"onRolesValueChanged($event)\"\n      ></ax-selection-list>\n    </div>\n  </div>\n}\n","//#region ----- Imports -----\n\nimport {\n  AXPPageComponentDefinition,\n  AXPPageComponentProvider,\n} from '@acorex-platform/framework-client/layout/components';\nimport { USER_ROLES_PAGE_COMPONENT_KEY } from '@acorex-platform/module-security-management-client/contracts';\nimport { Injectable } from '@angular/core';\n\n//#endregion\n\n//#region ----- Provider -----\n\n@Injectable()\nexport class AXMUserRolesPageComponentProvider implements AXPPageComponentProvider {\n  async components(): Promise<AXPPageComponentDefinition[]> {\n    return [\n      {\n        key: USER_ROLES_PAGE_COMPONENT_KEY,\n        loader: () =>\n          import('./user-roles-page.component').then((m) => m.AXMUserRolesPageComponent),\n      },\n    ];\n  }\n}\n\n//#endregion\n"],"names":["i2","i3","i4"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAiBA;AAEA;AAEA;;;AAGG;MAEU,uBAAuB,CAAA;AADpC,IAAA,WAAA,GAAA;;AAImB,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,kCAAkC,CAAC;AAC3D,QAAA,IAAA,CAAA,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;AACxC,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAC1C,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAiKlE,IAAA;;;IA3JC,mBAAmB,GAAA;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE;QAC/C,IAAI,CAAC,QAAQ,EAAE;AACb,YAAA,OAAO,IAAI;QACb;QACA,OAAO;YACL,QAAQ;AACR,YAAA,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE;SACnD;IACH;;;IAMQ,YAAY,GAAA;QAClB,OAAO,IAAI,CAAC;AACT,aAAA,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI;AACpE,aAAA,IAAI,EAA8C;IACvD;AAEA;;;AAGG;AACH,IAAA,MAAM,eAAe,CAAC,cAAA,GAAoC,EAAE,EAAA;AAC1D,QAAA,MAAM,QAAQ,GAAG,IAAI,CAAC;AACnB,aAAA,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;AACjE,aAAA,IAAI,EAA0C;AAEjD,QAAA,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC;AAClC,YAAA,IAAI,EAAE,CAAC;AACP,YAAA,IAAI,EAAE,GAAG;AACD,SAAA,CAAC;AAEX,QAAA,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B;QAC9C,MAAM,KAAK,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAA8C;AAChF,QAAA,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YACxB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE,EAAE;gBACP;YACF;AACA,YAAA,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;gBACX,EAAE;AACF,gBAAA,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,gBAAA,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,SAAS;AAClE,aAAA,CAAC;QACJ;QAEA,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACrE,QAAA,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAI;AAC1B,YAAA,IAAI;gBACF,MAAM,GAAG,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAmC;AACxE,gBAAA,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE;oBAChB;gBACF;gBACA,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE;AAC1B,oBAAA,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,oBAAA,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,oBAAA,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS;AAChE,iBAAA,CAAC;YACJ;AAAE,YAAA,MAAM;;YAER;QACF,CAAC,CAAC,CACH;AAED,QAAA,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E;AAEA,IAAA,MAAM,SAAS,CACb,MAAc,EACd,QAAgB,EAChB,aAAiC,EAAA;QAEjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC;AAC7C,YAAA,IAAI,EAAE,CAAC;AACP,YAAA,IAAI,EAAE,EAAE;AACR,YAAA,MAAM,EAAE;AACN,gBAAA,KAAK,EAAE,KAAK;AACZ,gBAAA,OAAO,EAAE;AACP,oBAAA,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;AAC/D,oBAAA,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;AAC9E,iBAAA;AACF,aAAA;AACO,SAAA,CAAC;QAEX,MAAM,KAAK,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAAuB;AACzD,QAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,YAAA,OAAO,IAAI;QACb;QAEA,IAAI,aAAa,EAAE;AACjB,YAAA,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,aAAa,KAAK,aAAa,CAAC;YACtF,IAAI,QAAQ,EAAE;AACZ,gBAAA,OAAO,QAAQ;YACjB;QACF;AAEA,QAAA,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;QACvE,OAAO,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI;IACvC;;;IAMA,MAAM,SAAS,CAAC,OAAiC,EAAA;AAC/C,QAAA,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS;AACjD,QAAA,IAAI,aAAa,EAAE,QAAQ,KAAK,IAAI,IAAI,aAAa,EAAE,WAAW,KAAK,IAAI,EAAE;AAC3E,YAAA,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;QAC1D;AAEA,QAAA,MAAM,SAAS,GAAG,CAAA,EAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAA,CAAA,EAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;AAClF,QAAA,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;AACrD,QAAA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC;AAE3E,QAAA,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;AAC1B,YAAA,IAAI,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE;kBAC7B,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa;kBACzD,OAAO,CAAC;AACR,sBAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa;sBACtC,EAAE,CAAC;SACV;AAED,QAAA,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE;AACxB,YAAA,MAAM,aAAa,GAAG;gBACpB,GAAG,OAAO,CAAC,QAAQ;gBACnB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS;aACV;AACD,YAAA,OAAO,CACL,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAC7B,EAAC,aAAa,CAAC;QAClB;AAEA,QAAA,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS;SACV;AACD,QAAA,OAAO,CACL,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAC7B,EAAC,aAAa,CAAC;IAClB;AAEA,IAAA,mBAAmB,CAAC,KAA8B,EAAA;AAChD,QAAA,MAAM,SAAS,GAAG,CAAA,EAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAA,CAAA,EAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClF,iCAAiC,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC;IACxE;8GApKW,uBAAuB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAvB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,uBAAuB,cADV,MAAM,EAAA,CAAA,CAAA;;2FACnB,uBAAuB,EAAA,UAAA,EAAA,CAAA;kBADnC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACOlC;AAEA;AAEA,MAAM,0BAA0B,GAAG,oBAAoB;AACvD,MAAM,uBAAuB,GAAG,iBAAiB;AAEjD;AAEA;AAEA;;AAEG;AAwBG,MAAO,yBAA0B,SAAQ,0BAA0B,CAAA;;;AAwDvE,IAAA,WAAA,GAAA;AACE,QAAA,KAAK,EAAE;;AAtDT,QAAA,IAAA,CAAA,WAAW,GAAG,KAAK;mGAA2B;AAC9C,QAAA,IAAA,CAAA,UAAU,GAAG,KAAK;kGAA2B;;;AAM5B,QAAA,IAAA,CAAA,YAAY,GAAG,MAAM,CAAC,uBAAuB,CAAC;AAC9C,QAAA,IAAA,CAAA,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;;QAM9E,IAAA,CAAA,YAAY,GAAG,MAAM,CAAqB,SAAS;yFAAC;QACpD,IAAA,CAAA,aAAa,GAAG,MAAM,CAA0B,IAAI;0FAAC;QACrD,IAAA,CAAA,eAAe,GAAG,MAAM,CAAW,EAAE;4FAAC;QACpC,IAAA,CAAA,cAAc,GAAG,MAAM,CAAW,EAAE;2FAAC;QACrC,IAAA,CAAA,WAAW,GAAG,MAAM,CAAmB,EAAE;wFAAC;QAC1C,IAAA,CAAA,SAAS,GAAG,MAAM,CAAC,IAAI;sFAAC;;;AAMxB,QAAA,IAAA,CAAA,MAAM,GAAG,QAAQ,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;mFAAC;AAErE,QAAA,IAAA,CAAA,OAAO,GAAG,QAAQ,CAAC,MAAK;AACzC,YAAA,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9E,CAAC;oFAAC;;AAGiB,QAAA,IAAA,CAAA,eAAe,GAAG,QAAQ,CAAC,MAAK;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS;YAC7C,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,IAAI,KAAK,EAAE,WAAW,KAAK,IAAI;QAChE,CAAC;4FAAC;;AAGiB,QAAA,IAAA,CAAA,wBAAwB,GAAG,QAAQ,CAAC,MAAM;YAC3D,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;AACP,SAAA;qGAAC;QAQA,MAAM,CAAC,MAAK;AACV,YAAA,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;YACxB,SAAS,CAAC,MAAK;AACb,gBAAA,KAAK,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAChC,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CAAC;IACJ;;;IAMS,iBAAiB,GAAA;AACxB,QAAA,OAAO,IAAI,CAAC,OAAO,EAAE;IACvB;;;AAMS,IAAA,MAAM,mBAAmB,GAAA;AAChC,QAAA,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,gCAAgC,CAAC,KAAK,SAAS;AAChH,QAAA,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,6BAA6B,CAAC,KAAK,MAAM;QACvG,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;AAE/E,QAAA,MAAM,aAAa,GAA+B;AAChD,YAAA,KAAK,EAAE,YAAY;AACnB,YAAA,IAAI,EAAE,yBAAyB;AAC/B,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,QAAQ,EAAE,WAAW;AACrB,YAAA,KAAK,EAAE,SAAS;AAChB,YAAA,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,EAAE;SAC3D;AAED,QAAA,MAAM,UAAU,GAA+B;AAC7C,YAAA,KAAK,EAAE,SAAS;AAChB,YAAA,IAAI,EAAE,yBAAyB;AAC/B,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,QAAQ,EAAE,SAAS;AACnB,YAAA,KAAK,EAAE,SAAS;AAChB,YAAA,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,EAAE;SACxD;AAED,QAAA,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;IACpC;;;AAMS,IAAA,OAAO,CAAC,OAA0B,EAAA;AACzC,QAAA,IAAI,OAAO,CAAC,IAAI,KAAK,0BAA0B,EAAE;YAC/C,IAAI,CAAC,aAAa,EAAE;YACpB;QACF;AACA,QAAA,IAAI,OAAO,CAAC,IAAI,KAAK,uBAAuB,EAAE;YAC5C;QACF;AACA,QAAA,OAAO,IAAI,CAAC,iBAAiB,EAA8B;IAC7D;AAEQ,IAAA,MAAM,iBAAiB,GAAA;AAC7B,QAAA,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE;AAErD,QAAA,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE;YACrB,OAAO;AACL,gBAAA,OAAO,EAAE,KAAK;AACd,gBAAA,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,uCAAuC,CAAC;AAC1F,iBAAA;aACF;QACH;AAEA,QAAA,IAAI;YACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;AAC9C,gBAAA,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE;gBAC9B,MAAM;gBACN,OAAO;gBACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,aAAa,EAAE,KAAK,CAAC,aAAa;AACnC,aAAA,CAAC;AAEF,YAAA,MAAM,SAAS,GAAqB;AAClC,gBAAA,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM;gBACN,OAAO;gBACP,SAAS,EAAG,KAAK,CAAC,WAAW,CAAmC,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS;aACpG;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACvE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;AACrC,YAAA,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC5C,IAAI,CAAC,SAAS,EAAE;YAEhB,OAAO;AACL,gBAAA,OAAO,EAAE,IAAI;AACb,gBAAA,IAAI,EAAE,QAAQ;AACd,gBAAA,IAAI,EAAE,OAAO;aACa;QAC9B;QAAE,OAAO,KAAc,EAAE;AACvB,YAAA,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,uBAAuB;YAChF,OAAO;AACL,gBAAA,OAAO,EAAE,KAAK;AACd,gBAAA,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC3B;QACH;IACF;;;AAMU,IAAA,mBAAmB,CAAC,KAA0B,EAAA;QACtD,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE;YACtD;QACF;QAEA,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;cAClC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;AACxB,cAAE,KAAK,CAAC,KAAK,IAAI;kBACb,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;kBACpB,EAAE;AAER,QAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,EAAE;IAClB;IAEQ,aAAa,GAAA;AACnB,QAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE;IAClB;;;IAMS,oBAAoB,GAAA;AAC3B,QAAA,OAAO,IAAI;IACb;;;IAMQ,MAAM,gBAAgB,CAAC,MAA0B,EAAA;QACvD,IAAI,CAAC,MAAM,EAAE;AACX,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AAChC,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5B,YAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3B,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;AACxB,YAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,SAAS,EAAE;YAChB;QACF;AAEA,QAAA,IAAI,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;YACvD;QACF;AAEA,QAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,SAAS,EAAE;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE;QACrD,IAAI,CAAC,KAAK,EAAE;AACV,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC7B,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5B,YAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3B,YAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,SAAS,EAAE;YAChB;QACF;AAEA,QAAA,IAAI;AACF,YAAA,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC;AAC5F,YAAA,MAAM,OAAO,GAAG,CAAC,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;AAChE,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC7B,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;AACrC,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAC/B;AAAE,QAAA,MAAM;AACN,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC7B,YAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5B,YAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3B,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B;gBAAU;AACR,YAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,SAAS,EAAE;QAClB;IACF;;;IAMQ,gBAAgB,CAAC,CAAW,EAAE,CAAW,EAAA;AAC/C,QAAA,OAAO,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C;IAEmB,SAAS,GAAA;QAC1B,KAAK,CAAC,SAAS,EAAE;AACjB,QAAA,MAAM,WAAW,GAAG,IAAI,CAAC,cAAuD;AAChF,QAAA,WAAW,EAAE,SAAS,IAAI;IAC5B;8GA7QW,yBAAyB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA,CAAA;AAAzB,IAAA,SAAA,IAAA,CAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,yBAAyB,EAAA,YAAA,EAAA,IAAA,EAAA,QAAA,EAAA,qBAAA,EAAA,MAAA,EAAA,EAAA,WAAA,EAAA,EAAA,iBAAA,EAAA,aAAA,EAAA,UAAA,EAAA,aAAA,EAAA,QAAA,EAAA,IAAA,EAAA,UAAA,EAAA,KAAA,EAAA,iBAAA,EAAA,IAAA,EAAA,EAAA,UAAA,EAAA,EAAA,iBAAA,EAAA,YAAA,EAAA,UAAA,EAAA,YAAA,EAAA,QAAA,EAAA,IAAA,EAAA,UAAA,EAAA,KAAA,EAAA,iBAAA,EAAA,IAAA,EAAA,EAAA,EAAA,IAAA,EAAA,EAAA,cAAA,EAAA,qDAAA,EAAA,EAAA,SAAA,EAVzB;AACT,YAAA;AACE,gBAAA,OAAO,EAAE,iBAAiB;AAC1B,gBAAA,WAAW,EAAE,yBAAyB;AACvC,aAAA;AACF,SAAA,EAAA,eAAA,EAAA,IAAA,EAAA,QAAA,EAAA,EAAA,EAAA,QAAA,EChEH,gpFAiEA,EAAA,YAAA,EAAA,CAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EDfI,wBAAwB,EAAA,QAAA,EAAA,mBAAA,EAAA,MAAA,EAAA,CAAA,MAAA,EAAA,MAAA,EAAA,OAAA,EAAA,aAAA,EAAA,aAAA,EAAA,mBAAA,EAAA,MAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EACxB,qBAAqB,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAA,EAAA,CAAA,wBAAA,EAAA,QAAA,EAAA,mBAAA,EAAA,MAAA,EAAA,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EAAA,UAAA,EAAA,UAAA,EAAA,OAAA,EAAA,YAAA,EAAA,WAAA,EAAA,eAAA,EAAA,eAAA,EAAA,UAAA,EAAA,WAAA,EAAA,gBAAA,EAAA,aAAA,EAAA,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA,EAAA,CAAA,gBAAA,EAAA,QAAA,EAAA,SAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EACrB,gBAAgB,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAAA,GAAA,CAAA,mBAAA,EAAA,QAAA,EAAA,aAAA,EAAA,MAAA,EAAA,CAAA,UAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EAChB,mBAAmB,EAAA,EAAA,EAAA,IAAA,EAAA,UAAA,EAAA,IAAA,EAEnB,WAAW,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAAC,EAAA,CAAA,eAAA,EAAA,QAAA,EAAA,2CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,WAAA,EAAA,IAAA,EAAAA,EAAA,CAAA,OAAA,EAAA,QAAA,EAAA,qDAAA,EAAA,MAAA,EAAA,CAAA,MAAA,EAAA,UAAA,EAAA,SAAA,EAAA,gBAAA,CAAA,EAAA,OAAA,EAAA,CAAA,eAAA,CAAA,EAAA,QAAA,EAAA,CAAA,SAAA,CAAA,EAAA,EAAA,EAAA,IAAA,EAAA,MAAA,EAAA,IAAA,EAAAC,GAAA,CAAA,gBAAA,EAAA,IAAA,EAAA,WAAA,EAAA,EAAA,EAAA,IAAA,EAAA,MAAA,EAAA,IAAA,EADX,SAAS,EAAA,IAAA,EAAA,OAAA,EAAA,CAAA,EAAA,eAAA,EAAA,EAAA,CAAA,uBAAA,CAAA,MAAA,EAAA,CAAA,CAAA;;2FAeA,yBAAyB,EAAA,UAAA,EAAA,CAAA;kBAvBrC,SAAS;+BACE,qBAAqB,EAAA,UAAA,EACnB,IAAI,EAAA,OAAA,EACP;wBACP,wBAAwB;wBACxB,qBAAqB;wBACrB,gBAAgB;wBAChB,mBAAmB;wBACnB,SAAS;wBACT,WAAW;qBACZ,EAAA,eAAA,EAEgB,uBAAuB,CAAC,MAAM,EAAA,SAAA,EACpC;AACT,wBAAA;AACE,4BAAA,OAAO,EAAE,iBAAiB;AAC1B,4BAAA,WAAW,EAAA,yBAA2B;AACvC,yBAAA;qBACF,EAAA,IAAA,EACK;AACJ,wBAAA,KAAK,EAAE,qDAAqD;AAC7D,qBAAA,EAAA,QAAA,EAAA,gpFAAA,EAAA;;;;;;;;AE1DH;AAEA;MAGa,iCAAiC,CAAA;AAC5C,IAAA,MAAM,UAAU,GAAA;QACd,OAAO;AACL,YAAA;AACE,gBAAA,GAAG,EAAE,6BAA6B;AAClC,gBAAA,MAAM,EAAE,MACN,uEAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,yBAAyB,CAAC;AACjF,aAAA;SACF;IACH;8GATW,iCAAiC,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;kHAAjC,iCAAiC,EAAA,CAAA,CAAA;;2FAAjC,iCAAiC,EAAA,UAAA,EAAA,CAAA;kBAD7C;;;"}

package/fesm2022/acorex-platform-module-security-management-client-invitation-target.util-BAXQZwLW.mjs

@@ -0,0 +1,41 @@
+//#region ----- Types -----
+//#endregion
+//#region ----- Resolve targets -----
+/**
+ * Map entity-action payload to invite targets.
+ * - Users list row: `data.id` is User id (no `data.userId`)
+ * - TenantUser list row: `data.id` is TenantUser id and `data.userId` is User id
+ */
+function resolveInvitationCommandTargets(input = {}) {
+    const explicitTenantUserId = input.tenantUserId?.trim();
+    if (explicitTenantUserId) {
+        return {
+            tenantUserId: explicitTenantUserId,
+            userId: input.userId?.trim() || input.data?.userId?.trim() || undefined,
+        };
+    }
+    const explicitUserId = input.userId?.trim();
+    if (explicitUserId) {
+        return { userId: explicitUserId };
+    }
+    const data = input.data;
+    if (!data) {
+        return {};
+    }
+    const rowUserId = typeof data.userId === 'string' ? data.userId.trim() : '';
+    const rowId = typeof data.id === 'string' ? data.id.trim() : '';
+    if (rowUserId) {
+        return {
+            tenantUserId: rowId || undefined,
+            userId: rowUserId,
+        };
+    }
+    if (rowId) {
+        return { userId: rowId };
+    }
+    return {};
+}
+//#endregion
+
+export { resolveInvitationCommandTargets as r };
+//# sourceMappingURL=acorex-platform-module-security-management-client-invitation-target.util-BAXQZwLW.mjs.map

package/fesm2022/acorex-platform-module-security-management-client-invitation-target.util-BAXQZwLW.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"acorex-platform-module-security-management-client-invitation-target.util-BAXQZwLW.mjs","sources":["../../../../libs/modules/security-management/client/src/lib/commands/invitation-target.util.ts"],"sourcesContent":["//#region ----- Types -----\n\nexport interface AXPInvitationTargetCommandInput {\n  tenantUserId?: string;\n  userId?: string;\n  data?: { id?: string; userId?: string; displayName?: string; email?: string };\n}\n\n//#endregion\n\n//#region ----- Resolve targets -----\n\n/**\n * Map entity-action payload to invite targets.\n * - Users list row: `data.id` is User id (no `data.userId`)\n * - TenantUser list row: `data.id` is TenantUser id and `data.userId` is User id\n */\nexport function resolveInvitationCommandTargets(\n  input: AXPInvitationTargetCommandInput = {},\n): { tenantUserId?: string; userId?: string } {\n  const explicitTenantUserId = input.tenantUserId?.trim();\n  if (explicitTenantUserId) {\n    return {\n      tenantUserId: explicitTenantUserId,\n      userId: input.userId?.trim() || input.data?.userId?.trim() || undefined,\n    };\n  }\n\n  const explicitUserId = input.userId?.trim();\n  if (explicitUserId) {\n    return { userId: explicitUserId };\n  }\n\n  const data = input.data;\n  if (!data) {\n    return {};\n  }\n\n  const rowUserId = typeof data.userId === 'string' ? data.userId.trim() : '';\n  const rowId = typeof data.id === 'string' ? data.id.trim() : '';\n\n  if (rowUserId) {\n    return {\n      tenantUserId: rowId || undefined,\n      userId: rowUserId,\n    };\n  }\n\n  if (rowId) {\n    return { userId: rowId };\n  }\n\n  return {};\n}\n\n//#endregion\n"],"names":[],"mappings":"AAAA;AAQA;AAEA;AAEA;;;;AAIG;AACG,SAAU,+BAA+B,CAC7C,KAAA,GAAyC,EAAE,EAAA;IAE3C,MAAM,oBAAoB,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;IACvD,IAAI,oBAAoB,EAAE;QACxB,OAAO;AACL,YAAA,YAAY,EAAE,oBAAoB;AAClC,YAAA,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS;SACxE;IACH;IAEA,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;IAC3C,IAAI,cAAc,EAAE;AAClB,QAAA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE;IACnC;AAEA,IAAA,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;IACvB,IAAI,CAAC,IAAI,EAAE;AACT,QAAA,OAAO,EAAE;IACX;IAEA,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IAC3E,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE;IAE/D,IAAI,SAAS,EAAE;QACb,OAAO;YACL,YAAY,EAAE,KAAK,IAAI,SAAS;AAChC,YAAA,MAAM,EAAE,SAAS;SAClB;IACH;IAEA,IAAI,KAAK,EAAE;AACT,QAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;IAC1B;AAEA,IAAA,OAAO,EAAE;AACX;AAEA;;"}

package/fesm2022/acorex-platform-module-security-management-client-invite-user.command-kFXjLdxy.mjs

@@ -0,0 +1,143 @@
+import { AXDialogService } from '@acorex/components/dialog';
+import { AXToastService } from '@acorex/components/toast';
+import { AXTranslationService } from '@acorex/core/translation';
+import { AXPLayoutBuilderService, resolveLayoutBuilderDialogResult } from '@acorex-platform/framework-client/layout/builder';
+import { AXPCommandService } from '@acorex-platform/framework-client/runtime';
+import { AXMSecurityManagementServerCommands } from '@acorex-platform/module-security-management-client/contracts';
+export { AXM_USER_INVITE_COMMAND } from '@acorex-platform/module-security-management-client/contracts';
+import * as i0 from '@angular/core';
+import { inject, Injectable } from '@angular/core';
+
+//#endregion
+//#region ---- Invite user command ----
+class AXPInviteUserCommand {
+    constructor() {
+        this.layoutBuilder = inject(AXPLayoutBuilderService);
+        this.commandService = inject(AXPCommandService);
+        this.dialogService = inject(AXDialogService);
+        this.toastService = inject(AXToastService);
+        this.translationService = inject(AXTranslationService);
+    }
+    async execute() {
+        const form = await this.openInviteDialog();
+        if (!form) {
+            return { success: true, kind: 'object', data: { outcome: 'cancelled' } };
+        }
+        const webOrigin = typeof window !== 'undefined' ? window.location.origin : undefined;
+        // Nested server call must skip toast middleware — this command owns UX toasts.
+        let result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.InviteUser, {
+            email: form.email,
+            displayName: form.displayName,
+            applicationIds: form.applicationIds,
+            webOrigin,
+        });
+        const payload = result?.data;
+        if (result?.success && payload?.userAlreadyExists && !payload.sent) {
+            const title = await this.translationService
+                .translateAsync('@security-management:users.entities.user.actions.invite.existing-warning-title')
+                .catch(() => 'User Already Exists');
+            const message = await this.translationService
+                .translateAsync('@security-management:users.entities.user.actions.invite.existing-warning-message', {
+                params: { email: form.email },
+            })
+                .catch(() => `A user with email ${form.email} already exists. Send an invitation to join this tenant?`);
+            const confirmed = await this.dialogService.confirm(title, message, 'warning', 'horizontal');
+            if (!confirmed.result) {
+                return { success: true, kind: 'object', data: { outcome: 'cancelled' } };
+            }
+            result = await this.commandService.executeRemote(AXMSecurityManagementServerCommands.InviteUser, {
+                email: form.email,
+                displayName: form.displayName,
+                applicationIds: form.applicationIds,
+                confirmExisting: true,
+                webOrigin,
+            });
+        }
+        if (result?.success) {
+            const [toastTitle, toastContent] = await Promise.all([
+                this.translationService
+                    .translateAsync('@security-management:users.entities.user.actions.invite.success.title')
+                    .catch(() => 'Invitation Sent'),
+                this.translationService
+                    .translateAsync('@security-management:users.entities.user.actions.invite.success.description')
+                    .catch(() => 'The invitation email was sent.'),
+            ]);
+            this.toastService.show({ color: 'success', title: toastTitle, content: toastContent, timeOut: 3000 });
+            return { success: true, kind: 'object', data: result.data };
+        }
+        const [toastTitle, fallback] = await Promise.all([
+            this.translationService
+                .translateAsync('@security-management:users.entities.user.actions.invite.error.title')
+                .catch(() => 'Invite Failed'),
+            this.translationService
+                .translateAsync('@security-management:users.entities.user.actions.invite.error.description')
+                .catch(() => 'Failed to invite user.'),
+        ]);
+        const toastContent = (typeof result?.message?.text === 'string' && result.message.text) || fallback;
+        this.toastService.show({ color: 'danger', title: toastTitle, content: toastContent, timeOut: 4000 });
+        // No `message` — outer command toast middleware would duplicate this toast.
+        return { success: false };
+    }
+    async openInviteDialog() {
+        const result = await this.layoutBuilder
+            .create()
+            .dialog((dialog) => {
+            dialog
+                .setTitle('@security-management:users.entities.user.actions.invite.dialog.title')
+                .setSize('md')
+                .setCloseButton(true)
+                .setContext({ email: '', displayName: '', applicationIds: [] })
+                .content((flex) => {
+                flex
+                    .setDirection('column')
+                    .setGap('12px')
+                    .formField('@security-management:users.entities.user.actions.invite.fields.email', (field) => {
+                    field.path('email');
+                    field.textBox({ validations: [{ rule: 'required' }, { rule: 'email' }] });
+                })
+                    .formField('@security-management:users.entities.user.actions.invite.fields.display-name', (field) => {
+                    field.path('displayName');
+                    field.textBox({});
+                })
+                    .formField('@security-management:users.entities.user.actions.invite.fields.applications', (field) => {
+                    field.path('applicationIds');
+                    field.lookupBox({
+                        entity: 'ApplicationManagement.Application',
+                        multiple: true,
+                        look: 'select',
+                    });
+                });
+            })
+                .setActions((actions) => {
+                actions.cancel('@general:actions.cancel.title');
+                actions.submit('@security-management:users.entities.user.actions.invite.dialog.submit');
+            })
+                .onAction(async (dialogRef) => {
+                if (dialogRef.action() === 'cancel') {
+                    return null;
+                }
+                const ctx = dialogRef.context();
+                const email = (ctx.email ?? '').trim();
+                if (!email) {
+                    throw new Error('@security-management:users.entities.user.actions.invite.errors.email-required');
+                }
+                return {
+                    email,
+                    displayName: (ctx.displayName ?? '').trim() || undefined,
+                    applicationIds: Array.isArray(ctx.applicationIds) ? ctx.applicationIds : undefined,
+                };
+            });
+        })
+            .show();
+        return resolveLayoutBuilderDialogResult(result);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPInviteUserCommand, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPInviteUserCommand, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPInviteUserCommand, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+export { AXPInviteUserCommand };
+//# sourceMappingURL=acorex-platform-module-security-management-client-invite-user.command-kFXjLdxy.mjs.map