@acorex-platform/module-security-management-client 0.0.58 → 0.0.60

package/types/acorex-platform-module-security-management-client-contracts.d.ts

@@ -1,5 +1,5 @@
 import { AXPContextDefinition, AXPModuleManifest, AXPExpression } from '@acorex-platform/framework-shared/core';
-import { AXPEntityModel, AXPEntity } from '@acorex-platform/framework-shared/entity';
+import { AXPEntityModel, AXPEntity, AXPEntityAction } from '@acorex-platform/framework-shared/entity';
 
 declare const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[];
 
@@ -236,13 +236,29 @@ interface AXMUserInvitationInfo {
     sentAt: string;
     invitedByUserId: string;
     applicationIds?: string[];
-    /** Always `invite` for rows created/updated by Invite (not create-in-tenant). */
-    source: 'invite';
+    /** Role ids selected at invite time (flat union; mirrored onto scoped UserRole). */
+    roleIds?: string[];
+    /** TM Tenant Users: roles grouped by application (optional audit / accept helper). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * `invite` = admin sent; `join-request` = user requested membership from waiting room;
+     * `tenant-request` = user requested creation of a new tenant (public form).
+     */
+    source: AXMMembershipInvitationSource;
     /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */
     acceptedAt?: string;
 }
+type AXMMembershipInvitationSource = 'invite' | 'join-request' | 'tenant-request';
+declare const AXM_MEMBERSHIP_INVITATION_SOURCE: {
+    readonly Invite: "invite";
+    readonly JoinRequest: "join-request";
+    readonly TenantRequest: "tenant-request";
+};
 /** How a User identity row was created (directory provenance). */
-type AXMUserCreatedVia = 'invite' | 'create-in-tenant' | 'register' | 'seed' | 'idp';
+type AXMUserCreatedVia = 'invite' | 'create-in-tenant' | 'register' | 'seed' | 'idp' | 'tenant-request';
 /**
  * In-app inbox definition for membership invites to users who already have a tenant.
  * Inbox row action opens the auth waiting room (Approve/Decline live there).
@@ -251,17 +267,97 @@ declare const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY: "security-m
 /** Query `source` value when opening waiting room from a membership-invite notification. */
 declare const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE: "membership-invite";
 
+/** Invite surface that decides which Role catalog rows are selectable. */
+type AXMInviteRoleAssignmentMode = 'application' | 'tenant';
+interface AXMInviteRoleScopeContext {
+    tenantId: string;
+    /** Required for application-mode filtering. */
+    applicationId?: string;
+}
+interface AXMInviteRoleScopeInfo {
+    tenantId?: string;
+    applicationId?: string;
+}
+declare function readInviteRoleScopeInfo(role: {
+    scopeInfo?: unknown;
+} | null | undefined): AXMInviteRoleScopeInfo;
+/**
+ * Whether a Role catalog row may appear in the invite roles multi-select.
+ *
+ * UI-only selection filter (does not change Role / RLS):
+ * - Application invite / per-app repeater row → current-tenant + that application overlays only
+ * - Tenant invite → current-tenant-wide rows only (no applicationId, no other-app overlays)
+ */
+declare function isRoleAssignableForInvite(role: {
+    scopeInfo?: unknown;
+    stateInfo?: unknown;
+} | null | undefined, mode: AXMInviteRoleAssignmentMode, context: AXMInviteRoleScopeContext): boolean;
+/**
+ * TM Tenant Users invite repeater only: overlay for current tenant + the
+ * application chosen on that row. Independent of {@link isRoleAssignableForInvite}
+ * so Security → Users invite can change without affecting this picker.
+ */
+declare function isRoleAssignableForTenantUserInviteRow(role: {
+    scopeInfo?: unknown;
+    stateInfo?: unknown;
+} | null | undefined, context: AXMInviteRoleScopeContext): boolean;
+
+/** One TM invite repeater row: application + multi-select roles for that app. */
+interface AXMInviteApplicationRoleAssignment {
+    applicationId: string;
+    roleIds: string[];
+}
+/**
+ * Submit-time merge for the TM invite repeater.
+ * Duplicate applications (same app on two rows, different role picks) become one assignment
+ * with the union of role ids. Empty application rows are dropped. Do not unique the dropdown
+ * instead — the UI may repeat an application.
+ */
+declare function normalizeInviteApplicationRoleAssignments(rows: unknown): AXMInviteApplicationRoleAssignment[];
+declare function flattenInviteApplicationRoleAssignments(assignments: readonly AXMInviteApplicationRoleAssignment[]): {
+    applicationIds: string[];
+    roleIds: string[];
+};
+
+/** One TM create-in-tenant repeater row: application + multi-select roles for that app. */
+interface AXMCreateApplicationRoleAssignment {
+    applicationId: string;
+    roleIds: string[];
+}
+/**
+ * Submit-time merge for the TM create-in-tenant repeater.
+ * Duplicate applications (same app on two rows, different role picks) become one assignment
+ * with the union of role ids. Empty application rows are dropped.
+ */
+declare function normalizeCreateApplicationRoleAssignments(rows: unknown): AXMCreateApplicationRoleAssignment[];
+declare function flattenCreateApplicationRoleAssignments(assignments: readonly AXMCreateApplicationRoleAssignment[]): {
+    applicationIds: string[];
+    roleIds: string[];
+};
+
 declare const AXMSecurityManagementServerCommands: {
     readonly SendPasswordResetEmail: "SecurityManagement:Server:SendPasswordResetEmail";
     readonly CompletePasswordReset: "SecurityManagement:Server:CompletePasswordReset";
     readonly ChangeOwnPassword: "SecurityManagement:Server:ChangeOwnPassword";
+    readonly GetOwnPasswordStatus: "SecurityManagement:Server:GetOwnPasswordStatus";
     readonly InviteUser: "SecurityManagement:Server:InviteUser";
+    /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */
+    readonly ListTenantEntitledApplications: "SecurityManagement:Server:ListTenantEntitledApplications";
+    /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */
+    readonly ListInviteAssignableRoles: "SecurityManagement:Server:ListInviteAssignableRoles";
     readonly ResendInvitation: "SecurityManagement:Server:ResendInvitation";
     readonly CancelInvitation: "SecurityManagement:Server:CancelInvitation";
     readonly AcceptInvitation: "SecurityManagement:Server:AcceptInvitation";
     readonly ListMyPendingInvitations: "SecurityManagement:Server:ListMyPendingInvitations";
     readonly DeclineInvitation: "SecurityManagement:Server:DeclineInvitation";
     readonly AcceptMyInvitation: "SecurityManagement:Server:AcceptMyInvitation";
+    readonly LookupTenantByUniqueName: "SecurityManagement:Server:LookupTenantByUniqueName";
+    readonly RequestTenantMembership: "SecurityManagement:Server:RequestTenantMembership";
+    readonly ListMyJoinRequests: "SecurityManagement:Server:ListMyJoinRequests";
+    readonly CancelMyJoinRequest: "SecurityManagement:Server:CancelMyJoinRequest";
+    readonly ApproveJoinRequest: "SecurityManagement:Server:ApproveJoinRequest";
+    readonly RejectJoinRequest: "SecurityManagement:Server:RejectJoinRequest";
+    readonly CreateUserInTenant: "SecurityManagement:Server:CreateUserInTenant";
     readonly StartTwoFactorEnrollment: "SecurityManagement:Server:StartTwoFactorEnrollment";
     readonly ConfirmTwoFactorEnrollment: "SecurityManagement:Server:ConfirmTwoFactorEnrollment";
     readonly DisableTwoFactor: "SecurityManagement:Server:DisableTwoFactor";
@@ -282,10 +378,13 @@ declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
 declare const AXM_USER_SEND_PASSWORD_RESET_COMMAND = "SecurityManagement:User:SendPasswordResetEmail";
 /** Client/UI action key (confirm dialog → server admin reset 2FA). */
 declare const AXM_USER_RESET_TWO_FACTOR_COMMAND = "SecurityManagement:User:ResetTwoFactor";
-/** Client/UI action keys for invite flows. */
+/** Client/UI action keys for invite / create-in-tenant flows. */
 declare const AXM_USER_INVITE_COMMAND = "SecurityManagement:User:Invite";
 declare const AXM_USER_RESEND_INVITATION_COMMAND = "SecurityManagement:User:ResendInvitation";
 declare const AXM_USER_CANCEL_INVITATION_COMMAND = "SecurityManagement:User:CancelInvitation";
+declare const AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = "SecurityManagement:User:ApproveJoinRequest";
+declare const AXM_USER_REJECT_JOIN_REQUEST_COMMAND = "SecurityManagement:User:RejectJoinRequest";
+declare const AXM_USER_CREATE_IN_TENANT_COMMAND = "SecurityManagement:User:CreateInTenant";
 interface AXMSendPasswordResetEmailInput {
     /** Admin path: target user id. */
     userId?: string;
@@ -299,20 +398,66 @@ interface AXMCompletePasswordResetInput {
     newPassword: string;
 }
 interface AXMChangeOwnPasswordInput {
-    currentPassword: string;
+    /** Required when the account already has a password; omit/empty when setting the first password. */
+    currentPassword?: string;
     newPassword: string;
 }
 interface AXMChangeOwnPasswordResult {
     passwordChangedAt: string;
 }
+interface AXMGetOwnPasswordStatusResult {
+    /** True when the signed-in user has a non-empty stored password credential. */
+    hasPassword: boolean;
+}
 interface AXMInviteUserInput {
     email: string;
     displayName?: string;
     applicationIds?: string[];
+    /**
+     * Role ids to assign on invite (scoped UserRole grant).
+     * Application invite → app-scoped grant; tenant invite without per-app rows → tenant-wide grant.
+     */
+    roleIds?: string[];
+    /**
+     * TM Tenant Users repeater: roles per selected application.
+     * When present, server upserts a UserRole grant per application (not one tenant-wide grant).
+     */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * True when invite is from Tenant Users (tenant-membership) with multi-app UI.
+     * Server SoT with session edition feature — not Application.code === 'TM'.
+     */
+    tenantMembershipInvite?: boolean;
     /** Client sets true after warning that the identity already exists. */
     confirmExisting?: boolean;
     webOrigin?: string;
 }
+/** One selectable application for TM invite (tenant subscription entitlement). */
+interface AXMTenantEntitledApplicationItem {
+    id: string;
+    /** Raw MLS / string title — client resolves for display. */
+    title: unknown;
+}
+interface AXMListTenantEntitledApplicationsResult {
+    items: AXMTenantEntitledApplicationItem[];
+}
+/** One Role overlay selectable on a TM invite repeater row. */
+interface AXMInviteAssignableRoleItem {
+    id: string;
+    title: unknown;
+    name?: string;
+    applicationId: string;
+}
+interface AXMListInviteAssignableRolesInput {
+    /** When set, only overlays for this application (current tenant). */
+    applicationId?: string;
+}
+interface AXMListInviteAssignableRolesResult {
+    items: AXMInviteAssignableRoleItem[];
+}
 interface AXMInviteUserResult {
     userId: string;
     tenantUserId: string;
@@ -349,6 +494,8 @@ interface AXMPendingInvitationItem {
     tenantUserId: string;
     tenantId: string;
     tenantTitle?: string;
+    /** Tenant branding logo URL / storage id when available. */
+    tenantLogo?: string;
     invitedByUserId?: string;
     expiresAt?: string;
     sentAt?: string;
@@ -364,6 +511,98 @@ interface AXMAcceptMyInvitationInput {
 interface AXMDeclineInvitationInput {
     tenantUserId: string;
 }
+/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */
+declare const AXM_JOIN_REQUEST_ERROR_CODES: {
+    readonly NotSignedIn: "JOIN_REQUEST_NOT_SIGNED_IN";
+    readonly InvalidInput: "JOIN_REQUEST_INVALID_INPUT";
+    readonly TenantNotFound: "JOIN_REQUEST_TENANT_NOT_FOUND";
+    readonly AlreadyMember: "JOIN_REQUEST_ALREADY_MEMBER";
+    readonly InvitePending: "JOIN_REQUEST_INVITE_PENDING";
+    readonly RequestNotFound: "JOIN_REQUEST_NOT_FOUND";
+    readonly NotPending: "JOIN_REQUEST_NOT_PENDING";
+};
+interface AXMLookupTenantByUniqueNameInput {
+    /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */
+    uniqueName: string;
+}
+interface AXMLookupTenantByUniqueNameItem {
+    id: string;
+    /** Stored unique name with original casing. */
+    name: string;
+}
+interface AXMLookupTenantByUniqueNameResult {
+    /** Present only when the name/title matches exactly one active tenant. */
+    item?: AXMLookupTenantByUniqueNameItem | null;
+}
+interface AXMRequestTenantMembershipInput {
+    /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */
+    uniqueName: string;
+}
+interface AXMRequestTenantMembershipResult {
+    tenantUserId: string;
+    tenantId: string;
+    tenantName: string;
+}
+interface AXMJoinRequestItem {
+    tenantUserId: string;
+    tenantId: string;
+    tenantName?: string;
+    tenantTitle?: string;
+    /** Tenant branding logo URL / storage id when available. */
+    tenantLogo?: string;
+    sentAt?: string;
+    expiresAt?: string;
+}
+interface AXMListMyJoinRequestsResult {
+    items: AXMJoinRequestItem[];
+}
+interface AXMCancelMyJoinRequestInput {
+    tenantUserId: string;
+}
+interface AXMApproveJoinRequestInput {
+    tenantUserId?: string;
+    userId?: string;
+    /** Product / app-scoped approve: roles for the current session application. */
+    roleIds?: string[];
+    applicationIds?: string[];
+    /** TM Tenant Users: per-application role rows (same shape as invite). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * When true, allow multi-application assignment (TM Tenant Users + edition feature).
+     * Mirrors invite `tenantMembershipInvite`.
+     */
+    tenantMembershipApprove?: boolean;
+}
+interface AXMRejectJoinRequestInput {
+    tenantUserId?: string;
+    userId?: string;
+}
+interface AXMCreateUserInTenantInput {
+    email?: string;
+    username?: string;
+    displayName?: string;
+    password?: string;
+    applicationIds?: string[];
+    /** Product Users create: roles for the current session application. */
+    roleIds?: string[];
+    /** TM Tenant Users create: per-application role rows (merged client-side before submit). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * When true, allow multi-application assignment (TM Tenant Users + edition feature).
+     * Parallel to invite `tenantMembershipInvite`; Create path only.
+     */
+    tenantMembershipCreate?: boolean;
+}
+interface AXMCreateUserInTenantResult {
+    userId: string;
+    tenantUserId: string;
+}
 /** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
 declare const AXM_TWO_FACTOR_ERROR_CODES: {
     readonly NotSignedIn: "TWO_FACTOR_NOT_SIGNED_IN";
@@ -437,6 +676,39 @@ interface AXMVerifyTwoFactorLoginInput {
     rememberMe?: boolean;
 }
 
+/** Platform settings owned by Security Management. */
+declare const AXMSecurityManagementSettings: {
+    /**
+     * Which Users-list add actions are available.
+     * `create` and `invite` are primary. `both` shows them as secondary actions.
+     */
+    readonly UserProvisioningMode: "SecurityManagement:Setting:User.ProvisioningMode";
+};
+declare const AXMUserProvisioningMode: {
+    readonly Create: "create";
+    readonly Invite: "invite";
+    readonly Both: "both";
+};
+type AXMUserProvisioningMode = (typeof AXMUserProvisioningMode)[keyof typeof AXMUserProvisioningMode];
+/** Used when the platform setting has not been saved yet. */
+declare const AXM_USER_PROVISIONING_MODE_DEFAULT: "both";
+
+/**
+
+ * Explicit DeviceSessions admin operation scope (ADR-TEN-001 D-07).
+
+ * Selected by the calling surface (menu/view), not by Application.code / TM ids.
+
+ */
+type AXPDeviceSessionAdminScope = 'tenant' | 'application';
+/** Query `params` key and HTTP header value for admin scope. */
+declare const AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM = "deviceSessionAdminScope";
+/** HTTP header (lowercase) carrying the same scope for getOne/update/delete. */
+declare const AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER = "x-axp-device-session-admin-scope";
+/** Entity list view name for TM → Tenant Sessions. */
+declare const AXP_DEVICE_SESSION_TENANT_SESSIONS_VIEW = "tenant-sessions";
+declare function normalizeDeviceSessionAdminScope(value: unknown): AXPDeviceSessionAdminScope;
+
 declare enum AXMSessionStatusTypes {
     revoked = "revoked",
     expired = "expired",
@@ -668,5 +940,13 @@ interface AXMSecurityManagementUsersEntityModel extends AXPEntityModel<string> {
     passwordReset?: AXMUserPasswordResetInfo | null;
 }
 
-export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_ACCEPT_INVITATION_ERROR_CODES, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY, AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_TWO_FACTOR_ERROR_CODES, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_CANCEL_INVITATION_COMMAND, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_INVITE_COMMAND, AXM_USER_RESEND_INVITATION_COMMAND, AXM_USER_RESET_TWO_FACTOR_COMMAND, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, SecurityManagementManifest, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState, userTwoFactorFactory };
-export type { AXMAcceptInvitationInput, AXMAcceptInvitationPreviewResult, AXMAcceptInvitationReason, AXMAcceptMyInvitationInput, AXMAdminResetTwoFactorInput, AXMAdminResetTwoFactorResult, AXMCancelInvitationInput, AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMConfirmTwoFactorEnrollmentInput, AXMConfirmTwoFactorEnrollmentResult, AXMDeclineInvitationInput, AXMDisableTwoFactorInput, AXMDisableTwoFactorResult, AXMGenerateTwoFactorRecoveryCodesInput, AXMGenerateTwoFactorRecoveryCodesResult, AXMGetTwoFactorStatusResult, AXMIdentityProviderEntityModel, AXMIdentityProviderProtocol, AXMInviteUserInput, AXMInviteUserResult, AXMListMyPendingInvitationsResult, AXMPendingInvitationItem, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMResendInvitationInput, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUserTwoFactorEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMStartTwoFactorEnrollmentInput, AXMStartTwoFactorEnrollmentResult, AXMUserCreatedVia, AXMUserInvitationInfo, AXMUserPasswordResetInfo, AXMUserTwoFactorMethod, AXMUserTwoFactorRecoveryCode, AXMVerifyTwoFactorLoginInput };
+/** Type-level Invite / Create actions, including the legacy Create dropdown. */
+declare function isUserProvisioningListAction(action: AXPEntityAction): boolean;
+/**
+ * Users list add actions driven by the platform provisioning setting.
+ * Create-only and invite-only stay primary. Both are secondary menu items.
+ */
+declare function userProvisioningListActions(): AXPEntityAction[];
+
+export { AXMSecurityManagementServerCommands, AXMSecurityManagementSettings, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXMUserProvisioningMode, AXM_ACCEPT_INVITATION_ERROR_CODES, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_JOIN_REQUEST_ERROR_CODES, AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY, AXM_MEMBERSHIP_INVITATION_SOURCE, AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_TWO_FACTOR_ERROR_CODES, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_APPROVE_JOIN_REQUEST_COMMAND, AXM_USER_CANCEL_INVITATION_COMMAND, AXM_USER_CREATE_IN_TENANT_COMMAND, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_INVITE_COMMAND, AXM_USER_PROVISIONING_MODE_DEFAULT, AXM_USER_REJECT_JOIN_REQUEST_COMMAND, AXM_USER_RESEND_INVITATION_COMMAND, AXM_USER_RESET_TWO_FACTOR_COMMAND, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER, AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM, AXP_DEVICE_SESSION_TENANT_SESSIONS_VIEW, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, SecurityManagementManifest, USER_ROLES_PAGE_COMPONENT_KEY, flattenCreateApplicationRoleAssignments, flattenInviteApplicationRoleAssignments, isRoleAssignableForInvite, isRoleAssignableForTenantUserInviteRow, isUserProvisioningListAction, normalizeCreateApplicationRoleAssignments, normalizeDeviceSessionAdminScope, normalizeInviteApplicationRoleAssignments, readInviteRoleScopeInfo, resolveAXMUserEffectiveState, userProvisioningListActions, userTwoFactorFactory };
+export type { AXMAcceptInvitationInput, AXMAcceptInvitationPreviewResult, AXMAcceptInvitationReason, AXMAcceptMyInvitationInput, AXMAdminResetTwoFactorInput, AXMAdminResetTwoFactorResult, AXMApproveJoinRequestInput, AXMCancelInvitationInput, AXMCancelMyJoinRequestInput, AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult, AXMCompletePasswordResetInput, AXMConfirmTwoFactorEnrollmentInput, AXMConfirmTwoFactorEnrollmentResult, AXMCreateApplicationRoleAssignment, AXMCreateUserInTenantInput, AXMCreateUserInTenantResult, AXMDeclineInvitationInput, AXMDisableTwoFactorInput, AXMDisableTwoFactorResult, AXMGenerateTwoFactorRecoveryCodesInput, AXMGenerateTwoFactorRecoveryCodesResult, AXMGetOwnPasswordStatusResult, AXMGetTwoFactorStatusResult, AXMIdentityProviderEntityModel, AXMIdentityProviderProtocol, AXMInviteApplicationRoleAssignment, AXMInviteAssignableRoleItem, AXMInviteRoleAssignmentMode, AXMInviteRoleScopeContext, AXMInviteRoleScopeInfo, AXMInviteUserInput, AXMInviteUserResult, AXMJoinRequestItem, AXMListInviteAssignableRolesInput, AXMListInviteAssignableRolesResult, AXMListMyJoinRequestsResult, AXMListMyPendingInvitationsResult, AXMListTenantEntitledApplicationsResult, AXMLookupTenantByUniqueNameInput, AXMLookupTenantByUniqueNameItem, AXMLookupTenantByUniqueNameResult, AXMMembershipInvitationSource, AXMPendingInvitationItem, AXMPolicyEffect, AXMPolicyEffectRule, AXMPolicyScope, AXMRejectJoinRequestInput, AXMRequestTenantMembershipInput, AXMRequestTenantMembershipResult, AXMResendInvitationInput, AXMSecurityManagementDeviceSessionsEntityModel, AXMSecurityManagementPolicyEntityModel, AXMSecurityManagementProfileEntityModel, AXMSecurityManagementRolePermissionEntityModel, AXMSecurityManagementRolesEntityModel, AXMSecurityManagementUserRoleEntityModel, AXMSecurityManagementUserTwoFactorEntityModel, AXMSecurityManagementUsersEntityModel, AXMSendPasswordResetEmailInput, AXMStartTwoFactorEnrollmentInput, AXMStartTwoFactorEnrollmentResult, AXMTenantEntitledApplicationItem, AXMUserCreatedVia, AXMUserInvitationInfo, AXMUserPasswordResetInfo, AXMUserTwoFactorMethod, AXMUserTwoFactorRecoveryCode, AXMVerifyTwoFactorLoginInput, AXPDeviceSessionAdminScope };