@acorex-platform/module-security-management-client 0.0.58 → 0.0.60

package/fesm2022/acorex-platform-module-security-management-client-contracts.mjs

@@ -1,5 +1,5 @@
-import { AXPWidgetsCatalog } from '@acorex-platform/framework-shared/core';
-import { createAllQueryView, entityMasterCrudActions } from '@acorex-platform/framework-shared/entity';
+import { AXPWidgetsCatalog, AXPSystemActionType } from '@acorex-platform/framework-shared/core';
+import { createAllQueryView, entityMasterCrudActions, AXPEntityCommandScope } from '@acorex-platform/framework-shared/entity';
 
 //#region ---- User context definitions ----
 const AXM_SECURITY_CONTEXT_DEFINITIONS = [
@@ -283,6 +283,11 @@ function resolveAXMUserEffectiveState(input) {
 //#endregion
 
 //#region ---- User invitation payload on TenantUser ----
+const AXM_MEMBERSHIP_INVITATION_SOURCE = {
+    Invite: 'invite',
+    JoinRequest: 'join-request',
+    TenantRequest: 'tenant-request',
+};
 /**
  * In-app inbox definition for membership invites to users who already have a tenant.
  * Inbox row action opens the auth waiting room (Approve/Decline live there).
@@ -292,18 +297,223 @@ const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY = 'security-manageme
 const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = 'membership-invite';
 //#endregion
 
+//#region ----- Types -----
+//#endregion
+//#region ----- Helpers -----
+function readScopeString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function readInviteRoleScopeInfo(role) {
+    const scope = role?.scopeInfo && typeof role.scopeInfo === 'object'
+        ? role.scopeInfo
+        : undefined;
+    return {
+        tenantId: readScopeString(scope?.['tenantId']),
+        applicationId: readScopeString(scope?.['applicationId']),
+    };
+}
+function isHiddenRole(role) {
+    const state = role?.stateInfo && typeof role.stateInfo === 'object'
+        ? role.stateInfo
+        : undefined;
+    return state?.['isHidden'] === true;
+}
+/**
+ * Whether a Role catalog row may appear in the invite roles multi-select.
+ *
+ * UI-only selection filter (does not change Role / RLS):
+ * - Application invite / per-app repeater row → current-tenant + that application overlays only
+ * - Tenant invite → current-tenant-wide rows only (no applicationId, no other-app overlays)
+ */
+function isRoleAssignableForInvite(role, mode, context) {
+    if (isHiddenRole(role)) {
+        return false;
+    }
+    const tenantId = context.tenantId?.trim();
+    if (!tenantId) {
+        return false;
+    }
+    const scope = readInviteRoleScopeInfo(role);
+    if (!scope.tenantId || scope.tenantId !== tenantId) {
+        return false;
+    }
+    if (mode === 'tenant') {
+        return !scope.applicationId;
+    }
+    const applicationId = context.applicationId?.trim();
+    if (!applicationId) {
+        return false;
+    }
+    return scope.applicationId === applicationId;
+}
+/**
+ * TM Tenant Users invite repeater only: overlay for current tenant + the
+ * application chosen on that row. Independent of {@link isRoleAssignableForInvite}
+ * so Security → Users invite can change without affecting this picker.
+ */
+function isRoleAssignableForTenantUserInviteRow(role, context) {
+    if (isHiddenRole(role)) {
+        return false;
+    }
+    const tenantId = context.tenantId?.trim();
+    const applicationId = context.applicationId?.trim();
+    if (!tenantId || !applicationId) {
+        return false;
+    }
+    const scope = readInviteRoleScopeInfo(role);
+    return scope.tenantId === tenantId && scope.applicationId === applicationId;
+}
+//#endregion
+
+//#region ----- Types -----
+//#endregion
+//#region ----- Helpers -----
+function readId$1(value) {
+    if (typeof value === 'string') {
+        return value.trim();
+    }
+    if (value && typeof value === 'object') {
+        const id = value.id;
+        if (typeof id === 'string') {
+            return id.trim();
+        }
+        if (typeof id === 'number') {
+            return String(id);
+        }
+        return '';
+    }
+    return value != null ? String(value).trim() : '';
+}
+function readRoleIds$1(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return [...new Set(value.map((id) => readId$1(id)).filter(Boolean))];
+}
+/**
+ * Submit-time merge for the TM invite repeater.
+ * Duplicate applications (same app on two rows, different role picks) become one assignment
+ * with the union of role ids. Empty application rows are dropped. Do not unique the dropdown
+ * instead — the UI may repeat an application.
+ */
+function normalizeInviteApplicationRoleAssignments(rows) {
+    if (!Array.isArray(rows)) {
+        return [];
+    }
+    const byApp = new Map();
+    for (const row of rows) {
+        if (!row || typeof row !== 'object') {
+            continue;
+        }
+        const record = row;
+        const applicationId = readId$1(record['applicationId']);
+        if (!applicationId) {
+            continue;
+        }
+        const bucket = byApp.get(applicationId) ?? new Set();
+        for (const roleId of readRoleIds$1(record['roleIds'])) {
+            bucket.add(roleId);
+        }
+        byApp.set(applicationId, bucket);
+    }
+    return [...byApp.entries()].map(([applicationId, roleIds]) => ({
+        applicationId,
+        roleIds: [...roleIds],
+    }));
+}
+function flattenInviteApplicationRoleAssignments(assignments) {
+    const applicationIds = assignments.map((row) => row.applicationId);
+    const roleIds = [...new Set(assignments.flatMap((row) => row.roleIds))];
+    return { applicationIds, roleIds };
+}
+//#endregion
+
+//#region ----- Types -----
+//#endregion
+//#region ----- Helpers -----
+function readId(value) {
+    if (typeof value === 'string') {
+        return value.trim();
+    }
+    if (value && typeof value === 'object') {
+        const id = value.id;
+        if (typeof id === 'string') {
+            return id.trim();
+        }
+        if (typeof id === 'number') {
+            return String(id);
+        }
+        return '';
+    }
+    return value != null ? String(value).trim() : '';
+}
+function readRoleIds(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return [...new Set(value.map((id) => readId(id)).filter(Boolean))];
+}
+/**
+ * Submit-time merge for the TM create-in-tenant repeater.
+ * Duplicate applications (same app on two rows, different role picks) become one assignment
+ * with the union of role ids. Empty application rows are dropped.
+ */
+function normalizeCreateApplicationRoleAssignments(rows) {
+    if (!Array.isArray(rows)) {
+        return [];
+    }
+    const byApp = new Map();
+    for (const row of rows) {
+        if (!row || typeof row !== 'object') {
+            continue;
+        }
+        const record = row;
+        const applicationId = readId(record['applicationId']);
+        if (!applicationId) {
+            continue;
+        }
+        const bucket = byApp.get(applicationId) ?? new Set();
+        for (const roleId of readRoleIds(record['roleIds'])) {
+            bucket.add(roleId);
+        }
+        byApp.set(applicationId, bucket);
+    }
+    return [...byApp.entries()].map(([applicationId, roleIds]) => ({
+        applicationId,
+        roleIds: [...roleIds],
+    }));
+}
+function flattenCreateApplicationRoleAssignments(assignments) {
+    const applicationIds = assignments.map((row) => row.applicationId);
+    const roleIds = [...new Set(assignments.flatMap((row) => row.roleIds))];
+    return { applicationIds, roleIds };
+}
+//#endregion
+
 //#region ---- Security management server command keys ----
 const AXMSecurityManagementServerCommands = {
     SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',
     CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',
     ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',
+    GetOwnPasswordStatus: 'SecurityManagement:Server:GetOwnPasswordStatus',
     InviteUser: 'SecurityManagement:Server:InviteUser',
+    /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */
+    ListTenantEntitledApplications: 'SecurityManagement:Server:ListTenantEntitledApplications',
+    /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */
+    ListInviteAssignableRoles: 'SecurityManagement:Server:ListInviteAssignableRoles',
     ResendInvitation: 'SecurityManagement:Server:ResendInvitation',
     CancelInvitation: 'SecurityManagement:Server:CancelInvitation',
     AcceptInvitation: 'SecurityManagement:Server:AcceptInvitation',
     ListMyPendingInvitations: 'SecurityManagement:Server:ListMyPendingInvitations',
     DeclineInvitation: 'SecurityManagement:Server:DeclineInvitation',
     AcceptMyInvitation: 'SecurityManagement:Server:AcceptMyInvitation',
+    LookupTenantByUniqueName: 'SecurityManagement:Server:LookupTenantByUniqueName',
+    RequestTenantMembership: 'SecurityManagement:Server:RequestTenantMembership',
+    ListMyJoinRequests: 'SecurityManagement:Server:ListMyJoinRequests',
+    CancelMyJoinRequest: 'SecurityManagement:Server:CancelMyJoinRequest',
+    ApproveJoinRequest: 'SecurityManagement:Server:ApproveJoinRequest',
+    RejectJoinRequest: 'SecurityManagement:Server:RejectJoinRequest',
+    CreateUserInTenant: 'SecurityManagement:Server:CreateUserInTenant',
     StartTwoFactorEnrollment: 'SecurityManagement:Server:StartTwoFactorEnrollment',
     ConfirmTwoFactorEnrollment: 'SecurityManagement:Server:ConfirmTwoFactorEnrollment',
     DisableTwoFactor: 'SecurityManagement:Server:DisableTwoFactor',
@@ -324,16 +534,29 @@ const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {
 const AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';
 /** Client/UI action key (confirm dialog → server admin reset 2FA). */
 const AXM_USER_RESET_TWO_FACTOR_COMMAND = 'SecurityManagement:User:ResetTwoFactor';
-/** Client/UI action keys for invite flows. */
+/** Client/UI action keys for invite / create-in-tenant flows. */
 const AXM_USER_INVITE_COMMAND = 'SecurityManagement:User:Invite';
 const AXM_USER_RESEND_INVITATION_COMMAND = 'SecurityManagement:User:ResendInvitation';
 const AXM_USER_CANCEL_INVITATION_COMMAND = 'SecurityManagement:User:CancelInvitation';
+const AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:ApproveJoinRequest';
+const AXM_USER_REJECT_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:RejectJoinRequest';
+const AXM_USER_CREATE_IN_TENANT_COMMAND = 'SecurityManagement:User:CreateInTenant';
 /** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */
 const AXM_ACCEPT_INVITATION_ERROR_CODES = {
     Invalid: 'ACCEPT_INVITATION_INVALID',
     Expired: 'ACCEPT_INVITATION_EXPIRED',
     PasswordRequired: 'ACCEPT_INVITATION_PASSWORD_REQUIRED',
 };
+/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */
+const AXM_JOIN_REQUEST_ERROR_CODES = {
+    NotSignedIn: 'JOIN_REQUEST_NOT_SIGNED_IN',
+    InvalidInput: 'JOIN_REQUEST_INVALID_INPUT',
+    TenantNotFound: 'JOIN_REQUEST_TENANT_NOT_FOUND',
+    AlreadyMember: 'JOIN_REQUEST_ALREADY_MEMBER',
+    InvitePending: 'JOIN_REQUEST_INVITE_PENDING',
+    RequestNotFound: 'JOIN_REQUEST_NOT_FOUND',
+    NotPending: 'JOIN_REQUEST_NOT_PENDING',
+};
 /** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
 const AXM_TWO_FACTOR_ERROR_CODES = {
     NotSignedIn: 'TWO_FACTOR_NOT_SIGNED_IN',
@@ -352,6 +575,36 @@ const AXM_TWO_FACTOR_ERROR_CODES = {
 };
 //#endregion
 
+//#region ----- User provisioning settings -----
+/** Platform settings owned by Security Management. */
+const AXMSecurityManagementSettings = {
+    /**
+     * Which Users-list add actions are available.
+     * `create` and `invite` are primary. `both` shows them as secondary actions.
+     */
+    UserProvisioningMode: 'SecurityManagement:Setting:User.ProvisioningMode',
+};
+const AXMUserProvisioningMode = {
+    Create: 'create',
+    Invite: 'invite',
+    Both: 'both',
+};
+/** Used when the platform setting has not been saved yet. */
+const AXM_USER_PROVISIONING_MODE_DEFAULT = AXMUserProvisioningMode.Both;
+//#endregion
+
+//#region ----- Device session admin scope (operation-owned) -----
+/** Query `params` key and HTTP header value for admin scope. */
+const AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM = 'deviceSessionAdminScope';
+/** HTTP header (lowercase) carrying the same scope for getOne/update/delete. */
+const AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER = 'x-axp-device-session-admin-scope';
+/** Entity list view name for TM → Tenant Sessions. */
+const AXP_DEVICE_SESSION_TENANT_SESSIONS_VIEW = 'tenant-sessions';
+function normalizeDeviceSessionAdminScope(value) {
+    return value === 'tenant' ? 'tenant' : 'application';
+}
+//#endregion
+
 var AXMSessionStatusTypes;
 (function (AXMSessionStatusTypes) {
     AXMSessionStatusTypes["revoked"] = "revoked";
@@ -513,11 +766,96 @@ async function userTwoFactorFactory() {
     return entityDef;
 }
 
+//#region ----- Imports -----
+//#endregion
+//#region ----- List actions -----
+const PROVISIONING_MODE_KEY = AXMSecurityManagementSettings.UserProvisioningMode;
+/**
+ * Hides the action unless the platform provisioning setting matches `mode`.
+ * A missing value uses {@link AXM_USER_PROVISIONING_MODE_DEFAULT}.
+ * Select widgets may persist either the scalar or `{ value }`.
+ */
+function hiddenUnlessProvisioningMode(mode) {
+    return `{{ (((await settings.get('${PROVISIONING_MODE_KEY}'))?.value ?? (await settings.get('${PROVISIONING_MODE_KEY}'))) || '${AXM_USER_PROVISIONING_MODE_DEFAULT}') !== '${mode}' }}`;
+}
+const USER_ADD_COMMANDS = new Set([AXM_USER_INVITE_COMMAND, AXM_USER_CREATE_IN_TENANT_COMMAND]);
+function commandNameOf(action) {
+    return typeof action.command === 'string' ? action.command : action.command?.name;
+}
+/** Type-level Invite / Create actions, including the legacy Create dropdown. */
+function isUserProvisioningListAction(action) {
+    if (action.scope !== AXPEntityCommandScope.TypeLevel) {
+        return false;
+    }
+    if (USER_ADD_COMMANDS.has(commandNameOf(action) ?? '')) {
+        return true;
+    }
+    return (action.items ?? []).some((child) => USER_ADD_COMMANDS.has(commandNameOf(child) ?? ''));
+}
+function provisioningAction(input) {
+    return {
+        name: input.name,
+        title: input.title,
+        icon: input.icon,
+        command: { name: input.command },
+        priority: input.priority,
+        type: AXPSystemActionType.Create,
+        scope: AXPEntityCommandScope.TypeLevel,
+        order: input.order,
+        hidden: hiddenUnlessProvisioningMode(input.mode),
+    };
+}
+/**
+ * Users list add actions driven by the platform provisioning setting.
+ * Create-only and invite-only stay primary. Both are secondary menu items.
+ */
+function userProvisioningListActions() {
+    return [
+        provisioningAction({
+            name: 'provision-create',
+            title: '@general:actions.create.title',
+            icon: 'fa-light fa-user-plus',
+            command: AXM_USER_CREATE_IN_TENANT_COMMAND,
+            priority: 'primary',
+            mode: AXMUserProvisioningMode.Create,
+            order: 1,
+        }),
+        provisioningAction({
+            name: 'provision-invite',
+            title: '@security-management:users.entities.user.actions.invite.title',
+            icon: 'fa-light fa-envelope',
+            command: AXM_USER_INVITE_COMMAND,
+            priority: 'primary',
+            mode: AXMUserProvisioningMode.Invite,
+            order: 1,
+        }),
+        provisioningAction({
+            name: 'provision-invite-secondary',
+            title: '@security-management:users.entities.user.actions.invite.title',
+            icon: 'fa-light fa-envelope',
+            command: AXM_USER_INVITE_COMMAND,
+            priority: 'secondary',
+            mode: AXMUserProvisioningMode.Both,
+            order: 1,
+        }),
+        provisioningAction({
+            name: 'provision-create-secondary',
+            title: '@security-management:users.entities.user.actions.create-in-tenant.title',
+            icon: 'fa-light fa-user-plus',
+            command: AXM_USER_CREATE_IN_TENANT_COMMAND,
+            priority: 'secondary',
+            mode: AXMUserProvisioningMode.Both,
+            order: 2,
+        }),
+    ];
+}
+//#endregion
+
 //#region ---- Contracts barrel ----
 
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { AXMSecurityManagementServerCommands, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_ACCEPT_INVITATION_ERROR_CODES, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY, AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_TWO_FACTOR_ERROR_CODES, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_CANCEL_INVITATION_COMMAND, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_INVITE_COMMAND, AXM_USER_RESEND_INVITATION_COMMAND, AXM_USER_RESET_TWO_FACTOR_COMMAND, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, SecurityManagementManifest, USER_ROLES_PAGE_COMPONENT_KEY, resolveAXMUserEffectiveState, userTwoFactorFactory };
+export { AXMSecurityManagementServerCommands, AXMSecurityManagementSettings, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXMUserProvisioningMode, AXM_ACCEPT_INVITATION_ERROR_CODES, AXM_CHANGE_OWN_PASSWORD_ERROR_CODES, AXM_IDENTITY_PROVIDER_PROTOCOL, AXM_JOIN_REQUEST_ERROR_CODES, AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY, AXM_MEMBERSHIP_INVITATION_SOURCE, AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE, AXM_SECURITY_CONTEXT_DEFINITIONS, AXM_TWO_FACTOR_ERROR_CODES, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_APPROVE_JOIN_REQUEST_COMMAND, AXM_USER_CANCEL_INVITATION_COMMAND, AXM_USER_CREATE_IN_TENANT_COMMAND, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXM_USER_INVITE_COMMAND, AXM_USER_PROVISIONING_MODE_DEFAULT, AXM_USER_REJECT_JOIN_REQUEST_COMMAND, AXM_USER_RESEND_INVITATION_COMMAND, AXM_USER_RESET_TWO_FACTOR_COMMAND, AXM_USER_SEND_PASSWORD_RESET_COMMAND, AXPAdministrationPermissionKeys, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER, AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM, AXP_DEVICE_SESSION_TENANT_SESSIONS_VIEW, ROLE_PERMISSIONS_PAGE_COMPONENT_KEY, RootConfig, SecurityManagementManifest, USER_ROLES_PAGE_COMPONENT_KEY, flattenCreateApplicationRoleAssignments, flattenInviteApplicationRoleAssignments, isRoleAssignableForInvite, isRoleAssignableForTenantUserInviteRow, isUserProvisioningListAction, normalizeCreateApplicationRoleAssignments, normalizeDeviceSessionAdminScope, normalizeInviteApplicationRoleAssignments, readInviteRoleScopeInfo, resolveAXMUserEffectiveState, userProvisioningListActions, userTwoFactorFactory };
 //# sourceMappingURL=acorex-platform-module-security-management-client-contracts.mjs.map