@acorex-platform/module-security-management-server 0.0.15 → 0.0.18

package/contracts/src/user-password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password-reset.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/user-password-reset.ts"],"names":[],"mappings":";AAAA,kDAAkD;;AAYlD,YAAY"}

package/package.json

@@ -1,12 +1,19 @@
 {
   "name": "@acorex-platform/module-security-management-server",
-  "version": "0.0.15",
+  "version": "0.0.18",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",
-    "@acorex-platform/module-common-server": "0.0.15"
+    "@acorex-platform/framework-server": "0.0.18",
+    "@acorex-platform/framework-shared": "0.0.18",
+    "@acorex-platform/module-communication-management-server": "0.0.18",
+    "@acorex-platform/module-content-management-server": "0.0.18",
+    "@acorex-platform/module-organization-management-server": "0.0.18",
+    "@acorex-platform/module-security-management-server": "0.0.18",
+    "@acorex-platform/module-settings-management-server": "0.0.18",
+    "@acorex-platform/module-common-server": "0.0.18"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/lib/middlewares/user-effective-state.middleware.d.ts

@@ -0,0 +1,13 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+/**
+ * Keeps persisted `effectiveState` in sync with `accountState` + `accessState`
+ * on SecurityManagement.User create/update.
+ */
+export declare class UserEffectiveStateMiddleware implements EntityStorageMiddleware {
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+}

package/src/lib/middlewares/user-effective-state.middleware.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserEffectiveStateMiddleware = void 0;
+const tslib_1 = require("tslib");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-contracts");
+const common_1 = require("@nestjs/common");
+//#region ---- User effective state middleware ----
+const USER_ENTITY = 'SecurityManagement.User';
+/**
+ * Keeps persisted `effectiveState` in sync with `accountState` + `accessState`
+ * on SecurityManagement.User create/update.
+ */
+let UserEffectiveStateMiddleware = class UserEffectiveStateMiddleware {
+    constructor() {
+        this.target = {
+            entity: USER_ENTITY,
+            ops: ['create', 'update'],
+            order: 4,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!ctx.data || typeof ctx.data !== 'object') {
+                yield next();
+                return;
+            }
+            const patch = ctx.data;
+            let accountState = patch['accountState'];
+            let accessState = patch['accessState'];
+            if (ctx.op === 'update' && ctx.id && (accountState === undefined || accessState === undefined)) {
+                try {
+                    const existing = (yield ctx.backend.getOne(ctx.entityName, ctx.id));
+                    if (existing) {
+                        accountState = accountState !== null && accountState !== void 0 ? accountState : existing['accountState'];
+                        accessState = accessState !== null && accessState !== void 0 ? accessState : existing['accessState'];
+                    }
+                }
+                catch (_b) {
+                    /* keep patch-only values */
+                }
+            }
+            patch['effectiveState'] = (0, module_security_management_contracts_1.resolveAXMUserEffectiveState)({
+                accountState,
+                accessState: (_a = accessState) !== null && _a !== void 0 ? _a : module_security_management_contracts_1.AXMUserAccessState.Allowed,
+            });
+            ctx.data = patch;
+            yield next();
+        });
+    }
+};
+exports.UserEffectiveStateMiddleware = UserEffectiveStateMiddleware;
+exports.UserEffectiveStateMiddleware = UserEffectiveStateMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], UserEffectiveStateMiddleware);
+//#endregion
+//# sourceMappingURL=user-effective-state.middleware.js.map

package/src/lib/middlewares/user-effective-state.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-effective-state.middleware.js","sourceRoot":"","sources":["../../../../../../libs/modules/security-management/server/src/lib/middlewares/user-effective-state.middleware.ts"],"names":[],"mappings":";;;;AAKA,gHAG+D;AAE/D,2CAA4C;AAE5C,mDAAmD;AAEnD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C;;;GAGG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAAlC;QACI,WAAM,GAAG;YAChB,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAkB;YAC1C,KAAK,EAAE,CAAC;SACT,CAAC;IAmCJ,CAAC;IAjCO,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAChE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAA+B,CAAC;YAClD,IAAI,YAAY,GAAG,KAAK,CAAC,cAAc,CAAuB,CAAC;YAC/D,IAAI,WAAW,GAAG,KAAK,CAAC,aAAa,CAAuB,CAAC;YAE7D,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/F,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAGrD,CAAC;oBACd,IAAI,QAAQ,EAAE,CAAC;wBACb,YAAY,GAAG,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAK,QAAQ,CAAC,cAAc,CAAwB,CAAC;wBAChF,WAAW,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAK,QAAQ,CAAC,aAAa,CAAwB,CAAC;oBAC/E,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;YAED,KAAK,CAAC,gBAAgB,CAAC,GAAG,IAAA,mEAA4B,EAAC;gBACrD,YAAY;gBACZ,WAAW,EAAE,MAAC,WAA8C,mCAAI,yDAAkB,CAAC,OAAO;aAC3F,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC;YAEjB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAxCY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;GACA,4BAA4B,CAwCxC;AAED,YAAY"}

package/src/lib/password-reset/complete-password-reset.command.d.ts

@@ -0,0 +1,9 @@
+import type { AXPCommand } from '@acorex-platform/framework-shared/runtime';
+import type { AXPExecuteCommandResult } from '@acorex-platform/framework-shared/core';
+import { type AXMCompletePasswordResetInput } from '@acorex-platform/module-security-management-contracts';
+import { UserPasswordResetService } from './user-password-reset.service';
+export declare class CompletePasswordResetCommand implements AXPCommand<AXMCompletePasswordResetInput, unknown> {
+    private readonly passwordReset;
+    constructor(passwordReset: UserPasswordResetService);
+    execute(input: AXMCompletePasswordResetInput): Promise<AXPExecuteCommandResult>;
+}

package/src/lib/password-reset/complete-password-reset.command.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompletePasswordResetCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-contracts");
+const user_password_reset_service_1 = require("./user-password-reset.service");
+//#region ---- Complete password reset command ----
+let CompletePasswordResetCommand = class CompletePasswordResetCommand {
+    constructor(passwordReset) {
+        this.passwordReset = passwordReset;
+    }
+    execute(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            try {
+                const result = yield this.passwordReset.completePasswordReset(input !== null && input !== void 0 ? input : { token: '', newPassword: '' });
+                return {
+                    success: result.success,
+                    message: result.message ? { text: result.message } : undefined,
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: {
+                        text: error instanceof Error ? error.message : 'Failed to reset password.',
+                    },
+                };
+            }
+        });
+    }
+};
+exports.CompletePasswordResetCommand = CompletePasswordResetCommand;
+exports.CompletePasswordResetCommand = CompletePasswordResetCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.CompletePasswordReset }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_password_reset_service_1.UserPasswordResetService])
+], CompletePasswordResetCommand);
+//#endregion
+//# sourceMappingURL=complete-password-reset.command.js.map

package/src/lib/password-reset/complete-password-reset.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-password-reset.command.js","sourceRoot":"","sources":["../../../../../../libs/modules/security-management/server/src/lib/password-reset/complete-password-reset.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAG5C,gFAAkF;AAClF,gHAG+D;AAE/D,+EAAyE;AAEzE,mDAAmD;AAI5C,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAGvC,YAA6B,aAAuC;QAAvC,kBAAa,GAAb,aAAa,CAA0B;IAAG,CAAC;IAElE,OAAO,CAAC,KAAoC;;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvG,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;iBAC/D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE;wBACP,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;qBAC3E;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AArBY,oEAA4B;uCAA5B,4BAA4B;IAFxC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,qBAAqB,EAAE,CAAC;IACjF,IAAA,mBAAU,GAAE;6CAIiC,sDAAwB;GAHzD,4BAA4B,CAqBxC;AAED,YAAY"}

package/src/lib/password-reset/send-password-reset-email.command.d.ts

@@ -0,0 +1,21 @@
+import type { AXPCommand } from '@acorex-platform/framework-shared/runtime';
+import type { AXPExecuteCommandResult } from '@acorex-platform/framework-shared/core';
+import { type AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-contracts';
+import { UserPasswordResetService } from './user-password-reset.service';
+export declare class SendPasswordResetEmailCommand implements AXPCommand<AXMSendPasswordResetEmailInput & {
+    __context__?: {
+        data?: {
+            id?: string;
+        };
+    };
+}, unknown> {
+    private readonly passwordReset;
+    constructor(passwordReset: UserPasswordResetService);
+    execute(input?: AXMSendPasswordResetEmailInput & {
+        __context__?: {
+            data?: {
+                id?: string;
+            };
+        };
+    }): Promise<AXPExecuteCommandResult>;
+}

package/src/lib/password-reset/send-password-reset-email.command.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SendPasswordResetEmailCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-contracts");
+const user_password_reset_service_1 = require("./user-password-reset.service");
+//#region ---- Send password reset email command ----
+let SendPasswordResetEmailCommand = class SendPasswordResetEmailCommand {
+    constructor(passwordReset) {
+        this.passwordReset = passwordReset;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = {}) {
+            var _a, _b, _c;
+            try {
+                const userId = (_a = input.userId) !== null && _a !== void 0 ? _a : (_c = (_b = input.__context__) === null || _b === void 0 ? void 0 : _b.data) === null || _c === void 0 ? void 0 : _c.id;
+                const result = yield this.passwordReset.sendPasswordResetEmail({
+                    userId: userId ? String(userId) : undefined,
+                    login: input.login,
+                    webOrigin: input.webOrigin,
+                });
+                return {
+                    success: result.success,
+                    data: { sent: result.sent === true },
+                    message: result.message ? { text: result.message } : undefined,
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: {
+                        text: error instanceof Error ? error.message : 'Failed to send password reset email.',
+                    },
+                };
+            }
+        });
+    }
+};
+exports.SendPasswordResetEmailCommand = SendPasswordResetEmailCommand;
+exports.SendPasswordResetEmailCommand = SendPasswordResetEmailCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.SendPasswordResetEmail }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_password_reset_service_1.UserPasswordResetService])
+], SendPasswordResetEmailCommand);
+//#endregion
+//# sourceMappingURL=send-password-reset-email.command.js.map

package/src/lib/password-reset/send-password-reset-email.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-password-reset-email.command.js","sourceRoot":"","sources":["../../../../../../libs/modules/security-management/server/src/lib/password-reset/send-password-reset-email.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAG5C,gFAAkF;AAClF,gHAG+D;AAE/D,+EAAyE;AAEzE,qDAAqD;AAI9C,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAGxC,YAA6B,aAAuC;QAAvC,kBAAa,GAAb,aAAa,CAA0B;IAAG,CAAC;IAElE,OAAO;qEACX,QAAuF,EAAE;;YAEzF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAA,KAAK,CAAC,MAAM,mCAAI,MAAA,MAAA,KAAK,CAAC,WAAW,0CAAE,IAAI,0CAAE,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC;oBAC7D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE;oBACpC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;iBAC/D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE;wBACP,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC;qBACtF;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA9BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,sBAAsB,EAAE,CAAC;IAClF,IAAA,mBAAU,GAAE;6CAIiC,sDAAwB;GAHzD,6BAA6B,CA8BzC;AAED,YAAY"}

package/src/lib/password-reset/user-password-reset.service.d.ts

@@ -0,0 +1,31 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { ServerCommandExecutorService } from '@acorex-platform/framework-server/domain/providers';
+import { SettingsManagementStoreService } from '@acorex-platform/module-settings-management-server';
+import { AXMCompletePasswordResetInput, AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-contracts';
+export declare class UserPasswordResetService {
+    private readonly entityStorage;
+    private readonly commandExecutor;
+    private readonly settingsStore;
+    private readonly logger;
+    private readonly recentRequests;
+    constructor(entityStorage: EntityStorageMiddlewareService, commandExecutor: ServerCommandExecutorService, settingsStore: SettingsManagementStoreService);
+    /**
+     * Shared by admin Action and public forgot-password.
+     * Always returns a generic success for the forgot path (no user enumeration).
+     */
+    sendPasswordResetEmail(input: AXMSendPasswordResetEmailInput): Promise<{
+        success: boolean;
+        message?: string;
+        sent?: boolean;
+    }>;
+    completePasswordReset(input: AXMCompletePasswordResetInput): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    private resolveUser;
+    private listUsers;
+    private resolveCompanyEmailMerge;
+    private loadTenantSnapshot;
+    private resolveScopedSettings;
+    private assertRateLimit;
+}

package/src/lib/password-reset/user-password-reset.service.js

@@ -0,0 +1,282 @@
+"use strict";
+var UserPasswordResetService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserPasswordResetService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const lodash_1 = require("lodash");
+const core_1 = require("@acorex-platform/framework-server/core");
+const providers_1 = require("@acorex-platform/framework-server/domain/providers");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_communication_management_contracts_1 = require("@acorex-platform/module-communication-management-contracts");
+const module_content_management_contracts_1 = require("@acorex-platform/module-content-management-contracts");
+const module_organization_management_contracts_1 = require("@acorex-platform/module-organization-management-contracts");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+//#region ---- Constants ----
+const USER_ENTITY = 'SecurityManagement.User';
+const TENANT_ENTITY = 'TenantManagement.Tenant';
+const TEMPLATE_NAME = 'password-reset';
+const EMAIL_CHANNEL = 'email-smtp';
+const EXPIRY_MINUTES = 60;
+const RATE_LIMIT_WINDOW_MS = 60000;
+const RATE_LIMIT_MAX = 5;
+//#endregion
+//#region ---- Helpers ----
+function resolvePasswordResetApiOrigin() {
+    var _a, _b, _c;
+    const fromBase = ((_a = process.env['ACOREX_API_BASE_URL']) === null || _a === void 0 ? void 0 : _a.trim()) ||
+        ((_b = process.env['DEMO_API_BASE_URL']) === null || _b === void 0 ? void 0 : _b.trim()) ||
+        '';
+    if (fromBase) {
+        try {
+            const url = new URL(fromBase.includes('://') ? fromBase : `http://${fromBase}`);
+            return url.origin;
+        }
+        catch (_d) {
+            // fall through
+        }
+    }
+    const port = ((_c = process.env['PORT']) === null || _c === void 0 ? void 0 : _c.trim()) || '5500';
+    return `http://localhost:${port}`;
+}
+function hashToken(token) {
+    return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+}
+function resolveWebOrigin(explicit) {
+    var _a, _b, _c;
+    const fromInput = explicit === null || explicit === void 0 ? void 0 : explicit.trim();
+    if (fromInput) {
+        return fromInput.replace(/\/$/, '');
+    }
+    const fromEnv = ((_a = process.env['ACOREX_WEB_ORIGIN']) === null || _a === void 0 ? void 0 : _a.trim()) ||
+        ((_c = (_b = process.env['CORS_ORIGINS']) === null || _b === void 0 ? void 0 : _b.split(',')[0]) === null || _c === void 0 ? void 0 : _c.trim()) ||
+        'http://localhost:4800';
+    return fromEnv.replace(/\/$/, '');
+}
+function tokensMatch(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(left, right);
+}
+//#endregion
+//#region ---- User password reset service ----
+let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordResetService {
+    constructor(entityStorage, commandExecutor, settingsStore) {
+        this.entityStorage = entityStorage;
+        this.commandExecutor = commandExecutor;
+        this.settingsStore = settingsStore;
+        this.logger = new common_1.Logger(UserPasswordResetService_1.name);
+        this.recentRequests = new Map();
+    }
+    /**
+     * Shared by admin Action and public forgot-password.
+     * Always returns a generic success for the forgot path (no user enumeration).
+     */
+    sendPasswordResetEmail(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g;
+            const loginKey = ((_b = (_a = input.login) !== null && _a !== void 0 ? _a : input.userId) !== null && _b !== void 0 ? _b : '').toString().trim().toLowerCase();
+            if (loginKey) {
+                this.assertRateLimit(loginKey);
+            }
+            const user = yield this.resolveUser(input);
+            if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                // Opaque success for forgot; admin path still reports missing user.
+                if (input.userId) {
+                    return { success: false, message: 'User not found.' };
+                }
+                return { success: true, sent: false };
+            }
+            const email = (_c = user.email) === null || _c === void 0 ? void 0 : _c.trim();
+            if (!email) {
+                if (input.userId) {
+                    return { success: false, message: 'User does not have an email address.' };
+                }
+                return { success: true, sent: false };
+            }
+            const rawToken = (0, crypto_1.randomBytes)(32).toString('hex');
+            const now = new Date();
+            const expiresAt = new Date(now.getTime() + EXPIRY_MINUTES * 60000);
+            const passwordReset = {
+                tokenHash: hashToken(rawToken),
+                expiresAt: expiresAt.toISOString(),
+                sentAt: now.toISOString(),
+            };
+            yield this.entityStorage.updateOne(USER_ENTITY, user.id, { passwordReset });
+            const isAdminPath = Boolean(input.userId);
+            const webOrigin = resolveWebOrigin(input.webOrigin);
+            const resetLink = `${webOrigin}/auth/reset-password?token=${encodeURIComponent(rawToken)}`;
+            const tenantId = (_e = (_d = user.ownershipInfo) === null || _d === void 0 ? void 0 : _d.tenantId) === null || _e === void 0 ? void 0 : _e.trim();
+            if (!tenantId) {
+                this.logger.warn(`password-reset missing ownershipInfo.tenantId for user ${user.id}`);
+                if (isAdminPath) {
+                    return { success: false, message: 'User tenant context is required to send email.' };
+                }
+                return { success: true, sent: false };
+            }
+            const companyMerge = yield this.resolveCompanyEmailMerge(tenantId, webOrigin);
+            const merge = Object.assign(Object.assign({}, companyMerge), { userName: user.displayName || user.username || email, resetLink, expiryMinutes: String(EXPIRY_MINUTES) });
+            const renderResult = yield this.commandExecutor.execute(module_content_management_contracts_1.AXM_TEXT_TEMPLATE_RENDER_COMMAND_KEY, {
+                textTemplateName: TEMPLATE_NAME,
+                channel: 'email',
+                merge,
+            });
+            const rendered = renderResult === null || renderResult === void 0 ? void 0 : renderResult.data;
+            if (!(renderResult === null || renderResult === void 0 ? void 0 : renderResult.success) || !(rendered === null || rendered === void 0 ? void 0 : rendered.body)) {
+                const text = typeof ((_f = renderResult === null || renderResult === void 0 ? void 0 : renderResult.message) === null || _f === void 0 ? void 0 : _f.text) === 'string'
+                    ? renderResult.message.text
+                    : 'Password reset template is not configured.';
+                this.logger.warn(`password-reset text template render failed: ${text}`);
+                if (isAdminPath) {
+                    return { success: false, message: text };
+                }
+                return { success: true, sent: false };
+            }
+            const subject = rendered.subject;
+            const body = rendered.body;
+            const result = yield this.commandExecutor.execute(module_communication_management_contracts_1.AXMCommunicationManagementServerCommands.Send, {
+                title: subject || 'Password reset',
+                message: { subject, body },
+                channel: EMAIL_CHANNEL,
+                recipientAddress: email,
+                recipientUserId: user.id,
+                recipientName: user.displayName || user.username,
+                tenantId,
+                definitionKey: TEMPLATE_NAME,
+                correlationId: `password-reset:${user.id}:${passwordReset.sentAt}`,
+                idempotencyKey: `password-reset:${user.id}:${passwordReset.tokenHash}`,
+            });
+            if (!(result === null || result === void 0 ? void 0 : result.success)) {
+                const text = typeof ((_g = result === null || result === void 0 ? void 0 : result.message) === null || _g === void 0 ? void 0 : _g.text) === 'string'
+                    ? result.message.text
+                    : 'Failed to send password reset email.';
+                this.logger.warn(`password-reset send failed for user ${user.id}: ${text}`);
+                if (isAdminPath) {
+                    return { success: false, message: text };
+                }
+                return { success: true, sent: false };
+            }
+            return { success: true, sent: true };
+        });
+    }
+    completePasswordReset(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const token = (_a = input.token) === null || _a === void 0 ? void 0 : _a.trim();
+            const newPassword = (_b = input.newPassword) !== null && _b !== void 0 ? _b : '';
+            if (!token || !newPassword || newPassword.length < 6) {
+                return { success: false, message: 'A valid token and new password are required.' };
+            }
+            const tokenHash = hashToken(token);
+            const users = yield this.listUsers();
+            const user = users.find((u) => { var _a; return ((_a = u.passwordReset) === null || _a === void 0 ? void 0 : _a.tokenHash) && tokensMatch(u.passwordReset.tokenHash, tokenHash); });
+            if (!(user === null || user === void 0 ? void 0 : user.id) || !user.passwordReset) {
+                return { success: false, message: 'This password reset link is invalid or has expired.' };
+            }
+            const expiresAt = Date.parse(user.passwordReset.expiresAt);
+            if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) {
+                yield this.entityStorage.updateOne(USER_ENTITY, user.id, { passwordReset: null });
+                return { success: false, message: 'This password reset link is invalid or has expired.' };
+            }
+            const password = yield (0, core_2.hashPassword)(newPassword);
+            yield this.entityStorage.updateOne(USER_ENTITY, user.id, {
+                password,
+                passwordChangedAt: new Date().toISOString(),
+                passwordReset: null,
+            });
+            return { success: true };
+        });
+    }
+    resolveUser(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            if ((_a = input.userId) === null || _a === void 0 ? void 0 : _a.trim()) {
+                const record = yield this.entityStorage.getOne(USER_ENTITY, input.userId.trim());
+                return (_b = record) !== null && _b !== void 0 ? _b : null;
+            }
+            const login = (_c = input.login) === null || _c === void 0 ? void 0 : _c.trim().toLowerCase();
+            if (!login) {
+                return null;
+            }
+            const users = yield this.listUsers();
+            return ((_d = users.find((u) => { var _a, _b; return ((_a = u.username) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) === login || ((_b = u.email) === null || _b === void 0 ? void 0 : _b.trim().toLowerCase()) === login; })) !== null && _d !== void 0 ? _d : null);
+        });
+    }
+    listUsers() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.entityStorage.query(USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 5000 }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            return Array.isArray(items) ? items : [];
+        });
+    }
+    resolveCompanyEmailMerge(tenantId, webOrigin) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const settingsValues = yield this.resolveScopedSettings(tenantId);
+            const tenant = yield this.loadTenantSnapshot(tenantId);
+            return (0, module_organization_management_contracts_1.buildCompanyEmailMergeFromOrganization)({
+                settingsValues,
+                tenant,
+                webOrigin,
+                apiOrigin: resolvePasswordResetApiOrigin(),
+            });
+        });
+    }
+    loadTenantSnapshot(tenantId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const id = tenantId.trim();
+            if (!id) {
+                return null;
+            }
+            try {
+                const row = (yield this.entityStorage.getOne(TENANT_ENTITY, id));
+                return row !== null && row !== void 0 ? row : null;
+            }
+            catch (_a) {
+                return null;
+            }
+        });
+    }
+    resolveScopedSettings(tenantId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const platformDocument = yield this.settingsStore.findByPartition({ scope: 'P', documentId: 'P' });
+            let values = Object.assign({}, ((_a = platformDocument === null || platformDocument === void 0 ? void 0 : platformDocument.values) !== null && _a !== void 0 ? _a : {}));
+            if (tenantId.trim()) {
+                const tenantDocument = yield this.settingsStore.findByPartition({
+                    scope: 'T',
+                    documentId: `T:${tenantId}`,
+                    tenantId,
+                });
+                if (tenantDocument === null || tenantDocument === void 0 ? void 0 : tenantDocument.values) {
+                    values = Object.assign(Object.assign({}, values), tenantDocument.values);
+                }
+            }
+            return values;
+        });
+    }
+    assertRateLimit(key) {
+        var _a;
+        const now = Date.now();
+        const windowStart = now - RATE_LIMIT_WINDOW_MS;
+        const prior = ((_a = this.recentRequests.get(key)) !== null && _a !== void 0 ? _a : []).filter((t) => t >= windowStart);
+        if (prior.length >= RATE_LIMIT_MAX) {
+            throw new Error('Too many password reset requests. Please try again later.');
+        }
+        prior.push(now);
+        this.recentRequests.set(key, prior);
+    }
+};
+exports.UserPasswordResetService = UserPasswordResetService;
+exports.UserPasswordResetService = UserPasswordResetService = UserPasswordResetService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        providers_1.ServerCommandExecutorService,
+        module_settings_management_server_1.SettingsManagementStoreService])
+], UserPasswordResetService);
+//#endregion
+//# sourceMappingURL=user-password-reset.service.js.map

package/src/lib/password-reset/user-password-reset.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password-reset.service.js","sourceRoot":"","sources":["../../../../../../libs/modules/security-management/server/src/lib/password-reset/user-password-reset.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,mCAAkE;AAClE,mCAA6B;AAE7B,iEAAwF;AACxF,kFAAkG;AAClG,6EAAkG;AAClG,iEAAsE;AACtE,0HAAsH;AACtH,8GAG8D;AAC9D,wHAGmE;AACnE,0GAAoG;AAQpG,6BAA6B;AAE7B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,oBAAoB,GAAG,KAAM,CAAC;AACpC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,YAAY;AAEZ,2BAA2B;AAE3B,SAAS,6BAA6B;;IACpC,MAAM,QAAQ,GACZ,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,0CAAE,IAAI,EAAE;SAC1C,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,0CAAE,IAAI,EAAE,CAAA;QACxC,EAAE,CAAC;IACL,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;YAChF,OAAO,GAAG,CAAC,MAAM,CAAC;QACpB,CAAC;QAAC,WAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,0CAAE,IAAI,EAAE,KAAI,MAAM,CAAC;IACnD,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiB;;IACzC,MAAM,SAAS,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,EAAE,CAAC;IACnC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GACX,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,0CAAE,IAAI,EAAE;SACxC,MAAA,MAAA,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0CAAE,IAAI,EAAE,CAAA;QAClD,uBAAuB,CAAC;IAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,YAAY;AAEZ,+CAA+C;AAGxC,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAInC,YACmB,aAA6C,EAC7C,eAA6C,EAC7C,aAA6C;QAF7C,kBAAa,GAAb,aAAa,CAAgC;QAC7C,oBAAe,GAAf,eAAe,CAA8B;QAC7C,kBAAa,GAAb,aAAa,CAAgC;QAN/C,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;QACnD,mBAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IAM3D,CAAC;IAEJ;;;OAGG;IACG,sBAAsB,CAC1B,KAAqC;;;YAErC,MAAM,QAAQ,GAAG,CAAC,MAAA,MAAA,KAAK,CAAC,KAAK,mCAAI,KAAK,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE,CAAC;gBACd,oEAAoE;gBACpE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBACxD,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;gBAC7E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,KAAM,CAAC,CAAC;YACpE,MAAM,aAAa,GAA6B;gBAC9C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;gBAC9B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE;aAC1B,CAAC;YAEF,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAE5E,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,GAAG,SAAS,8BAA8B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAE3F,MAAM,QAAQ,GAAG,MAAA,MAAA,IAAI,CAAC,aAAa,0CAAE,QAAQ,0CAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtF,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;gBACvF,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC9E,MAAM,KAAK,mCACN,YAAY,KACf,QAAQ,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,EACpD,SAAS,EACT,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,GACtC,CAAC;YAEF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,0EAAoC,EAAE;gBAC5F,gBAAgB,EAAE,aAAa;gBAC/B,OAAO,EAAE,OAAO;gBAChB,KAAK;aACN,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,IAA+C,CAAC;YAC/E,IAAI,CAAC,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,CAAA,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA,EAAE,CAAC;gBAC9C,MAAM,IAAI,GACR,OAAO,CAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,0CAAE,IAAI,CAAA,KAAK,QAAQ;oBAC7C,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,4CAA4C,CAAC;gBACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;gBACxE,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,oFAAwC,CAAC,IAAI,EAAE;gBAC/F,KAAK,EAAE,OAAO,IAAI,gBAAgB;gBAClC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC1B,OAAO,EAAE,aAAa;gBACtB,gBAAgB,EAAE,KAAK;gBACvB,eAAe,EAAE,IAAI,CAAC,EAAE;gBACxB,aAAa,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAChD,QAAQ;gBACR,aAAa,EAAE,aAAa;gBAC5B,aAAa,EAAE,kBAAkB,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,MAAM,EAAE;gBAClE,cAAc,EAAE,kBAAkB,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE;aACvE,CAAC,CAAC;YAEH,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAA,EAAE,CAAC;gBACrB,MAAM,IAAI,GACR,OAAO,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,0CAAE,IAAI,CAAA,KAAK,QAAQ;oBACvC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;oBACrB,CAAC,CAAC,sCAAsC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC5E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;KAAA;IAEK,qBAAqB,CACzB,KAAoC;;;YAEpC,MAAM,KAAK,GAAG,MAAA,KAAK,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,CAAC,CAAC,aAAa,0CAAE,SAAS,KAAI,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA,EAAA,CAAC,CAAC;YAChH,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;gBACvD,QAAQ;gBACR,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC3C,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;KAAA;IAEa,WAAW,CACvB,KAAqC;;;YAErC,IAAI,MAAA,KAAK,CAAC,MAAM,0CAAE,IAAI,EAAE,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACjF,OAAO,MAAC,MAAuD,mCAAI,IAAI,CAAC;YAC1E,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,KAAK,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,OAAO,CACL,MAAA,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,EAAE,eACJ,OAAA,CAAA,MAAA,CAAC,CAAC,QAAQ,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,IAAI,CAAA,MAAA,CAAC,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAA,EAAA,CACxF,mCAAI,IAAI,CACV,CAAC;QACJ,CAAC;KAAA;IAEa,SAAS;;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;YACF,MAAM,KAAK,GAAG,IAAA,YAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAA4C,CAAC;YAClF,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,CAAC;KAAA;IAEa,wBAAwB,CACpC,QAAgB,EAChB,SAAiB;;YAEjB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACvD,OAAO,IAAA,iFAAsC,EAAC;gBAC5C,cAAc;gBACd,MAAM;gBACN,SAAS;gBACT,SAAS,EAAE,6BAA6B,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;KAAA;IAEa,kBAAkB,CAAC,QAAgB;;YAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAsC,CAAC;gBACtG,OAAO,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,IAAI,CAAC;YACrB,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAEa,qBAAqB,CAAC,QAAgB;;;YAClD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACnG,IAAI,MAAM,qBAAiC,CAAC,MAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,MAAM,mCAAI,EAAE,CAAC,CAAE,CAAC;YAE9E,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;oBAC9D,KAAK,EAAE,GAAG;oBACV,UAAU,EAAE,KAAK,QAAQ,EAAE;oBAC3B,QAAQ;iBACT,CAAC,CAAC;gBACH,IAAI,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,MAAM,EAAE,CAAC;oBAC3B,MAAM,mCAAQ,MAAM,GAAK,cAAc,CAAC,MAAM,CAAE,CAAC;gBACnD,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEO,eAAe,CAAC,GAAW;;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,oBAAoB,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,MAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;CACF,CAAA;AA7OY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;6CAMuB,qCAA8B;QAC5B,wCAA4B;QAC9B,kEAA8B;GAPrD,wBAAwB,CA6OpC;AAED,YAAY"}

package/src/lib/security-management-server.module.js

@@ -3,21 +3,46 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityManagementServerModule = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const user_effective_state_middleware_1 = require("./middlewares/user-effective-state.middleware");
+const complete_password_reset_command_1 = require("./password-reset/complete-password-reset.command");
+const send_password_reset_email_command_1 = require("./password-reset/send-password-reset-email.command");
+const user_password_reset_service_1 = require("./password-reset/user-password-reset.service");
 const security_management_seed_catalog_1 = require("./seed/security-management.seed-catalog");
 const security_management_seed_tokens_1 = require("./seed/security-management-seed.tokens");
 const security_management_seed_provider_1 = require("./seed/security-management-seed.provider");
+//#region ---- Security management backend module ----
 let SecurityManagementServerModule = class SecurityManagementServerModule {
 };
 exports.SecurityManagementServerModule = SecurityManagementServerModule;
 exports.SecurityManagementServerModule = SecurityManagementServerModule = tslib_1.__decorate([
     (0, common_1.Module)({
+        imports: [core_1.EntityStorageModule, module_settings_management_server_1.SettingsManagementServerModule],
         providers: [
             security_management_seed_provider_1.SecurityManagementSeedCatalogProvider,
             {
                 provide: security_management_seed_tokens_1.SECURITY_MANAGEMENT_MODULE_SEED,
                 useValue: security_management_seed_catalog_1.securitymanagementSeedCatalog,
             },
+            user_effective_state_middleware_1.UserEffectiveStateMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: user_effective_state_middleware_1.UserEffectiveStateMiddleware,
+                multi: true,
+            },
+            user_password_reset_service_1.UserPasswordResetService,
+            send_password_reset_email_command_1.SendPasswordResetEmailCommand,
+            complete_password_reset_command_1.CompletePasswordResetCommand,
+        ],
+        exports: [
+            security_management_seed_tokens_1.SECURITY_MANAGEMENT_MODULE_SEED,
+            security_management_seed_provider_1.SecurityManagementSeedCatalogProvider,
+            user_effective_state_middleware_1.UserEffectiveStateMiddleware,
+            core_1.ENTITY_STORAGE_MIDDLEWARE,
+            user_password_reset_service_1.UserPasswordResetService,
         ],
     })
 ], SecurityManagementServerModule);
+//#endregion
 //# sourceMappingURL=security-management-server.module.js.map

package/src/lib/security-management-server.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-management-server.module.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/src/lib/security-management-server.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAwC;AACxC,8FAAwF;AACxF,4FAAyF;AACzF,gGAAiG;AAW1F,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;CAAG,CAAA;AAAjC,wEAA8B;yCAA9B,8BAA8B;IAR1C,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT,yEAAqC;YACrC;gBACE,OAAO,EAAE,iEAA+B;gBACxC,QAAQ,EAAE,gEAA6B;aACxC;SACF;KAAE,CAAC;GACO,8BAA8B,CAAG"}
+{"version":3,"file":"security-management-server.module.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/src/lib/security-management-server.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAuD;AACvD,iEAAwG;AACxG,0GAAoG;AAEpG,mGAA6F;AAC7F,sGAAgG;AAChG,0GAAmG;AACnG,8FAAwF;AACxF,8FAAwF;AACxF,4FAAyF;AACzF,gGAAiG;AAEjG,sDAAsD;AA4B/C,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;CAAG,CAAA;AAAjC,wEAA8B;yCAA9B,8BAA8B;IA1B1C,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,EAAE,kEAA8B,CAAC;QAC9D,SAAS,EAAE;YACT,yEAAqC;YACrC;gBACE,OAAO,EAAE,iEAA+B;gBACxC,QAAQ,EAAE,gEAA6B;aACxC;YACD,8DAA4B;YAC5B;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,8DAA4B;gBACzC,KAAK,EAAE,IAAI;aACA;YACb,sDAAwB;YACxB,iEAA6B;YAC7B,8DAA4B;SAC7B;QACD,OAAO,EAAE;YACP,iEAA+B;YAC/B,yEAAqC;YACrC,8DAA4B;YAC5B,gCAAyB;YACzB,sDAAwB;SACzB;KACF,CAAC;GACW,8BAA8B,CAAG;AAE9C,YAAY"}