@acorex-platform/module-security-management-server 0.0.15 → 2.0.0-next.42

package/server/src/lib/identity-provider/identity-provider-catalog.service.js

@@ -0,0 +1,169 @@
+"use strict";
+//#region ---- Imports ----
+var IdentityProviderCatalogService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityProviderCatalogService = void 0;
+exports.provideAuthIdentityProviderCatalog = provideAuthIdentityProviderCatalog;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const identity_provider_constants_1 = require("./identity-provider.constants");
+const identity_provider_ids_constants_1 = require("./identity-provider-ids.constants");
+//#endregion
+//#region ---- Catalog service ----
+let IdentityProviderCatalogService = IdentityProviderCatalogService_1 = class IdentityProviderCatalogService {
+    constructor(storage) {
+        this.storage = storage;
+        this.logger = new common_1.Logger(IdentityProviderCatalogService_1.name);
+    }
+    listEnabledForLogin() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const result = yield this.storage.query(identity_provider_constants_1.IDENTITY_PROVIDER_ENTITY, {
+                    skip: 0,
+                    take: 200,
+                    sort: [{ field: 'priority', dir: 'asc' }, { field: 'title', dir: 'asc' }],
+                });
+                const items = ((_a = result.items) !== null && _a !== void 0 ? _a : []);
+                return items
+                    .filter((row) => this.isOidcProtocol(row) && this.isActiveForLogin(row))
+                    .map((row) => this.toPublicDto(row));
+            }
+            catch (error) {
+                this.logger.warn(`listEnabledForLogin failed (entity may not be registered yet): ${error instanceof Error ? error.message : String(error)}`);
+                return [];
+            }
+        });
+    }
+    getBrokerConfig(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g;
+            try {
+                const row = yield this.findByKey(key);
+                if (!row || !this.isOidcProtocol(row) || !this.isActiveForLogin(row)) {
+                    return null;
+                }
+                const clientId = (_a = row.clientId) === null || _a === void 0 ? void 0 : _a.trim();
+                const clientSecret = (_b = row.clientSecret) === null || _b === void 0 ? void 0 : _b.trim();
+                const authorizationUrl = (_c = row.authorizationUrl) === null || _c === void 0 ? void 0 : _c.trim();
+                const tokenUrl = (_d = row.tokenUrl) === null || _d === void 0 ? void 0 : _d.trim();
+                if (!clientId || !clientSecret || !authorizationUrl || !tokenUrl) {
+                    return null;
+                }
+                return {
+                    key: row.key,
+                    clientId,
+                    clientSecret,
+                    enabled: true,
+                    authorizationUrl,
+                    tokenUrl,
+                    userInfoUrl: ((_e = row.userInfoUrl) === null || _e === void 0 ? void 0 : _e.trim()) || undefined,
+                    issuerUrl: ((_f = row.issuerUrl) === null || _f === void 0 ? void 0 : _f.trim()) || undefined,
+                    scopes: ((_g = row.scopes) === null || _g === void 0 ? void 0 : _g.trim()) || 'openid email profile',
+                };
+            }
+            catch (error) {
+                this.logger.warn(`getBrokerConfig(${key}) failed: ${error instanceof Error ? error.message : String(error)}`);
+                return null;
+            }
+        });
+    }
+    ensureStub(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g;
+            try {
+                const existing = yield this.findByKey(input.key);
+                if (existing) {
+                    return;
+                }
+                yield this.storage.insertOne(identity_provider_constants_1.IDENTITY_PROVIDER_ENTITY, {
+                    id: identity_provider_ids_constants_1.IDENTITY_PROVIDER_STUB_IDS_BY_KEY[input.key],
+                    key: input.key,
+                    title: input.title,
+                    icon: (_a = input.icon) !== null && _a !== void 0 ? _a : null,
+                    protocol: module_security_management_contracts_1.AXM_IDENTITY_PROVIDER_PROTOCOL.Oidc,
+                    isDisabled: true,
+                    priority: (_b = input.priority) !== null && _b !== void 0 ? _b : 100,
+                    clientId: null,
+                    clientSecret: null,
+                    authorizationUrl: (_c = input.authorizationUrl) !== null && _c !== void 0 ? _c : null,
+                    tokenUrl: (_d = input.tokenUrl) !== null && _d !== void 0 ? _d : null,
+                    userInfoUrl: (_e = input.userInfoUrl) !== null && _e !== void 0 ? _e : null,
+                    scopes: (_f = input.scopes) !== null && _f !== void 0 ? _f : 'openid email profile',
+                    issuerUrl: (_g = input.issuerUrl) !== null && _g !== void 0 ? _g : null,
+                    directoryUrl: null,
+                    directoryBaseDn: null,
+                    directoryUserDnTemplate: null,
+                    directoryUserSearchFilter: null,
+                    directoryUseTls: null,
+                    directoryTlsRejectUnauthorized: null,
+                });
+                this.logger.log(`Ensured IdentityProvider stub key=${input.key}`);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                if ((0, abstract_1.isCliSeedProcess)() && /schema is not registered/i.test(message)) {
+                    return;
+                }
+                this.logger.warn(`ensureStub(${input.key}) failed: ${message}`);
+            }
+        });
+    }
+    findByKey(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield this.storage.query(identity_provider_constants_1.IDENTITY_PROVIDER_ENTITY, {
+                skip: 0,
+                take: 1,
+                filter: {
+                    logic: 'and',
+                    filters: [{ field: 'key', operator: { type: 'equal' }, value: key }],
+                },
+            });
+            const row = ((_a = result.items) !== null && _a !== void 0 ? _a : [])[0];
+            return row !== null && row !== void 0 ? row : null;
+        });
+    }
+    toPublicDto(row) {
+        var _a;
+        return {
+            id: row.key,
+            title: row.title,
+            icon: (_a = row.icon) !== null && _a !== void 0 ? _a : undefined,
+            priority: typeof row.priority === 'number' ? row.priority : 100,
+        };
+    }
+    /** Prefer `isDisabled` (disable plugin); fall back to legacy `enabled` seed rows. */
+    isActiveForLogin(row) {
+        if (typeof row.isDisabled === 'boolean') {
+            return row.isDisabled !== true;
+        }
+        if (typeof row.enabled === 'boolean') {
+            return row.enabled === true;
+        }
+        return false;
+    }
+    /** Directory (LDAP/AD) rows use a separate login path — not OAuth ListProviders. */
+    isOidcProtocol(row) {
+        var _a;
+        const protocol = (_a = row.protocol) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase();
+        return !protocol || protocol === module_security_management_contracts_1.AXM_IDENTITY_PROVIDER_PROTOCOL.Oidc;
+    }
+};
+exports.IdentityProviderCatalogService = IdentityProviderCatalogService;
+exports.IdentityProviderCatalogService = IdentityProviderCatalogService = IdentityProviderCatalogService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], IdentityProviderCatalogService);
+function provideAuthIdentityProviderCatalog() {
+    return {
+        provide: security_1.AUTH_IDENTITY_PROVIDER_CATALOG,
+        useExisting: IdentityProviderCatalogService,
+    };
+}
+//#endregion
+//# sourceMappingURL=identity-provider-catalog.service.js.map

package/server/src/lib/identity-provider/identity-provider-catalog.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-catalog.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider-catalog.service.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAsK3B,gFAQC;;AA5KD,iEAAwF;AACxF,yEAMoD;AACpD,gHAG+D;AAC/D,2CAAoD;AACpD,6EAAkF;AAElF,+EAAyE;AACzE,uFAAsF;AAEtF,YAAY;AAEZ,mCAAmC;AAG5B,IAAM,8BAA8B,sCAApC,MAAM,8BAA8B;IAGzC,YAA6B,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;QAFnD,WAAM,GAAG,IAAI,eAAM,CAAC,gCAA8B,CAAC,IAAI,CAAC,CAAC;IAEH,CAAC;IAElE,mBAAmB;;;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sDAAwB,EAAE;oBAChE,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,GAAG;oBACT,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;iBAC1E,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAG,CAAC,MAAA,MAAM,CAAC,KAAK,mCAAI,EAAE,CAAqC,CAAC;gBACvE,OAAO,KAAK;qBACT,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;qBACvE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kEACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;KAAA;IAEK,eAAe,CAAC,GAAW;;;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrE,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,EAAE,CAAC;gBACtC,MAAM,YAAY,GAAG,MAAA,GAAG,CAAC,YAAY,0CAAE,IAAI,EAAE,CAAC;gBAC9C,MAAM,gBAAgB,GAAG,MAAA,GAAG,CAAC,gBAAgB,0CAAE,IAAI,EAAE,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,EAAE,CAAC;gBACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACjE,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO;oBACL,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ;oBACR,YAAY;oBACZ,OAAO,EAAE,IAAI;oBACb,gBAAgB;oBAChB,QAAQ;oBACR,WAAW,EAAE,CAAA,MAAA,GAAG,CAAC,WAAW,0CAAE,IAAI,EAAE,KAAI,SAAS;oBACjD,SAAS,EAAE,CAAA,MAAA,GAAG,CAAC,SAAS,0CAAE,IAAI,EAAE,KAAI,SAAS;oBAC7C,MAAM,EAAE,CAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,IAAI,EAAE,KAAI,sBAAsB;iBACrD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mBAAmB,GAAG,aAAa,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAEK,UAAU,CAAC,KAA0C;;;YACzD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,sDAAwB,EAAE;oBACrD,EAAE,EAAE,mEAAiC,CAAC,KAAK,CAAC,GAAG,CAAC;oBAChD,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,MAAA,KAAK,CAAC,IAAI,mCAAI,IAAI;oBACxB,QAAQ,EAAE,qEAA8B,CAAC,IAAI;oBAC7C,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,MAAA,KAAK,CAAC,QAAQ,mCAAI,GAAG;oBAC/B,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,MAAA,KAAK,CAAC,gBAAgB,mCAAI,IAAI;oBAChD,QAAQ,EAAE,MAAA,KAAK,CAAC,QAAQ,mCAAI,IAAI;oBAChC,WAAW,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI;oBACtC,MAAM,EAAE,MAAA,KAAK,CAAC,MAAM,mCAAI,sBAAsB;oBAC9C,SAAS,EAAE,MAAA,KAAK,CAAC,SAAS,mCAAI,IAAI;oBAClC,YAAY,EAAE,IAAI;oBAClB,eAAe,EAAE,IAAI;oBACrB,uBAAuB,EAAE,IAAI;oBAC7B,yBAAyB,EAAE,IAAI;oBAC/B,eAAe,EAAE,IAAI;oBACrB,8BAA8B,EAAE,IAAI;iBACa,CAAC,CAAC;gBAErD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,IAAA,2BAAgB,GAAE,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,GAAG,aAAa,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KAAA;IAEa,SAAS,CAAC,GAAW;;;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sDAAwB,EAAE;gBAChE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;iBACrE;aACF,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAA,MAAM,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC,CAA+C,CAAC;YAClF,OAAO,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,IAAI,CAAC;QACrB,CAAC;KAAA;IAEO,WAAW,CAAC,GAAmC;;QACrD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,GAAG;YACX,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,MAAA,GAAG,CAAC,IAAI,mCAAI,SAAS;YAC3B,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG;SAChE,CAAC;IACJ,CAAC;IAED,qFAAqF;IAC7E,gBAAgB,CAAC,GAA2D;QAClF,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oFAAoF;IAC5E,cAAc,CAAC,GAAmC;;QACxD,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK,qEAA8B,CAAC,IAAI,CAAC;IACvE,CAAC;CACF,CAAA;AA3IY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;6CAI2B,qCAA8B;GAHzD,8BAA8B,CA2I1C;AAED,SAAgB,kCAAkC;IAIhD,OAAO;QACL,OAAO,EAAE,yCAA8B;QACvC,WAAW,EAAE,8BAA8B;KAC5C,CAAC;AACJ,CAAC;AAED,YAAY"}

package/server/src/lib/identity-provider/identity-provider-ids.constants.d.ts

@@ -0,0 +1,8 @@
+export declare const MOCK_IDENTITY_PROVIDER_IDS: {
+    readonly google: "f0000010-0000-4000-a000-000000000001";
+    readonly microsoft: "f0000010-0000-4000-a000-000000000002";
+    readonly oktaHr: "f0000010-0000-4000-a000-000000000003";
+    readonly azureAdCorp: "f0000010-0000-4000-a000-000000000004";
+};
+/** Stable ids used by ensureStub so seed + bootstrap do not create duplicate keys. */
+export declare const IDENTITY_PROVIDER_STUB_IDS_BY_KEY: Record<string, string>;

package/server/src/lib/identity-provider/identity-provider-ids.constants.js

@@ -0,0 +1,19 @@
+"use strict";
+//#region ---- Stable IdentityProvider IDs ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_PROVIDER_STUB_IDS_BY_KEY = exports.MOCK_IDENTITY_PROVIDER_IDS = void 0;
+exports.MOCK_IDENTITY_PROVIDER_IDS = {
+    google: 'f0000010-0000-4000-a000-000000000001',
+    microsoft: 'f0000010-0000-4000-a000-000000000002',
+    oktaHr: 'f0000010-0000-4000-a000-000000000003',
+    azureAdCorp: 'f0000010-0000-4000-a000-000000000004',
+};
+/** Stable ids used by ensureStub so seed + bootstrap do not create duplicate keys. */
+exports.IDENTITY_PROVIDER_STUB_IDS_BY_KEY = {
+    google: exports.MOCK_IDENTITY_PROVIDER_IDS.google,
+    microsoft: exports.MOCK_IDENTITY_PROVIDER_IDS.microsoft,
+    'okta-hr': exports.MOCK_IDENTITY_PROVIDER_IDS.oktaHr,
+    'azure-ad-corp': exports.MOCK_IDENTITY_PROVIDER_IDS.azureAdCorp,
+};
+//#endregion
+//# sourceMappingURL=identity-provider-ids.constants.js.map

package/server/src/lib/identity-provider/identity-provider-ids.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-ids.constants.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider-ids.constants.ts"],"names":[],"mappings":";AAAA,+CAA+C;;;AAElC,QAAA,0BAA0B,GAAG;IACxC,MAAM,EAAE,sCAAsC;IAC9C,SAAS,EAAE,sCAAsC;IACjD,MAAM,EAAE,sCAAsC;IAC9C,WAAW,EAAE,sCAAsC;CAC3C,CAAC;AAEX,sFAAsF;AACzE,QAAA,iCAAiC,GAA2B;IACvE,MAAM,EAAE,kCAA0B,CAAC,MAAM;IACzC,SAAS,EAAE,kCAA0B,CAAC,SAAS;IAC/C,SAAS,EAAE,kCAA0B,CAAC,MAAM;IAC5C,eAAe,EAAE,kCAA0B,CAAC,WAAW;CACxD,CAAC;AAEF,YAAY"}

package/server/src/lib/identity-provider/identity-provider-stub.bootstrap.d.ts

@@ -0,0 +1,12 @@
+import { type AuthIdentityProviderCatalog } from '@acorex-platform/framework-server/security';
+import { type OnApplicationBootstrap } from '@nestjs/common';
+/**
+ * Ensures the Microsoft platform IdP stub. Google/SSO extensions ensure their own rows.
+ * Microsoft has client-only package today — keep this until a microsoft-server module exists.
+ */
+export declare class IdentityProviderStubBootstrap implements OnApplicationBootstrap {
+    private readonly catalog;
+    private readonly logger;
+    constructor(catalog: AuthIdentityProviderCatalog);
+    onApplicationBootstrap(): Promise<void>;
+}

package/server/src/lib/identity-provider/identity-provider-stub.bootstrap.js

@@ -0,0 +1,48 @@
+"use strict";
+//#region ---- Imports ----
+var IdentityProviderStubBootstrap_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityProviderStubBootstrap = void 0;
+const tslib_1 = require("tslib");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+//#endregion
+//#region ---- Platform IdP stubs (no dedicated extension server) ----
+/**
+ * Ensures the Microsoft platform IdP stub. Google/SSO extensions ensure their own rows.
+ * Microsoft has client-only package today — keep this until a microsoft-server module exists.
+ */
+let IdentityProviderStubBootstrap = IdentityProviderStubBootstrap_1 = class IdentityProviderStubBootstrap {
+    constructor(catalog) {
+        this.catalog = catalog;
+        this.logger = new common_1.Logger(IdentityProviderStubBootstrap_1.name);
+    }
+    onApplicationBootstrap() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.catalog.ensureStub({
+                    key: 'microsoft',
+                    title: 'Microsoft',
+                    icon: 'fa-brands fa-microsoft',
+                    priority: 20,
+                    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+                    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+                    userInfoUrl: 'https://graph.microsoft.com/oidc/userinfo',
+                    scopes: 'openid email profile',
+                    issuerUrl: 'https://login.microsoftonline.com/common/v2.0',
+                });
+            }
+            catch (error) {
+                this.logger.warn(`Microsoft IdP stub ensure failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        });
+    }
+};
+exports.IdentityProviderStubBootstrap = IdentityProviderStubBootstrap;
+exports.IdentityProviderStubBootstrap = IdentityProviderStubBootstrap = IdentityProviderStubBootstrap_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, common_1.Inject)(security_1.AUTH_IDENTITY_PROVIDER_CATALOG)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], IdentityProviderStubBootstrap);
+//#endregion
+//# sourceMappingURL=identity-provider-stub.bootstrap.js.map

package/server/src/lib/identity-provider/identity-provider-stub.bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-stub.bootstrap.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider-stub.bootstrap.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;;AAE3B,yEAGoD;AACpD,2CAAyF;AAEzF,YAAY;AAEZ,sEAAsE;AAEtE;;;GAGG;AAEI,IAAM,6BAA6B,qCAAnC,MAAM,6BAA6B;IAGxC,YAEE,OAAqD;QAApC,YAAO,GAAP,OAAO,CAA6B;QAJtC,WAAM,GAAG,IAAI,eAAM,CAAC,+BAA6B,CAAC,IAAI,CAAC,CAAC;IAKtE,CAAC;IAEE,sBAAsB;;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;oBAC5B,GAAG,EAAE,WAAW;oBAChB,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,wBAAwB;oBAC9B,QAAQ,EAAE,EAAE;oBACZ,gBAAgB,EAAE,gEAAgE;oBAClF,QAAQ,EAAE,4DAA4D;oBACtE,WAAW,EAAE,2CAA2C;oBACxD,MAAM,EAAE,sBAAsB;oBAC9B,SAAS,EAAE,+CAA+C;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA3BY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAKR,mBAAA,IAAA,eAAM,EAAC,yCAA8B,CAAC,CAAA;;GAJ9B,6BAA6B,CA2BzC;AAED,YAAY"}

package/server/src/lib/identity-provider/identity-provider.constants.d.ts

@@ -0,0 +1 @@
+export declare const IDENTITY_PROVIDER_ENTITY = "SecurityManagement.IdentityProvider";

package/server/src/lib/identity-provider/identity-provider.constants.js

@@ -0,0 +1,7 @@
+"use strict";
+//#region ---- Identity provider storage constants ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_PROVIDER_ENTITY = void 0;
+exports.IDENTITY_PROVIDER_ENTITY = 'SecurityManagement.IdentityProvider';
+//#endregion
+//# sourceMappingURL=identity-provider.constants.js.map

package/server/src/lib/identity-provider/identity-provider.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider.constants.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider.constants.ts"],"names":[],"mappings":";AAAA,uDAAuD;;;AAE1C,QAAA,wBAAwB,GAAG,qCAAqC,CAAC;AAE9E,YAAY"}

package/server/src/lib/middlewares/device-sessions-active.middleware.d.ts

@@ -0,0 +1,15 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+/**
+ * Marks `isActiveSession` relative to the caller's JWT `sid`.
+ * Persisted values are ignored on read — every login used to stamp true,
+ * which hid other devices from Active Sessions.
+ */
+export declare class DeviceSessionsActiveMiddleware implements EntityStorageMiddleware {
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private readSession;
+}

package/server/src/lib/middlewares/device-sessions-active.middleware.js

@@ -0,0 +1,76 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceSessionsActiveMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+//#endregion
+//#region ----- Constants -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+//#endregion
+//#region ----- Helpers -----
+function rowSessionId(row) {
+    var _a;
+    if (typeof row.sessionId === 'string' && row.sessionId.trim()) {
+        return row.sessionId.trim();
+    }
+    const configSid = (_a = row.config) === null || _a === void 0 ? void 0 : _a.sessionId;
+    return typeof configSid === 'string' ? configSid.trim() : '';
+}
+function collectRows(ctx) {
+    const result = ctx.result;
+    if (!result) {
+        return [];
+    }
+    if (Array.isArray(result.items)) {
+        return result.items;
+    }
+    if (typeof result === 'object') {
+        return [result];
+    }
+    return [];
+}
+//#endregion
+//#region ----- Device sessions active-flag middleware -----
+/**
+ * Marks `isActiveSession` relative to the caller's JWT `sid`.
+ * Persisted values are ignored on read — every login used to stamp true,
+ * which hid other devices from Active Sessions.
+ */
+let DeviceSessionsActiveMiddleware = class DeviceSessionsActiveMiddleware {
+    constructor() {
+        this.target = {
+            entity: DEVICE_SESSION_ENTITY,
+            ops: ['query', 'getOne'],
+            order: 20,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            yield next();
+            if (!ctx.result) {
+                return;
+            }
+            const sid = (_c = (_b = (_a = this.readSession()) === null || _a === void 0 ? void 0 : _a.sid) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : '';
+            for (const row of collectRows(ctx)) {
+                // Always recompute. Persisted `isActiveSession: true` on every login hid other devices.
+                // Without JWT sid we cannot mark "this device" — clear flags so clients fall back to latest.
+                row.isActiveSession = Boolean(sid) && rowSessionId(row) === sid;
+            }
+        });
+    }
+    readSession() {
+        var _a;
+        const req = (0, core_1.getEntityStorageRequest)();
+        return (_a = req === null || req === void 0 ? void 0 : req[security_1.CURRENT_SESSION_KEY]) !== null && _a !== void 0 ? _a : null;
+    }
+};
+exports.DeviceSessionsActiveMiddleware = DeviceSessionsActiveMiddleware;
+exports.DeviceSessionsActiveMiddleware = DeviceSessionsActiveMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], DeviceSessionsActiveMiddleware);
+//#endregion
+//# sourceMappingURL=device-sessions-active.middleware.js.map

package/server/src/lib/middlewares/device-sessions-active.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-active.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-active.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAE7B,iEAKgD;AAChD,yEAGoD;AACpD,2CAA4C;AAiB5C,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAElE,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,YAAY,CAAC,GAAqB;;IACzC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,SAAS,GAAG,MAAA,GAAG,CAAC,MAAM,0CAAE,SAAS,CAAC;IACxC,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,GAAyB;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAE,MAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAQ,MAAwC,CAAC,KAAK,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,MAA0B,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,YAAY;AAEZ,4DAA4D;AAE5D;;;;GAIG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAApC;QACI,WAAM,GAAG;YAChB,MAAM,EAAE,qBAAqB;YAC7B,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAkB;YACzC,KAAK,EAAE,EAAE;SACV,CAAC;IAqBJ,CAAC;IAnBO,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAChE,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,MAAA,MAAA,MAAA,IAAI,CAAC,WAAW,EAAE,0CAAE,GAAG,0CAAE,IAAI,EAAE,mCAAI,EAAE,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,wFAAwF;gBACxF,6FAA6F;gBAC7F,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;YAClE,CAAC;QACH,CAAC;KAAA;IAEO,WAAW;;QACjB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,OAAO,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,8BAAmB,CAAC,mCAAI,IAAI,CAAC;IAC5C,CAAC;CACF,CAAA;AA1BY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;GACA,8BAA8B,CA0B1C;AAED,YAAY"}

package/server/src/lib/middlewares/device-sessions-app-scope.middleware.d.ts

@@ -0,0 +1,29 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+/**
+
+ * ADR-TEN-001 D-07: operation-owned DeviceSessions admin scope.
+
+ *
+
+ * - Application Sessions → tenant-owner + current `applicationId`
+
+ * - Tenant Sessions → tenant-owner only (explicit `deviceSessionAdminScope=tenant`)
+
+ *
+
+ * Scope is selected by the operation signal (param/header), not Application.code / TM ids.
+
+ * Does not invent Feature/Permission gates in this phase.
+
+ */
+export declare class DeviceSessionsAppScopeMiddleware implements EntityStorageMiddleware {
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private failClosedMissingApplicationId;
+    private readRequest;
+    private readSessionApplicationId;
+}

package/server/src/lib/middlewares/device-sessions-app-scope.middleware.js

@@ -0,0 +1,137 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceSessionsAppScopeMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+const device_sessions_app_scope_util_1 = require("./device-sessions-app-scope.util");
+//#endregion
+//#region ----- Constants -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+/** Fail-closed sentinel when application scope lacks session.applicationId. */
+const NO_APPLICATION_SCOPE_ID = '__no-application__';
+//#endregion
+//#region ----- Device sessions application-scope middleware -----
+/**
+
+ * ADR-TEN-001 D-07: operation-owned DeviceSessions admin scope.
+
+ *
+
+ * - Application Sessions → tenant-owner + current `applicationId`
+
+ * - Tenant Sessions → tenant-owner only (explicit `deviceSessionAdminScope=tenant`)
+
+ *
+
+ * Scope is selected by the operation signal (param/header), not Application.code / TM ids.
+
+ * Does not invent Feature/Permission gates in this phase.
+
+ */
+let DeviceSessionsAppScopeMiddleware = class DeviceSessionsAppScopeMiddleware {
+    constructor() {
+        this.target = {
+            entity: DEVICE_SESSION_ENTITY,
+            ops: ['query', 'getOne', 'update', 'delete'],
+            order: 9,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            if ((0, abstract_1.isEngineStorageBypass)(ctx.locals) || (0, abstract_1.isSystemCommandBypass)(ctx.locals)) {
+                yield next();
+                return;
+            }
+            const applicationId = this.readSessionApplicationId();
+            const adminScope = (0, device_sessions_app_scope_util_1.resolveDeviceSessionAdminScope)({
+                queryParams: (_a = ctx.request) === null || _a === void 0 ? void 0 : _a.params,
+                headerValue: (0, device_sessions_app_scope_util_1.readDeviceSessionAdminScopeHeader)((_b = this.readRequest()) === null || _b === void 0 ? void 0 : _b.headers),
+            });
+            if (!(0, device_sessions_app_scope_util_1.shouldApplyDeviceSessionApplicationFilter)(adminScope)) {
+                yield next();
+                return;
+            }
+            if ((0, device_sessions_app_scope_util_1.isDeviceSessionApplicationScopeMissingApplicationId)(adminScope, applicationId)) {
+                yield this.failClosedMissingApplicationId(ctx, next);
+                return;
+            }
+            if (ctx.op === 'query' && ctx.request) {
+                ctx.request = Object.assign(Object.assign({}, ctx.request), { filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, {
+                        logic: 'and',
+                        filters: [
+                            {
+                                field: 'applicationId',
+                                operator: { type: 'equal' },
+                                value: applicationId,
+                            },
+                        ],
+                    }) });
+                yield next();
+                return;
+            }
+            if ((ctx.op === 'update' || ctx.op === 'delete') && ctx.id) {
+                const existing = (yield ctx.backend.getOne(ctx.entityName, ctx.id));
+                if (existing && String((_c = existing['applicationId']) !== null && _c !== void 0 ? _c : '') !== applicationId) {
+                    throw new core_1.MiddlewareAbortError('Device session is outside the current application scope.', {
+                        code: 'SCOPE_READONLY',
+                        status: 403,
+                    });
+                }
+            }
+            yield next();
+            if (ctx.op === 'getOne') {
+                const row = ctx.result;
+                if (row && String((_d = row['applicationId']) !== null && _d !== void 0 ? _d : '') !== applicationId) {
+                    ctx.result = null;
+                }
+            }
+        });
+    }
+    failClosedMissingApplicationId(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (ctx.op === 'query' && ctx.request) {
+                ctx.request = Object.assign(Object.assign({}, ctx.request), { filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, {
+                        logic: 'and',
+                        filters: [
+                            {
+                                field: 'id',
+                                operator: { type: 'equal' },
+                                value: NO_APPLICATION_SCOPE_ID,
+                            },
+                        ],
+                    }) });
+                yield next();
+                return;
+            }
+            if (ctx.op === 'update' || ctx.op === 'delete') {
+                throw new core_1.MiddlewareAbortError('Device session application scope requires a current application.', {
+                    code: 'SCOPE_READONLY',
+                    status: 403,
+                });
+            }
+            yield next();
+            if (ctx.op === 'getOne') {
+                ctx.result = null;
+            }
+        });
+    }
+    readRequest() {
+        return (0, core_1.getEntityStorageRequest)();
+    }
+    readSessionApplicationId() {
+        var _a, _b, _c;
+        const applicationId = (_c = (_b = (_a = this.readRequest()) === null || _a === void 0 ? void 0 : _a[security_1.CURRENT_SESSION_KEY]) === null || _b === void 0 ? void 0 : _b.applicationId) === null || _c === void 0 ? void 0 : _c.trim();
+        return applicationId || undefined;
+    }
+};
+exports.DeviceSessionsAppScopeMiddleware = DeviceSessionsAppScopeMiddleware;
+exports.DeviceSessionsAppScopeMiddleware = DeviceSessionsAppScopeMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], DeviceSessionsAppScopeMiddleware);
+//#endregion
+//# sourceMappingURL=device-sessions-app-scope.middleware.js.map

package/server/src/lib/middlewares/device-sessions-app-scope.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-app-scope.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-app-scope.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAI7B,iEAYgD;AAEhD,6EAQwD;AAExD,yEAMoD;AAEpD,2CAA4C;AAI5C,qFAU0C;AAoB1C,YAAY;AAIZ,+BAA+B;AAI/B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAIlE,+EAA+E;AAE/E,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAIrD,YAAY;AAIZ,kEAAkE;AAIlE;;;;;;;;;;;;;;;;GAgBG;AAII,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAAtC;QAEI,WAAM,GAAG;YAEhB,MAAM,EAAE,qBAAqB;YAE7B,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAkB;YAE7D,KAAK,EAAE,CAAC;SAET,CAAC;IAsOJ,CAAC;IAlOO,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAEhE,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAE3E,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAEtD,MAAM,UAAU,GAAG,IAAA,+DAA8B,EAAC;gBAEhD,WAAW,EAAE,MAAA,GAAG,CAAC,OAAO,0CAAE,MAA6C;gBAEvE,WAAW,EAAE,IAAA,kEAAiC,EAE5C,MAAA,IAAI,CAAC,WAAW,EAAE,0CAAE,OAIP,CAEd;aAEF,CAAC,CAAC;YAIH,IAAI,CAAC,IAAA,0EAAyC,EAAC,UAAU,CAAC,EAAE,CAAC;gBAE3D,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,IAAI,IAAA,oFAAmD,EAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;gBAEnF,MAAM,IAAI,CAAC,8BAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAErD,OAAO;YAET,CAAC;YAID,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAEtC,GAAG,CAAC,OAAO,mCAEN,GAAG,CAAC,OAAO,KAEd,MAAM,EAAE,IAAA,+BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;wBAE/C,KAAK,EAAE,KAAK;wBAEZ,OAAO,EAAE;4BAEP;gCAEE,KAAK,EAAE,eAAe;gCAEtB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gCAE3B,KAAK,EAAE,aAAa;6BAErB;yBAEF;qBAEF,CAAC,GAEH,CAAC;gBAEF,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAE3D,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAMrD,CAAC;gBAEd,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAA,QAAQ,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC;oBAE1E,MAAM,IAAI,2BAAoB,CAAC,0DAA0D,EAAE;wBAEzF,IAAI,EAAE,gBAAgB;wBAEtB,MAAM,EAAE,GAAG;qBAEZ,CAAC,CAAC;gBAEL,CAAC;YAEH,CAAC;YAID,MAAM,IAAI,EAAE,CAAC;YAIb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAExB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAoD,CAAC;gBAErE,IAAI,GAAG,IAAI,MAAM,CAAC,MAAA,GAAG,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC;oBAEhE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAEpB,CAAC;YAEH,CAAC;QAEH,CAAC;KAAA;IAIa,8BAA8B,CAE1C,GAAyB,EAEzB,IAAyB;;YAIzB,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAEtC,GAAG,CAAC,OAAO,mCAEN,GAAG,CAAC,OAAO,KAEd,MAAM,EAAE,IAAA,+BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;wBAE/C,KAAK,EAAE,KAAK;wBAEZ,OAAO,EAAE;4BAEP;gCAEE,KAAK,EAAE,IAAI;gCAEX,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gCAE3B,KAAK,EAAE,uBAAuB;6BAE/B;yBAEF;qBAEF,CAAC,GAEH,CAAC;gBAEF,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAE/C,MAAM,IAAI,2BAAoB,CAE5B,kEAAkE,EAElE;oBAEE,IAAI,EAAE,gBAAgB;oBAEtB,MAAM,EAAE,GAAG;iBAEZ,CAEF,CAAC;YAEJ,CAAC;YAID,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAExB,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;YAEpB,CAAC;QAEH,CAAC;KAAA;IAIO,WAAW;QAEjB,OAAO,IAAA,8BAAuB,GAAoC,CAAC;IAErE,CAAC;IAIO,wBAAwB;;QAE9B,MAAM,aAAa,GAAG,MAAA,MAAA,MAAA,IAAI,CAAC,WAAW,EAAE,0CAAG,8BAAmB,CAAC,0CAAE,aAAa,0CAAE,IAAI,EAAE,CAAC;QAEvF,OAAO,aAAa,IAAI,SAAS,CAAC;IAEpC,CAAC;CAEF,CAAA;AAhPY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,mBAAU,GAAE;GAEA,gCAAgC,CAgP5C;AAID,YAAY"}

package/server/src/lib/middlewares/device-sessions-app-scope.util.d.ts

@@ -0,0 +1,41 @@
+import { type AXPDeviceSessionAdminScope } from '../../../../contracts/src/device-session-admin-scope';
+/**
+
+ * Whether DeviceSessions should apply an additional `applicationId` filter.
+
+ * Tenant-sessions operation → false; application-sessions → true.
+
+ * Tenant bound remains `tenant-owner` either way.
+
+ */
+export declare function shouldApplyDeviceSessionApplicationFilter(adminScope: AXPDeviceSessionAdminScope): boolean;
+/**
+
+ * Application-scoped Device Sessions must not degrade to tenant-wide when
+
+ * `session.applicationId` is missing.
+
+ */
+export declare function isDeviceSessionApplicationScopeMissingApplicationId(adminScope: AXPDeviceSessionAdminScope, applicationId: string | undefined): boolean;
+/**
+
+ * Resolve explicit admin scope from query params and/or HTTP header.
+
+ * Defaults to application-sessions (narrower scope).
+
+ *
+
+ * Note: this value is an operation signal, not an authorization decision.
+
+ * Tenant-owner isolation still applies; distinguishing who may request
+
+ * tenant-wide admin scope is a separate auth concern (see audit notes).
+
+ */
+export declare function resolveDeviceSessionAdminScope(options: {
+    queryParams?: Record<string, unknown> | null | undefined;
+    headerValue?: string | string[] | null | undefined;
+}): AXPDeviceSessionAdminScope;
+export declare function readDeviceSessionAdminScopeHeader(headers: {
+    [key: string]: string | string[] | undefined;
+} | undefined): string | string[] | undefined;