@acorex-platform/module-security-management-server 0.0.15 → 2.0.0-next.42

package/server/src/lib/middlewares/device-sessions-app-scope.util.js

@@ -0,0 +1,69 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldApplyDeviceSessionApplicationFilter = shouldApplyDeviceSessionApplicationFilter;
+exports.isDeviceSessionApplicationScopeMissingApplicationId = isDeviceSessionApplicationScopeMissingApplicationId;
+exports.resolveDeviceSessionAdminScope = resolveDeviceSessionAdminScope;
+exports.readDeviceSessionAdminScopeHeader = readDeviceSessionAdminScopeHeader;
+const device_session_admin_scope_1 = require("../../../../contracts/src/device-session-admin-scope");
+//#endregion
+//#region ----- Device Sessions admin scope resolution -----
+/**
+
+ * Whether DeviceSessions should apply an additional `applicationId` filter.
+
+ * Tenant-sessions operation → false; application-sessions → true.
+
+ * Tenant bound remains `tenant-owner` either way.
+
+ */
+function shouldApplyDeviceSessionApplicationFilter(adminScope) {
+    return adminScope === 'application';
+}
+/**
+
+ * Application-scoped Device Sessions must not degrade to tenant-wide when
+
+ * `session.applicationId` is missing.
+
+ */
+function isDeviceSessionApplicationScopeMissingApplicationId(adminScope, applicationId) {
+    return shouldApplyDeviceSessionApplicationFilter(adminScope) && !applicationId;
+}
+/**
+
+ * Resolve explicit admin scope from query params and/or HTTP header.
+
+ * Defaults to application-sessions (narrower scope).
+
+ *
+
+ * Note: this value is an operation signal, not an authorization decision.
+
+ * Tenant-owner isolation still applies; distinguishing who may request
+
+ * tenant-wide admin scope is a separate auth concern (see audit notes).
+
+ */
+function resolveDeviceSessionAdminScope(options) {
+    var _a;
+    const fromParams = (_a = options.queryParams) === null || _a === void 0 ? void 0 : _a[device_session_admin_scope_1.AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM];
+    if (fromParams === 'tenant' || fromParams === 'application') {
+        return fromParams;
+    }
+    const header = options.headerValue;
+    const headerRaw = Array.isArray(header) ? header[0] : header;
+    if (typeof headerRaw === 'string' && headerRaw.trim()) {
+        return (0, device_session_admin_scope_1.normalizeDeviceSessionAdminScope)(headerRaw.trim().toLowerCase());
+    }
+    return 'application';
+}
+function readDeviceSessionAdminScopeHeader(headers) {
+    var _a;
+    if (!headers) {
+        return undefined;
+    }
+    return ((_a = headers[device_session_admin_scope_1.AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER]) !== null && _a !== void 0 ? _a : headers[device_session_admin_scope_1.AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER.toUpperCase()]);
+}
+//#endregion
+//# sourceMappingURL=device-sessions-app-scope.util.js.map

package/server/src/lib/middlewares/device-sessions-app-scope.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-app-scope.util.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-app-scope.util.ts"],"names":[],"mappings":";AAAA,6BAA6B;;AAoC7B,8FAQC;AAYD,kHAUC;AAoBD,wEAgCC;AAID,8EAoBC;AA1ID,qGAU8D;AAI9D,YAAY;AAIZ,4DAA4D;AAI5D;;;;;;;;GAQG;AAEH,SAAgB,yCAAyC,CAEvD,UAAsC;IAItC,OAAO,UAAU,KAAK,aAAa,CAAC;AAEtC,CAAC;AAID;;;;;;GAMG;AAEH,SAAgB,mDAAmD,CAEjE,UAAsC,EAEtC,aAAiC;IAIjC,OAAO,yCAAyC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;AAEjF,CAAC;AAID;;;;;;;;;;;;;;GAcG;AAEH,SAAgB,8BAA8B,CAAC,OAM9C;;IAEC,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,WAAW,0CAAG,iEAAoC,CAAC,CAAC;IAE/E,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QAE5D,OAAO,UAAU,CAAC;IAEpB,CAAC;IAID,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAEnC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAE7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAEtD,OAAO,IAAA,6DAAgC,EAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1E,CAAC;IAID,OAAO,aAAa,CAAC;AAEvB,CAAC;AAID,SAAgB,iCAAiC,CAE/C,OAAqE;;IAIrE,IAAI,CAAC,OAAO,EAAE,CAAC;QAEb,OAAO,SAAS,CAAC;IAEnB,CAAC;IAED,OAAO,CAEL,MAAA,OAAO,CAAC,kEAAqC,CAAC,mCAE9C,OAAO,CAAC,kEAAqC,CAAC,WAAW,EAAE,CAAC,CAE7D,CAAC;AAEJ,CAAC;AAID,YAAY"}

package/server/src/lib/middlewares/device-sessions-token-revoke.middleware.d.ts

@@ -0,0 +1,18 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware, EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { AuthService } from '@acorex-platform/framework-server/security';
+/**
+ * Projects DeviceSessions revoke (DB SoT) onto Redis (`sid`).
+ * Request validation must check Redis only — see device-session-revocation.mdc.
+ */
+export declare class DeviceSessionsTokenRevokeMiddleware implements EntityStorageMiddleware {
+    private readonly auth;
+    private readonly storage;
+    private readonly logger;
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    constructor(auth: AuthService, storage: EntityStorageMiddlewareService);
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+}

package/server/src/lib/middlewares/device-sessions-token-revoke.middleware.js

@@ -0,0 +1,90 @@
+"use strict";
+//#region ----- Imports -----
+var DeviceSessionsTokenRevokeMiddleware_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceSessionsTokenRevokeMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+//#endregion
+//#region ----- Constants -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+const REVOKED = 'revoked';
+//#endregion
+//#region ----- Helpers -----
+function rowSessionId(row) {
+    var _a;
+    if (typeof row.sessionId === 'string' && row.sessionId.trim()) {
+        return row.sessionId.trim();
+    }
+    const configSid = (_a = row.config) === null || _a === void 0 ? void 0 : _a.sessionId;
+    return typeof configSid === 'string' ? configSid.trim() : '';
+}
+function isRevokedStatus(value) {
+    return String(value !== null && value !== void 0 ? value : '')
+        .trim()
+        .toLowerCase() === REVOKED;
+}
+//#endregion
+//#region ----- Device sessions JWT revoke middleware -----
+/**
+ * Projects DeviceSessions revoke (DB SoT) onto Redis (`sid`).
+ * Request validation must check Redis only — see device-session-revocation.mdc.
+ */
+let DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware_1 = class DeviceSessionsTokenRevokeMiddleware {
+    constructor(auth, storage) {
+        this.auth = auth;
+        this.storage = storage;
+        this.logger = new common_1.Logger(DeviceSessionsTokenRevokeMiddleware_1.name);
+        this.target = {
+            entity: DEVICE_SESSION_ENTITY,
+            ops: ['update'],
+            order: 30,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const patchStatus = (_a = ctx.data) === null || _a === void 0 ? void 0 : _a['status'];
+            const patchRequestsRevoke = isRevokedStatus(patchStatus);
+            yield next();
+            if (!patchRequestsRevoke || !ctx.result || typeof ctx.result !== 'object') {
+                return;
+            }
+            let row = ctx.result;
+            if (!isRevokedStatus(row.status)) {
+                return;
+            }
+            let sid = rowSessionId(row);
+            const entityId = typeof row.id === 'string' ? row.id : typeof ctx.id === 'string' ? ctx.id : '';
+            let userId = typeof row.userId === 'string' ? row.userId.trim() : '';
+            if ((!sid || !userId) && entityId) {
+                // Update responses can omit nested/legacy fields — reload for sessionId / userId.
+                const full = (yield this.storage.getOneAsEngine(DEVICE_SESSION_ENTITY, entityId));
+                if (full) {
+                    row = full;
+                    sid = rowSessionId(row);
+                    userId = typeof row.userId === 'string' ? row.userId.trim() : userId;
+                }
+            }
+            if (!sid) {
+                this.logger.warn(`Device session ${entityId || '(unknown)'} revoked without sessionId; JWT family not invalidated`);
+                return;
+            }
+            yield this.auth.invalidateLoginSession(sid);
+            this.logger.warn(`DeviceSessions revoke projected JWT family invalidate + session_terminated: sid=${sid} userId=${userId || '(unknown)'} entityId=${entityId || '(unknown)'}`);
+            if (userId) {
+                this.auth.notifyRemoteSessionTerminated(userId, sid);
+            }
+        });
+    }
+};
+exports.DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware;
+exports.DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [security_1.AuthService,
+        core_1.EntityStorageMiddlewareService])
+], DeviceSessionsTokenRevokeMiddleware);
+//#endregion
+//# sourceMappingURL=device-sessions-token-revoke.middleware.js.map

package/server/src/lib/middlewares/device-sessions-token-revoke.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-token-revoke.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-token-revoke.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;;AAE7B,iEAKgD;AAChD,yEAAyE;AACzE,2CAAoD;AAcpD,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,YAAY,CAAC,GAAqB;;IACzC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,SAAS,GAAG,MAAA,GAAG,CAAC,MAAM,0CAAE,SAAS,CAAC;IACxC,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,MAAM,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;SACvB,IAAI,EAAE;SACN,WAAW,EAAE,KAAK,OAAO,CAAC;AAC/B,CAAC;AAED,YAAY;AAEZ,2DAA2D;AAE3D;;;GAGG;AAEI,IAAM,mCAAmC,2CAAzC,MAAM,mCAAmC;IAS9C,YACmB,IAAiB,EACjB,OAAuC;QADvC,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAgC;QAVzC,WAAM,GAAG,IAAI,eAAM,CAAC,qCAAmC,CAAC,IAAI,CAAC,CAAC;QAEtE,WAAM,GAAG;YAChB,MAAM,EAAE,qBAAqB;YAC7B,GAAG,EAAE,CAAC,QAAQ,CAAkB;YAChC,KAAK,EAAE,EAAE;SACV,CAAC;IAKC,CAAC;IAEE,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAChE,MAAM,WAAW,GAAG,MAAC,GAAG,CAAC,IAA4C,0CAAG,QAAQ,CAAC,CAAC;YAClF,MAAM,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;YAEzD,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,GAAG,GAAG,GAAG,CAAC,MAA0B,CAAC;YACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,IAAI,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAClC,kFAAkF;gBAClF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAA4B,CAAC;gBAC7G,IAAI,IAAI,EAAE,CAAC;oBACT,GAAG,GAAG,IAAI,CAAC;oBACX,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;oBACxB,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kBAAkB,QAAQ,IAAI,WAAW,wDAAwD,CAClG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mFAAmF,GAAG,WAAW,MAAM,IAAI,WAAW,aAAa,QAAQ,IAAI,WAAW,EAAE,CAC7J,CAAC;YAEF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA3DY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;6CAWc,sBAAW;QACR,qCAA8B;GAX/C,mCAAmC,CA2D/C;AAED,YAAY"}

package/server/src/lib/middlewares/user-assigned-roles.middleware.d.ts

@@ -0,0 +1,36 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+import { ModuleRef } from '@nestjs/core';
+/**
+ * Users stay identity-only for roles. List/card still need `rolesList` the same
+ * way Job Definition uses `jobLevelsList`, so this hydrates scoped UserRole
+ * grants after read (same query path as the Roles page) and strips those keys
+ * on write. Also fills `lastSignInAt` from device-session history when unset.
+ */
+export declare class UserAssignedRolesMiddleware implements EntityStorageMiddleware {
+    private readonly moduleRef;
+    private readonly logger;
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        /** Outermost after-hook so lookup joins cannot replace hydrated display fields. */
+        order: number;
+    };
+    constructor(moduleRef: ModuleRef);
+    private get storage();
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private stripDisplayOnlyRoleFields;
+    private hydrateAssignedRoles;
+    private hydrateLastSignInAt;
+    private collectUserRows;
+    /**
+     * Same grant pick as the User Roles page: prefer the current application,
+     * then a tenant-wide row, then the first grant isolation already returned.
+     */
+    private pickWorkspaceGrant;
+    private loadUserRoleGrants;
+    private loadRoleSnapshots;
+    private loadLatestSessionLogin;
+    private queryItems;
+    private queryItemsAsEngine;
+    private readSession;
+}

package/server/src/lib/middlewares/user-assigned-roles.middleware.js

@@ -0,0 +1,359 @@
+"use strict";
+//#region ----- Imports -----
+var UserAssignedRolesMiddleware_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserAssignedRolesMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+const core_2 = require("@nestjs/core");
+//#endregion
+//#region ----- Constants -----
+const USER_ENTITY = 'SecurityManagement.User';
+const USER_ROLE_ENTITY = 'SecurityManagement.UserRole';
+const ROLE_ENTITY = 'SecurityManagement.Role';
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+const DISPLAY_ONLY_ROLE_KEYS = ['roleIds', 'rolesList'];
+//#endregion
+function asScopeInfo(value) {
+    if (value == null || typeof value !== 'object' || Array.isArray(value)) {
+        return undefined;
+    }
+    const scope = value;
+    return {
+        tenantId: typeof scope['tenantId'] === 'string' ? scope['tenantId'] : undefined,
+        applicationId: typeof scope['applicationId'] === 'string' ? scope['applicationId'] : undefined,
+    };
+}
+function rowId(row) {
+    var _a;
+    const id = (_a = row['id']) !== null && _a !== void 0 ? _a : row['_id'];
+    return id != null ? String(id).trim() : '';
+}
+function extractRoleIds(assignment) {
+    const fromHelper = (0, security_1.extractUserRoleIds)(assignment);
+    if (fromHelper.length > 0) {
+        return fromHelper;
+    }
+    const raw = assignment === null || assignment === void 0 ? void 0 : assignment['roleIds'];
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    return raw
+        .map((item) => {
+        if (typeof item === 'string' && item.trim()) {
+            return item.trim();
+        }
+        if (item != null && typeof item === 'object') {
+            const id = item.id;
+            return id != null ? String(id).trim() : '';
+        }
+        return '';
+    })
+        .filter((id) => id.length > 0);
+}
+function snapshotsFromGrant(grant, roleIds) {
+    var _a;
+    const raw = grant === null || grant === void 0 ? void 0 : grant['rolesList'];
+    if (!Array.isArray(raw) || raw.length === 0) {
+        return roleIds.map((id) => ({ id, title: id }));
+    }
+    const byId = new Map();
+    for (const item of raw) {
+        if (item == null || typeof item !== 'object') {
+            continue;
+        }
+        const row = item;
+        const id = typeof row['id'] === 'string' ? row['id'] : '';
+        if (!id) {
+            continue;
+        }
+        byId.set(id, {
+            id,
+            title: row['title'] != null && row['title'] !== '' ? row['title'] : (_a = row['name']) !== null && _a !== void 0 ? _a : id,
+        });
+    }
+    return roleIds.map((id) => { var _a; return (_a = byId.get(id)) !== null && _a !== void 0 ? _a : { id, title: id }; });
+}
+function toIsoTimestamp(value) {
+    if (value instanceof Date && !Number.isNaN(value.getTime())) {
+        return value.toISOString();
+    }
+    if (typeof value === 'string' && value.trim()) {
+        const parsed = new Date(value);
+        return Number.isNaN(parsed.getTime()) ? null : parsed.toISOString();
+    }
+    return null;
+}
+function orEqualFilter(field, values) {
+    if (values.length === 1) {
+        return { field, operator: { type: 'equal' }, value: values[0] };
+    }
+    return {
+        logic: 'or',
+        filters: values.map((value) => ({ field, operator: { type: 'equal' }, value })),
+    };
+}
+//#region ----- User assigned roles middleware -----
+/**
+ * Users stay identity-only for roles. List/card still need `rolesList` the same
+ * way Job Definition uses `jobLevelsList`, so this hydrates scoped UserRole
+ * grants after read (same query path as the Roles page) and strips those keys
+ * on write. Also fills `lastSignInAt` from device-session history when unset.
+ */
+let UserAssignedRolesMiddleware = UserAssignedRolesMiddleware_1 = class UserAssignedRolesMiddleware {
+    constructor(moduleRef) {
+        this.moduleRef = moduleRef;
+        this.logger = new common_1.Logger(UserAssignedRolesMiddleware_1.name);
+        this.target = {
+            entity: USER_ENTITY,
+            ops: ['create', 'update', 'query', 'getOne'],
+            /** Outermost after-hook so lookup joins cannot replace hydrated display fields. */
+            order: 1,
+        };
+    }
+    get storage() {
+        return this.moduleRef.get(core_1.EntityStorageMiddlewareService, { strict: false });
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if ((ctx.op === 'create' || ctx.op === 'update') && ctx.data && typeof ctx.data === 'object') {
+                this.stripDisplayOnlyRoleFields(ctx.data);
+            }
+            yield next();
+            if ((ctx.op === 'query' || ctx.op === 'getOne') && ctx.result) {
+                try {
+                    yield this.hydrateAssignedRoles(ctx);
+                }
+                catch (error) {
+                    this.logger.warn(`Failed to hydrate assigned roles for users: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                try {
+                    yield this.hydrateLastSignInAt(ctx);
+                }
+                catch (error) {
+                    this.logger.warn(`Failed to hydrate lastSignInAt for users: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        });
+    }
+    stripDisplayOnlyRoleFields(data) {
+        for (const key of DISPLAY_ONLY_ROLE_KEYS) {
+            delete data[key];
+        }
+    }
+    hydrateAssignedRoles(ctx) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const rows = this.collectUserRows(ctx);
+            if (rows.length === 0) {
+                return;
+            }
+            const userIds = [...new Set(rows.map((row) => rowId(row)).filter((id) => id.length > 0))];
+            if (userIds.length === 0) {
+                return;
+            }
+            const session = this.readSession();
+            const grants = yield this.loadUserRoleGrants(userIds);
+            const roleIdsByUser = new Map();
+            const grantByUser = new Map();
+            const missingSnapshotIds = new Set();
+            for (const userId of userIds) {
+                const assignments = grants.filter((grant) => { var _a; return String((_a = grant['userId']) !== null && _a !== void 0 ? _a : '') === userId; });
+                const selected = this.pickWorkspaceGrant(assignments, session);
+                const roleIds = extractRoleIds(selected);
+                roleIdsByUser.set(userId, roleIds);
+                if (selected) {
+                    grantByUser.set(userId, selected);
+                }
+                const snapshots = selected === null || selected === void 0 ? void 0 : selected['rolesList'];
+                const hasSnapshots = Array.isArray(snapshots) && snapshots.length > 0;
+                if (!hasSnapshots) {
+                    for (const roleId of roleIds) {
+                        missingSnapshotIds.add(roleId);
+                    }
+                }
+            }
+            const rolesById = yield this.loadRoleSnapshots([...missingSnapshotIds]);
+            for (const row of rows) {
+                const userId = rowId(row);
+                const roleIds = (_a = roleIdsByUser.get(userId)) !== null && _a !== void 0 ? _a : [];
+                const grant = grantByUser.get(userId);
+                const fromGrant = snapshotsFromGrant(grant, roleIds);
+                delete row.roleIds;
+                row.rolesList = fromGrant.map((snapshot) => {
+                    var _a;
+                    if (snapshot.title !== snapshot.id) {
+                        return snapshot;
+                    }
+                    return (_a = rolesById.get(snapshot.id)) !== null && _a !== void 0 ? _a : snapshot;
+                });
+            }
+        });
+    }
+    hydrateLastSignInAt(ctx) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const rows = this.collectUserRows(ctx);
+            for (const row of rows) {
+                if (toIsoTimestamp(row.lastSignInAt) == null) {
+                    delete row.lastSignInAt;
+                }
+            }
+            const missing = rows.filter((row) => toIsoTimestamp(row.lastSignInAt) == null);
+            if (missing.length === 0) {
+                return;
+            }
+            const userIds = [...new Set(missing.map((row) => rowId(row)).filter((id) => id.length > 0))];
+            if (userIds.length === 0) {
+                return;
+            }
+            const latestByUser = yield this.loadLatestSessionLogin(userIds);
+            for (const row of missing) {
+                const stamped = latestByUser.get(rowId(row));
+                if (stamped) {
+                    row.lastSignInAt = stamped;
+                }
+                else {
+                    delete row.lastSignInAt;
+                }
+            }
+        });
+    }
+    collectUserRows(ctx) {
+        var _a;
+        if (ctx.op === 'getOne' && ctx.result && typeof ctx.result === 'object') {
+            return [ctx.result];
+        }
+        if (ctx.op === 'query') {
+            const items = (_a = ctx.result) === null || _a === void 0 ? void 0 : _a.items;
+            if (!Array.isArray(items)) {
+                return [];
+            }
+            return items.filter((item) => item != null && typeof item === 'object');
+        }
+        return [];
+    }
+    /**
+     * Same grant pick as the User Roles page: prefer the current application,
+     * then a tenant-wide row, then the first grant isolation already returned.
+     */
+    pickWorkspaceGrant(assignments, session) {
+        var _a, _b, _c;
+        if (assignments.length === 0) {
+            return undefined;
+        }
+        const tenantId = (_a = session === null || session === void 0 ? void 0 : session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+        const applicationId = (_b = session === null || session === void 0 ? void 0 : session.applicationId) === null || _b === void 0 ? void 0 : _b.trim();
+        const inTenant = tenantId
+            ? assignments.filter((row) => {
+                const scope = asScopeInfo(row['scopeInfo']);
+                return !(scope === null || scope === void 0 ? void 0 : scope.tenantId) || scope.tenantId === tenantId;
+            })
+            : assignments;
+        const pool = inTenant.length > 0 ? inTenant : assignments;
+        let selected = pool[0];
+        if (applicationId) {
+            const appMatch = pool.find((row) => { var _a; return ((_a = asScopeInfo(row['scopeInfo'])) === null || _a === void 0 ? void 0 : _a.applicationId) === applicationId; });
+            const tenantWide = pool.find((row) => { var _a; return !((_a = asScopeInfo(row['scopeInfo'])) === null || _a === void 0 ? void 0 : _a.applicationId); });
+            selected = (_c = appMatch !== null && appMatch !== void 0 ? appMatch : tenantWide) !== null && _c !== void 0 ? _c : selected;
+        }
+        return selected;
+    }
+    loadUserRoleGrants(userIds) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const request = {
+                skip: 0,
+                take: Math.max(userIds.length * 8, 50),
+                filter: orEqualFilter('userId', userIds),
+                fields: ['id', 'userId', 'roleIds', 'rolesList', 'scopeInfo'],
+            };
+            const viaStorage = yield this.queryItems(USER_ROLE_ENTITY, request);
+            if (viaStorage.length > 0) {
+                return viaStorage;
+            }
+            return this.queryItemsAsEngine(USER_ROLE_ENTITY, request);
+        });
+    }
+    loadRoleSnapshots(roleIds) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const byId = new Map();
+            if (roleIds.length === 0) {
+                return byId;
+            }
+            const request = {
+                skip: 0,
+                take: Math.max(roleIds.length, 20),
+                filter: orEqualFilter('id', roleIds),
+                fields: ['id', 'title', 'name'],
+            };
+            let items = yield this.queryItems(ROLE_ENTITY, request);
+            if (items.length === 0) {
+                items = yield this.queryItemsAsEngine(ROLE_ENTITY, request);
+            }
+            for (const item of items) {
+                const id = typeof item['id'] === 'string' ? item['id'] : '';
+                if (!id) {
+                    continue;
+                }
+                const title = item['title'] != null && item['title'] !== '' ? item['title'] : (_a = item['name']) !== null && _a !== void 0 ? _a : id;
+                byId.set(id, { id, title });
+            }
+            return byId;
+        });
+    }
+    loadLatestSessionLogin(userIds) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const latest = new Map();
+            const request = {
+                skip: 0,
+                take: Math.max(userIds.length * 8, 50),
+                filter: orEqualFilter('userId', userIds),
+                fields: ['userId', 'lastLoginDate'],
+            };
+            let items = yield this.queryItems(DEVICE_SESSION_ENTITY, request);
+            if (items.length === 0) {
+                items = yield this.queryItemsAsEngine(DEVICE_SESSION_ENTITY, request);
+            }
+            for (const item of items) {
+                const userId = typeof item['userId'] === 'string' ? item['userId'] : '';
+                const iso = toIsoTimestamp(item['lastLoginDate']);
+                if (!userId || !iso) {
+                    continue;
+                }
+                const previous = latest.get(userId);
+                if (!previous || iso > previous) {
+                    latest.set(userId, iso);
+                }
+            }
+            return latest;
+        });
+    }
+    queryItems(entityName, request) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const page = yield this.storage.query(entityName, request);
+            return ((_a = page === null || page === void 0 ? void 0 : page.items) !== null && _a !== void 0 ? _a : []);
+        });
+    }
+    queryItemsAsEngine(entityName, request) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const page = yield this.storage.queryAsEngine(entityName, request);
+            return ((_a = page === null || page === void 0 ? void 0 : page.items) !== null && _a !== void 0 ? _a : []);
+        });
+    }
+    readSession() {
+        var _a;
+        const req = (0, core_1.getEntityStorageRequest)();
+        return (_a = req === null || req === void 0 ? void 0 : req[security_1.CURRENT_SESSION_KEY]) !== null && _a !== void 0 ? _a : null;
+    }
+};
+exports.UserAssignedRolesMiddleware = UserAssignedRolesMiddleware;
+exports.UserAssignedRolesMiddleware = UserAssignedRolesMiddleware = UserAssignedRolesMiddleware_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_2.ModuleRef])
+], UserAssignedRolesMiddleware);
+//#endregion
+//# sourceMappingURL=user-assigned-roles.middleware.js.map

package/server/src/lib/middlewares/user-assigned-roles.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-assigned-roles.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/user-assigned-roles.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;;AAE7B,iEAMgD;AAChD,yEAIoD;AACpD,2CAAoD;AACpD,uCAAyC;AA4BzC,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAElE,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAU,CAAC;AAEjE,YAAY;AAEZ,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO;QACL,QAAQ,EAAE,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/E,aAAa,EAAE,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,GAA4B;;IACzC,MAAM,EAAE,GAAG,MAAA,GAAG,CAAC,IAAI,CAAC,mCAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,UAAsD;IAC5E,MAAM,UAAU,GAAG,IAAA,6BAAkB,EAAC,UAAU,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAG,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,GAAG;SACP,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA0C,EAAE,OAAiB;;IACvF,MAAM,GAAG,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;YACX,EAAE;YACF,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,MAAM,CAAC,mCAAI,EAAE;SACtF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,WAAC,OAAA,MAAA,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA,EAAA,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,MAAgB;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,oDAAoD;AAEpD;;;;;GAKG;AAEI,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAUtC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;QAThC,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;QAE9D,WAAM,GAAG;YAChB,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAkB;YAC7D,mFAAmF;YACnF,KAAK,EAAE,CAAC;SACT,CAAC;IAEkD,CAAC;IAErD,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qCAA8B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEK,OAAO,CAAC,GAAyB,EAAE,IAAyB;;YAChE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7F,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAA+B,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBACvC,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KAAA;IAEO,0BAA0B,CAAC,IAA6B;QAC9D,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAEa,oBAAoB,CAAC,GAAyB;;;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;YAClD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;YAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;YAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,KAAK,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC,KAAK,MAAM,CAAA,EAAA,CAAC,CAAC;gBACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC/D,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACnC,IAAI,QAAQ,EAAE,CAAC;oBACb,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACpC,CAAC;gBACD,MAAM,SAAS,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,WAAW,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC;YAExE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM,OAAO,GAAG,MAAA,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC,OAAO,CAAC;gBACnB,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;;oBACzC,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACnC,OAAO,QAAQ,CAAC;oBAClB,CAAC;oBACD,OAAO,MAAA,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,mCAAI,QAAQ,CAAC;gBAChD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KAAA;IAEa,mBAAmB,CAAC,GAAyB;;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC7C,OAAO,GAAG,CAAC,YAAY,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;YAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAChE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,CAAC,YAAY,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;KAAA;IAEO,eAAe,CAAC,GAAyB;;QAC/C,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,MAAiB,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAC,GAAG,CAAC,MAAgC,0CAAE,KAAK,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAmB,EAAE,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACK,kBAAkB,CACxB,WAAsC,EACtC,OAAqC;;QAErC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,0CAAE,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,QAAQ;YACvB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC5C,OAAO,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,CAAA,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACzD,CAAC,CAAC;YACJ,CAAC,CAAC,WAAW,CAAC;QAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QAE1D,IAAI,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,0CAAE,aAAa,MAAK,aAAa,CAAA,EAAA,CAAC,CAAC;YACpG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,WAAC,OAAA,CAAC,CAAA,MAAA,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,0CAAE,aAAa,CAAA,CAAA,EAAA,CAAC,CAAC;YACrF,QAAQ,GAAG,MAAA,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,UAAU,mCAAI,QAAQ,CAAC;QAChD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEa,kBAAkB,CAAC,OAAiB;;YAChD,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC;gBACxC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC;aAC9D,CAAC;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;KAAA;IAEa,iBAAiB,CAAC,OAAiB;;;YAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC;gBACpC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;aAChC,CAAC;YAEF,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,mCAAI,EAAE,CAAC;gBACjG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9B,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAEa,sBAAsB,CAAC,OAAiB;;YACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;YACzC,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC;gBACxC,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;aACpC,CAAC;YAEF,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;YACxE,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEa,UAAU,CACtB,UAAkB,EAClB,OAA+D;;;YAE/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,mCAAI,EAAE,CAA8B,CAAC;QAC1D,CAAC;KAAA;IAEa,kBAAkB,CAC9B,UAAkB,EAClB,OAAuE;;;YAEvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,mCAAI,EAAE,CAA8B,CAAC;QAC1D,CAAC;KAAA;IAEO,WAAW;;QACjB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,OAAO,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,8BAAmB,CAAC,mCAAI,IAAI,CAAC;IAC5C,CAAC;CACF,CAAA;AAlRY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAW6B,gBAAS;GAVtC,2BAA2B,CAkRvC;AAED,YAAY"}

package/server/src/lib/middlewares/user-effective-state.middleware.d.ts

@@ -0,0 +1,13 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+/**
+ * Keeps persisted `effectiveState` in sync with `accountState` + `accessState`
+ * on SecurityManagement.User create/update.
+ */
+export declare class UserEffectiveStateMiddleware implements EntityStorageMiddleware {
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+}