@acorex-platform/module-security-management-server 0.0.15 → 2.0.0-next.42

package/server/src/lib/middlewares/user-effective-state.middleware.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserEffectiveStateMiddleware = void 0;
+const tslib_1 = require("tslib");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const common_1 = require("@nestjs/common");
+//#region ---- User effective state middleware ----
+const USER_ENTITY = 'SecurityManagement.User';
+/**
+ * Keeps persisted `effectiveState` in sync with `accountState` + `accessState`
+ * on SecurityManagement.User create/update.
+ */
+let UserEffectiveStateMiddleware = class UserEffectiveStateMiddleware {
+    constructor() {
+        this.target = {
+            entity: USER_ENTITY,
+            ops: ['create', 'update'],
+            order: 4,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!ctx.data || typeof ctx.data !== 'object') {
+                yield next();
+                return;
+            }
+            const patch = ctx.data;
+            let accountState = patch['accountState'];
+            let accessState = patch['accessState'];
+            if (ctx.op === 'update' && ctx.id && (accountState === undefined || accessState === undefined)) {
+                try {
+                    const existing = (yield ctx.backend.getOne(ctx.entityName, ctx.id));
+                    if (existing) {
+                        accountState = accountState !== null && accountState !== void 0 ? accountState : existing['accountState'];
+                        accessState = accessState !== null && accessState !== void 0 ? accessState : existing['accessState'];
+                    }
+                }
+                catch (_b) {
+                    /* keep patch-only values */
+                }
+            }
+            patch['effectiveState'] = (0, module_security_management_contracts_1.resolveAXMUserEffectiveState)({
+                accountState,
+                accessState: (_a = accessState) !== null && _a !== void 0 ? _a : module_security_management_contracts_1.AXMUserAccessState.Allowed,
+            });
+            ctx.data = patch;
+            yield next();
+        });
+    }
+};
+exports.UserEffectiveStateMiddleware = UserEffectiveStateMiddleware;
+exports.UserEffectiveStateMiddleware = UserEffectiveStateMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], UserEffectiveStateMiddleware);
+//#endregion
+//# sourceMappingURL=user-effective-state.middleware.js.map

package/server/src/lib/middlewares/user-effective-state.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-effective-state.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/user-effective-state.middleware.ts"],"names":[],"mappings":";;;;AAKA,gHAG+D;AAE/D,2CAA4C;AAE5C,mDAAmD;AAEnD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C;;;GAGG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAAlC;QACI,WAAM,GAAG;YAChB,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAkB;YAC1C,KAAK,EAAE,CAAC;SACT,CAAC;IAmCJ,CAAC;IAjCO,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAChE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAA+B,CAAC;YAClD,IAAI,YAAY,GAAG,KAAK,CAAC,cAAc,CAAuB,CAAC;YAC/D,IAAI,WAAW,GAAG,KAAK,CAAC,aAAa,CAAuB,CAAC;YAE7D,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/F,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAGrD,CAAC;oBACd,IAAI,QAAQ,EAAE,CAAC;wBACb,YAAY,GAAG,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAK,QAAQ,CAAC,cAAc,CAAwB,CAAC;wBAChF,WAAW,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAK,QAAQ,CAAC,aAAa,CAAwB,CAAC;oBAC/E,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;YAED,KAAK,CAAC,gBAAgB,CAAC,GAAG,IAAA,mEAA4B,EAAC;gBACrD,YAAY;gBACZ,WAAW,EAAE,MAAC,WAA8C,mCAAI,yDAAkB,CAAC,OAAO;aAC3F,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC;YAEjB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAxCY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;GACA,4BAA4B,CAwCxC;AAED,YAAY"}

package/server/src/lib/middlewares/user-invitation-list.middleware.d.ts

@@ -0,0 +1,32 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+import { ModuleRef } from '@nestjs/core';
+/**
+ * Hidden Users-view condition — not a persisted User field.
+ * Rewritten to id∈(TenantUser where invitation.source is invite or join-request) before Mongo query.
+ */
+export declare const USER_INVITE_LIFECYCLE_FILTER_FIELD = "membershipInviteScope";
+export declare const USER_INVITE_LIFECYCLE_FILTER_VALUE = "lifecycle";
+/**
+ * Users list view `invitations` (UI tab on User list):
+ * - Rewrites hidden filter marker into id∈(session-tenant TenantUser with invitation.source invite|join-request)
+ * - Hydrates display-only `membershipStatusId` from that TenantUser
+ *
+ * Source of truth remains TenantUser — nothing is written to User Mongo documents.
+ */
+export declare class UserInvitationListMiddleware implements EntityStorageMiddleware {
+    private readonly moduleRef;
+    private readonly logger;
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    constructor(moduleRef: ModuleRef);
+    private get storage();
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private rewriteInviteLifecycleFilter;
+    private listInviteLifecycleUserIds;
+    private hydrateMembershipStatus;
+    private collectUserRows;
+    private readSession;
+}

package/server/src/lib/middlewares/user-invitation-list.middleware.js

@@ -0,0 +1,250 @@
+"use strict";
+//#region ----- Imports -----
+var UserInvitationListMiddleware_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationListMiddleware = exports.USER_INVITE_LIFECYCLE_FILTER_VALUE = exports.USER_INVITE_LIFECYCLE_FILTER_FIELD = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+const core_2 = require("@nestjs/core");
+const lodash_1 = require("lodash");
+//#endregion
+//#region ----- Constants -----
+const USER_ENTITY = 'SecurityManagement.User';
+const TENANT_USER_ENTITY = 'TenantManagement.TenantUser';
+/**
+ * Hidden Users-view condition — not a persisted User field.
+ * Rewritten to id∈(TenantUser where invitation.source is invite or join-request) before Mongo query.
+ */
+exports.USER_INVITE_LIFECYCLE_FILTER_FIELD = 'membershipInviteScope';
+exports.USER_INVITE_LIFECYCLE_FILTER_VALUE = 'lifecycle';
+const DISPLAY_ONLY_KEYS = [
+    'membershipStatusId',
+    'membershipInviteScope',
+    'membershipInvitationSource',
+];
+//#endregion
+//#region ----- Helpers -----
+function rowId(row) {
+    var _a;
+    const id = (_a = row['id']) !== null && _a !== void 0 ? _a : row['_id'];
+    return id != null ? String(id).trim() : '';
+}
+function stripInviteLifecycleMarker(filter) {
+    var _a;
+    if (!filter || typeof filter !== 'object') {
+        return { cleaned: filter, inviteLifecycle: false };
+    }
+    const node = filter;
+    if (Array.isArray(node.filters) && node.filters.length > 0) {
+        let inviteLifecycle = false;
+        const nextFilters = [];
+        for (const child of node.filters) {
+            const nested = stripInviteLifecycleMarker(child);
+            inviteLifecycle = inviteLifecycle || nested.inviteLifecycle;
+            if (nested.cleaned != null) {
+                nextFilters.push(nested.cleaned);
+            }
+        }
+        if (nextFilters.length === 0) {
+            return { cleaned: undefined, inviteLifecycle };
+        }
+        if (nextFilters.length === 1 && !node.logic) {
+            return { cleaned: nextFilters[0], inviteLifecycle };
+        }
+        return {
+            cleaned: Object.assign(Object.assign({}, node), { filters: nextFilters }),
+            inviteLifecycle,
+        };
+    }
+    const field = typeof node.field === 'string' ? node.field : '';
+    const op = (_a = node.operator) === null || _a === void 0 ? void 0 : _a.type;
+    const value = node.value;
+    if (field === exports.USER_INVITE_LIFECYCLE_FILTER_FIELD &&
+        op === 'equal' &&
+        value === exports.USER_INVITE_LIFECYCLE_FILTER_VALUE) {
+        return { cleaned: undefined, inviteLifecycle: true };
+    }
+    return { cleaned: filter, inviteLifecycle: false };
+}
+function andWithUserIdIn(filter, userIds) {
+    const idFilter = {
+        field: 'id',
+        operator: { type: 'in' },
+        value: userIds.length > 0 ? userIds : ['__no-invite-membership__'],
+    };
+    if (!filter) {
+        return idFilter;
+    }
+    return {
+        logic: 'and',
+        filters: [filter, idFilter],
+    };
+}
+function resolveDisplayMembershipStatus(membership) {
+    const statusId = typeof membership.statusId === 'string' ? membership.statusId : null;
+    const invitation = membership.invitation;
+    if (statusId === 'active' && (invitation === null || invitation === void 0 ? void 0 : invitation.acceptedAt)) {
+        return 'accepted';
+    }
+    return statusId;
+}
+//#endregion
+//#region ----- User invitation list middleware -----
+/**
+ * Users list view `invitations` (UI tab on User list):
+ * - Rewrites hidden filter marker into id∈(session-tenant TenantUser with invitation.source invite|join-request)
+ * - Hydrates display-only `membershipStatusId` from that TenantUser
+ *
+ * Source of truth remains TenantUser — nothing is written to User Mongo documents.
+ */
+let UserInvitationListMiddleware = UserInvitationListMiddleware_1 = class UserInvitationListMiddleware {
+    constructor(moduleRef) {
+        this.moduleRef = moduleRef;
+        this.logger = new common_1.Logger(UserInvitationListMiddleware_1.name);
+        this.target = {
+            entity: USER_ENTITY,
+            ops: ['create', 'update', 'query', 'getOne'],
+            order: 2,
+        };
+    }
+    get storage() {
+        return this.moduleRef.get(core_1.EntityStorageMiddlewareService, { strict: false });
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if ((ctx.op === 'create' || ctx.op === 'update') && ctx.data && typeof ctx.data === 'object') {
+                for (const key of DISPLAY_ONLY_KEYS) {
+                    delete ctx.data[key];
+                }
+            }
+            let inviteLifecycle = false;
+            if (ctx.op === 'query' && ctx.request) {
+                try {
+                    inviteLifecycle = yield this.rewriteInviteLifecycleFilter(ctx);
+                }
+                catch (error) {
+                    this.logger.warn(`Failed to rewrite invite lifecycle filter: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            yield next();
+            if ((ctx.op === 'query' || ctx.op === 'getOne') && ctx.result) {
+                try {
+                    yield this.hydrateMembershipStatus(ctx, inviteLifecycle || ctx.op === 'getOne');
+                }
+                catch (error) {
+                    this.logger.warn(`Failed to hydrate membership invite status: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        });
+    }
+    rewriteInviteLifecycleFilter(ctx) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const request = ctx.request;
+            if (!request) {
+                return false;
+            }
+            const { cleaned, inviteLifecycle } = stripInviteLifecycleMarker(request.filter);
+            if (!inviteLifecycle) {
+                return false;
+            }
+            const session = this.readSession();
+            const tenantId = (_a = session === null || session === void 0 ? void 0 : session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                ctx.request = Object.assign(Object.assign({}, request), { filter: andWithUserIdIn(cleaned, []) });
+                return true;
+            }
+            const userIds = yield this.listInviteLifecycleUserIds(tenantId);
+            ctx.request = Object.assign(Object.assign({}, request), { filter: andWithUserIdIn(cleaned, userIds) });
+            return true;
+        });
+    }
+    listInviteLifecycleUserIds(tenantId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.storage.query(TENANT_USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: 10000,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        { field: 'tenantId', operator: { type: 'equal' }, value: tenantId },
+                        { field: 'invitation.source', operator: { type: 'in' }, value: ['invite', 'join-request'] },
+                    ],
+                },
+            }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            const ids = (Array.isArray(items) ? items : [])
+                .map((row) => { var _a; return String((_a = row.userId) !== null && _a !== void 0 ? _a : '').trim(); })
+                .filter((id) => id.length > 0);
+            return [...new Set(ids)];
+        });
+    }
+    hydrateMembershipStatus(ctx, force) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            if (!force && ctx.op === 'query') {
+                return;
+            }
+            const session = this.readSession();
+            const tenantId = (_a = session === null || session === void 0 ? void 0 : session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return;
+            }
+            const rows = this.collectUserRows(ctx);
+            if (rows.length === 0) {
+                return;
+            }
+            const userIds = [...new Set(rows.map((row) => rowId(row)).filter((id) => id.length > 0))];
+            if (userIds.length === 0) {
+                return;
+            }
+            const result = yield this.storage.query(TENANT_USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: Math.max(userIds.length * 2, 100),
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        { field: 'tenantId', operator: { type: 'equal' }, value: tenantId },
+                        { field: 'userId', operator: { type: 'in' }, value: userIds },
+                    ],
+                },
+            }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            const byUserId = new Map();
+            for (const item of Array.isArray(items) ? items : []) {
+                const userId = String((_b = item.userId) !== null && _b !== void 0 ? _b : '').trim();
+                if (userId) {
+                    byUserId.set(userId, item);
+                }
+            }
+            for (const row of rows) {
+                const membership = byUserId.get(rowId(row));
+                row.membershipStatusId = membership ? resolveDisplayMembershipStatus(membership) : null;
+                const source = (_c = membership === null || membership === void 0 ? void 0 : membership.invitation) === null || _c === void 0 ? void 0 : _c.source;
+                row.membershipInvitationSource =
+                    typeof source === 'string' && source.trim() ? source.trim() : null;
+            }
+        });
+    }
+    collectUserRows(ctx) {
+        if (ctx.op === 'getOne' && ctx.result && typeof ctx.result === 'object') {
+            return [ctx.result];
+        }
+        const items = (0, lodash_1.get)(ctx.result, 'items', []);
+        return Array.isArray(items) ? items : [];
+    }
+    readSession() {
+        const request = (0, core_1.getEntityStorageRequest)();
+        return request === null || request === void 0 ? void 0 : request[security_1.CURRENT_SESSION_KEY];
+    }
+};
+exports.UserInvitationListMiddleware = UserInvitationListMiddleware;
+exports.UserInvitationListMiddleware = UserInvitationListMiddleware = UserInvitationListMiddleware_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_2.ModuleRef])
+], UserInvitationListMiddleware);
+//#endregion
+//# sourceMappingURL=user-invitation-list.middleware.js.map

package/server/src/lib/middlewares/user-invitation-list.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-invitation-list.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/user-invitation-list.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;;AAE7B,iEAMgD;AAChD,6EAAkG;AAClG,yEAGoD;AACpD,2CAAoD;AACpD,uCAAyC;AAEzC,mCAA6B;AA8B7B,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD;;;GAGG;AACU,QAAA,kCAAkC,GAAG,uBAAuB,CAAC;AAC7D,QAAA,kCAAkC,GAAG,WAAW,CAAC;AAE9D,MAAM,iBAAiB,GAAG;IACxB,oBAAoB;IACpB,uBAAuB;IACvB,4BAA4B;CACpB,CAAC;AAEX,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,KAAK,CAAC,GAA4B;;IACzC,MAAM,EAAE,GAAG,MAAA,GAAG,CAAC,IAAI,CAAC,mCAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAe;;IAIjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,GAAG,MAAoB,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YACjD,eAAe,GAAG,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC;YAC5D,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAqB,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QACtD,CAAC;QACD,OAAO;YACL,OAAO,kCAAO,IAAI,KAAE,OAAO,EAAE,WAAW,GAAE;YAC1C,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,EAAE,GAAG,MAAA,IAAI,CAAC,QAAQ,0CAAE,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IACE,KAAK,KAAK,0CAAkC;QAC5C,EAAE,KAAK,OAAO;QACd,KAAK,KAAK,0CAAkC,EAC5C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,MAAe,EAAE,OAAiB;IACzD,MAAM,QAAQ,GAAe;QAC3B,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACxB,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;KACnE,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,MAAoB,EAAE,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,UAA+B;IACrE,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,IAAI,QAAQ,KAAK,QAAQ,KAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,UAAU,CAAA,EAAE,CAAC;QACpD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,YAAY;AAEZ,qDAAqD;AAErD;;;;;;GAMG;AAEI,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IASvC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;QARhC,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;QAE/D,WAAM,GAAG;YAChB,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAkB;YAC7D,KAAK,EAAE,CAAC;SACT,CAAC;IAEkD,CAAC;IAErD,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qCAA8B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEK,OAAO,CAAC,GAAyB,EAAE,IAAyB;;YAChE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7F,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;oBACpC,OAAQ,GAAG,CAAC,IAAgC,CAAC,GAAG,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAED,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,eAAe,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC;gBACjE,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,eAAe,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;gBAClF,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KAAA;IAEa,4BAA4B,CAAC,GAAyB;;;YAClE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,OAAO,mCACN,OAAO,KACV,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,GACrC,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;YAChE,GAAG,CAAC,OAAO,mCACN,OAAO,KACV,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,GAC1C,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAEa,0BAA0B,CAAC,QAAgB;;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,kBAAkB,EAClB,IAAA,2CAAgC,EAAC;gBAC/B,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,KAAM;gBACZ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;wBACnE,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE;qBAC5F;iBACF;aACF,CAAC,CACH,CAAC;YACF,MAAM,KAAK,GAAG,IAAA,YAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAA0B,CAAC;YAChE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA,EAAA,CAAC;iBAC7C,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC;KAAA;IAEa,uBAAuB,CACnC,GAAyB,EACzB,KAAc;;;YAEd,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,kBAAkB,EAClB,IAAA,2CAAgC,EAAC;gBAC/B,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC;gBACvC,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;wBACnE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;qBAC9D;iBACF;aACF,CAAC,CACH,CAAC;YACF,MAAM,KAAK,GAAG,IAAA,YAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAA0B,CAAC;YAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAA,IAAI,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChD,IAAI,MAAM,EAAE,CAAC;oBACX,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,kBAAkB,GAAG,UAAU,CAAC,CAAC,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxF,MAAM,MAAM,GAAG,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,UAAU,0CAAE,MAAM,CAAC;gBAC9C,GAAG,CAAC,0BAA0B;oBAC5B,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,CAAC;QACH,CAAC;KAAA;IAEO,eAAe,CAAC,GAAyB;QAC/C,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,MAAiB,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,YAAG,EAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAc,CAAC;QACxD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEO,WAAW;QACjB,MAAM,OAAO,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QAC5E,OAAO,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAG,8BAAmB,CAAC,CAAC;IACxC,CAAC;CACF,CAAA;AAxKY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;6CAU6B,gBAAS;GATtC,4BAA4B,CAwKxC;AAED,YAAY"}

package/server/src/lib/middlewares/user-profile-write.middleware.d.ts

@@ -0,0 +1,18 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+/**
+ * Stamps `homeTenantId` on create when the session has a tenant, allowlists
+ * User update fields for non-platform sessions (self / home-tenant profile
+ * writes), and copies an email-shaped username onto `email` when missing.
+ * Independent public register may create a User with no home tenant (waiting
+ * room). Always strips nested `homeTenant` and locks `homeTenantId` after create.
+ */
+export declare class UserProfileWriteMiddleware implements EntityStorageMiddleware {
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        /** Before {@link UserEffectiveStateMiddleware} so allowlisted patches still refresh effectiveState. */
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private readSession;
+}

package/server/src/lib/middlewares/user-profile-write.middleware.js

@@ -0,0 +1,206 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserProfileWriteMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const common_1 = require("@nestjs/common");
+//#endregion
+//#region ----- Constants -----
+const USER_ENTITY = 'SecurityManagement.User';
+/** Soft profile fields: self, home tenant, or platform. */
+const PROFILE_FIELDS = new Set(['displayName', 'avatar', 'email']);
+/** Credential fields: self or platform only. */
+const SELF_CREDENTIAL_FIELDS = new Set(['password', 'passwordChangedAt', 'pinCode', 'pinChangedAt']);
+/** Tenant directory lifecycle on User (until moved to TenantUser). */
+const HOME_TENANT_LIFECYCLE_FIELDS = new Set(['accountState']);
+/**
+ * Never accept from clients on update (including platform).
+ * `homeTenant` is a lookup denorm leak — identity stores `homeTenantId` only.
+ */
+const IMMUTABLE_OR_DENORM_FIELDS = new Set([
+    'homeTenantId',
+    'homeTenant',
+    'createdVia',
+    'createdByUserId',
+    'username',
+    'passwordReset',
+    'lastSignInAt',
+    'id',
+    'scopeInfo',
+    'stateInfo',
+    'auditInfo',
+    'workflowInfo',
+    'effectiveState',
+    'roleIds',
+    'rolesList',
+    'membershipStatusId',
+    'membershipInviteScope',
+    'membershipInvitationSource',
+]);
+/** Platform-only identity fields (stripped for non-platform). */
+const PLATFORM_ONLY_FIELDS = new Set(['accessState']);
+//#endregion
+//#region ----- User profile write middleware -----
+/**
+ * Stamps `homeTenantId` on create when the session has a tenant, allowlists
+ * User update fields for non-platform sessions (self / home-tenant profile
+ * writes), and copies an email-shaped username onto `email` when missing.
+ * Independent public register may create a User with no home tenant (waiting
+ * room). Always strips nested `homeTenant` and locks `homeTenantId` after create.
+ */
+let UserProfileWriteMiddleware = class UserProfileWriteMiddleware {
+    constructor() {
+        this.target = {
+            entity: USER_ENTITY,
+            ops: ['create', 'update'],
+            /** Before {@link UserEffectiveStateMiddleware} so allowlisted patches still refresh effectiveState. */
+            order: 3,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if ((0, abstract_1.isEngineStorageBypass)(ctx.locals) || (0, abstract_1.isSystemCommandBypass)(ctx.locals)) {
+                yield next();
+                return;
+            }
+            if (!ctx.data || typeof ctx.data !== 'object') {
+                yield next();
+                return;
+            }
+            const session = this.readSession();
+            const sessionTenantId = (_a = session === null || session === void 0 ? void 0 : session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            const sessionUserId = (_b = session === null || session === void 0 ? void 0 : session.userId) === null || _b === void 0 ? void 0 : _b.trim();
+            const isPlatform = (0, abstract_1.isPlatformSessionTenant)(sessionTenantId);
+            if (ctx.op === 'create') {
+                const data = Object.assign({}, ctx.data);
+                delete data['homeTenant'];
+                const existingHome = typeof data['homeTenantId'] === 'string' ? data['homeTenantId'].trim() : '';
+                if (!existingHome) {
+                    // Tenant-admin create stamps the current tenant. Independent public
+                    // register has no tenant yet (waiting room) — leave homeTenantId unset.
+                    if (sessionTenantId) {
+                        data['homeTenantId'] = sessionTenantId;
+                    }
+                }
+                else if (!isPlatform && sessionTenantId && existingHome !== sessionTenantId) {
+                    // Product tenants may only create users for their own directory.
+                    data['homeTenantId'] = sessionTenantId;
+                }
+                const email = typeof data['email'] === 'string' ? data['email'].trim() : '';
+                const username = typeof data['username'] === 'string' ? data['username'].trim() : '';
+                if (!email && username.includes('@')) {
+                    data['email'] = username.toLowerCase();
+                }
+                const existingVia = typeof data['createdVia'] === 'string' ? data['createdVia'].trim() : '';
+                if (!existingVia) {
+                    data['createdVia'] = sessionTenantId ? 'create-in-tenant' : 'register';
+                }
+                const existingBy = typeof data['createdByUserId'] === 'string' ? data['createdByUserId'].trim() : '';
+                if (!existingBy && sessionUserId && sessionTenantId) {
+                    data['createdByUserId'] = sessionUserId;
+                }
+                ctx.data = data;
+                yield next();
+                return;
+            }
+            // update — homeTenantId / nested homeTenant are never client-writable after create
+            const incoming = Object.assign({}, ctx.data);
+            const stampKeys = Object.keys(incoming).filter((key) => key !== 'id');
+            if (stampKeys.length === 1 && stampKeys[0] === 'lastSignInAt') {
+                ctx.data = incoming;
+                yield next();
+                return;
+            }
+            for (const key of IMMUTABLE_OR_DENORM_FIELDS) {
+                delete incoming[key];
+            }
+            if (isPlatform) {
+                ctx.data = incoming;
+                yield next();
+                return;
+            }
+            for (const key of PLATFORM_ONLY_FIELDS) {
+                delete incoming[key];
+            }
+            const userId = ctx.id != null ? String(ctx.id) : undefined;
+            if (!userId) {
+                throw new core_1.MiddlewareAbortError('User id is required for update.', {
+                    code: 'USER_UPDATE_ID_REQUIRED',
+                    status: 400,
+                });
+            }
+            let existing = null;
+            try {
+                existing = (yield ctx.backend.getOne(ctx.entityName, userId));
+            }
+            catch (_c) {
+                existing = null;
+            }
+            const homeTenantId = typeof (existing === null || existing === void 0 ? void 0 : existing['homeTenantId']) === 'string' ? existing['homeTenantId'].trim() : '';
+            const isSelf = !!sessionUserId && sessionUserId === userId;
+            const isHomeTenant = !!sessionTenantId && !!homeTenantId && sessionTenantId === homeTenantId;
+            if (!isSelf && !isHomeTenant) {
+                throw new core_1.MiddlewareAbortError('Only the user, their home tenant, or the platform can update this profile.', {
+                    code: core_2.AXP_PLATFORM_ERROR_CODES.USER_HOME_TENANT_PROFILE_DENIED,
+                    status: 403,
+                    details: {
+                        userId,
+                        homeTenantId: homeTenantId || null,
+                        sessionTenantId: sessionTenantId || null,
+                    },
+                });
+            }
+            const allowed = new Set();
+            if (isSelf || isHomeTenant) {
+                for (const field of PROFILE_FIELDS) {
+                    allowed.add(field);
+                }
+            }
+            if (isSelf) {
+                for (const field of SELF_CREDENTIAL_FIELDS) {
+                    allowed.add(field);
+                }
+            }
+            if (isHomeTenant) {
+                for (const field of HOME_TENANT_LIFECYCLE_FIELDS) {
+                    allowed.add(field);
+                }
+            }
+            const filtered = {};
+            for (const [key, value] of Object.entries(incoming)) {
+                if (allowed.has(key)) {
+                    filtered[key] = value;
+                }
+            }
+            if (Object.keys(filtered).length === 0) {
+                throw new core_1.MiddlewareAbortError('Only the user, their home tenant, or the platform can update this profile.', {
+                    code: core_2.AXP_PLATFORM_ERROR_CODES.USER_HOME_TENANT_PROFILE_DENIED,
+                    status: 403,
+                    details: {
+                        userId,
+                        homeTenantId: homeTenantId || null,
+                        sessionTenantId: sessionTenantId || null,
+                    },
+                });
+            }
+            ctx.data = filtered;
+            yield next();
+        });
+    }
+    readSession() {
+        var _a;
+        const req = (0, core_1.getEntityStorageRequest)();
+        return (_a = req === null || req === void 0 ? void 0 : req[security_1.CURRENT_SESSION_KEY]) !== null && _a !== void 0 ? _a : null;
+    }
+};
+exports.UserProfileWriteMiddleware = UserProfileWriteMiddleware;
+exports.UserProfileWriteMiddleware = UserProfileWriteMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], UserProfileWriteMiddleware);
+//#endregion
+//# sourceMappingURL=user-profile-write.middleware.js.map

package/server/src/lib/middlewares/user-profile-write.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-profile-write.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/user-profile-write.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAE7B,iEAMgD;AAChD,6EAIwD;AACxD,yEAGoD;AACpD,iEAAkF;AAElF,2CAA4C;AAW5C,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnE,gDAAgD;AAChD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAErG,sEAAsE;AACtE,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,cAAc;IACd,IAAI;IACJ,WAAW;IACX,WAAW;IACX,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,WAAW;IACX,oBAAoB;IACpB,uBAAuB;IACvB,4BAA4B;CAC7B,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAEtD,YAAY;AAEZ,mDAAmD;AAEnD;;;;;;GAMG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAAhC;QACI,WAAM,GAAG;YAChB,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAkB;YAC1C,uGAAuG;YACvG,KAAK,EAAE,CAAC;SACT,CAAC;IA8JJ,CAAC;IA5JO,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAChE,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,IAAI,EAAE,CAAC;YAClD,MAAM,aAAa,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,0CAAE,IAAI,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAA,kCAAuB,EAAC,eAAe,CAAC,CAAC;YAE5D,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAS,GAAG,CAAC,IAAgC,CAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1B,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,oEAAoE;oBACpE,wEAAwE;oBACxE,IAAI,eAAe,EAAE,CAAC;wBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC;oBACzC,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,UAAU,IAAI,eAAe,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;oBAC9E,iEAAiE;oBACjE,IAAI,CAAC,cAAc,CAAC,GAAG,eAAe,CAAC;gBACzC,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzC,CAAC;gBACD,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,IAAI,CAAC,YAAY,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC;gBACzE,CAAC;gBACD,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,eAAe,EAAE,CAAC;oBACpD,IAAI,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC;gBAC1C,CAAC;gBACD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,mFAAmF;YACnF,MAAM,QAAQ,qBAAS,GAAG,CAAC,IAAgC,CAAE,CAAC;YAE9D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;YACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACpB,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;gBAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACpB,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;gBACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,2BAAoB,CAAC,iCAAiC,EAAE;oBAChE,IAAI,EAAE,yBAAyB;oBAC/B,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAQ,GAAmC,IAAI,CAAC;YACpD,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAmC,CAAC;YAClG,CAAC;YAAC,WAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YAED,MAAM,YAAY,GAChB,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,cAAc,CAAC,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,IAAI,aAAa,KAAK,MAAM,CAAC;YAC3D,MAAM,YAAY,GAAG,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,YAAY,IAAI,eAAe,KAAK,YAAY,CAAC;YAE7F,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7B,MAAM,IAAI,2BAAoB,CAC5B,4EAA4E,EAC5E;oBACE,IAAI,EAAE,+BAAwB,CAAC,+BAA+B;oBAC9D,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,MAAM;wBACN,YAAY,EAAE,YAAY,IAAI,IAAI;wBAClC,eAAe,EAAE,eAAe,IAAI,IAAI;qBACzC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAClC,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;gBAC3B,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;oBACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;oBAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,KAAK,MAAM,KAAK,IAAI,4BAA4B,EAAE,CAAC;oBACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,2BAAoB,CAC5B,4EAA4E,EAC5E;oBACE,IAAI,EAAE,+BAAwB,CAAC,+BAA+B;oBAC9D,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,MAAM;wBACN,YAAY,EAAE,YAAY,IAAI,IAAI;wBAClC,eAAe,EAAE,eAAe,IAAI,IAAI;qBACzC;iBACF,CACF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;YACpB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;KAAA;IAEO,WAAW;;QACjB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,OAAO,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,8BAAmB,CAAC,mCAAI,IAAI,CAAC;IAC5C,CAAC;CACF,CAAA;AApKY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;GACA,0BAA0B,CAoKtC;AAED,YAAY"}

package/server/src/lib/password-reset/change-own-password.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMChangeOwnPasswordInput, type AXMChangeOwnPasswordResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserChangePasswordService } from './user-change-password.service';
+export declare class ChangeOwnPasswordCommand implements AXPCommand<AXMChangeOwnPasswordInput, AXMChangeOwnPasswordResult> {
+    private readonly changePassword;
+    constructor(changePassword: UserChangePasswordService);
+    execute(input?: AXMChangeOwnPasswordInput): AXPCommandExecuteResultPromise<AXMChangeOwnPasswordResult>;
+}

package/server/src/lib/password-reset/change-own-password.command.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChangeOwnPasswordCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_change_password_service_1 = require("./user-change-password.service");
+//#region ----- Change own password command -----
+let ChangeOwnPasswordCommand = class ChangeOwnPasswordCommand {
+    constructor(changePassword) {
+        this.changePassword = changePassword;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = { currentPassword: '', newPassword: '' }) {
+            const result = yield this.changePassword.changeOwnPassword(input);
+            if (!result.success) {
+                return {
+                    success: false,
+                    message: { code: result.code },
+                };
+            }
+            return {
+                success: true,
+                kind: 'object',
+                data: result.data,
+            };
+        });
+    }
+};
+exports.ChangeOwnPasswordCommand = ChangeOwnPasswordCommand;
+exports.ChangeOwnPasswordCommand = ChangeOwnPasswordCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.ChangeOwnPassword, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_change_password_service_1.UserChangePasswordService])
+], ChangeOwnPasswordCommand);
+//#endregion
+//# sourceMappingURL=change-own-password.command.js.map

package/server/src/lib/password-reset/change-own-password.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-own-password.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/change-own-password.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAI+D;AAE/D,iFAA2E;AAE3E,iDAAiD;AAI1C,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAGnC,YAA6B,cAAyC;QAAzC,mBAAc,GAAd,cAAc,CAA2B;IAAG,CAAC;IAEpE,OAAO;qEACX,QAAmC,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YAE3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAElE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBAC/B,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AAvBY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9F,IAAA,mBAAU,GAAE;6CAIkC,wDAAyB;GAH3D,wBAAwB,CAuBpC;AAED,YAAY"}