@acorex-platform/module-security-management-server 0.0.15 → 2.0.0-next.42

package/server/src/lib/password-reset/complete-password-reset.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMCompletePasswordResetInput } from '@acorex-platform/module-security-management-client/contracts';
+import { UserPasswordResetService } from './user-password-reset.service';
+export declare class CompletePasswordResetCommand implements AXPCommand<AXMCompletePasswordResetInput, unknown> {
+    private readonly passwordReset;
+    constructor(passwordReset: UserPasswordResetService);
+    execute(input: AXMCompletePasswordResetInput): AXPCommandExecuteResultPromise;
+}

package/server/src/lib/password-reset/complete-password-reset.command.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompletePasswordResetCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-shared/core");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_password_reset_service_1 = require("./user-password-reset.service");
+//#region ---- Complete password reset command ----
+let CompletePasswordResetCommand = class CompletePasswordResetCommand {
+    constructor(passwordReset) {
+        this.passwordReset = passwordReset;
+    }
+    execute(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            try {
+                const result = yield this.passwordReset.completePasswordReset(input !== null && input !== void 0 ? input : { token: '', newPassword: '' });
+                if (!result.success) {
+                    return (0, core_1.runtimeCommandFailure)(result.message);
+                }
+                return (0, core_1.runtimeCommandSuccessObject)(undefined, result.message ? { message: { text: result.message } } : undefined);
+            }
+            catch (error) {
+                return (0, core_1.runtimeCommandFailure)(error instanceof Error ? error.message : 'Failed to reset password.');
+            }
+        });
+    }
+};
+exports.CompletePasswordResetCommand = CompletePasswordResetCommand;
+exports.CompletePasswordResetCommand = CompletePasswordResetCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.CompletePasswordReset, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_password_reset_service_1.UserPasswordResetService])
+], CompletePasswordResetCommand);
+//#endregion
+//# sourceMappingURL=complete-password-reset.command.js.map

package/server/src/lib/password-reset/complete-password-reset.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-password-reset.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/complete-password-reset.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA4G;AAE5G,gFAAkF;AAClF,gHAG+D;AAE/D,+EAAyE;AAEzE,mDAAmD;AAI5C,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAGvC,YAA6B,aAAuC;QAAvC,kBAAa,GAAb,aAAa,CAA0B;IAAG,CAAC;IAElE,OAAO,CAAC,KAAoC;;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO,IAAA,4BAAqB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,IAAA,kCAA2B,EAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAA,4BAAqB,EAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAhBY,oEAA4B;uCAA5B,4BAA4B;IAFxC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjG,IAAA,mBAAU,GAAE;6CAIiC,sDAAwB;GAHzD,4BAA4B,CAgBxC;AAED,YAAY"}

package/server/src/lib/password-reset/get-own-password-status.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMGetOwnPasswordStatusResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserChangePasswordService } from './user-change-password.service';
+export declare class GetOwnPasswordStatusCommand implements AXPCommand<void, AXMGetOwnPasswordStatusResult> {
+    private readonly changePassword;
+    constructor(changePassword: UserChangePasswordService);
+    execute(): AXPCommandExecuteResultPromise<AXMGetOwnPasswordStatusResult>;
+}

package/server/src/lib/password-reset/get-own-password-status.command.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetOwnPasswordStatusCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_change_password_service_1 = require("./user-change-password.service");
+//#region ----- Get own password status command -----
+let GetOwnPasswordStatusCommand = class GetOwnPasswordStatusCommand {
+    constructor(changePassword) {
+        this.changePassword = changePassword;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.changePassword.getOwnPasswordStatus();
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.GetOwnPasswordStatusCommand = GetOwnPasswordStatusCommand;
+exports.GetOwnPasswordStatusCommand = GetOwnPasswordStatusCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.GetOwnPasswordStatus, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_change_password_service_1.UserChangePasswordService])
+], GetOwnPasswordStatusCommand);
+//#endregion
+//# sourceMappingURL=get-own-password-status.command.js.map

package/server/src/lib/password-reset/get-own-password-status.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-own-password-status.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/get-own-password-status.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAG+D;AAE/D,iFAA2E;AAE3E,qDAAqD;AAI9C,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACtC,YAA6B,cAAyC;QAAzC,mBAAc,GAAd,cAAc,CAA2B;IAAG,CAAC;IAEpE,OAAO;;YACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAVY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjG,IAAA,mBAAU,GAAE;6CAEkC,wDAAyB;GAD3D,2BAA2B,CAUvC;AAED,YAAY"}

package/server/src/lib/password-reset/send-password-reset-email.command.d.ts

@@ -0,0 +1,20 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-client/contracts';
+import { UserPasswordResetService } from './user-password-reset.service';
+export declare class SendPasswordResetEmailCommand implements AXPCommand<AXMSendPasswordResetEmailInput & {
+    data?: {
+        id?: string;
+    };
+}, {
+    sent: boolean;
+}> {
+    private readonly passwordReset;
+    constructor(passwordReset: UserPasswordResetService);
+    execute(input?: AXMSendPasswordResetEmailInput & {
+        data?: {
+            id?: string;
+        };
+    }): AXPCommandExecuteResultPromise<{
+        sent: boolean;
+    }>;
+}

package/server/src/lib/password-reset/send-password-reset-email.command.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SendPasswordResetEmailCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-shared/core");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_password_reset_service_1 = require("./user-password-reset.service");
+//#region ---- Send password reset email command ----
+let SendPasswordResetEmailCommand = class SendPasswordResetEmailCommand {
+    constructor(passwordReset) {
+        this.passwordReset = passwordReset;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = {}) {
+            var _a, _b;
+            try {
+                const userId = (_a = input.userId) !== null && _a !== void 0 ? _a : (_b = input.data) === null || _b === void 0 ? void 0 : _b.id;
+                const result = yield this.passwordReset.sendPasswordResetEmail({
+                    userId: userId ? String(userId) : undefined,
+                    login: input.login,
+                    webOrigin: input.webOrigin,
+                });
+                if (!result.success) {
+                    return (0, core_1.runtimeCommandFailure)(result.message);
+                }
+                return (0, core_1.runtimeCommandSuccessObject)({ sent: result.sent === true }, result.message ? { message: { text: result.message } } : undefined);
+            }
+            catch (error) {
+                return (0, core_1.runtimeCommandFailure)(error instanceof Error ? error.message : 'Failed to send password reset email.');
+            }
+        });
+    }
+};
+exports.SendPasswordResetEmailCommand = SendPasswordResetEmailCommand;
+exports.SendPasswordResetEmailCommand = SendPasswordResetEmailCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.SendPasswordResetEmail, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_password_reset_service_1.UserPasswordResetService])
+], SendPasswordResetEmailCommand);
+//#endregion
+//# sourceMappingURL=send-password-reset-email.command.js.map

package/server/src/lib/password-reset/send-password-reset-email.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-password-reset-email.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/send-password-reset-email.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA4G;AAE5G,gFAAkF;AAClF,gHAG+D;AAE/D,+EAAyE;AAEzE,qDAAqD;AAI9C,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAGxC,YAA6B,aAAuC;QAAvC,kBAAa,GAAb,aAAa,CAA0B;IAAG,CAAC;IAElE,OAAO;qEACX,QAAqE,EAAE;;YAEvE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAA,KAAK,CAAC,MAAM,mCAAI,MAAA,KAAK,CAAC,IAAI,0CAAE,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC;oBAC7D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO,IAAA,4BAAqB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,IAAA,kCAA2B,EAChC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAA,4BAAqB,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA7BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClG,IAAA,mBAAU,GAAE;6CAIiC,sDAAwB;GAHzD,6BAA6B,CA6BzC;AAED,YAAY"}

package/server/src/lib/password-reset/user-change-password.service.d.ts

@@ -0,0 +1,24 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { type AXMChangeOwnPasswordInput, type AXMChangeOwnPasswordResult, type AXMGetOwnPasswordStatusResult } from '@acorex-platform/module-security-management-client/contracts';
+export type ChangeOwnPasswordOutcome = {
+    success: true;
+    data: AXMChangeOwnPasswordResult;
+} | {
+    success: false;
+    code: string;
+};
+export type OwnPasswordStatusOutcome = {
+    success: true;
+    data: AXMGetOwnPasswordStatusResult;
+} | {
+    success: false;
+    code: string;
+};
+/** Verifies the current password (when present) and updates the signed-in user's credential. */
+export declare class UserChangePasswordService {
+    private readonly entityStorage;
+    constructor(entityStorage: EntityStorageMiddlewareService);
+    getOwnPasswordStatus(): Promise<OwnPasswordStatusOutcome>;
+    changeOwnPassword(input: AXMChangeOwnPasswordInput): Promise<ChangeOwnPasswordOutcome>;
+    private readSessionUserId;
+}

package/server/src/lib/password-reset/user-change-password.service.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserChangePasswordService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const lodash_1 = require("lodash");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+//#endregion
+//#region ----- Constants -----
+const USER_ENTITY = 'SecurityManagement.User';
+//#endregion
+//#region ----- Helpers -----
+function hasStoredPassword(stored) {
+    return typeof stored === 'string' && stored.trim().length > 0;
+}
+//#endregion
+//#region ----- User change-password service -----
+/** Verifies the current password (when present) and updates the signed-in user's credential. */
+let UserChangePasswordService = class UserChangePasswordService {
+    constructor(entityStorage) {
+        this.entityStorage = entityStorage;
+    }
+    getOwnPasswordStatus() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            const user = (yield this.entityStorage.getOneAsEngine(USER_ENTITY, userId));
+            if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            return {
+                success: true,
+                data: { hasPassword: hasStoredPassword((0, lodash_1.get)(user, 'password')) },
+            };
+        });
+    }
+    changeOwnPassword(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const currentPassword = (_a = input.currentPassword) !== null && _a !== void 0 ? _a : '';
+            const newPassword = (_b = input.newPassword) !== null && _b !== void 0 ? _b : '';
+            if (!newPassword) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.InvalidInput };
+            }
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            const user = (yield this.entityStorage.getOneAsEngine(USER_ENTITY, userId));
+            if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            const storedPassword = (0, lodash_1.get)(user, 'password');
+            const hasPassword = hasStoredPassword(storedPassword);
+            if (hasPassword) {
+                if (!currentPassword) {
+                    return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.InvalidInput };
+                }
+                if (!(yield (0, core_2.verifyPassword)(currentPassword, storedPassword))) {
+                    return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.IncorrectCurrent };
+                }
+                if (yield (0, core_2.verifyPassword)(newPassword, storedPassword)) {
+                    return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.SameAsCurrent };
+                }
+            }
+            const passwordChangedAt = new Date().toISOString();
+            yield this.entityStorage.updateOne(USER_ENTITY, userId, {
+                password: yield (0, core_2.hashPassword)(newPassword),
+                passwordChangedAt,
+            });
+            return { success: true, data: { passwordChangedAt } };
+        });
+    }
+    readSessionUserId() {
+        var _a, _b;
+        const req = (0, core_1.getEntityStorageRequest)();
+        const userId = (_b = (_a = req === null || req === void 0 ? void 0 : req[security_1.CURRENT_SESSION_KEY]) === null || _a === void 0 ? void 0 : _a.userId) === null || _b === void 0 ? void 0 : _b.trim();
+        return userId || undefined;
+    }
+};
+exports.UserChangePasswordService = UserChangePasswordService;
+exports.UserChangePasswordService = UserChangePasswordService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], UserChangePasswordService);
+//#endregion
+//# sourceMappingURL=user-change-password.service.js.map

package/server/src/lib/password-reset/user-change-password.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-change-password.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/user-change-password.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,mCAA6B;AAE7B,iEAAiH;AACjH,yEAGoD;AACpD,iEAAsF;AACtF,gHAM+D;AAgB/D,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,iBAAiB,CAAC,MAAe;IACxC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,YAAY;AAEZ,kDAAkD;AAElD,gGAAgG;AAEzF,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;IAAG,CAAC;IAExE,oBAAoB;;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CACnD,WAAW,EACX,MAAM,CACP,CAAiD,CAAC;YAEnD,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAA,YAAG,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE;aAChE,CAAC;QACJ,CAAC;KAAA;IAEK,iBAAiB,CAAC,KAAgC;;;YACtD,MAAM,eAAe,GAAG,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC;YAE5C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,YAAY,EAAE,CAAC;YACpF,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CACnD,WAAW,EACX,MAAM,CACP,CAAiD,CAAC;YAEnD,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,cAAc,GAAG,IAAA,YAAG,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,WAAW,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAEtD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,YAAY,EAAE,CAAC;gBACpF,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,IAAA,qBAAc,EAAC,eAAe,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;oBAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,gBAAgB,EAAE,CAAC;gBACxF,CAAC;gBACD,IAAI,MAAM,IAAA,qBAAc,EAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,aAAa,EAAE,CAAC;gBACrF,CAAC;YACH,CAAC;YAED,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,QAAQ,EAAE,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC;gBACzC,iBAAiB;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC;QACxD,CAAC;KAAA;IAEO,iBAAiB;;QACvB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,8BAAmB,CAAC,0CAAE,MAAM,0CAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;CACF,CAAA;AA3EY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;6CAEiC,qCAA8B;GAD/D,yBAAyB,CA2ErC;AAED,YAAY"}

package/server/src/lib/password-reset/user-password-reset.service.d.ts

@@ -0,0 +1,26 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { ServerCommandExecutorService } from '@acorex-platform/framework-server/domain/providers';
+import { AXMCompletePasswordResetInput, AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-client/contracts';
+export declare class UserPasswordResetService {
+    private readonly entityStorage;
+    private readonly commandExecutor;
+    private readonly logger;
+    private readonly recentRequests;
+    constructor(entityStorage: EntityStorageMiddlewareService, commandExecutor: ServerCommandExecutorService);
+    /**
+     * Shared by admin Action and public forgot-password.
+     * Always returns a generic success for the forgot path (no user enumeration).
+     */
+    sendPasswordResetEmail(input: AXMSendPasswordResetEmailInput): Promise<{
+        success: boolean;
+        message?: string;
+        sent?: boolean;
+    }>;
+    completePasswordReset(input: AXMCompletePasswordResetInput): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    private resolveUser;
+    private listUsers;
+    private assertRateLimit;
+}

package/server/src/lib/password-reset/user-password-reset.service.js

@@ -0,0 +1,221 @@
+"use strict";
+var UserPasswordResetService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserPasswordResetService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const lodash_1 = require("lodash");
+const core_1 = require("@acorex-platform/framework-server/core");
+const providers_1 = require("@acorex-platform/framework-server/domain/providers");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_communication_management_contracts_1 = require("@acorex-platform/module-communication-management-client/contracts");
+const module_content_management_contracts_1 = require("@acorex-platform/module-content-management-client/contracts");
+//#region ---- Constants ----
+const USER_ENTITY = 'SecurityManagement.User';
+const TEMPLATE_ID = module_content_management_contracts_1.AXM_TEXT_TEMPLATE_IDS.passwordReset;
+const EMAIL_CHANNEL = 'email-smtp';
+const EXPIRY_MINUTES = 60;
+const RATE_LIMIT_WINDOW_MS = 60000;
+const RATE_LIMIT_MAX = 5;
+//#endregion
+//#region ---- Helpers ----
+function hashToken(token) {
+    return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+}
+function resolveWebOrigin(explicit) {
+    var _a, _b, _c;
+    const fromInput = explicit === null || explicit === void 0 ? void 0 : explicit.trim();
+    if (fromInput) {
+        return fromInput.replace(/\/$/, '');
+    }
+    const fromEnv = ((_a = process.env['ACOREX_WEB_ORIGIN']) === null || _a === void 0 ? void 0 : _a.trim()) ||
+        ((_c = (_b = process.env['CORS_ORIGINS']) === null || _b === void 0 ? void 0 : _b.split(',')[0]) === null || _c === void 0 ? void 0 : _c.trim()) ||
+        'http://localhost:4800';
+    return fromEnv.replace(/\/$/, '');
+}
+function tokensMatch(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(left, right);
+}
+//#endregion
+//#region ---- User password reset service ----
+let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordResetService {
+    constructor(entityStorage, commandExecutor) {
+        this.entityStorage = entityStorage;
+        this.commandExecutor = commandExecutor;
+        this.logger = new common_1.Logger(UserPasswordResetService_1.name);
+        this.recentRequests = new Map();
+    }
+    /**
+     * Shared by admin Action and public forgot-password.
+     * Always returns a generic success for the forgot path (no user enumeration).
+     */
+    sendPasswordResetEmail(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f;
+            const loginKey = ((_b = (_a = input.login) !== null && _a !== void 0 ? _a : input.userId) !== null && _b !== void 0 ? _b : '').toString().trim().toLowerCase();
+            if (loginKey) {
+                this.assertRateLimit(loginKey);
+            }
+            const user = yield this.resolveUser(input);
+            if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                // Opaque success for forgot; admin path still reports missing user.
+                if (input.userId) {
+                    return { success: false, message: 'User not found.' };
+                }
+                return { success: true, sent: false };
+            }
+            const email = (_c = user.email) === null || _c === void 0 ? void 0 : _c.trim();
+            if (!email) {
+                if (input.userId) {
+                    return { success: false, message: 'User does not have an email address.' };
+                }
+                return { success: true, sent: false };
+            }
+            const rawToken = (0, crypto_1.randomBytes)(32).toString('hex');
+            const now = new Date();
+            const expiresAt = new Date(now.getTime() + EXPIRY_MINUTES * 60000);
+            const passwordReset = {
+                tokenHash: hashToken(rawToken),
+                expiresAt: expiresAt.toISOString(),
+                sentAt: now.toISOString(),
+            };
+            yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, { passwordReset });
+            const isAdminPath = Boolean(input.userId);
+            const webOrigin = resolveWebOrigin(input.webOrigin);
+            const resetLink = `${webOrigin}/auth/reset-password?token=${encodeURIComponent(rawToken)}`;
+            const platformTenantId = (_d = (0, abstract_1.getPrimaryPlatformTenantId)()) === null || _d === void 0 ? void 0 : _d.trim();
+            if (!platformTenantId) {
+                this.logger.warn(`password-reset missing platform tenant id for user ${user.id}`);
+                if (isAdminPath) {
+                    return { success: false, message: 'Platform tenant context is required to send email.' };
+                }
+                return { success: true, sent: false };
+            }
+            // Event tokens only — master Context tokens (companyName, …) come from render resolve.
+            const merge = {
+                userName: user.displayName || user.username || email,
+                resetLink,
+                expiryMinutes: EXPIRY_MINUTES,
+            };
+            const renderResult = yield this.commandExecutor.execute(module_content_management_contracts_1.AXM_TEXT_TEMPLATE_RENDER_COMMAND_KEY, {
+                textTemplateId: TEMPLATE_ID,
+                tenantId: platformTenantId,
+                userId: user.id,
+                channel: 'email',
+                data: merge,
+            });
+            const rendered = (0, core_2.runtimeCommandPayloadData)(renderResult);
+            if (!(renderResult === null || renderResult === void 0 ? void 0 : renderResult.success) || !(rendered === null || rendered === void 0 ? void 0 : rendered.body)) {
+                const text = typeof ((_e = renderResult === null || renderResult === void 0 ? void 0 : renderResult.message) === null || _e === void 0 ? void 0 : _e.text) === 'string'
+                    ? renderResult.message.text
+                    : 'Password reset template is not configured.';
+                this.logger.warn(`password-reset text template render failed: ${text}`);
+                if (isAdminPath) {
+                    return { success: false, message: text };
+                }
+                return { success: true, sent: false };
+            }
+            const subject = rendered.subject;
+            const body = rendered.body;
+            const result = yield this.commandExecutor.execute(module_communication_management_contracts_1.AXMCommunicationManagementServerCommands.Send, {
+                title: subject || 'Password reset',
+                message: { subject, body },
+                channel: EMAIL_CHANNEL,
+                recipientAddress: email,
+                recipientUserId: user.id,
+                recipientName: user.displayName || user.username,
+                tenantId: platformTenantId,
+                definitionKey: TEMPLATE_ID,
+                correlationId: `password-reset:${user.id}:${passwordReset.sentAt}`,
+                idempotencyKey: `password-reset:${user.id}:${passwordReset.tokenHash}`,
+            });
+            if (!(result === null || result === void 0 ? void 0 : result.success)) {
+                const text = typeof ((_f = result === null || result === void 0 ? void 0 : result.message) === null || _f === void 0 ? void 0 : _f.text) === 'string'
+                    ? result.message.text
+                    : 'Failed to send password reset email.';
+                this.logger.warn(`password-reset send failed for user ${user.id}: ${text}`);
+                if (isAdminPath) {
+                    return { success: false, message: text };
+                }
+                return { success: true, sent: false };
+            }
+            return { success: true, sent: true };
+        });
+    }
+    completePasswordReset(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const token = (_a = input.token) === null || _a === void 0 ? void 0 : _a.trim();
+            const newPassword = (_b = input.newPassword) !== null && _b !== void 0 ? _b : '';
+            if (!token || !newPassword || newPassword.length < 6) {
+                return { success: false, message: 'A valid token and new password are required.' };
+            }
+            const tokenHash = hashToken(token);
+            const users = yield this.listUsers();
+            const user = users.find((u) => { var _a; return ((_a = u.passwordReset) === null || _a === void 0 ? void 0 : _a.tokenHash) && tokensMatch(u.passwordReset.tokenHash, tokenHash); });
+            if (!(user === null || user === void 0 ? void 0 : user.id) || !user.passwordReset) {
+                return { success: false, message: 'This password reset link is invalid or has expired.' };
+            }
+            const expiresAt = Date.parse(user.passwordReset.expiresAt);
+            if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) {
+                yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, { passwordReset: null });
+                return { success: false, message: 'This password reset link is invalid or has expired.' };
+            }
+            const password = yield (0, core_2.hashPassword)(newPassword);
+            yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, {
+                password,
+                passwordChangedAt: new Date().toISOString(),
+                passwordReset: null,
+            });
+            return { success: true };
+        });
+    }
+    resolveUser(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            if ((_a = input.userId) === null || _a === void 0 ? void 0 : _a.trim()) {
+                const record = yield this.entityStorage.getOneAsEngine(USER_ENTITY, input.userId.trim());
+                return (_b = record) !== null && _b !== void 0 ? _b : null;
+            }
+            const login = (_c = input.login) === null || _c === void 0 ? void 0 : _c.trim().toLowerCase();
+            if (!login) {
+                return null;
+            }
+            const users = yield this.listUsers();
+            return ((_d = users.find((u) => { var _a, _b; return ((_a = u.username) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) === login || ((_b = u.email) === null || _b === void 0 ? void 0 : _b.trim().toLowerCase()) === login; })) !== null && _d !== void 0 ? _d : null);
+        });
+    }
+    listUsers() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.entityStorage.query(USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 5000 }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            return Array.isArray(items) ? items : [];
+        });
+    }
+    assertRateLimit(key) {
+        var _a;
+        const now = Date.now();
+        const windowStart = now - RATE_LIMIT_WINDOW_MS;
+        const prior = ((_a = this.recentRequests.get(key)) !== null && _a !== void 0 ? _a : []).filter((t) => t >= windowStart);
+        if (prior.length >= RATE_LIMIT_MAX) {
+            throw new Error('Too many password reset requests. Please try again later.');
+        }
+        prior.push(now);
+        this.recentRequests.set(key, prior);
+    }
+};
+exports.UserPasswordResetService = UserPasswordResetService;
+exports.UserPasswordResetService = UserPasswordResetService = UserPasswordResetService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        providers_1.ServerCommandExecutorService])
+], UserPasswordResetService);
+//#endregion
+//# sourceMappingURL=user-password-reset.service.js.map

package/server/src/lib/password-reset/user-password-reset.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password-reset.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/user-password-reset.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,mCAAkE;AAClE,mCAA6B;AAE7B,iEAAwF;AACxF,kFAAkG;AAClG,6EAA8H;AAC9H,iEAAiG;AACjG,0HAAsH;AACtH,8GAI8D;AAQ9D,6BAA6B;AAE7B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,WAAW,GAAG,2DAAqB,CAAC,aAAa,CAAC;AACxD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,oBAAoB,GAAG,KAAM,CAAC;AACpC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,YAAY;AAEZ,2BAA2B;AAE3B,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiB;;IACzC,MAAM,SAAS,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,EAAE,CAAC;IACnC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GACX,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,0CAAE,IAAI,EAAE;SACxC,MAAA,MAAA,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0CAAE,IAAI,EAAE,CAAA;QAClD,uBAAuB,CAAC;IAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,YAAY;AAEZ,+CAA+C;AAGxC,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAInC,YACmB,aAA6C,EAC7C,eAA6C;QAD7C,kBAAa,GAAb,aAAa,CAAgC;QAC7C,oBAAe,GAAf,eAAe,CAA8B;QAL/C,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;QACnD,mBAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IAK3D,CAAC;IAEJ;;;OAGG;IACG,sBAAsB,CAC1B,KAAqC;;;YAErC,MAAM,QAAQ,GAAG,CAAC,MAAA,MAAA,KAAK,CAAC,KAAK,mCAAI,KAAK,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE,CAAC;gBACd,oEAAoE;gBACpE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBACxD,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;gBAC7E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,KAAM,CAAC,CAAC;YACpE,MAAM,aAAa,GAA6B;gBAC9C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;gBAC9B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE;aAC1B,CAAC;YAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAEpF,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,GAAG,SAAS,8BAA8B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAE3F,MAAM,gBAAgB,GAAG,MAAA,IAAA,qCAA0B,GAAE,0CAAE,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClF,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;gBAC3F,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,uFAAuF;YACrF,MAAM,KAAK,GAAG;gBACZ,QAAQ,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK;gBACpD,SAAS;gBACT,aAAa,EAAE,cAAc;aAC9B,CAAC;YAEJ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,0EAAoC,EAAE;gBAC5F,cAAc,EAAE,WAAW;gBAC3B,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,gCAAyB,EAAC,YAAY,CAA4C,CAAC;YACpG,IAAI,CAAC,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,CAAA,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA,EAAE,CAAC;gBAC9C,MAAM,IAAI,GACR,OAAO,CAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,0CAAE,IAAI,CAAA,KAAK,QAAQ;oBAC7C,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,4CAA4C,CAAC;gBACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;gBACxE,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,oFAAwC,CAAC,IAAI,EAAE;gBAC/F,KAAK,EAAE,OAAO,IAAI,gBAAgB;gBAClC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC1B,OAAO,EAAE,aAAa;gBACtB,gBAAgB,EAAE,KAAK;gBACvB,eAAe,EAAE,IAAI,CAAC,EAAE;gBACxB,aAAa,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAChD,QAAQ,EAAE,gBAAgB;gBAC1B,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,MAAM,EAAE;gBAClE,cAAc,EAAE,kBAAkB,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE;aACvE,CAAC,CAAC;YAEH,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAA,EAAE,CAAC;gBACrB,MAAM,IAAI,GACR,OAAO,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,0CAAE,IAAI,CAAA,KAAK,QAAQ;oBACvC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;oBACrB,CAAC,CAAC,sCAAsC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC5E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;KAAA;IAEK,qBAAqB,CACzB,KAAoC;;;YAEpC,MAAM,KAAK,GAAG,MAAA,KAAK,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,CAAC,CAAC,aAAa,0CAAE,SAAS,KAAI,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA,EAAA,CAAC,CAAC;YAChH,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;gBAC/D,QAAQ;gBACR,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC3C,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;KAAA;IAEa,WAAW,CACvB,KAAqC;;;YAErC,IAAI,MAAA,KAAK,CAAC,MAAM,0CAAE,IAAI,EAAE,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzF,OAAO,MAAC,MAAuD,mCAAI,IAAI,CAAC;YAC1E,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,KAAK,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,OAAO,CACL,MAAA,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,EAAE,eACJ,OAAA,CAAA,MAAA,CAAC,CAAC,QAAQ,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,IAAI,CAAA,MAAA,CAAC,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAA,EAAA,CACxF,mCAAI,IAAI,CACV,CAAC;QACJ,CAAC;KAAA;IAEa,SAAS;;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;YACF,MAAM,KAAK,GAAG,IAAA,YAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAA4C,CAAC;YAClF,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,CAAC;KAAA;IAEO,eAAe,CAAC,GAAW;;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,oBAAoB,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,MAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;CACF,CAAA;AAhMY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;6CAMuB,qCAA8B;QAC5B,wCAA4B;GANrD,wBAAwB,CAgMpC;AAED,YAAY"}

package/server/src/lib/queries/get-permission-holders-history.query.d.ts

@@ -0,0 +1,4 @@
+import type { ReportQueryInput, ReportQueryResult } from '@acorex-platform/framework-server/report';
+import type { EffectiveAccessHistoryService } from '../effective-access-history/effective-access-history.service';
+import { type SecurityHistoryFilterScopeOptions } from './security-query.helpers';
+export declare function runGetPermissionHoldersHistoryQuery(history: EffectiveAccessHistoryService, input: ReportQueryInput, scope?: SecurityHistoryFilterScopeOptions): Promise<ReportQueryResult>;

package/server/src/lib/queries/get-permission-holders-history.query.definition.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Build-time only. Do not import from Nest modules.
+ * Source: get-permission-holders-history.query.ts
+ */
+export declare const getPermissionHoldersHistoryQueryDefinition: import("@acorex-platform/framework-shared/runtime").AXPAlignedQueryMetadataDefinition;

package/server/src/lib/queries/get-permission-holders-history.query.definition.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Build-time only. Do not import from Nest modules.
+ * Source: get-permission-holders-history.query.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPermissionHoldersHistoryQueryDefinition = void 0;
+const runtime_1 = require("@acorex-platform/framework-shared/runtime");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+exports.getPermissionHoldersHistoryQueryDefinition = (0, runtime_1.defineQuery)({
+    key: module_security_management_contracts_1.RootConfig.queries.reports.getPermissionHoldersHistory,
+    title: 'Permission holders',
+    description: 'Users who held a permission that overlaps the selected date range, reconstructed from grant Change History.',
+    executionMode: 'backend',
+    kind: 'collection',
+    filter: [
+        { name: 'permission', title: 'Permission', source: 'custom', interface: { name: 'text-editor' } },
+        { name: 'dateRange', title: 'Date range', source: 'custom', interface: { name: 'date-time-editor' } },
+        { name: 'tenantId', title: 'Tenant', source: 'custom', interface: { name: 'lookup-editor' } },
+        { name: 'applicationId', title: 'Application', source: 'custom', interface: { name: 'lookup-editor' } },
+    ],
+    sort: [
+        { name: 'username', title: 'Username', field: 'username' },
+        { name: 'displayName', title: 'Display name', field: 'displayName' },
+        { name: 'permission', title: 'Permission', field: 'permission' },
+        { name: 'validFrom', title: 'Valid from', field: 'validFrom' },
+        { name: 'validTo', title: 'Valid to', field: 'validTo' },
+    ],
+    columns: [
+        { name: 'username', title: 'Username', interface: { name: 'text-editor' } },
+        { name: 'displayName', title: 'Display name', interface: { name: 'text-editor' } },
+        { name: 'permission', title: 'Permission', interface: { name: 'text-editor' } },
+        { name: 'validFrom', title: 'Valid from', interface: { name: 'date-time-editor' } },
+        { name: 'validTo', title: 'Valid to', interface: { name: 'date-time-editor' } },
+    ],
+    categories: [runtime_1.AXP_CATALOG_DEFINITION_CATEGORY_REPORT],
+});
+//# sourceMappingURL=get-permission-holders-history.query.definition.js.map

package/server/src/lib/queries/get-permission-holders-history.query.definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-permission-holders-history.query.definition.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/queries/get-permission-holders-history.query.definition.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,uEAAgH;AAChH,gHAAmF;AAEtE,QAAA,0CAA0C,GAAG,IAAA,qBAAW,EAAC;IACpE,GAAG,EAAE,iDAAU,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B;IAC3D,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EACT,6GAA6G;IAC/G,aAAa,EAAE,SAAS;IACxB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACjG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE;QACrG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE;KACxG;IACD,IAAI,EAAE;QACJ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;QAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE;QACpE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;QAChE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE;QAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;KACzD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QAC3E,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QAClF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QAC/E,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE;QACnF,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE;KAChF;IACD,UAAU,EAAE,CAAC,gDAAsC,CAAC;CACrD,CAAC,CAAC"}