@acorex-platform/module-security-management-server 0.0.15 → 2.0.0-next.42

package/contracts/src/server-commands.d.ts

@@ -0,0 +1,340 @@
+export declare const AXMSecurityManagementServerCommands: {
+    readonly SendPasswordResetEmail: "SecurityManagement:Server:SendPasswordResetEmail";
+    readonly CompletePasswordReset: "SecurityManagement:Server:CompletePasswordReset";
+    readonly ChangeOwnPassword: "SecurityManagement:Server:ChangeOwnPassword";
+    readonly GetOwnPasswordStatus: "SecurityManagement:Server:GetOwnPasswordStatus";
+    readonly InviteUser: "SecurityManagement:Server:InviteUser";
+    /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */
+    readonly ListTenantEntitledApplications: "SecurityManagement:Server:ListTenantEntitledApplications";
+    /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */
+    readonly ListInviteAssignableRoles: "SecurityManagement:Server:ListInviteAssignableRoles";
+    readonly ResendInvitation: "SecurityManagement:Server:ResendInvitation";
+    readonly CancelInvitation: "SecurityManagement:Server:CancelInvitation";
+    readonly AcceptInvitation: "SecurityManagement:Server:AcceptInvitation";
+    readonly ListMyPendingInvitations: "SecurityManagement:Server:ListMyPendingInvitations";
+    readonly DeclineInvitation: "SecurityManagement:Server:DeclineInvitation";
+    readonly AcceptMyInvitation: "SecurityManagement:Server:AcceptMyInvitation";
+    readonly LookupTenantByUniqueName: "SecurityManagement:Server:LookupTenantByUniqueName";
+    readonly RequestTenantMembership: "SecurityManagement:Server:RequestTenantMembership";
+    readonly ListMyJoinRequests: "SecurityManagement:Server:ListMyJoinRequests";
+    readonly CancelMyJoinRequest: "SecurityManagement:Server:CancelMyJoinRequest";
+    readonly ApproveJoinRequest: "SecurityManagement:Server:ApproveJoinRequest";
+    readonly RejectJoinRequest: "SecurityManagement:Server:RejectJoinRequest";
+    readonly CreateUserInTenant: "SecurityManagement:Server:CreateUserInTenant";
+    readonly StartTwoFactorEnrollment: "SecurityManagement:Server:StartTwoFactorEnrollment";
+    readonly ConfirmTwoFactorEnrollment: "SecurityManagement:Server:ConfirmTwoFactorEnrollment";
+    readonly DisableTwoFactor: "SecurityManagement:Server:DisableTwoFactor";
+    readonly GenerateTwoFactorRecoveryCodes: "SecurityManagement:Server:GenerateTwoFactorRecoveryCodes";
+    readonly GetTwoFactorStatus: "SecurityManagement:Server:GetTwoFactorStatus";
+    readonly AdminResetTwoFactor: "SecurityManagement:Server:AdminResetTwoFactor";
+    /** Public — completes login after password challenge (TOTP or recovery). */
+    readonly VerifyTwoFactorLogin: "SecurityManagement:Server:VerifyTwoFactorLogin";
+};
+/** Stable codes for self-service password change (client maps to i18n). */
+export declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
+    readonly NotSignedIn: "CHANGE_OWN_PASSWORD_NOT_SIGNED_IN";
+    readonly IncorrectCurrent: "CHANGE_OWN_PASSWORD_INCORRECT_CURRENT";
+    readonly SameAsCurrent: "CHANGE_OWN_PASSWORD_SAME_AS_CURRENT";
+    readonly InvalidInput: "CHANGE_OWN_PASSWORD_INVALID_INPUT";
+};
+/** Client/UI action key (confirm dialog → server send). */
+export declare const AXM_USER_SEND_PASSWORD_RESET_COMMAND = "SecurityManagement:User:SendPasswordResetEmail";
+/** Client/UI action key (confirm dialog → server admin reset 2FA). */
+export declare const AXM_USER_RESET_TWO_FACTOR_COMMAND = "SecurityManagement:User:ResetTwoFactor";
+/** Client/UI action keys for invite / create-in-tenant flows. */
+export declare const AXM_USER_INVITE_COMMAND = "SecurityManagement:User:Invite";
+export declare const AXM_USER_RESEND_INVITATION_COMMAND = "SecurityManagement:User:ResendInvitation";
+export declare const AXM_USER_CANCEL_INVITATION_COMMAND = "SecurityManagement:User:CancelInvitation";
+export declare const AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = "SecurityManagement:User:ApproveJoinRequest";
+export declare const AXM_USER_REJECT_JOIN_REQUEST_COMMAND = "SecurityManagement:User:RejectJoinRequest";
+export declare const AXM_USER_CREATE_IN_TENANT_COMMAND = "SecurityManagement:User:CreateInTenant";
+export interface AXMSendPasswordResetEmailInput {
+    /** Admin path: target user id. */
+    userId?: string;
+    /** Forgot path: email or username. */
+    login?: string;
+    /** Optional absolute web origin for reset link (defaults to env / localhost). */
+    webOrigin?: string;
+}
+export interface AXMCompletePasswordResetInput {
+    token: string;
+    newPassword: string;
+}
+export interface AXMChangeOwnPasswordInput {
+    /** Required when the account already has a password; omit/empty when setting the first password. */
+    currentPassword?: string;
+    newPassword: string;
+}
+export interface AXMChangeOwnPasswordResult {
+    passwordChangedAt: string;
+}
+export interface AXMGetOwnPasswordStatusResult {
+    /** True when the signed-in user has a non-empty stored password credential. */
+    hasPassword: boolean;
+}
+export interface AXMInviteUserInput {
+    email: string;
+    displayName?: string;
+    applicationIds?: string[];
+    /**
+     * Role ids to assign on invite (scoped UserRole grant).
+     * Application invite → app-scoped grant; tenant invite without per-app rows → tenant-wide grant.
+     */
+    roleIds?: string[];
+    /**
+     * TM Tenant Users repeater: roles per selected application.
+     * When present, server upserts a UserRole grant per application (not one tenant-wide grant).
+     */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * True when invite is from Tenant Users (tenant-membership) with multi-app UI.
+     * Server SoT with session edition feature — not Application.code === 'TM'.
+     */
+    tenantMembershipInvite?: boolean;
+    /** Client sets true after warning that the identity already exists. */
+    confirmExisting?: boolean;
+    webOrigin?: string;
+}
+/** One selectable application for TM invite (tenant subscription entitlement). */
+export interface AXMTenantEntitledApplicationItem {
+    id: string;
+    /** Raw MLS / string title — client resolves for display. */
+    title: unknown;
+}
+export interface AXMListTenantEntitledApplicationsResult {
+    items: AXMTenantEntitledApplicationItem[];
+}
+/** One Role overlay selectable on a TM invite repeater row. */
+export interface AXMInviteAssignableRoleItem {
+    id: string;
+    title: unknown;
+    name?: string;
+    applicationId: string;
+}
+export interface AXMListInviteAssignableRolesInput {
+    /** When set, only overlays for this application (current tenant). */
+    applicationId?: string;
+}
+export interface AXMListInviteAssignableRolesResult {
+    items: AXMInviteAssignableRoleItem[];
+}
+export interface AXMInviteUserResult {
+    userId: string;
+    tenantUserId: string;
+    userAlreadyExists: boolean;
+    sent: boolean;
+}
+export interface AXMResendInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+    webOrigin?: string;
+}
+export interface AXMCancelInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+}
+/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */
+export declare const AXM_ACCEPT_INVITATION_ERROR_CODES: {
+    readonly Invalid: "ACCEPT_INVITATION_INVALID";
+    readonly Expired: "ACCEPT_INVITATION_EXPIRED";
+    readonly PasswordRequired: "ACCEPT_INVITATION_PASSWORD_REQUIRED";
+};
+export type AXMAcceptInvitationReason = 'valid' | 'invalid' | 'expired';
+export interface AXMAcceptInvitationInput {
+    token: string;
+    newPassword?: string;
+    /** Check the token only. Does not set a password or consume the link. */
+    preview?: boolean;
+}
+export interface AXMAcceptInvitationPreviewResult {
+    usable: boolean;
+    reason: AXMAcceptInvitationReason;
+}
+export interface AXMPendingInvitationItem {
+    tenantUserId: string;
+    tenantId: string;
+    tenantTitle?: string;
+    /** Tenant branding logo URL / storage id when available. */
+    tenantLogo?: string;
+    invitedByUserId?: string;
+    expiresAt?: string;
+    sentAt?: string;
+    applicationIds?: string[];
+}
+export interface AXMListMyPendingInvitationsResult {
+    items: AXMPendingInvitationItem[];
+}
+export interface AXMAcceptMyInvitationInput {
+    tenantUserId: string;
+    newPassword?: string;
+}
+export interface AXMDeclineInvitationInput {
+    tenantUserId: string;
+}
+/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */
+export declare const AXM_JOIN_REQUEST_ERROR_CODES: {
+    readonly NotSignedIn: "JOIN_REQUEST_NOT_SIGNED_IN";
+    readonly InvalidInput: "JOIN_REQUEST_INVALID_INPUT";
+    readonly TenantNotFound: "JOIN_REQUEST_TENANT_NOT_FOUND";
+    readonly AlreadyMember: "JOIN_REQUEST_ALREADY_MEMBER";
+    readonly InvitePending: "JOIN_REQUEST_INVITE_PENDING";
+    readonly RequestNotFound: "JOIN_REQUEST_NOT_FOUND";
+    readonly NotPending: "JOIN_REQUEST_NOT_PENDING";
+};
+export interface AXMLookupTenantByUniqueNameInput {
+    /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */
+    uniqueName: string;
+}
+export interface AXMLookupTenantByUniqueNameItem {
+    id: string;
+    /** Stored unique name with original casing. */
+    name: string;
+}
+export interface AXMLookupTenantByUniqueNameResult {
+    /** Present only when the name/title matches exactly one active tenant. */
+    item?: AXMLookupTenantByUniqueNameItem | null;
+}
+export interface AXMRequestTenantMembershipInput {
+    /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */
+    uniqueName: string;
+}
+export interface AXMRequestTenantMembershipResult {
+    tenantUserId: string;
+    tenantId: string;
+    tenantName: string;
+}
+export interface AXMJoinRequestItem {
+    tenantUserId: string;
+    tenantId: string;
+    tenantName?: string;
+    tenantTitle?: string;
+    /** Tenant branding logo URL / storage id when available. */
+    tenantLogo?: string;
+    sentAt?: string;
+    expiresAt?: string;
+}
+export interface AXMListMyJoinRequestsResult {
+    items: AXMJoinRequestItem[];
+}
+export interface AXMCancelMyJoinRequestInput {
+    tenantUserId: string;
+}
+export interface AXMApproveJoinRequestInput {
+    tenantUserId?: string;
+    userId?: string;
+    /** Product / app-scoped approve: roles for the current session application. */
+    roleIds?: string[];
+    applicationIds?: string[];
+    /** TM Tenant Users: per-application role rows (same shape as invite). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * When true, allow multi-application assignment (TM Tenant Users + edition feature).
+     * Mirrors invite `tenantMembershipInvite`.
+     */
+    tenantMembershipApprove?: boolean;
+}
+export interface AXMRejectJoinRequestInput {
+    tenantUserId?: string;
+    userId?: string;
+}
+export interface AXMCreateUserInTenantInput {
+    email?: string;
+    username?: string;
+    displayName?: string;
+    password?: string;
+    applicationIds?: string[];
+    /** Product Users create: roles for the current session application. */
+    roleIds?: string[];
+    /** TM Tenant Users create: per-application role rows (merged client-side before submit). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * When true, allow multi-application assignment (TM Tenant Users + edition feature).
+     * Parallel to invite `tenantMembershipInvite`; Create path only.
+     */
+    tenantMembershipCreate?: boolean;
+}
+export interface AXMCreateUserInTenantResult {
+    userId: string;
+    tenantUserId: string;
+}
+/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
+export declare const AXM_TWO_FACTOR_ERROR_CODES: {
+    readonly NotSignedIn: "TWO_FACTOR_NOT_SIGNED_IN";
+    readonly InvalidInput: "TWO_FACTOR_INVALID_INPUT";
+    readonly IncorrectPassword: "TWO_FACTOR_INCORRECT_PASSWORD";
+    readonly IncorrectCode: "TWO_FACTOR_INCORRECT_CODE";
+    readonly AlreadyEnabled: "TWO_FACTOR_ALREADY_ENABLED";
+    readonly NotEnabled: "TWO_FACTOR_NOT_ENABLED";
+    readonly EnrollmentExpired: "TWO_FACTOR_ENROLLMENT_EXPIRED";
+    readonly ChallengeExpired: "TWO_FACTOR_CHALLENGE_EXPIRED";
+    readonly RateLimited: "TWO_FACTOR_RATE_LIMITED";
+    readonly InvalidConfiguration: "TWO_FACTOR_INVALID_CONFIGURATION";
+    readonly ProofRequired: "TWO_FACTOR_PROOF_REQUIRED";
+    readonly UserNotFound: "TWO_FACTOR_USER_NOT_FOUND";
+    readonly Forbidden: "TWO_FACTOR_FORBIDDEN";
+};
+export interface AXMStartTwoFactorEnrollmentInput {
+    password: string;
+}
+export interface AXMStartTwoFactorEnrollmentResult {
+    enrollmentId: string;
+    otpauthUri: string;
+    /** Base32 secret for manual entry (client renders QR via ax-qrcode). */
+    secretBase32: string;
+    expiresAt: string;
+}
+export interface AXMConfirmTwoFactorEnrollmentInput {
+    enrollmentId: string;
+    code: string;
+}
+export interface AXMConfirmTwoFactorEnrollmentResult {
+    enabled: true;
+    verifiedAt: string;
+}
+export interface AXMDisableTwoFactorInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+export interface AXMDisableTwoFactorResult {
+    enabled: false;
+}
+export interface AXMGenerateTwoFactorRecoveryCodesInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+export interface AXMGenerateTwoFactorRecoveryCodesResult {
+    /** Plaintext codes shown once only (display format ABCD-EFGH). */
+    codes: string[];
+}
+export interface AXMGetTwoFactorStatusResult {
+    enabled: boolean;
+    enrolled: boolean;
+    verifiedAt?: string | null;
+    hasRecoveryCodes: boolean;
+    unusedRecoveryCodeCount: number;
+}
+export interface AXMAdminResetTwoFactorInput {
+    userId: string;
+    /** When true, only validates that 2FA is enabled; does not wipe or revoke sessions. */
+    dryRun?: boolean;
+}
+export interface AXMAdminResetTwoFactorResult {
+    reset: boolean;
+}
+export interface AXMVerifyTwoFactorLoginInput {
+    challengeId: string;
+    /** TOTP (6 digits) or recovery code. */
+    code: string;
+    rememberMe?: boolean;
+}

package/contracts/src/server-commands.js

@@ -0,0 +1,88 @@
+"use strict";
+//#region ---- Security management server command keys ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXM_TWO_FACTOR_ERROR_CODES = exports.AXM_JOIN_REQUEST_ERROR_CODES = exports.AXM_ACCEPT_INVITATION_ERROR_CODES = exports.AXM_USER_CREATE_IN_TENANT_COMMAND = exports.AXM_USER_REJECT_JOIN_REQUEST_COMMAND = exports.AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = exports.AXM_USER_CANCEL_INVITATION_COMMAND = exports.AXM_USER_RESEND_INVITATION_COMMAND = exports.AXM_USER_INVITE_COMMAND = exports.AXM_USER_RESET_TWO_FACTOR_COMMAND = exports.AXM_USER_SEND_PASSWORD_RESET_COMMAND = exports.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = exports.AXMSecurityManagementServerCommands = void 0;
+exports.AXMSecurityManagementServerCommands = {
+    SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',
+    CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',
+    ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',
+    GetOwnPasswordStatus: 'SecurityManagement:Server:GetOwnPasswordStatus',
+    InviteUser: 'SecurityManagement:Server:InviteUser',
+    /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */
+    ListTenantEntitledApplications: 'SecurityManagement:Server:ListTenantEntitledApplications',
+    /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */
+    ListInviteAssignableRoles: 'SecurityManagement:Server:ListInviteAssignableRoles',
+    ResendInvitation: 'SecurityManagement:Server:ResendInvitation',
+    CancelInvitation: 'SecurityManagement:Server:CancelInvitation',
+    AcceptInvitation: 'SecurityManagement:Server:AcceptInvitation',
+    ListMyPendingInvitations: 'SecurityManagement:Server:ListMyPendingInvitations',
+    DeclineInvitation: 'SecurityManagement:Server:DeclineInvitation',
+    AcceptMyInvitation: 'SecurityManagement:Server:AcceptMyInvitation',
+    LookupTenantByUniqueName: 'SecurityManagement:Server:LookupTenantByUniqueName',
+    RequestTenantMembership: 'SecurityManagement:Server:RequestTenantMembership',
+    ListMyJoinRequests: 'SecurityManagement:Server:ListMyJoinRequests',
+    CancelMyJoinRequest: 'SecurityManagement:Server:CancelMyJoinRequest',
+    ApproveJoinRequest: 'SecurityManagement:Server:ApproveJoinRequest',
+    RejectJoinRequest: 'SecurityManagement:Server:RejectJoinRequest',
+    CreateUserInTenant: 'SecurityManagement:Server:CreateUserInTenant',
+    StartTwoFactorEnrollment: 'SecurityManagement:Server:StartTwoFactorEnrollment',
+    ConfirmTwoFactorEnrollment: 'SecurityManagement:Server:ConfirmTwoFactorEnrollment',
+    DisableTwoFactor: 'SecurityManagement:Server:DisableTwoFactor',
+    GenerateTwoFactorRecoveryCodes: 'SecurityManagement:Server:GenerateTwoFactorRecoveryCodes',
+    GetTwoFactorStatus: 'SecurityManagement:Server:GetTwoFactorStatus',
+    AdminResetTwoFactor: 'SecurityManagement:Server:AdminResetTwoFactor',
+    /** Public — completes login after password challenge (TOTP or recovery). */
+    VerifyTwoFactorLogin: 'SecurityManagement:Server:VerifyTwoFactorLogin',
+};
+/** Stable codes for self-service password change (client maps to i18n). */
+exports.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {
+    NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',
+    IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',
+    SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',
+    InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',
+};
+/** Client/UI action key (confirm dialog → server send). */
+exports.AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';
+/** Client/UI action key (confirm dialog → server admin reset 2FA). */
+exports.AXM_USER_RESET_TWO_FACTOR_COMMAND = 'SecurityManagement:User:ResetTwoFactor';
+/** Client/UI action keys for invite / create-in-tenant flows. */
+exports.AXM_USER_INVITE_COMMAND = 'SecurityManagement:User:Invite';
+exports.AXM_USER_RESEND_INVITATION_COMMAND = 'SecurityManagement:User:ResendInvitation';
+exports.AXM_USER_CANCEL_INVITATION_COMMAND = 'SecurityManagement:User:CancelInvitation';
+exports.AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:ApproveJoinRequest';
+exports.AXM_USER_REJECT_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:RejectJoinRequest';
+exports.AXM_USER_CREATE_IN_TENANT_COMMAND = 'SecurityManagement:User:CreateInTenant';
+/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */
+exports.AXM_ACCEPT_INVITATION_ERROR_CODES = {
+    Invalid: 'ACCEPT_INVITATION_INVALID',
+    Expired: 'ACCEPT_INVITATION_EXPIRED',
+    PasswordRequired: 'ACCEPT_INVITATION_PASSWORD_REQUIRED',
+};
+/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */
+exports.AXM_JOIN_REQUEST_ERROR_CODES = {
+    NotSignedIn: 'JOIN_REQUEST_NOT_SIGNED_IN',
+    InvalidInput: 'JOIN_REQUEST_INVALID_INPUT',
+    TenantNotFound: 'JOIN_REQUEST_TENANT_NOT_FOUND',
+    AlreadyMember: 'JOIN_REQUEST_ALREADY_MEMBER',
+    InvitePending: 'JOIN_REQUEST_INVITE_PENDING',
+    RequestNotFound: 'JOIN_REQUEST_NOT_FOUND',
+    NotPending: 'JOIN_REQUEST_NOT_PENDING',
+};
+/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
+exports.AXM_TWO_FACTOR_ERROR_CODES = {
+    NotSignedIn: 'TWO_FACTOR_NOT_SIGNED_IN',
+    InvalidInput: 'TWO_FACTOR_INVALID_INPUT',
+    IncorrectPassword: 'TWO_FACTOR_INCORRECT_PASSWORD',
+    IncorrectCode: 'TWO_FACTOR_INCORRECT_CODE',
+    AlreadyEnabled: 'TWO_FACTOR_ALREADY_ENABLED',
+    NotEnabled: 'TWO_FACTOR_NOT_ENABLED',
+    EnrollmentExpired: 'TWO_FACTOR_ENROLLMENT_EXPIRED',
+    ChallengeExpired: 'TWO_FACTOR_CHALLENGE_EXPIRED',
+    RateLimited: 'TWO_FACTOR_RATE_LIMITED',
+    InvalidConfiguration: 'TWO_FACTOR_INVALID_CONFIGURATION',
+    ProofRequired: 'TWO_FACTOR_PROOF_REQUIRED',
+    UserNotFound: 'TWO_FACTOR_USER_NOT_FOUND',
+    Forbidden: 'TWO_FACTOR_FORBIDDEN',
+};
+//#endregion
+//# sourceMappingURL=server-commands.js.map

package/contracts/src/server-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-commands.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/server-commands.ts"],"names":[],"mappings":";AAAA,2DAA2D;;;AAE9C,QAAA,mCAAmC,GAAG;IACjD,sBAAsB,EAAE,kDAAkD;IAC1E,qBAAqB,EAAE,iDAAiD;IACxE,iBAAiB,EAAE,6CAA6C;IAChE,oBAAoB,EAAE,gDAAgD;IACtE,UAAU,EAAE,sCAAsC;IAClD,8EAA8E;IAC9E,8BAA8B,EAAE,0DAA0D;IAC1F,0FAA0F;IAC1F,yBAAyB,EAAE,qDAAqD;IAChF,gBAAgB,EAAE,4CAA4C;IAC9D,gBAAgB,EAAE,4CAA4C;IAC9D,gBAAgB,EAAE,4CAA4C;IAC9D,wBAAwB,EAAE,oDAAoD;IAC9E,iBAAiB,EAAE,6CAA6C;IAChE,kBAAkB,EAAE,8CAA8C;IAClE,wBAAwB,EAAE,oDAAoD;IAC9E,uBAAuB,EAAE,mDAAmD;IAC5E,kBAAkB,EAAE,8CAA8C;IAClE,mBAAmB,EAAE,+CAA+C;IACpE,kBAAkB,EAAE,8CAA8C;IAClE,iBAAiB,EAAE,6CAA6C;IAChE,kBAAkB,EAAE,8CAA8C;IAClE,wBAAwB,EAAE,oDAAoD;IAC9E,0BAA0B,EAAE,sDAAsD;IAClF,gBAAgB,EAAE,4CAA4C;IAC9D,8BAA8B,EAAE,0DAA0D;IAC1F,kBAAkB,EAAE,8CAA8C;IAClE,mBAAmB,EAAE,+CAA+C;IACpE,4EAA4E;IAC5E,oBAAoB,EAAE,gDAAgD;CAC9D,CAAC;AAEX,2EAA2E;AAC9D,QAAA,mCAAmC,GAAG;IACjD,WAAW,EAAE,mCAAmC;IAChD,gBAAgB,EAAE,uCAAuC;IACzD,aAAa,EAAE,qCAAqC;IACpD,YAAY,EAAE,mCAAmC;CACzC,CAAC;AAEX,2DAA2D;AAC9C,QAAA,oCAAoC,GAAG,gDAAgD,CAAC;AAErG,sEAAsE;AACzD,QAAA,iCAAiC,GAAG,wCAAwC,CAAC;AAE1F,iEAAiE;AACpD,QAAA,uBAAuB,GAAG,gCAAgC,CAAC;AAC3D,QAAA,kCAAkC,GAAG,0CAA0C,CAAC;AAChF,QAAA,kCAAkC,GAAG,0CAA0C,CAAC;AAChF,QAAA,qCAAqC,GAAG,4CAA4C,CAAC;AACrF,QAAA,oCAAoC,GAAG,2CAA2C,CAAC;AACnF,QAAA,iCAAiC,GAAG,wCAAwC,CAAC;AAqG1F,wGAAwG;AAC3F,QAAA,iCAAiC,GAAG;IAC/C,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,2BAA2B;IACpC,gBAAgB,EAAE,qCAAqC;CAC/C,CAAC;AAyCX,+EAA+E;AAClE,QAAA,4BAA4B,GAAG;IAC1C,WAAW,EAAE,4BAA4B;IACzC,YAAY,EAAE,4BAA4B;IAC1C,cAAc,EAAE,+BAA+B;IAC/C,aAAa,EAAE,6BAA6B;IAC5C,aAAa,EAAE,6BAA6B;IAC5C,eAAe,EAAE,wBAAwB;IACzC,UAAU,EAAE,0BAA0B;CAC9B,CAAC;AA0FX,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG;IACxC,WAAW,EAAE,0BAA0B;IACvC,YAAY,EAAE,0BAA0B;IACxC,iBAAiB,EAAE,+BAA+B;IAClD,aAAa,EAAE,2BAA2B;IAC1C,cAAc,EAAE,4BAA4B;IAC5C,UAAU,EAAE,wBAAwB;IACpC,iBAAiB,EAAE,+BAA+B;IAClD,gBAAgB,EAAE,8BAA8B;IAChD,WAAW,EAAE,yBAAyB;IACtC,oBAAoB,EAAE,kCAAkC;IACxD,aAAa,EAAE,2BAA2B;IAC1C,YAAY,EAAE,2BAA2B;IACzC,SAAS,EAAE,sBAAsB;CACzB,CAAC;AAsEX,YAAY"}

package/contracts/src/settings.keys.d.ts

@@ -0,0 +1,16 @@
+/** Platform settings owned by Security Management. */
+export declare const AXMSecurityManagementSettings: {
+    /**
+     * Which Users-list add actions are available.
+     * `create` and `invite` are primary. `both` shows them as secondary actions.
+     */
+    readonly UserProvisioningMode: "SecurityManagement:Setting:User.ProvisioningMode";
+};
+export declare const AXMUserProvisioningMode: {
+    readonly Create: "create";
+    readonly Invite: "invite";
+    readonly Both: "both";
+};
+export type AXMUserProvisioningMode = (typeof AXMUserProvisioningMode)[keyof typeof AXMUserProvisioningMode];
+/** Used when the platform setting has not been saved yet. */
+export declare const AXM_USER_PROVISIONING_MODE_DEFAULT: "both";

package/contracts/src/settings.keys.js

@@ -0,0 +1,21 @@
+"use strict";
+//#region ----- User provisioning settings -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXM_USER_PROVISIONING_MODE_DEFAULT = exports.AXMUserProvisioningMode = exports.AXMSecurityManagementSettings = void 0;
+/** Platform settings owned by Security Management. */
+exports.AXMSecurityManagementSettings = {
+    /**
+     * Which Users-list add actions are available.
+     * `create` and `invite` are primary. `both` shows them as secondary actions.
+     */
+    UserProvisioningMode: 'SecurityManagement:Setting:User.ProvisioningMode',
+};
+exports.AXMUserProvisioningMode = {
+    Create: 'create',
+    Invite: 'invite',
+    Both: 'both',
+};
+/** Used when the platform setting has not been saved yet. */
+exports.AXM_USER_PROVISIONING_MODE_DEFAULT = exports.AXMUserProvisioningMode.Both;
+//#endregion
+//# sourceMappingURL=settings.keys.js.map

package/contracts/src/settings.keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/settings.keys.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AAEhD,sDAAsD;AACzC,QAAA,6BAA6B,GAAG;IAC3C;;;OAGG;IACH,oBAAoB,EAAE,kDAAkD;CAChE,CAAC;AAEE,QAAA,uBAAuB,GAAG;IACrC,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;CACJ,CAAC;AAIX,6DAA6D;AAChD,QAAA,kCAAkC,GAAG,+BAAuB,CAAC,IAAI,CAAC;AAE/E,YAAY"}

package/contracts/src/user-access-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-access-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/user-access-state.ts"],"names":[],"mappings":";AAAA,qCAAqC;;;AAErC;;;GAGG;AACH,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;AACrB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAED,YAAY"}
+{"version":3,"file":"user-access-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-access-state.ts"],"names":[],"mappings":";AAAA,qCAAqC;;;AAErC;;;GAGG;AACH,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;AACrB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAED,YAAY"}

package/contracts/src/user-effective-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-effective-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/user-effective-state.ts"],"names":[],"mappings":";AAAA,kDAAkD;;;AAElD;;GAEG;AACH,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,0CAAiB,CAAA;IACjB,gDAAuB,CAAA;IACvB,8CAAqB,CAAA;IACrB,8CAAqB,CAAA;IACrB,0DAAiC,CAAA;IACjC,iEAAwC,CAAA;AAC1C,CAAC,EARW,qBAAqB,qCAArB,qBAAqB,QAQhC;AAED,YAAY"}
+{"version":3,"file":"user-effective-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-effective-state.ts"],"names":[],"mappings":";AAAA,kDAAkD;;;AAElD;;GAEG;AACH,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,0CAAiB,CAAA;IACjB,gDAAuB,CAAA;IACvB,8CAAqB,CAAA;IACrB,8CAAqB,CAAA;IACrB,0DAAiC,CAAA;IACjC,iEAAwC,CAAA;AAC1C,CAAC,EARW,qBAAqB,qCAArB,qBAAqB,QAQhC;AAED,YAAY"}

package/contracts/src/user-invitation.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Invitation challenge / audit metadata on TenantManagement.TenantUser.
+ * The raw token is never persisted — only a SHA-256 hash while the invite is pending.
+ */
+export interface AXMUserInvitationInfo {
+    /** Present only while `TenantUser.statusId` is pending; cleared after resolve. */
+    tokenHash?: string;
+    expiresAt: string;
+    sentAt: string;
+    invitedByUserId: string;
+    applicationIds?: string[];
+    /** Role ids selected at invite time (flat union; mirrored onto scoped UserRole). */
+    roleIds?: string[];
+    /** TM Tenant Users: roles grouped by application (optional audit / accept helper). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * `invite` = admin sent; `join-request` = user requested membership from waiting room;
+     * `tenant-request` = user requested creation of a new tenant (public form).
+     */
+    source: AXMMembershipInvitationSource;
+    /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */
+    acceptedAt?: string;
+}
+export type AXMMembershipInvitationSource = 'invite' | 'join-request' | 'tenant-request';
+export declare const AXM_MEMBERSHIP_INVITATION_SOURCE: {
+    readonly Invite: "invite";
+    readonly JoinRequest: "join-request";
+    readonly TenantRequest: "tenant-request";
+};
+/** How a User identity row was created (directory provenance). */
+export type AXMUserCreatedVia = 'invite' | 'create-in-tenant' | 'register' | 'seed' | 'idp' | 'tenant-request';
+/**
+ * In-app inbox definition for membership invites to users who already have a tenant.
+ * Inbox row action opens the auth waiting room (Approve/Decline live there).
+ */
+export declare const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY: "security-management.membership-invitation";
+/** Query `source` value when opening waiting room from a membership-invite notification. */
+export declare const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE: "membership-invite";

package/contracts/src/user-invitation.js

@@ -0,0 +1,18 @@
+"use strict";
+//#region ---- User invitation payload on TenantUser ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = exports.AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY = exports.AXM_MEMBERSHIP_INVITATION_SOURCE = void 0;
+exports.AXM_MEMBERSHIP_INVITATION_SOURCE = {
+    Invite: 'invite',
+    JoinRequest: 'join-request',
+    TenantRequest: 'tenant-request',
+};
+/**
+ * In-app inbox definition for membership invites to users who already have a tenant.
+ * Inbox row action opens the auth waiting room (Approve/Decline live there).
+ */
+exports.AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY = 'security-management.membership-invitation';
+/** Query `source` value when opening waiting room from a membership-invite notification. */
+exports.AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = 'membership-invite';
+//#endregion
+//# sourceMappingURL=user-invitation.js.map

package/contracts/src/user-invitation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-invitation.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-invitation.ts"],"names":[],"mappings":";AAAA,yDAAyD;;;AA4B5C,QAAA,gCAAgC,GAAG;IAC9C,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,cAAc;IAC3B,aAAa,EAAE,gBAAgB;CACvB,CAAC;AAUX;;;GAGG;AACU,QAAA,qDAAqD,GAChE,2CAAoD,CAAC;AAEvD,4FAA4F;AAC/E,QAAA,yCAAyC,GAAG,mBAA4B,CAAC;AAEtF,YAAY"}

package/contracts/src/user-password-reset.d.ts

@@ -0,0 +1,9 @@
+/**
+ * One-time password-reset token state stored as JSON on SecurityManagement.User.
+ * The raw token is never persisted — only a SHA-256 hash.
+ */
+export interface AXMUserPasswordResetInfo {
+    tokenHash: string;
+    expiresAt: string;
+    sentAt: string;
+}

package/contracts/src/user-password-reset.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- Password reset payload on User ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=user-password-reset.js.map

package/contracts/src/user-password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password-reset.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-password-reset.ts"],"names":[],"mappings":";AAAA,kDAAkD;;AAYlD,YAAY"}

package/package.json

@@ -1,22 +1,27 @@
 {
   "name": "@acorex-platform/module-security-management-server",
-  "version": "0.0.15",
+  "version": "2.0.0-next.42",
   "type": "commonjs",
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
+  "main": "./server/src/index.js",
+  "types": "./server/src/index.d.ts",
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@acorex-platform/module-common-server": "0.0.15"
+    "@acorex-platform/framework-server": "2.0.0-next.42",
+    "@acorex-platform/framework-shared": "2.0.0-next.42",
+    "@acorex-platform/module-auth-client": "2.0.0-next.42",
+    "@acorex-platform/module-common-client": "2.0.0-next.42",
+    "@acorex-platform/module-common-server": "2.0.0-next.42",
+    "@acorex-platform/module-communication-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-content-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-organization-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-security-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-settings-management-server": "2.0.0-next.42",
+    "@nestjs/common": "^11.0.0"
   },
   "exports": {
     "./package.json": "./package.json",
     ".": {
-      "types": "./src/index.d.ts",
-      "default": "./src/index.js"
-    },
-    "./seed": {
-      "types": "./src/lib/seed/index.d.ts",
-      "default": "./src/lib/seed/index.js"
+      "types": "./server/src/index.d.ts",
+      "default": "./server/src/index.js"
     },
     "./contracts": {
       "types": "./contracts/src/index.d.ts",

package/server/src/index.d.ts

@@ -0,0 +1,3 @@
+export * from './lib/security-management-server.module';
+export { securityManagementEntityCatalog } from './lib/entities';
+export { ADMINISTRATION_REPORTS_CATEGORY_ID, SECURITY_ACCESS_CATEGORY_ID, } from './lib/reports/security-report.definitions';

package/server/src/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECURITY_ACCESS_CATEGORY_ID = exports.ADMINISTRATION_REPORTS_CATEGORY_ID = exports.securityManagementEntityCatalog = void 0;
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lib/security-management-server.module"), exports);
+var entities_1 = require("./lib/entities");
+Object.defineProperty(exports, "securityManagementEntityCatalog", { enumerable: true, get: function () { return entities_1.securityManagementEntityCatalog; } });
+var security_report_definitions_1 = require("./lib/reports/security-report.definitions");
+Object.defineProperty(exports, "ADMINISTRATION_REPORTS_CATEGORY_ID", { enumerable: true, get: function () { return security_report_definitions_1.ADMINISTRATION_REPORTS_CATEGORY_ID; } });
+Object.defineProperty(exports, "SECURITY_ACCESS_CATEGORY_ID", { enumerable: true, get: function () { return security_report_definitions_1.SECURITY_ACCESS_CATEGORY_ID; } });
+//# sourceMappingURL=index.js.map

package/server/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/src/index.ts"],"names":[],"mappings":";;;;AAAA,kFAAwD;AACxD,2CAAiE;AAAxD,2HAAA,+BAA+B,OAAA;AACxC,yFAGmD;AAFjD,iJAAA,kCAAkC,OAAA;AAClC,0IAAA,2BAA2B,OAAA"}