@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/effective-access-history/version-as-of.util.js

@@ -0,0 +1,167 @@
+"use strict";
+//#region ----- Types -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sortVersionEntries = sortVersionEntries;
+exports.reconstructSnapshotAt = reconstructSnapshotAt;
+exports.buildStateIntervals = buildStateIntervals;
+exports.intervalsOverlap = intervalsOverlap;
+exports.clipInterval = clipInterval;
+exports.mergeTimeIntervals = mergeTimeIntervals;
+exports.collectBoundaries = collectBoundaries;
+exports.toIso = toIso;
+//#endregion
+//#region ----- Entry sorting & as-of -----
+/** Sort entries ascending by versionNumber, then changedAt. */
+function sortVersionEntries(entries) {
+    return [...entries].sort((a, b) => {
+        var _a, _b;
+        const versionDiff = Number((_a = a.versionNumber) !== null && _a !== void 0 ? _a : 0) - Number((_b = b.versionNumber) !== null && _b !== void 0 ? _b : 0);
+        if (versionDiff !== 0) {
+            return versionDiff;
+        }
+        return toTime(a.changedAt) - toTime(b.changedAt);
+    });
+}
+/**
+ * Reconstruct entity snapshot at `asOf` from a version stream.
+ * Uses the latest entry with `changedAt <= asOf`. Delete → null.
+ */
+function reconstructSnapshotAt(entries, asOf) {
+    var _a;
+    const sorted = sortVersionEntries(entries);
+    const asOfMs = asOf.getTime();
+    let latest = null;
+    for (const entry of sorted) {
+        const changedMs = toTime(entry.changedAt);
+        if (Number.isNaN(changedMs) || changedMs > asOfMs) {
+            break;
+        }
+        latest = entry;
+    }
+    if (!latest) {
+        return null;
+    }
+    if (String((_a = latest.changeType) !== null && _a !== void 0 ? _a : '') === 'Delete') {
+        return null;
+    }
+    return asRecord(latest.snapshotJson);
+}
+/**
+ * Build contiguous state intervals from ordered version entries.
+ * Each Create/Update opens/continues a state until the next entry (or open-ended).
+ */
+function buildStateIntervals(entries) {
+    var _a;
+    const sorted = sortVersionEntries(entries);
+    if (sorted.length === 0) {
+        return [];
+    }
+    const intervals = [];
+    for (let i = 0; i < sorted.length; i++) {
+        const entry = sorted[i];
+        const from = new Date(toTime(entry.changedAt));
+        if (Number.isNaN(from.getTime())) {
+            continue;
+        }
+        const next = sorted[i + 1];
+        const to = next ? new Date(toTime(next.changedAt)) : null;
+        const isDelete = String((_a = entry.changeType) !== null && _a !== void 0 ? _a : '') === 'Delete';
+        const state = isDelete ? null : asRecord(entry.snapshotJson);
+        intervals.push({ from, to, state });
+    }
+    return intervals;
+}
+//#endregion
+//#region ----- Interval helpers -----
+function intervalsOverlap(a, b) {
+    var _a, _b, _c, _d;
+    const aEnd = (_b = (_a = a.to) === null || _a === void 0 ? void 0 : _a.getTime()) !== null && _b !== void 0 ? _b : Number.POSITIVE_INFINITY;
+    const bEnd = (_d = (_c = b.to) === null || _c === void 0 ? void 0 : _c.getTime()) !== null && _d !== void 0 ? _d : Number.POSITIVE_INFINITY;
+    return a.from.getTime() < bEnd && b.from.getTime() < aEnd;
+}
+/** Clip `interval` to `range`; returns null when there is no overlap. */
+function clipInterval(interval, range) {
+    var _a, _b, _c, _d;
+    if (!intervalsOverlap(interval, range)) {
+        return null;
+    }
+    const fromMs = Math.max(interval.from.getTime(), range.from.getTime());
+    const intervalEnd = (_b = (_a = interval.to) === null || _a === void 0 ? void 0 : _a.getTime()) !== null && _b !== void 0 ? _b : Number.POSITIVE_INFINITY;
+    const rangeEnd = (_d = (_c = range.to) === null || _c === void 0 ? void 0 : _c.getTime()) !== null && _d !== void 0 ? _d : Number.POSITIVE_INFINITY;
+    const toMs = Math.min(intervalEnd, rangeEnd);
+    if (fromMs >= toMs) {
+        return null;
+    }
+    return {
+        from: new Date(fromMs),
+        to: Number.isFinite(toMs) ? new Date(toMs) : null,
+    };
+}
+/** Merge overlapping/adjacent intervals (assumes same payload identity). */
+function mergeTimeIntervals(intervals) {
+    var _a, _b, _c, _d;
+    if (intervals.length === 0) {
+        return [];
+    }
+    const sorted = [...intervals].sort((a, b) => a.from.getTime() - b.from.getTime());
+    const merged = [Object.assign({}, sorted[0])];
+    for (let i = 1; i < sorted.length; i++) {
+        const current = sorted[i];
+        const last = merged[merged.length - 1];
+        const lastEnd = (_b = (_a = last.to) === null || _a === void 0 ? void 0 : _a.getTime()) !== null && _b !== void 0 ? _b : Number.POSITIVE_INFINITY;
+        const currentStart = current.from.getTime();
+        const currentEnd = (_d = (_c = current.to) === null || _c === void 0 ? void 0 : _c.getTime()) !== null && _d !== void 0 ? _d : Number.POSITIVE_INFINITY;
+        if (currentStart <= lastEnd) {
+            const nextEnd = Math.max(lastEnd, currentEnd);
+            last.to = Number.isFinite(nextEnd) ? new Date(nextEnd) : null;
+        }
+        else {
+            merged.push(Object.assign({}, current));
+        }
+    }
+    return merged;
+}
+/** Collect sorted unique boundary timestamps inside/around a range. */
+function collectBoundaries(intervals, range) {
+    const points = new Set();
+    points.add(range.from.getTime());
+    if (range.to) {
+        points.add(range.to.getTime());
+    }
+    for (const interval of intervals) {
+        const clipped = clipInterval(interval, range);
+        if (!clipped) {
+            continue;
+        }
+        points.add(clipped.from.getTime());
+        if (clipped.to) {
+            points.add(clipped.to.getTime());
+        }
+    }
+    return [...points]
+        .filter((ms) => !Number.isNaN(ms))
+        .sort((a, b) => a - b)
+        .map((ms) => new Date(ms));
+}
+function toIso(date) {
+    if (!date) {
+        return null;
+    }
+    return date.toISOString();
+}
+//#endregion
+//#region ----- Internals -----
+function toTime(value) {
+    if (!value) {
+        return Number.NaN;
+    }
+    return new Date(value).getTime();
+}
+function asRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+//#endregion
+//# sourceMappingURL=version-as-of.util.js.map

package/server/src/lib/effective-access-history/version-as-of.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-as-of.util.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/effective-access-history/version-as-of.util.ts"],"names":[],"mappings":";AAAA,2BAA2B;;AA2B3B,gDAQC;AAMD,sDAuBC;AAMD,kDA0BC;AAMD,4CAIC;AAGD,oCAqBC;AAGD,gDAwBC;AAGD,8CAyBC;AAED,sBAKC;AA1KD,YAAY;AAEZ,2CAA2C;AAE3C,+DAA+D;AAC/D,SAAgB,kBAAkB,CAA6B,OAAY;IACzE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,CAAC,CAAC,aAAa,mCAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAA,CAAC,CAAC,aAAa,mCAAI,CAAC,CAAC,CAAC;QAChF,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,OAA2B,EAC3B,IAAU;;IAEV,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,MAAM,GAA4B,IAAI,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;YAClD,MAAM;QACR,CAAC;QACD,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAA,MAAM,CAAC,UAAU,mCAAI,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,OAA2B;;IAE3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAA2D,EAAE,CAAC;IAE7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,KAAK,CAAC,UAAU,mCAAI,EAAE,CAAC,KAAK,QAAQ,CAAC;QAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7D,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,YAAY;AAEZ,sCAAsC;AAEtC,SAAgB,gBAAgB,CAAC,CAAsB,EAAE,CAAsB;;IAC7E,MAAM,IAAI,GAAG,MAAA,MAAA,CAAC,CAAC,EAAE,0CAAE,OAAO,EAAE,mCAAI,MAAM,CAAC,iBAAiB,CAAC;IACzD,MAAM,IAAI,GAAG,MAAA,MAAA,CAAC,CAAC,EAAE,0CAAE,OAAO,EAAE,mCAAI,MAAM,CAAC,iBAAiB,CAAC;IACzD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;AAC5D,CAAC;AAED,yEAAyE;AACzE,SAAgB,YAAY,CAC1B,QAA6B,EAC7B,KAA0B;;IAE1B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,MAAA,MAAA,QAAQ,CAAC,EAAE,0CAAE,OAAO,EAAE,mCAAI,MAAM,CAAC,iBAAiB,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAA,MAAA,KAAK,CAAC,EAAE,0CAAE,OAAO,EAAE,mCAAI,MAAM,CAAC,iBAAiB,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,SAAgC;;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,MAAM,GAA0B,mBAAM,MAAM,CAAC,CAAC,CAAC,EAAG,CAAC;IAEzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAA,MAAA,IAAI,CAAC,EAAE,0CAAE,OAAO,EAAE,mCAAI,MAAM,CAAC,iBAAiB,CAAC;QAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAA,MAAA,OAAO,CAAC,EAAE,0CAAE,OAAO,EAAE,mCAAI,MAAM,CAAC,iBAAiB,CAAC;QAErE,IAAI,YAAY,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,mBAAM,OAAO,EAAG,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAgB,iBAAiB,CAC/B,SAAgC,EAChC,KAA0B;IAE1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC;SACf,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,KAAK,CAAC,IAA6B;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,YAAY;AAEZ,+BAA+B;AAE/B,SAAS,MAAM,CAAC,KAAyB;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,YAAY"}

package/server/src/lib/entities/index.d.ts

@@ -0,0 +1 @@
+export * from './security-management.entity-catalog';

package/server/src/lib/entities/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./security-management.entity-catalog"), exports);
+//# sourceMappingURL=index.js.map

package/{src/lib/seed/tenant → server/src/lib/entities}/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/seed/tenant/index.ts"],"names":[],"mappings":";;;AAAA,iEAAuC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/entities/index.ts"],"names":[],"mappings":";;;AAAA,+EAAqD"}

package/server/src/lib/entities/security-management.entity-catalog.d.ts

@@ -0,0 +1 @@
+export declare const securityManagementEntityCatalog: import("@acorex-platform/framework-server/domain/seed").AXPDomainEntityCatalog;

package/server/src/lib/entities/security-management.entity-catalog.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityManagementEntityCatalog = void 0;
+const seed_1 = require("@acorex-platform/framework-server/domain/seed");
+const entity_catalog_1 = require("../../../../contracts/src/entity-catalog");
+//#region ---- security-management entity catalog ----
+exports.securityManagementEntityCatalog = (0, seed_1.defineEntityCatalog)({
+    moduleName: 'security-management',
+    factories: Object.values(entity_catalog_1.securityManagementLocalEntityCatalog.loaders),
+});
+//#endregion
+//# sourceMappingURL=security-management.entity-catalog.js.map

package/server/src/lib/entities/security-management.entity-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-management.entity-catalog.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/entities/security-management.entity-catalog.ts"],"names":[],"mappings":";;;AAAA,wEAAoF;AACpF,6EAAgG;AAEhG,sDAAsD;AAEzC,QAAA,+BAA+B,GAAG,IAAA,0BAAmB,EAAC;IACjE,UAAU,EAAE,qBAAqB;IACjC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,qDAAoC,CAAC,OAAO,CAAC;CACvE,CAAC,CAAC;AAEH,YAAY"}

package/server/src/lib/handlers/security-report.handlers.d.ts

@@ -0,0 +1,36 @@
+import { type AXPServerQueryHandler } from '@acorex-platform/framework-server/domain/abstract';
+import type { ReportQueryInput } from '@acorex-platform/framework-server/report';
+import { RuntimePermissionService } from '@acorex-platform/framework-server/security';
+import type { AXPQueryFetchResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { EffectiveAccessHistoryService } from '../effective-access-history/effective-access-history.service';
+import { PasswordChangeHistoryService } from '../reports/password-change-history.service';
+export declare class GetUserEffectiveRolesHistoryQueryHandler implements AXPServerQueryHandler<ReportQueryInput, Record<string, unknown>> {
+    private readonly history;
+    private readonly permissions;
+    constructor(history: EffectiveAccessHistoryService, permissions: RuntimePermissionService);
+    execute(input: ReportQueryInput): AXPQueryFetchResultPromise<Record<string, unknown>>;
+}
+export declare class GetUserEffectivePermissionsHistoryQueryHandler implements AXPServerQueryHandler<ReportQueryInput, Record<string, unknown>> {
+    private readonly history;
+    private readonly permissions;
+    constructor(history: EffectiveAccessHistoryService, permissions: RuntimePermissionService);
+    execute(input: ReportQueryInput): AXPQueryFetchResultPromise<Record<string, unknown>>;
+}
+export declare class GetRoleHoldersHistoryQueryHandler implements AXPServerQueryHandler<ReportQueryInput, Record<string, unknown>> {
+    private readonly history;
+    private readonly permissions;
+    constructor(history: EffectiveAccessHistoryService, permissions: RuntimePermissionService);
+    execute(input: ReportQueryInput): AXPQueryFetchResultPromise<Record<string, unknown>>;
+}
+export declare class GetPermissionHoldersHistoryQueryHandler implements AXPServerQueryHandler<ReportQueryInput, Record<string, unknown>> {
+    private readonly history;
+    private readonly permissions;
+    constructor(history: EffectiveAccessHistoryService, permissions: RuntimePermissionService);
+    execute(input: ReportQueryInput): AXPQueryFetchResultPromise<Record<string, unknown>>;
+}
+export declare class GetUserPasswordChangeHistoryQueryHandler implements AXPServerQueryHandler<ReportQueryInput, Record<string, unknown>> {
+    private readonly passwordChangeHistory;
+    private readonly permissions;
+    constructor(passwordChangeHistory: PasswordChangeHistoryService, permissions: RuntimePermissionService);
+    execute(input: ReportQueryInput): AXPQueryFetchResultPromise<Record<string, unknown>>;
+}

package/server/src/lib/handlers/security-report.handlers.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetUserPasswordChangeHistoryQueryHandler = exports.GetPermissionHoldersHistoryQueryHandler = exports.GetRoleHoldersHistoryQueryHandler = exports.GetUserEffectivePermissionsHistoryQueryHandler = exports.GetUserEffectiveRolesHistoryQueryHandler = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const effective_access_history_service_1 = require("../effective-access-history/effective-access-history.service");
+const get_permission_holders_history_query_1 = require("../queries/get-permission-holders-history.query");
+const get_role_holders_history_query_1 = require("../queries/get-role-holders-history.query");
+const get_user_effective_permissions_history_query_1 = require("../queries/get-user-effective-permissions-history.query");
+const get_user_effective_roles_history_query_1 = require("../queries/get-user-effective-roles-history.query");
+const get_user_password_change_history_query_1 = require("../queries/get-user-password-change-history.query");
+const password_change_history_service_1 = require("../reports/password-change-history.service");
+const security_report_scope_constants_1 = require("../reports/security-report-scope.constants");
+//#region ----- Helpers -----
+const SECURITY_REPORT_PERMISSIONS = [module_security_management_contracts_1.AXPAdministrationPermissionKeys.MaintainUsersAndRoles];
+function runReportCollection(run, input) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        try {
+            const result = yield run(input);
+            return (0, core_2.runtimeQuerySuccessCollection)({
+                items: result.items,
+                total: result.total,
+                aggregateRows: result.summary ? [result.summary] : undefined,
+            });
+        }
+        catch (error) {
+            return (0, core_2.runtimeQueryFailure)(error instanceof Error ? error.message : 'Report query failed');
+        }
+    });
+}
+function resolveSecurityReportFilterScope(permissions) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        const session = resolveRequestSession();
+        const canSelectTenant = yield permissions.authorize(session === null || session === void 0 ? void 0 : session.userId, security_report_scope_constants_1.SECURITY_REPORT_SELECT_TENANT_PERMISSION);
+        return {
+            canSelectTenant,
+            sessionTenantId: session === null || session === void 0 ? void 0 : session.tenantId,
+            sessionApplicationId: session === null || session === void 0 ? void 0 : session.applicationId,
+        };
+    });
+}
+function resolveRequestSession() {
+    const request = (0, core_1.getEntityStorageRequest)();
+    return request === null || request === void 0 ? void 0 : request[security_1.CURRENT_SESSION_KEY];
+}
+//#endregion
+//#region ----- Security report query handlers -----
+let GetUserEffectiveRolesHistoryQueryHandler = class GetUserEffectiveRolesHistoryQueryHandler {
+    constructor(history, permissions) {
+        this.history = history;
+        this.permissions = permissions;
+    }
+    execute(input) {
+        return runReportCollection((i) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return (0, get_user_effective_roles_history_query_1.runGetUserEffectiveRolesHistoryQuery)(this.history, i, yield resolveSecurityReportFilterScope(this.permissions));
+        }), input);
+    }
+};
+exports.GetUserEffectiveRolesHistoryQueryHandler = GetUserEffectiveRolesHistoryQueryHandler;
+exports.GetUserEffectiveRolesHistoryQueryHandler = GetUserEffectiveRolesHistoryQueryHandler = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    (0, abstract_1.ServerQueryHandler)({
+        key: module_security_management_contracts_1.RootConfig.queries.reports.getUserEffectiveRolesHistory,
+        auth: 'session',
+        permissions: SECURITY_REPORT_PERMISSIONS,
+    }),
+    tslib_1.__metadata("design:paramtypes", [effective_access_history_service_1.EffectiveAccessHistoryService,
+        security_1.RuntimePermissionService])
+], GetUserEffectiveRolesHistoryQueryHandler);
+let GetUserEffectivePermissionsHistoryQueryHandler = class GetUserEffectivePermissionsHistoryQueryHandler {
+    constructor(history, permissions) {
+        this.history = history;
+        this.permissions = permissions;
+    }
+    execute(input) {
+        return runReportCollection((i) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return (0, get_user_effective_permissions_history_query_1.runGetUserEffectivePermissionsHistoryQuery)(this.history, i, yield resolveSecurityReportFilterScope(this.permissions));
+        }), input);
+    }
+};
+exports.GetUserEffectivePermissionsHistoryQueryHandler = GetUserEffectivePermissionsHistoryQueryHandler;
+exports.GetUserEffectivePermissionsHistoryQueryHandler = GetUserEffectivePermissionsHistoryQueryHandler = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    (0, abstract_1.ServerQueryHandler)({
+        key: module_security_management_contracts_1.RootConfig.queries.reports.getUserEffectivePermissionsHistory,
+        auth: 'session',
+        permissions: SECURITY_REPORT_PERMISSIONS,
+    }),
+    tslib_1.__metadata("design:paramtypes", [effective_access_history_service_1.EffectiveAccessHistoryService,
+        security_1.RuntimePermissionService])
+], GetUserEffectivePermissionsHistoryQueryHandler);
+let GetRoleHoldersHistoryQueryHandler = class GetRoleHoldersHistoryQueryHandler {
+    constructor(history, permissions) {
+        this.history = history;
+        this.permissions = permissions;
+    }
+    execute(input) {
+        return runReportCollection((i) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return (0, get_role_holders_history_query_1.runGetRoleHoldersHistoryQuery)(this.history, i, yield resolveSecurityReportFilterScope(this.permissions));
+        }), input);
+    }
+};
+exports.GetRoleHoldersHistoryQueryHandler = GetRoleHoldersHistoryQueryHandler;
+exports.GetRoleHoldersHistoryQueryHandler = GetRoleHoldersHistoryQueryHandler = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    (0, abstract_1.ServerQueryHandler)({
+        key: module_security_management_contracts_1.RootConfig.queries.reports.getRoleHoldersHistory,
+        auth: 'session',
+        permissions: SECURITY_REPORT_PERMISSIONS,
+    }),
+    tslib_1.__metadata("design:paramtypes", [effective_access_history_service_1.EffectiveAccessHistoryService,
+        security_1.RuntimePermissionService])
+], GetRoleHoldersHistoryQueryHandler);
+let GetPermissionHoldersHistoryQueryHandler = class GetPermissionHoldersHistoryQueryHandler {
+    constructor(history, permissions) {
+        this.history = history;
+        this.permissions = permissions;
+    }
+    execute(input) {
+        return runReportCollection((i) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return (0, get_permission_holders_history_query_1.runGetPermissionHoldersHistoryQuery)(this.history, i, yield resolveSecurityReportFilterScope(this.permissions));
+        }), input);
+    }
+};
+exports.GetPermissionHoldersHistoryQueryHandler = GetPermissionHoldersHistoryQueryHandler;
+exports.GetPermissionHoldersHistoryQueryHandler = GetPermissionHoldersHistoryQueryHandler = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    (0, abstract_1.ServerQueryHandler)({
+        key: module_security_management_contracts_1.RootConfig.queries.reports.getPermissionHoldersHistory,
+        auth: 'session',
+        permissions: SECURITY_REPORT_PERMISSIONS,
+    }),
+    tslib_1.__metadata("design:paramtypes", [effective_access_history_service_1.EffectiveAccessHistoryService,
+        security_1.RuntimePermissionService])
+], GetPermissionHoldersHistoryQueryHandler);
+let GetUserPasswordChangeHistoryQueryHandler = class GetUserPasswordChangeHistoryQueryHandler {
+    constructor(passwordChangeHistory, permissions) {
+        this.passwordChangeHistory = passwordChangeHistory;
+        this.permissions = permissions;
+    }
+    execute(input) {
+        return runReportCollection((i) => tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return (0, get_user_password_change_history_query_1.runGetUserPasswordChangeHistoryQuery)(this.passwordChangeHistory, i, yield resolveSecurityReportFilterScope(this.permissions));
+        }), input);
+    }
+};
+exports.GetUserPasswordChangeHistoryQueryHandler = GetUserPasswordChangeHistoryQueryHandler;
+exports.GetUserPasswordChangeHistoryQueryHandler = GetUserPasswordChangeHistoryQueryHandler = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    (0, abstract_1.ServerQueryHandler)({
+        key: module_security_management_contracts_1.RootConfig.queries.reports.getUserPasswordChangeHistory,
+        auth: 'session',
+        permissions: SECURITY_REPORT_PERMISSIONS,
+    }),
+    tslib_1.__metadata("design:paramtypes", [password_change_history_service_1.PasswordChangeHistoryService,
+        security_1.RuntimePermissionService])
+], GetUserPasswordChangeHistoryQueryHandler);
+//#endregion
+//# sourceMappingURL=security-report.handlers.js.map

package/server/src/lib/handlers/security-report.handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-report.handlers.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/handlers/security-report.handlers.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAAiF;AACjF,gFAAmH;AAEnH,yEAIoD;AACpD,iEAGgD;AAEhD,gHAG+D;AAC/D,mHAA6G;AAC7G,0GAAsG;AACtG,8FAA0F;AAC1F,0HAAqH;AACrH,8GAAyG;AACzG,8GAAyG;AAEzG,gGAA0F;AAC1F,gGAAsG;AAEtG,6BAA6B;AAE7B,MAAM,2BAA2B,GAAG,CAAC,sEAA+B,CAAC,qBAAqB,CAAC,CAAC;AAE5F,SAAe,mBAAmB,CAChC,GAIE,EACF,KAAuB;;QAEvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,IAAA,oCAA6B,EAAC;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAA,0BAAmB,EAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;CAAA;AAED,SAAe,gCAAgC,CAC7C,WAAqC;;QAErC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,SAAS,CACjD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,EACf,0EAAwC,CACzC,CAAC;QACF,OAAO;YACL,eAAe;YACf,eAAe,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;YAClC,oBAAoB,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa;SAC7C,CAAC;IACJ,CAAC;CAAA;AAED,SAAS,qBAAqB;IAC5B,MAAM,OAAO,GAAG,IAAA,8BAAuB,GAE1B,CAAC;IACd,OAAO,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAG,8BAAmB,CAAC,CAAC;AACxC,CAAC;AAED,YAAY;AAEZ,oDAAoD;AAQ7C,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;IAGnD,YACmB,OAAsC,EACtC,WAAqC;QADrC,YAAO,GAAP,OAAO,CAA+B;QACtC,gBAAW,GAAX,WAAW,CAA0B;IACrD,CAAC;IAEJ,OAAO,CAAC,KAAuB;QAC7B,OAAO,mBAAmB,CACxB,CAAO,CAAC,EAAE,EAAE;YACV,OAAA,IAAA,6EAAoC,EAClC,IAAI,CAAC,OAAO,EACZ,CAAC,EACD,MAAM,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CACzD,CAAA;UAAA,EACH,KAAK,CACN,CAAC;IACJ,CAAC;CACF,CAAA;AAnBY,4FAAwC;mDAAxC,wCAAwC;IANpD,IAAA,mBAAU,GAAE;IACZ,IAAA,6BAAkB,EAAC;QAClB,GAAG,EAAE,iDAAU,CAAC,OAAO,CAAC,OAAO,CAAC,4BAA4B;QAC5D,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,2BAA2B;KACzC,CAAC;6CAK4B,gEAA6B;QACzB,mCAAwB;GAL7C,wCAAwC,CAmBpD;AAQM,IAAM,8CAA8C,GAApD,MAAM,8CAA8C;IAGzD,YACmB,OAAsC,EACtC,WAAqC;QADrC,YAAO,GAAP,OAAO,CAA+B;QACtC,gBAAW,GAAX,WAAW,CAA0B;IACrD,CAAC;IAEJ,OAAO,CAAC,KAAuB;QAC7B,OAAO,mBAAmB,CACxB,CAAO,CAAC,EAAE,EAAE;YACV,OAAA,IAAA,yFAA0C,EACxC,IAAI,CAAC,OAAO,EACZ,CAAC,EACD,MAAM,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CACzD,CAAA;UAAA,EACH,KAAK,CACN,CAAC;IACJ,CAAC;CACF,CAAA;AAnBY,wGAA8C;yDAA9C,8CAA8C;IAN1D,IAAA,mBAAU,GAAE;IACZ,IAAA,6BAAkB,EAAC;QAClB,GAAG,EAAE,iDAAU,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC;QAClE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,2BAA2B;KACzC,CAAC;6CAK4B,gEAA6B;QACzB,mCAAwB;GAL7C,8CAA8C,CAmB1D;AAQM,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAG5C,YACmB,OAAsC,EACtC,WAAqC;QADrC,YAAO,GAAP,OAAO,CAA+B;QACtC,gBAAW,GAAX,WAAW,CAA0B;IACrD,CAAC;IAEJ,OAAO,CAAC,KAAuB;QAC7B,OAAO,mBAAmB,CACxB,CAAO,CAAC,EAAE,EAAE;YACV,OAAA,IAAA,8DAA6B,EAC3B,IAAI,CAAC,OAAO,EACZ,CAAC,EACD,MAAM,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CACzD,CAAA;UAAA,EACH,KAAK,CACN,CAAC;IACJ,CAAC;CACF,CAAA;AAnBY,8EAAiC;4CAAjC,iCAAiC;IAN7C,IAAA,mBAAU,GAAE;IACZ,IAAA,6BAAkB,EAAC;QAClB,GAAG,EAAE,iDAAU,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB;QACrD,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,2BAA2B;KACzC,CAAC;6CAK4B,gEAA6B;QACzB,mCAAwB;GAL7C,iCAAiC,CAmB7C;AAQM,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAGlD,YACmB,OAAsC,EACtC,WAAqC;QADrC,YAAO,GAAP,OAAO,CAA+B;QACtC,gBAAW,GAAX,WAAW,CAA0B;IACrD,CAAC;IAEJ,OAAO,CAAC,KAAuB;QAC7B,OAAO,mBAAmB,CACxB,CAAO,CAAC,EAAE,EAAE;YACV,OAAA,IAAA,0EAAmC,EACjC,IAAI,CAAC,OAAO,EACZ,CAAC,EACD,MAAM,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CACzD,CAAA;UAAA,EACH,KAAK,CACN,CAAC;IACJ,CAAC;CACF,CAAA;AAnBY,0FAAuC;kDAAvC,uCAAuC;IANnD,IAAA,mBAAU,GAAE;IACZ,IAAA,6BAAkB,EAAC;QAClB,GAAG,EAAE,iDAAU,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B;QAC3D,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,2BAA2B;KACzC,CAAC;6CAK4B,gEAA6B;QACzB,mCAAwB;GAL7C,uCAAuC,CAmBnD;AAQM,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;IAGnD,YACmB,qBAAmD,EACnD,WAAqC;QADrC,0BAAqB,GAArB,qBAAqB,CAA8B;QACnD,gBAAW,GAAX,WAAW,CAA0B;IACrD,CAAC;IAEJ,OAAO,CAAC,KAAuB;QAC7B,OAAO,mBAAmB,CACxB,CAAO,CAAC,EAAE,EAAE;YACV,OAAA,IAAA,6EAAoC,EAClC,IAAI,CAAC,qBAAqB,EAC1B,CAAC,EACD,MAAM,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC,CACzD,CAAA;UAAA,EACH,KAAK,CACN,CAAC;IACJ,CAAC;CACF,CAAA;AAnBY,4FAAwC;mDAAxC,wCAAwC;IANpD,IAAA,mBAAU,GAAE;IACZ,IAAA,6BAAkB,EAAC;QAClB,GAAG,EAAE,iDAAU,CAAC,OAAO,CAAC,OAAO,CAAC,4BAA4B;QAC5D,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,2BAA2B;KACzC,CAAC;6CAK0C,8DAA4B;QACtC,mCAAwB;GAL7C,wCAAwC,CAmBpD;AAED,YAAY"}

package/server/src/lib/identity-provider/auth-oauth-clients.constants.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Client ids allowed to use the platform OAuth broker (`/connect/*`).
+ * Redirect URI allowlists are app/env-owned (see `apps/demo-api/.../demo-api.auth-oauth-clients.ts`).
+ */
+export declare const AUTH_OAUTH_SEEDED_CLIENT_IDS: readonly ["acorex", "spa-client", "backend-client"];

package/server/src/lib/identity-provider/auth-oauth-clients.constants.js

@@ -0,0 +1,11 @@
+"use strict";
+//#region ----- Allowed SPA / machine OAuth client ids -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_OAUTH_SEEDED_CLIENT_IDS = void 0;
+/**
+ * Client ids allowed to use the platform OAuth broker (`/connect/*`).
+ * Redirect URI allowlists are app/env-owned (see `apps/demo-api/.../demo-api.auth-oauth-clients.ts`).
+ */
+exports.AUTH_OAUTH_SEEDED_CLIENT_IDS = ['acorex', 'spa-client', 'backend-client'];
+//#endregion
+//# sourceMappingURL=auth-oauth-clients.constants.js.map

package/server/src/lib/identity-provider/auth-oauth-clients.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-oauth-clients.constants.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/auth-oauth-clients.constants.ts"],"names":[],"mappings":";AAAA,4DAA4D;;;AAE5D;;;GAGG;AACU,QAAA,4BAA4B,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAAU,CAAC;AAEhG,YAAY"}

package/server/src/lib/identity-provider/identity-provider-catalog.service.d.ts

@@ -0,0 +1,20 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { AUTH_IDENTITY_PROVIDER_CATALOG, type AuthIdentityProviderBrokerConfig, type AuthIdentityProviderCatalog, type AuthIdentityProviderEnsureStubInput, type AuthIdentityProviderPublicDto } from '@acorex-platform/framework-server/security';
+export declare class IdentityProviderCatalogService implements AuthIdentityProviderCatalog {
+    private readonly storage;
+    private readonly logger;
+    constructor(storage: EntityStorageMiddlewareService);
+    listEnabledForLogin(): Promise<AuthIdentityProviderPublicDto[]>;
+    getBrokerConfig(key: string): Promise<AuthIdentityProviderBrokerConfig | null>;
+    ensureStub(input: AuthIdentityProviderEnsureStubInput): Promise<void>;
+    private findByKey;
+    private toPublicDto;
+    /** Prefer `isDisabled` (disable plugin); fall back to legacy `enabled` seed rows. */
+    private isActiveForLogin;
+    /** Directory (LDAP/AD) rows use a separate login path — not OAuth ListProviders. */
+    private isOidcProtocol;
+}
+export declare function provideAuthIdentityProviderCatalog(): {
+    provide: typeof AUTH_IDENTITY_PROVIDER_CATALOG;
+    useExisting: typeof IdentityProviderCatalogService;
+};

package/server/src/lib/identity-provider/identity-provider-catalog.service.js

@@ -0,0 +1,169 @@
+"use strict";
+//#region ---- Imports ----
+var IdentityProviderCatalogService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityProviderCatalogService = void 0;
+exports.provideAuthIdentityProviderCatalog = provideAuthIdentityProviderCatalog;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const identity_provider_constants_1 = require("./identity-provider.constants");
+const identity_provider_ids_constants_1 = require("./identity-provider-ids.constants");
+//#endregion
+//#region ---- Catalog service ----
+let IdentityProviderCatalogService = IdentityProviderCatalogService_1 = class IdentityProviderCatalogService {
+    constructor(storage) {
+        this.storage = storage;
+        this.logger = new common_1.Logger(IdentityProviderCatalogService_1.name);
+    }
+    listEnabledForLogin() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const result = yield this.storage.query(identity_provider_constants_1.IDENTITY_PROVIDER_ENTITY, {
+                    skip: 0,
+                    take: 200,
+                    sort: [{ field: 'priority', dir: 'asc' }, { field: 'title', dir: 'asc' }],
+                });
+                const items = ((_a = result.items) !== null && _a !== void 0 ? _a : []);
+                return items
+                    .filter((row) => this.isOidcProtocol(row) && this.isActiveForLogin(row))
+                    .map((row) => this.toPublicDto(row));
+            }
+            catch (error) {
+                this.logger.warn(`listEnabledForLogin failed (entity may not be registered yet): ${error instanceof Error ? error.message : String(error)}`);
+                return [];
+            }
+        });
+    }
+    getBrokerConfig(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g;
+            try {
+                const row = yield this.findByKey(key);
+                if (!row || !this.isOidcProtocol(row) || !this.isActiveForLogin(row)) {
+                    return null;
+                }
+                const clientId = (_a = row.clientId) === null || _a === void 0 ? void 0 : _a.trim();
+                const clientSecret = (_b = row.clientSecret) === null || _b === void 0 ? void 0 : _b.trim();
+                const authorizationUrl = (_c = row.authorizationUrl) === null || _c === void 0 ? void 0 : _c.trim();
+                const tokenUrl = (_d = row.tokenUrl) === null || _d === void 0 ? void 0 : _d.trim();
+                if (!clientId || !clientSecret || !authorizationUrl || !tokenUrl) {
+                    return null;
+                }
+                return {
+                    key: row.key,
+                    clientId,
+                    clientSecret,
+                    enabled: true,
+                    authorizationUrl,
+                    tokenUrl,
+                    userInfoUrl: ((_e = row.userInfoUrl) === null || _e === void 0 ? void 0 : _e.trim()) || undefined,
+                    issuerUrl: ((_f = row.issuerUrl) === null || _f === void 0 ? void 0 : _f.trim()) || undefined,
+                    scopes: ((_g = row.scopes) === null || _g === void 0 ? void 0 : _g.trim()) || 'openid email profile',
+                };
+            }
+            catch (error) {
+                this.logger.warn(`getBrokerConfig(${key}) failed: ${error instanceof Error ? error.message : String(error)}`);
+                return null;
+            }
+        });
+    }
+    ensureStub(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g;
+            try {
+                const existing = yield this.findByKey(input.key);
+                if (existing) {
+                    return;
+                }
+                yield this.storage.insertOne(identity_provider_constants_1.IDENTITY_PROVIDER_ENTITY, {
+                    id: identity_provider_ids_constants_1.IDENTITY_PROVIDER_STUB_IDS_BY_KEY[input.key],
+                    key: input.key,
+                    title: input.title,
+                    icon: (_a = input.icon) !== null && _a !== void 0 ? _a : null,
+                    protocol: module_security_management_contracts_1.AXM_IDENTITY_PROVIDER_PROTOCOL.Oidc,
+                    isDisabled: true,
+                    priority: (_b = input.priority) !== null && _b !== void 0 ? _b : 100,
+                    clientId: null,
+                    clientSecret: null,
+                    authorizationUrl: (_c = input.authorizationUrl) !== null && _c !== void 0 ? _c : null,
+                    tokenUrl: (_d = input.tokenUrl) !== null && _d !== void 0 ? _d : null,
+                    userInfoUrl: (_e = input.userInfoUrl) !== null && _e !== void 0 ? _e : null,
+                    scopes: (_f = input.scopes) !== null && _f !== void 0 ? _f : 'openid email profile',
+                    issuerUrl: (_g = input.issuerUrl) !== null && _g !== void 0 ? _g : null,
+                    directoryUrl: null,
+                    directoryBaseDn: null,
+                    directoryUserDnTemplate: null,
+                    directoryUserSearchFilter: null,
+                    directoryUseTls: null,
+                    directoryTlsRejectUnauthorized: null,
+                });
+                this.logger.log(`Ensured IdentityProvider stub key=${input.key}`);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                if ((0, abstract_1.isCliSeedProcess)() && /schema is not registered/i.test(message)) {
+                    return;
+                }
+                this.logger.warn(`ensureStub(${input.key}) failed: ${message}`);
+            }
+        });
+    }
+    findByKey(key) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield this.storage.query(identity_provider_constants_1.IDENTITY_PROVIDER_ENTITY, {
+                skip: 0,
+                take: 1,
+                filter: {
+                    logic: 'and',
+                    filters: [{ field: 'key', operator: { type: 'equal' }, value: key }],
+                },
+            });
+            const row = ((_a = result.items) !== null && _a !== void 0 ? _a : [])[0];
+            return row !== null && row !== void 0 ? row : null;
+        });
+    }
+    toPublicDto(row) {
+        var _a;
+        return {
+            id: row.key,
+            title: row.title,
+            icon: (_a = row.icon) !== null && _a !== void 0 ? _a : undefined,
+            priority: typeof row.priority === 'number' ? row.priority : 100,
+        };
+    }
+    /** Prefer `isDisabled` (disable plugin); fall back to legacy `enabled` seed rows. */
+    isActiveForLogin(row) {
+        if (typeof row.isDisabled === 'boolean') {
+            return row.isDisabled !== true;
+        }
+        if (typeof row.enabled === 'boolean') {
+            return row.enabled === true;
+        }
+        return false;
+    }
+    /** Directory (LDAP/AD) rows use a separate login path — not OAuth ListProviders. */
+    isOidcProtocol(row) {
+        var _a;
+        const protocol = (_a = row.protocol) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase();
+        return !protocol || protocol === module_security_management_contracts_1.AXM_IDENTITY_PROVIDER_PROTOCOL.Oidc;
+    }
+};
+exports.IdentityProviderCatalogService = IdentityProviderCatalogService;
+exports.IdentityProviderCatalogService = IdentityProviderCatalogService = IdentityProviderCatalogService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], IdentityProviderCatalogService);
+function provideAuthIdentityProviderCatalog() {
+    return {
+        provide: security_1.AUTH_IDENTITY_PROVIDER_CATALOG,
+        useExisting: IdentityProviderCatalogService,
+    };
+}
+//#endregion
+//# sourceMappingURL=identity-provider-catalog.service.js.map