@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/identity-provider/identity-provider-catalog.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-catalog.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider-catalog.service.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAsK3B,gFAQC;;AA5KD,iEAAwF;AACxF,yEAMoD;AACpD,gHAG+D;AAC/D,2CAAoD;AACpD,6EAAkF;AAElF,+EAAyE;AACzE,uFAAsF;AAEtF,YAAY;AAEZ,mCAAmC;AAG5B,IAAM,8BAA8B,sCAApC,MAAM,8BAA8B;IAGzC,YAA6B,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;QAFnD,WAAM,GAAG,IAAI,eAAM,CAAC,gCAA8B,CAAC,IAAI,CAAC,CAAC;IAEH,CAAC;IAElE,mBAAmB;;;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sDAAwB,EAAE;oBAChE,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,GAAG;oBACT,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;iBAC1E,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAG,CAAC,MAAA,MAAM,CAAC,KAAK,mCAAI,EAAE,CAAqC,CAAC;gBACvE,OAAO,KAAK;qBACT,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;qBACvE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kEACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;KAAA;IAEK,eAAe,CAAC,GAAW;;;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrE,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,EAAE,CAAC;gBACtC,MAAM,YAAY,GAAG,MAAA,GAAG,CAAC,YAAY,0CAAE,IAAI,EAAE,CAAC;gBAC9C,MAAM,gBAAgB,GAAG,MAAA,GAAG,CAAC,gBAAgB,0CAAE,IAAI,EAAE,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,EAAE,CAAC;gBACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACjE,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO;oBACL,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ;oBACR,YAAY;oBACZ,OAAO,EAAE,IAAI;oBACb,gBAAgB;oBAChB,QAAQ;oBACR,WAAW,EAAE,CAAA,MAAA,GAAG,CAAC,WAAW,0CAAE,IAAI,EAAE,KAAI,SAAS;oBACjD,SAAS,EAAE,CAAA,MAAA,GAAG,CAAC,SAAS,0CAAE,IAAI,EAAE,KAAI,SAAS;oBAC7C,MAAM,EAAE,CAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,IAAI,EAAE,KAAI,sBAAsB;iBACrD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mBAAmB,GAAG,aAAa,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAEK,UAAU,CAAC,KAA0C;;;YACzD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,sDAAwB,EAAE;oBACrD,EAAE,EAAE,mEAAiC,CAAC,KAAK,CAAC,GAAG,CAAC;oBAChD,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,MAAA,KAAK,CAAC,IAAI,mCAAI,IAAI;oBACxB,QAAQ,EAAE,qEAA8B,CAAC,IAAI;oBAC7C,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,MAAA,KAAK,CAAC,QAAQ,mCAAI,GAAG;oBAC/B,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,MAAA,KAAK,CAAC,gBAAgB,mCAAI,IAAI;oBAChD,QAAQ,EAAE,MAAA,KAAK,CAAC,QAAQ,mCAAI,IAAI;oBAChC,WAAW,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI;oBACtC,MAAM,EAAE,MAAA,KAAK,CAAC,MAAM,mCAAI,sBAAsB;oBAC9C,SAAS,EAAE,MAAA,KAAK,CAAC,SAAS,mCAAI,IAAI;oBAClC,YAAY,EAAE,IAAI;oBAClB,eAAe,EAAE,IAAI;oBACrB,uBAAuB,EAAE,IAAI;oBAC7B,yBAAyB,EAAE,IAAI;oBAC/B,eAAe,EAAE,IAAI;oBACrB,8BAA8B,EAAE,IAAI;iBACa,CAAC,CAAC;gBAErD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,IAAA,2BAAgB,GAAE,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,GAAG,aAAa,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KAAA;IAEa,SAAS,CAAC,GAAW;;;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sDAAwB,EAAE;gBAChE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;iBACrE;aACF,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAA,MAAM,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC,CAA+C,CAAC;YAClF,OAAO,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,IAAI,CAAC;QACrB,CAAC;KAAA;IAEO,WAAW,CAAC,GAAmC;;QACrD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,GAAG;YACX,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,MAAA,GAAG,CAAC,IAAI,mCAAI,SAAS;YAC3B,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG;SAChE,CAAC;IACJ,CAAC;IAED,qFAAqF;IAC7E,gBAAgB,CAAC,GAA2D;QAClF,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oFAAoF;IAC5E,cAAc,CAAC,GAAmC;;QACxD,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK,qEAA8B,CAAC,IAAI,CAAC;IACvE,CAAC;CACF,CAAA;AA3IY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;6CAI2B,qCAA8B;GAHzD,8BAA8B,CA2I1C;AAED,SAAgB,kCAAkC;IAIhD,OAAO;QACL,OAAO,EAAE,yCAA8B;QACvC,WAAW,EAAE,8BAA8B;KAC5C,CAAC;AACJ,CAAC;AAED,YAAY"}

package/server/src/lib/identity-provider/identity-provider-ids.constants.d.ts

@@ -0,0 +1,8 @@
+export declare const MOCK_IDENTITY_PROVIDER_IDS: {
+    readonly google: "f0000010-0000-4000-a000-000000000001";
+    readonly microsoft: "f0000010-0000-4000-a000-000000000002";
+    readonly oktaHr: "f0000010-0000-4000-a000-000000000003";
+    readonly azureAdCorp: "f0000010-0000-4000-a000-000000000004";
+};
+/** Stable ids used by ensureStub so seed + bootstrap do not create duplicate keys. */
+export declare const IDENTITY_PROVIDER_STUB_IDS_BY_KEY: Record<string, string>;

package/server/src/lib/identity-provider/identity-provider-ids.constants.js

@@ -0,0 +1,19 @@
+"use strict";
+//#region ---- Stable IdentityProvider IDs ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_PROVIDER_STUB_IDS_BY_KEY = exports.MOCK_IDENTITY_PROVIDER_IDS = void 0;
+exports.MOCK_IDENTITY_PROVIDER_IDS = {
+    google: 'f0000010-0000-4000-a000-000000000001',
+    microsoft: 'f0000010-0000-4000-a000-000000000002',
+    oktaHr: 'f0000010-0000-4000-a000-000000000003',
+    azureAdCorp: 'f0000010-0000-4000-a000-000000000004',
+};
+/** Stable ids used by ensureStub so seed + bootstrap do not create duplicate keys. */
+exports.IDENTITY_PROVIDER_STUB_IDS_BY_KEY = {
+    google: exports.MOCK_IDENTITY_PROVIDER_IDS.google,
+    microsoft: exports.MOCK_IDENTITY_PROVIDER_IDS.microsoft,
+    'okta-hr': exports.MOCK_IDENTITY_PROVIDER_IDS.oktaHr,
+    'azure-ad-corp': exports.MOCK_IDENTITY_PROVIDER_IDS.azureAdCorp,
+};
+//#endregion
+//# sourceMappingURL=identity-provider-ids.constants.js.map

package/server/src/lib/identity-provider/identity-provider-ids.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-ids.constants.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider-ids.constants.ts"],"names":[],"mappings":";AAAA,+CAA+C;;;AAElC,QAAA,0BAA0B,GAAG;IACxC,MAAM,EAAE,sCAAsC;IAC9C,SAAS,EAAE,sCAAsC;IACjD,MAAM,EAAE,sCAAsC;IAC9C,WAAW,EAAE,sCAAsC;CAC3C,CAAC;AAEX,sFAAsF;AACzE,QAAA,iCAAiC,GAA2B;IACvE,MAAM,EAAE,kCAA0B,CAAC,MAAM;IACzC,SAAS,EAAE,kCAA0B,CAAC,SAAS;IAC/C,SAAS,EAAE,kCAA0B,CAAC,MAAM;IAC5C,eAAe,EAAE,kCAA0B,CAAC,WAAW;CACxD,CAAC;AAEF,YAAY"}

package/server/src/lib/identity-provider/identity-provider-stub.bootstrap.d.ts

@@ -0,0 +1,12 @@
+import { type AuthIdentityProviderCatalog } from '@acorex-platform/framework-server/security';
+import { type OnApplicationBootstrap } from '@nestjs/common';
+/**
+ * Ensures the Microsoft platform IdP stub. Google/SSO extensions ensure their own rows.
+ * Microsoft has client-only package today — keep this until a microsoft-server module exists.
+ */
+export declare class IdentityProviderStubBootstrap implements OnApplicationBootstrap {
+    private readonly catalog;
+    private readonly logger;
+    constructor(catalog: AuthIdentityProviderCatalog);
+    onApplicationBootstrap(): Promise<void>;
+}

package/server/src/lib/identity-provider/identity-provider-stub.bootstrap.js

@@ -0,0 +1,48 @@
+"use strict";
+//#region ---- Imports ----
+var IdentityProviderStubBootstrap_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityProviderStubBootstrap = void 0;
+const tslib_1 = require("tslib");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+//#endregion
+//#region ---- Platform IdP stubs (no dedicated extension server) ----
+/**
+ * Ensures the Microsoft platform IdP stub. Google/SSO extensions ensure their own rows.
+ * Microsoft has client-only package today — keep this until a microsoft-server module exists.
+ */
+let IdentityProviderStubBootstrap = IdentityProviderStubBootstrap_1 = class IdentityProviderStubBootstrap {
+    constructor(catalog) {
+        this.catalog = catalog;
+        this.logger = new common_1.Logger(IdentityProviderStubBootstrap_1.name);
+    }
+    onApplicationBootstrap() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.catalog.ensureStub({
+                    key: 'microsoft',
+                    title: 'Microsoft',
+                    icon: 'fa-brands fa-microsoft',
+                    priority: 20,
+                    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+                    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+                    userInfoUrl: 'https://graph.microsoft.com/oidc/userinfo',
+                    scopes: 'openid email profile',
+                    issuerUrl: 'https://login.microsoftonline.com/common/v2.0',
+                });
+            }
+            catch (error) {
+                this.logger.warn(`Microsoft IdP stub ensure failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        });
+    }
+};
+exports.IdentityProviderStubBootstrap = IdentityProviderStubBootstrap;
+exports.IdentityProviderStubBootstrap = IdentityProviderStubBootstrap = IdentityProviderStubBootstrap_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, common_1.Inject)(security_1.AUTH_IDENTITY_PROVIDER_CATALOG)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], IdentityProviderStubBootstrap);
+//#endregion
+//# sourceMappingURL=identity-provider-stub.bootstrap.js.map

package/server/src/lib/identity-provider/identity-provider-stub.bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-stub.bootstrap.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider-stub.bootstrap.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;;AAE3B,yEAGoD;AACpD,2CAAyF;AAEzF,YAAY;AAEZ,sEAAsE;AAEtE;;;GAGG;AAEI,IAAM,6BAA6B,qCAAnC,MAAM,6BAA6B;IAGxC,YAEE,OAAqD;QAApC,YAAO,GAAP,OAAO,CAA6B;QAJtC,WAAM,GAAG,IAAI,eAAM,CAAC,+BAA6B,CAAC,IAAI,CAAC,CAAC;IAKtE,CAAC;IAEE,sBAAsB;;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;oBAC5B,GAAG,EAAE,WAAW;oBAChB,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,wBAAwB;oBAC9B,QAAQ,EAAE,EAAE;oBACZ,gBAAgB,EAAE,gEAAgE;oBAClF,QAAQ,EAAE,4DAA4D;oBACtE,WAAW,EAAE,2CAA2C;oBACxD,MAAM,EAAE,sBAAsB;oBAC9B,SAAS,EAAE,+CAA+C;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA3BY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAKR,mBAAA,IAAA,eAAM,EAAC,yCAA8B,CAAC,CAAA;;GAJ9B,6BAA6B,CA2BzC;AAED,YAAY"}

package/server/src/lib/identity-provider/identity-provider.constants.d.ts

@@ -0,0 +1 @@
+export declare const IDENTITY_PROVIDER_ENTITY = "SecurityManagement.IdentityProvider";

package/server/src/lib/identity-provider/identity-provider.constants.js

@@ -0,0 +1,7 @@
+"use strict";
+//#region ---- Identity provider storage constants ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_PROVIDER_ENTITY = void 0;
+exports.IDENTITY_PROVIDER_ENTITY = 'SecurityManagement.IdentityProvider';
+//#endregion
+//# sourceMappingURL=identity-provider.constants.js.map

package/server/src/lib/identity-provider/identity-provider.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider.constants.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/identity-provider/identity-provider.constants.ts"],"names":[],"mappings":";AAAA,uDAAuD;;;AAE1C,QAAA,wBAAwB,GAAG,qCAAqC,CAAC;AAE9E,YAAY"}

package/server/src/lib/middlewares/device-sessions-active.middleware.d.ts

@@ -0,0 +1,15 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+/**
+ * Marks `isActiveSession` relative to the caller's JWT `sid`.
+ * Persisted values are ignored on read — every login used to stamp true,
+ * which hid other devices from Active Sessions.
+ */
+export declare class DeviceSessionsActiveMiddleware implements EntityStorageMiddleware {
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private readSession;
+}

package/server/src/lib/middlewares/device-sessions-active.middleware.js

@@ -0,0 +1,76 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceSessionsActiveMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+//#endregion
+//#region ----- Constants -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+//#endregion
+//#region ----- Helpers -----
+function rowSessionId(row) {
+    var _a;
+    if (typeof row.sessionId === 'string' && row.sessionId.trim()) {
+        return row.sessionId.trim();
+    }
+    const configSid = (_a = row.config) === null || _a === void 0 ? void 0 : _a.sessionId;
+    return typeof configSid === 'string' ? configSid.trim() : '';
+}
+function collectRows(ctx) {
+    const result = ctx.result;
+    if (!result) {
+        return [];
+    }
+    if (Array.isArray(result.items)) {
+        return result.items;
+    }
+    if (typeof result === 'object') {
+        return [result];
+    }
+    return [];
+}
+//#endregion
+//#region ----- Device sessions active-flag middleware -----
+/**
+ * Marks `isActiveSession` relative to the caller's JWT `sid`.
+ * Persisted values are ignored on read — every login used to stamp true,
+ * which hid other devices from Active Sessions.
+ */
+let DeviceSessionsActiveMiddleware = class DeviceSessionsActiveMiddleware {
+    constructor() {
+        this.target = {
+            entity: DEVICE_SESSION_ENTITY,
+            ops: ['query', 'getOne'],
+            order: 20,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            yield next();
+            if (!ctx.result) {
+                return;
+            }
+            const sid = (_c = (_b = (_a = this.readSession()) === null || _a === void 0 ? void 0 : _a.sid) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : '';
+            for (const row of collectRows(ctx)) {
+                // Always recompute. Persisted `isActiveSession: true` on every login hid other devices.
+                // Without JWT sid we cannot mark "this device" — clear flags so clients fall back to latest.
+                row.isActiveSession = Boolean(sid) && rowSessionId(row) === sid;
+            }
+        });
+    }
+    readSession() {
+        var _a;
+        const req = (0, core_1.getEntityStorageRequest)();
+        return (_a = req === null || req === void 0 ? void 0 : req[security_1.CURRENT_SESSION_KEY]) !== null && _a !== void 0 ? _a : null;
+    }
+};
+exports.DeviceSessionsActiveMiddleware = DeviceSessionsActiveMiddleware;
+exports.DeviceSessionsActiveMiddleware = DeviceSessionsActiveMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], DeviceSessionsActiveMiddleware);
+//#endregion
+//# sourceMappingURL=device-sessions-active.middleware.js.map

package/server/src/lib/middlewares/device-sessions-active.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-active.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-active.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAE7B,iEAKgD;AAChD,yEAGoD;AACpD,2CAA4C;AAiB5C,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAElE,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,YAAY,CAAC,GAAqB;;IACzC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,SAAS,GAAG,MAAA,GAAG,CAAC,MAAM,0CAAE,SAAS,CAAC;IACxC,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,GAAyB;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAE,MAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAQ,MAAwC,CAAC,KAAK,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,MAA0B,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,YAAY;AAEZ,4DAA4D;AAE5D;;;;GAIG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAApC;QACI,WAAM,GAAG;YAChB,MAAM,EAAE,qBAAqB;YAC7B,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAkB;YACzC,KAAK,EAAE,EAAE;SACV,CAAC;IAqBJ,CAAC;IAnBO,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAChE,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,MAAA,MAAA,MAAA,IAAI,CAAC,WAAW,EAAE,0CAAE,GAAG,0CAAE,IAAI,EAAE,mCAAI,EAAE,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,wFAAwF;gBACxF,6FAA6F;gBAC7F,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;YAClE,CAAC;QACH,CAAC;KAAA;IAEO,WAAW;;QACjB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,OAAO,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,8BAAmB,CAAC,mCAAI,IAAI,CAAC;IAC5C,CAAC;CACF,CAAA;AA1BY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;GACA,8BAA8B,CA0B1C;AAED,YAAY"}

package/server/src/lib/middlewares/device-sessions-app-scope.middleware.d.ts

@@ -0,0 +1,29 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware } from '@acorex-platform/framework-server/core';
+/**
+
+ * ADR-TEN-001 D-07: operation-owned DeviceSessions admin scope.
+
+ *
+
+ * - Application Sessions → tenant-owner + current `applicationId`
+
+ * - Tenant Sessions → tenant-owner only (explicit `deviceSessionAdminScope=tenant`)
+
+ *
+
+ * Scope is selected by the operation signal (param/header), not Application.code / TM ids.
+
+ * Does not invent Feature/Permission gates in this phase.
+
+ */
+export declare class DeviceSessionsAppScopeMiddleware implements EntityStorageMiddleware {
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+    private failClosedMissingApplicationId;
+    private readRequest;
+    private readSessionApplicationId;
+}

package/server/src/lib/middlewares/device-sessions-app-scope.middleware.js

@@ -0,0 +1,137 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceSessionsAppScopeMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+const device_sessions_app_scope_util_1 = require("./device-sessions-app-scope.util");
+//#endregion
+//#region ----- Constants -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+/** Fail-closed sentinel when application scope lacks session.applicationId. */
+const NO_APPLICATION_SCOPE_ID = '__no-application__';
+//#endregion
+//#region ----- Device sessions application-scope middleware -----
+/**
+
+ * ADR-TEN-001 D-07: operation-owned DeviceSessions admin scope.
+
+ *
+
+ * - Application Sessions → tenant-owner + current `applicationId`
+
+ * - Tenant Sessions → tenant-owner only (explicit `deviceSessionAdminScope=tenant`)
+
+ *
+
+ * Scope is selected by the operation signal (param/header), not Application.code / TM ids.
+
+ * Does not invent Feature/Permission gates in this phase.
+
+ */
+let DeviceSessionsAppScopeMiddleware = class DeviceSessionsAppScopeMiddleware {
+    constructor() {
+        this.target = {
+            entity: DEVICE_SESSION_ENTITY,
+            ops: ['query', 'getOne', 'update', 'delete'],
+            order: 9,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            if ((0, abstract_1.isEngineStorageBypass)(ctx.locals) || (0, abstract_1.isSystemCommandBypass)(ctx.locals)) {
+                yield next();
+                return;
+            }
+            const applicationId = this.readSessionApplicationId();
+            const adminScope = (0, device_sessions_app_scope_util_1.resolveDeviceSessionAdminScope)({
+                queryParams: (_a = ctx.request) === null || _a === void 0 ? void 0 : _a.params,
+                headerValue: (0, device_sessions_app_scope_util_1.readDeviceSessionAdminScopeHeader)((_b = this.readRequest()) === null || _b === void 0 ? void 0 : _b.headers),
+            });
+            if (!(0, device_sessions_app_scope_util_1.shouldApplyDeviceSessionApplicationFilter)(adminScope)) {
+                yield next();
+                return;
+            }
+            if ((0, device_sessions_app_scope_util_1.isDeviceSessionApplicationScopeMissingApplicationId)(adminScope, applicationId)) {
+                yield this.failClosedMissingApplicationId(ctx, next);
+                return;
+            }
+            if (ctx.op === 'query' && ctx.request) {
+                ctx.request = Object.assign(Object.assign({}, ctx.request), { filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, {
+                        logic: 'and',
+                        filters: [
+                            {
+                                field: 'applicationId',
+                                operator: { type: 'equal' },
+                                value: applicationId,
+                            },
+                        ],
+                    }) });
+                yield next();
+                return;
+            }
+            if ((ctx.op === 'update' || ctx.op === 'delete') && ctx.id) {
+                const existing = (yield ctx.backend.getOne(ctx.entityName, ctx.id));
+                if (existing && String((_c = existing['applicationId']) !== null && _c !== void 0 ? _c : '') !== applicationId) {
+                    throw new core_1.MiddlewareAbortError('Device session is outside the current application scope.', {
+                        code: 'SCOPE_READONLY',
+                        status: 403,
+                    });
+                }
+            }
+            yield next();
+            if (ctx.op === 'getOne') {
+                const row = ctx.result;
+                if (row && String((_d = row['applicationId']) !== null && _d !== void 0 ? _d : '') !== applicationId) {
+                    ctx.result = null;
+                }
+            }
+        });
+    }
+    failClosedMissingApplicationId(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (ctx.op === 'query' && ctx.request) {
+                ctx.request = Object.assign(Object.assign({}, ctx.request), { filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, {
+                        logic: 'and',
+                        filters: [
+                            {
+                                field: 'id',
+                                operator: { type: 'equal' },
+                                value: NO_APPLICATION_SCOPE_ID,
+                            },
+                        ],
+                    }) });
+                yield next();
+                return;
+            }
+            if (ctx.op === 'update' || ctx.op === 'delete') {
+                throw new core_1.MiddlewareAbortError('Device session application scope requires a current application.', {
+                    code: 'SCOPE_READONLY',
+                    status: 403,
+                });
+            }
+            yield next();
+            if (ctx.op === 'getOne') {
+                ctx.result = null;
+            }
+        });
+    }
+    readRequest() {
+        return (0, core_1.getEntityStorageRequest)();
+    }
+    readSessionApplicationId() {
+        var _a, _b, _c;
+        const applicationId = (_c = (_b = (_a = this.readRequest()) === null || _a === void 0 ? void 0 : _a[security_1.CURRENT_SESSION_KEY]) === null || _b === void 0 ? void 0 : _b.applicationId) === null || _c === void 0 ? void 0 : _c.trim();
+        return applicationId || undefined;
+    }
+};
+exports.DeviceSessionsAppScopeMiddleware = DeviceSessionsAppScopeMiddleware;
+exports.DeviceSessionsAppScopeMiddleware = DeviceSessionsAppScopeMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], DeviceSessionsAppScopeMiddleware);
+//#endregion
+//# sourceMappingURL=device-sessions-app-scope.middleware.js.map

package/server/src/lib/middlewares/device-sessions-app-scope.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-app-scope.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-app-scope.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAI7B,iEAYgD;AAEhD,6EAQwD;AAExD,yEAMoD;AAEpD,2CAA4C;AAI5C,qFAU0C;AAoB1C,YAAY;AAIZ,+BAA+B;AAI/B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAIlE,+EAA+E;AAE/E,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAIrD,YAAY;AAIZ,kEAAkE;AAIlE;;;;;;;;;;;;;;;;GAgBG;AAII,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAAtC;QAEI,WAAM,GAAG;YAEhB,MAAM,EAAE,qBAAqB;YAE7B,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAkB;YAE7D,KAAK,EAAE,CAAC;SAET,CAAC;IAsOJ,CAAC;IAlOO,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAEhE,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAE3E,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAEtD,MAAM,UAAU,GAAG,IAAA,+DAA8B,EAAC;gBAEhD,WAAW,EAAE,MAAA,GAAG,CAAC,OAAO,0CAAE,MAA6C;gBAEvE,WAAW,EAAE,IAAA,kEAAiC,EAE5C,MAAA,IAAI,CAAC,WAAW,EAAE,0CAAE,OAIP,CAEd;aAEF,CAAC,CAAC;YAIH,IAAI,CAAC,IAAA,0EAAyC,EAAC,UAAU,CAAC,EAAE,CAAC;gBAE3D,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,IAAI,IAAA,oFAAmD,EAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;gBAEnF,MAAM,IAAI,CAAC,8BAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAErD,OAAO;YAET,CAAC;YAID,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAEtC,GAAG,CAAC,OAAO,mCAEN,GAAG,CAAC,OAAO,KAEd,MAAM,EAAE,IAAA,+BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;wBAE/C,KAAK,EAAE,KAAK;wBAEZ,OAAO,EAAE;4BAEP;gCAEE,KAAK,EAAE,eAAe;gCAEtB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gCAE3B,KAAK,EAAE,aAAa;6BAErB;yBAEF;qBAEF,CAAC,GAEH,CAAC;gBAEF,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBAE3D,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAMrD,CAAC;gBAEd,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAA,QAAQ,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC;oBAE1E,MAAM,IAAI,2BAAoB,CAAC,0DAA0D,EAAE;wBAEzF,IAAI,EAAE,gBAAgB;wBAEtB,MAAM,EAAE,GAAG;qBAEZ,CAAC,CAAC;gBAEL,CAAC;YAEH,CAAC;YAID,MAAM,IAAI,EAAE,CAAC;YAIb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAExB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAoD,CAAC;gBAErE,IAAI,GAAG,IAAI,MAAM,CAAC,MAAA,GAAG,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,KAAK,aAAa,EAAE,CAAC;oBAEhE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAEpB,CAAC;YAEH,CAAC;QAEH,CAAC;KAAA;IAIa,8BAA8B,CAE1C,GAAyB,EAEzB,IAAyB;;YAIzB,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAEtC,GAAG,CAAC,OAAO,mCAEN,GAAG,CAAC,OAAO,KAEd,MAAM,EAAE,IAAA,+BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;wBAE/C,KAAK,EAAE,KAAK;wBAEZ,OAAO,EAAE;4BAEP;gCAEE,KAAK,EAAE,IAAI;gCAEX,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gCAE3B,KAAK,EAAE,uBAAuB;6BAE/B;yBAEF;qBAEF,CAAC,GAEH,CAAC;gBAEF,MAAM,IAAI,EAAE,CAAC;gBAEb,OAAO;YAET,CAAC;YAID,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAE/C,MAAM,IAAI,2BAAoB,CAE5B,kEAAkE,EAElE;oBAEE,IAAI,EAAE,gBAAgB;oBAEtB,MAAM,EAAE,GAAG;iBAEZ,CAEF,CAAC;YAEJ,CAAC;YAID,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAExB,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;YAEpB,CAAC;QAEH,CAAC;KAAA;IAIO,WAAW;QAEjB,OAAO,IAAA,8BAAuB,GAAoC,CAAC;IAErE,CAAC;IAIO,wBAAwB;;QAE9B,MAAM,aAAa,GAAG,MAAA,MAAA,MAAA,IAAI,CAAC,WAAW,EAAE,0CAAG,8BAAmB,CAAC,0CAAE,aAAa,0CAAE,IAAI,EAAE,CAAC;QAEvF,OAAO,aAAa,IAAI,SAAS,CAAC;IAEpC,CAAC;CAEF,CAAA;AAhPY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,mBAAU,GAAE;GAEA,gCAAgC,CAgP5C;AAID,YAAY"}

package/server/src/lib/middlewares/device-sessions-app-scope.util.d.ts

@@ -0,0 +1,41 @@
+import { type AXPDeviceSessionAdminScope } from '../../../../contracts/src/device-session-admin-scope';
+/**
+
+ * Whether DeviceSessions should apply an additional `applicationId` filter.
+
+ * Tenant-sessions operation → false; application-sessions → true.
+
+ * Tenant bound remains `tenant-owner` either way.
+
+ */
+export declare function shouldApplyDeviceSessionApplicationFilter(adminScope: AXPDeviceSessionAdminScope): boolean;
+/**
+
+ * Application-scoped Device Sessions must not degrade to tenant-wide when
+
+ * `session.applicationId` is missing.
+
+ */
+export declare function isDeviceSessionApplicationScopeMissingApplicationId(adminScope: AXPDeviceSessionAdminScope, applicationId: string | undefined): boolean;
+/**
+
+ * Resolve explicit admin scope from query params and/or HTTP header.
+
+ * Defaults to application-sessions (narrower scope).
+
+ *
+
+ * Note: this value is an operation signal, not an authorization decision.
+
+ * Tenant-owner isolation still applies; distinguishing who may request
+
+ * tenant-wide admin scope is a separate auth concern (see audit notes).
+
+ */
+export declare function resolveDeviceSessionAdminScope(options: {
+    queryParams?: Record<string, unknown> | null | undefined;
+    headerValue?: string | string[] | null | undefined;
+}): AXPDeviceSessionAdminScope;
+export declare function readDeviceSessionAdminScopeHeader(headers: {
+    [key: string]: string | string[] | undefined;
+} | undefined): string | string[] | undefined;

package/server/src/lib/middlewares/device-sessions-app-scope.util.js

@@ -0,0 +1,69 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldApplyDeviceSessionApplicationFilter = shouldApplyDeviceSessionApplicationFilter;
+exports.isDeviceSessionApplicationScopeMissingApplicationId = isDeviceSessionApplicationScopeMissingApplicationId;
+exports.resolveDeviceSessionAdminScope = resolveDeviceSessionAdminScope;
+exports.readDeviceSessionAdminScopeHeader = readDeviceSessionAdminScopeHeader;
+const device_session_admin_scope_1 = require("../../../../contracts/src/device-session-admin-scope");
+//#endregion
+//#region ----- Device Sessions admin scope resolution -----
+/**
+
+ * Whether DeviceSessions should apply an additional `applicationId` filter.
+
+ * Tenant-sessions operation → false; application-sessions → true.
+
+ * Tenant bound remains `tenant-owner` either way.
+
+ */
+function shouldApplyDeviceSessionApplicationFilter(adminScope) {
+    return adminScope === 'application';
+}
+/**
+
+ * Application-scoped Device Sessions must not degrade to tenant-wide when
+
+ * `session.applicationId` is missing.
+
+ */
+function isDeviceSessionApplicationScopeMissingApplicationId(adminScope, applicationId) {
+    return shouldApplyDeviceSessionApplicationFilter(adminScope) && !applicationId;
+}
+/**
+
+ * Resolve explicit admin scope from query params and/or HTTP header.
+
+ * Defaults to application-sessions (narrower scope).
+
+ *
+
+ * Note: this value is an operation signal, not an authorization decision.
+
+ * Tenant-owner isolation still applies; distinguishing who may request
+
+ * tenant-wide admin scope is a separate auth concern (see audit notes).
+
+ */
+function resolveDeviceSessionAdminScope(options) {
+    var _a;
+    const fromParams = (_a = options.queryParams) === null || _a === void 0 ? void 0 : _a[device_session_admin_scope_1.AXP_DEVICE_SESSION_ADMIN_SCOPE_PARAM];
+    if (fromParams === 'tenant' || fromParams === 'application') {
+        return fromParams;
+    }
+    const header = options.headerValue;
+    const headerRaw = Array.isArray(header) ? header[0] : header;
+    if (typeof headerRaw === 'string' && headerRaw.trim()) {
+        return (0, device_session_admin_scope_1.normalizeDeviceSessionAdminScope)(headerRaw.trim().toLowerCase());
+    }
+    return 'application';
+}
+function readDeviceSessionAdminScopeHeader(headers) {
+    var _a;
+    if (!headers) {
+        return undefined;
+    }
+    return ((_a = headers[device_session_admin_scope_1.AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER]) !== null && _a !== void 0 ? _a : headers[device_session_admin_scope_1.AXP_DEVICE_SESSION_ADMIN_SCOPE_HEADER.toUpperCase()]);
+}
+//#endregion
+//# sourceMappingURL=device-sessions-app-scope.util.js.map

package/server/src/lib/middlewares/device-sessions-app-scope.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-app-scope.util.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-app-scope.util.ts"],"names":[],"mappings":";AAAA,6BAA6B;;AAoC7B,8FAQC;AAYD,kHAUC;AAoBD,wEAgCC;AAID,8EAoBC;AA1ID,qGAU8D;AAI9D,YAAY;AAIZ,4DAA4D;AAI5D;;;;;;;;GAQG;AAEH,SAAgB,yCAAyC,CAEvD,UAAsC;IAItC,OAAO,UAAU,KAAK,aAAa,CAAC;AAEtC,CAAC;AAID;;;;;;GAMG;AAEH,SAAgB,mDAAmD,CAEjE,UAAsC,EAEtC,aAAiC;IAIjC,OAAO,yCAAyC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;AAEjF,CAAC;AAID;;;;;;;;;;;;;;GAcG;AAEH,SAAgB,8BAA8B,CAAC,OAM9C;;IAEC,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,WAAW,0CAAG,iEAAoC,CAAC,CAAC;IAE/E,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QAE5D,OAAO,UAAU,CAAC;IAEpB,CAAC;IAID,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAEnC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAE7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAEtD,OAAO,IAAA,6DAAgC,EAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1E,CAAC;IAID,OAAO,aAAa,CAAC;AAEvB,CAAC;AAID,SAAgB,iCAAiC,CAE/C,OAAqE;;IAIrE,IAAI,CAAC,OAAO,EAAE,CAAC;QAEb,OAAO,SAAS,CAAC;IAEnB,CAAC;IAED,OAAO,CAEL,MAAA,OAAO,CAAC,kEAAqC,CAAC,mCAE9C,OAAO,CAAC,kEAAqC,CAAC,WAAW,EAAE,CAAC,CAE7D,CAAC;AAEJ,CAAC;AAID,YAAY"}

package/server/src/lib/middlewares/device-sessions-token-revoke.middleware.d.ts

@@ -0,0 +1,18 @@
+import { AXPEntityOp, EntityStorageContext, EntityStorageMiddleware, EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { AuthService } from '@acorex-platform/framework-server/security';
+/**
+ * Projects DeviceSessions revoke (DB SoT) onto Redis (`sid`).
+ * Request validation must check Redis only — see device-session-revocation.mdc.
+ */
+export declare class DeviceSessionsTokenRevokeMiddleware implements EntityStorageMiddleware {
+    private readonly auth;
+    private readonly storage;
+    private readonly logger;
+    readonly target: {
+        entity: string;
+        ops: AXPEntityOp[];
+        order: number;
+    };
+    constructor(auth: AuthService, storage: EntityStorageMiddlewareService);
+    execute(ctx: EntityStorageContext, next: () => Promise<void>): Promise<void>;
+}

package/server/src/lib/middlewares/device-sessions-token-revoke.middleware.js

@@ -0,0 +1,90 @@
+"use strict";
+//#region ----- Imports -----
+var DeviceSessionsTokenRevokeMiddleware_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceSessionsTokenRevokeMiddleware = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const common_1 = require("@nestjs/common");
+//#endregion
+//#region ----- Constants -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+const REVOKED = 'revoked';
+//#endregion
+//#region ----- Helpers -----
+function rowSessionId(row) {
+    var _a;
+    if (typeof row.sessionId === 'string' && row.sessionId.trim()) {
+        return row.sessionId.trim();
+    }
+    const configSid = (_a = row.config) === null || _a === void 0 ? void 0 : _a.sessionId;
+    return typeof configSid === 'string' ? configSid.trim() : '';
+}
+function isRevokedStatus(value) {
+    return String(value !== null && value !== void 0 ? value : '')
+        .trim()
+        .toLowerCase() === REVOKED;
+}
+//#endregion
+//#region ----- Device sessions JWT revoke middleware -----
+/**
+ * Projects DeviceSessions revoke (DB SoT) onto Redis (`sid`).
+ * Request validation must check Redis only — see device-session-revocation.mdc.
+ */
+let DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware_1 = class DeviceSessionsTokenRevokeMiddleware {
+    constructor(auth, storage) {
+        this.auth = auth;
+        this.storage = storage;
+        this.logger = new common_1.Logger(DeviceSessionsTokenRevokeMiddleware_1.name);
+        this.target = {
+            entity: DEVICE_SESSION_ENTITY,
+            ops: ['update'],
+            order: 30,
+        };
+    }
+    execute(ctx, next) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const patchStatus = (_a = ctx.data) === null || _a === void 0 ? void 0 : _a['status'];
+            const patchRequestsRevoke = isRevokedStatus(patchStatus);
+            yield next();
+            if (!patchRequestsRevoke || !ctx.result || typeof ctx.result !== 'object') {
+                return;
+            }
+            let row = ctx.result;
+            if (!isRevokedStatus(row.status)) {
+                return;
+            }
+            let sid = rowSessionId(row);
+            const entityId = typeof row.id === 'string' ? row.id : typeof ctx.id === 'string' ? ctx.id : '';
+            let userId = typeof row.userId === 'string' ? row.userId.trim() : '';
+            if ((!sid || !userId) && entityId) {
+                // Update responses can omit nested/legacy fields — reload for sessionId / userId.
+                const full = (yield this.storage.getOneAsEngine(DEVICE_SESSION_ENTITY, entityId));
+                if (full) {
+                    row = full;
+                    sid = rowSessionId(row);
+                    userId = typeof row.userId === 'string' ? row.userId.trim() : userId;
+                }
+            }
+            if (!sid) {
+                this.logger.warn(`Device session ${entityId || '(unknown)'} revoked without sessionId; JWT family not invalidated`);
+                return;
+            }
+            yield this.auth.invalidateLoginSession(sid);
+            this.logger.warn(`DeviceSessions revoke projected JWT family invalidate + session_terminated: sid=${sid} userId=${userId || '(unknown)'} entityId=${entityId || '(unknown)'}`);
+            if (userId) {
+                this.auth.notifyRemoteSessionTerminated(userId, sid);
+            }
+        });
+    }
+};
+exports.DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware;
+exports.DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware = DeviceSessionsTokenRevokeMiddleware_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [security_1.AuthService,
+        core_1.EntityStorageMiddlewareService])
+], DeviceSessionsTokenRevokeMiddleware);
+//#endregion
+//# sourceMappingURL=device-sessions-token-revoke.middleware.js.map

package/server/src/lib/middlewares/device-sessions-token-revoke.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-sessions-token-revoke.middleware.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/middlewares/device-sessions-token-revoke.middleware.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;;AAE7B,iEAKgD;AAChD,yEAAyE;AACzE,2CAAoD;AAcpD,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,YAAY,CAAC,GAAqB;;IACzC,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,SAAS,GAAG,MAAA,GAAG,CAAC,MAAM,0CAAE,SAAS,CAAC;IACxC,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,MAAM,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;SACvB,IAAI,EAAE;SACN,WAAW,EAAE,KAAK,OAAO,CAAC;AAC/B,CAAC;AAED,YAAY;AAEZ,2DAA2D;AAE3D;;;GAGG;AAEI,IAAM,mCAAmC,2CAAzC,MAAM,mCAAmC;IAS9C,YACmB,IAAiB,EACjB,OAAuC;QADvC,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAgC;QAVzC,WAAM,GAAG,IAAI,eAAM,CAAC,qCAAmC,CAAC,IAAI,CAAC,CAAC;QAEtE,WAAM,GAAG;YAChB,MAAM,EAAE,qBAAqB;YAC7B,GAAG,EAAE,CAAC,QAAQ,CAAkB;YAChC,KAAK,EAAE,EAAE;SACV,CAAC;IAKC,CAAC;IAEE,OAAO,CAAC,GAAyB,EAAE,IAAyB;;;YAChE,MAAM,WAAW,GAAG,MAAC,GAAG,CAAC,IAA4C,0CAAG,QAAQ,CAAC,CAAC;YAClF,MAAM,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;YAEzD,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,GAAG,GAAG,GAAG,CAAC,MAA0B,CAAC;YACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,IAAI,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAClC,kFAAkF;gBAClF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAA4B,CAAC;gBAC7G,IAAI,IAAI,EAAE,CAAC;oBACT,GAAG,GAAG,IAAI,CAAC;oBACX,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;oBACxB,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kBAAkB,QAAQ,IAAI,WAAW,wDAAwD,CAClG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mFAAmF,GAAG,WAAW,MAAM,IAAI,WAAW,aAAa,QAAQ,IAAI,WAAW,EAAE,CAC7J,CAAC;YAEF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA3DY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;6CAWc,sBAAW;QACR,qCAA8B;GAX/C,mCAAmC,CA2D/C;AAED,YAAY"}