@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/password-reset/get-own-password-status.command.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetOwnPasswordStatusCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_change_password_service_1 = require("./user-change-password.service");
+//#region ----- Get own password status command -----
+let GetOwnPasswordStatusCommand = class GetOwnPasswordStatusCommand {
+    constructor(changePassword) {
+        this.changePassword = changePassword;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.changePassword.getOwnPasswordStatus();
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.GetOwnPasswordStatusCommand = GetOwnPasswordStatusCommand;
+exports.GetOwnPasswordStatusCommand = GetOwnPasswordStatusCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.GetOwnPasswordStatus, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_change_password_service_1.UserChangePasswordService])
+], GetOwnPasswordStatusCommand);
+//#endregion
+//# sourceMappingURL=get-own-password-status.command.js.map

package/server/src/lib/password-reset/get-own-password-status.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-own-password-status.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/get-own-password-status.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAG+D;AAE/D,iFAA2E;AAE3E,qDAAqD;AAI9C,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACtC,YAA6B,cAAyC;QAAzC,mBAAc,GAAd,cAAc,CAA2B;IAAG,CAAC;IAEpE,OAAO;;YACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAVY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjG,IAAA,mBAAU,GAAE;6CAEkC,wDAAyB;GAD3D,2BAA2B,CAUvC;AAED,YAAY"}

package/{src → server/src}/lib/password-reset/send-password-reset-email.command.d.ts

@@ -1,21 +1,20 @@
-import type { AXPCommand } from '@acorex-platform/framework-shared/runtime';
-import type { AXPExecuteCommandResult } from '@acorex-platform/framework-shared/core';
-import { type AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-contracts';
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-client/contracts';
 import { UserPasswordResetService } from './user-password-reset.service';
 export declare class SendPasswordResetEmailCommand implements AXPCommand<AXMSendPasswordResetEmailInput & {
-    __context__?: {
-        data?: {
-            id?: string;
-        };
+    data?: {
+        id?: string;
     };
-}, unknown> {
+}, {
+    sent: boolean;
+}> {
     private readonly passwordReset;
     constructor(passwordReset: UserPasswordResetService);
     execute(input?: AXMSendPasswordResetEmailInput & {
-        __context__?: {
-            data?: {
-                id?: string;
-            };
+        data?: {
+            id?: string;
         };
-    }): Promise<AXPExecuteCommandResult>;
+    }): AXPCommandExecuteResultPromise<{
+        sent: boolean;
+    }>;
 }

package/{src → server/src}/lib/password-reset/send-password-reset-email.command.js

@@ -3,8 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SendPasswordResetEmailCommand = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-shared/core");
 const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
-const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-contracts");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
 const user_password_reset_service_1 = require("./user-password-reset.service");
 //#region ---- Send password reset email command ----
 let SendPasswordResetEmailCommand = class SendPasswordResetEmailCommand {
@@ -13,34 +14,28 @@ let SendPasswordResetEmailCommand = class SendPasswordResetEmailCommand {
     }
     execute() {
         return tslib_1.__awaiter(this, arguments, void 0, function* (input = {}) {
-            var _a, _b, _c;
+            var _a, _b;
             try {
-                const userId = (_a = input.userId) !== null && _a !== void 0 ? _a : (_c = (_b = input.__context__) === null || _b === void 0 ? void 0 : _b.data) === null || _c === void 0 ? void 0 : _c.id;
+                const userId = (_a = input.userId) !== null && _a !== void 0 ? _a : (_b = input.data) === null || _b === void 0 ? void 0 : _b.id;
                 const result = yield this.passwordReset.sendPasswordResetEmail({
                     userId: userId ? String(userId) : undefined,
                     login: input.login,
                     webOrigin: input.webOrigin,
                 });
-                return {
-                    success: result.success,
-                    data: { sent: result.sent === true },
-                    message: result.message ? { text: result.message } : undefined,
-                };
+                if (!result.success) {
+                    return (0, core_1.runtimeCommandFailure)(result.message);
+                }
+                return (0, core_1.runtimeCommandSuccessObject)({ sent: result.sent === true }, result.message ? { message: { text: result.message } } : undefined);
             }
             catch (error) {
-                return {
-                    success: false,
-                    message: {
-                        text: error instanceof Error ? error.message : 'Failed to send password reset email.',
-                    },
-                };
+                return (0, core_1.runtimeCommandFailure)(error instanceof Error ? error.message : 'Failed to send password reset email.');
             }
         });
     }
 };
 exports.SendPasswordResetEmailCommand = SendPasswordResetEmailCommand;
 exports.SendPasswordResetEmailCommand = SendPasswordResetEmailCommand = tslib_1.__decorate([
-    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.SendPasswordResetEmail }),
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.SendPasswordResetEmail, auth: 'public' }),
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [user_password_reset_service_1.UserPasswordResetService])
 ], SendPasswordResetEmailCommand);

package/server/src/lib/password-reset/send-password-reset-email.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-password-reset-email.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/send-password-reset-email.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,iEAA4G;AAE5G,gFAAkF;AAClF,gHAG+D;AAE/D,+EAAyE;AAEzE,qDAAqD;AAI9C,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAGxC,YAA6B,aAAuC;QAAvC,kBAAa,GAAb,aAAa,CAA0B;IAAG,CAAC;IAElE,OAAO;qEACX,QAAqE,EAAE;;YAEvE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAA,KAAK,CAAC,MAAM,mCAAI,MAAA,KAAK,CAAC,IAAI,0CAAE,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC;oBAC7D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO,IAAA,4BAAqB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,IAAA,kCAA2B,EAChC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAA,4BAAqB,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA7BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClG,IAAA,mBAAU,GAAE;6CAIiC,sDAAwB;GAHzD,6BAA6B,CA6BzC;AAED,YAAY"}

package/server/src/lib/password-reset/user-change-password.service.d.ts

@@ -0,0 +1,24 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { type AXMChangeOwnPasswordInput, type AXMChangeOwnPasswordResult, type AXMGetOwnPasswordStatusResult } from '@acorex-platform/module-security-management-client/contracts';
+export type ChangeOwnPasswordOutcome = {
+    success: true;
+    data: AXMChangeOwnPasswordResult;
+} | {
+    success: false;
+    code: string;
+};
+export type OwnPasswordStatusOutcome = {
+    success: true;
+    data: AXMGetOwnPasswordStatusResult;
+} | {
+    success: false;
+    code: string;
+};
+/** Verifies the current password (when present) and updates the signed-in user's credential. */
+export declare class UserChangePasswordService {
+    private readonly entityStorage;
+    constructor(entityStorage: EntityStorageMiddlewareService);
+    getOwnPasswordStatus(): Promise<OwnPasswordStatusOutcome>;
+    changeOwnPassword(input: AXMChangeOwnPasswordInput): Promise<ChangeOwnPasswordOutcome>;
+    private readSessionUserId;
+}

package/server/src/lib/password-reset/user-change-password.service.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserChangePasswordService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const lodash_1 = require("lodash");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+//#endregion
+//#region ----- Constants -----
+const USER_ENTITY = 'SecurityManagement.User';
+//#endregion
+//#region ----- Helpers -----
+function hasStoredPassword(stored) {
+    return typeof stored === 'string' && stored.trim().length > 0;
+}
+//#endregion
+//#region ----- User change-password service -----
+/** Verifies the current password (when present) and updates the signed-in user's credential. */
+let UserChangePasswordService = class UserChangePasswordService {
+    constructor(entityStorage) {
+        this.entityStorage = entityStorage;
+    }
+    getOwnPasswordStatus() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            const user = (yield this.entityStorage.getOneAsEngine(USER_ENTITY, userId));
+            if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            return {
+                success: true,
+                data: { hasPassword: hasStoredPassword((0, lodash_1.get)(user, 'password')) },
+            };
+        });
+    }
+    changeOwnPassword(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const currentPassword = (_a = input.currentPassword) !== null && _a !== void 0 ? _a : '';
+            const newPassword = (_b = input.newPassword) !== null && _b !== void 0 ? _b : '';
+            if (!newPassword) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.InvalidInput };
+            }
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            const user = (yield this.entityStorage.getOneAsEngine(USER_ENTITY, userId));
+            if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.NotSignedIn };
+            }
+            const storedPassword = (0, lodash_1.get)(user, 'password');
+            const hasPassword = hasStoredPassword(storedPassword);
+            if (hasPassword) {
+                if (!currentPassword) {
+                    return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.InvalidInput };
+                }
+                if (!(yield (0, core_2.verifyPassword)(currentPassword, storedPassword))) {
+                    return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.IncorrectCurrent };
+                }
+                if (yield (0, core_2.verifyPassword)(newPassword, storedPassword)) {
+                    return { success: false, code: module_security_management_contracts_1.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES.SameAsCurrent };
+                }
+            }
+            const passwordChangedAt = new Date().toISOString();
+            yield this.entityStorage.updateOne(USER_ENTITY, userId, {
+                password: yield (0, core_2.hashPassword)(newPassword),
+                passwordChangedAt,
+            });
+            return { success: true, data: { passwordChangedAt } };
+        });
+    }
+    readSessionUserId() {
+        var _a, _b;
+        const req = (0, core_1.getEntityStorageRequest)();
+        const userId = (_b = (_a = req === null || req === void 0 ? void 0 : req[security_1.CURRENT_SESSION_KEY]) === null || _a === void 0 ? void 0 : _a.userId) === null || _b === void 0 ? void 0 : _b.trim();
+        return userId || undefined;
+    }
+};
+exports.UserChangePasswordService = UserChangePasswordService;
+exports.UserChangePasswordService = UserChangePasswordService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], UserChangePasswordService);
+//#endregion
+//# sourceMappingURL=user-change-password.service.js.map

package/server/src/lib/password-reset/user-change-password.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-change-password.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/user-change-password.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,mCAA6B;AAE7B,iEAAiH;AACjH,yEAGoD;AACpD,iEAAsF;AACtF,gHAM+D;AAgB/D,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,iBAAiB,CAAC,MAAe;IACxC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,YAAY;AAEZ,kDAAkD;AAElD,gGAAgG;AAEzF,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;IAAG,CAAC;IAExE,oBAAoB;;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CACnD,WAAW,EACX,MAAM,CACP,CAAiD,CAAC;YAEnD,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAA,YAAG,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE;aAChE,CAAC;QACJ,CAAC;KAAA;IAEK,iBAAiB,CAAC,KAAgC;;;YACtD,MAAM,eAAe,GAAG,MAAA,KAAK,CAAC,eAAe,mCAAI,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC;YAE5C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,YAAY,EAAE,CAAC;YACpF,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CACnD,WAAW,EACX,MAAM,CACP,CAAiD,CAAC;YAEnD,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,WAAW,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,cAAc,GAAG,IAAA,YAAG,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,WAAW,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAEtD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,YAAY,EAAE,CAAC;gBACpF,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,IAAA,qBAAc,EAAC,eAAe,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;oBAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,gBAAgB,EAAE,CAAC;gBACxF,CAAC;gBACD,IAAI,MAAM,IAAA,qBAAc,EAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0EAAmC,CAAC,aAAa,EAAE,CAAC;gBACrF,CAAC;YACH,CAAC;YAED,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,QAAQ,EAAE,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC;gBACzC,iBAAiB;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC;QACxD,CAAC;KAAA;IAEO,iBAAiB;;QACvB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,8BAAmB,CAAC,0CAAE,MAAM,0CAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;CACF,CAAA;AA3EY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;6CAEiC,qCAA8B;GAD/D,yBAAyB,CA2ErC;AAED,YAAY"}

package/{src → server/src}/lib/password-reset/user-password-reset.service.d.ts

@@ -1,14 +1,12 @@
 import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
 import { ServerCommandExecutorService } from '@acorex-platform/framework-server/domain/providers';
-import { SettingsManagementStoreService } from '@acorex-platform/module-settings-management-server';
-import { AXMCompletePasswordResetInput, AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-contracts';
+import { AXMCompletePasswordResetInput, AXMSendPasswordResetEmailInput } from '@acorex-platform/module-security-management-client/contracts';
 export declare class UserPasswordResetService {
     private readonly entityStorage;
     private readonly commandExecutor;
-    private readonly settingsStore;
     private readonly logger;
     private readonly recentRequests;
-    constructor(entityStorage: EntityStorageMiddlewareService, commandExecutor: ServerCommandExecutorService, settingsStore: SettingsManagementStoreService);
+    constructor(entityStorage: EntityStorageMiddlewareService, commandExecutor: ServerCommandExecutorService);
     /**
      * Shared by admin Action and public forgot-password.
      * Always returns a generic success for the forgot path (no user enumeration).
@@ -24,8 +22,5 @@ export declare class UserPasswordResetService {
     }>;
     private resolveUser;
     private listUsers;
-    private resolveCompanyEmailMerge;
-    private loadTenantSnapshot;
-    private resolveScopedSettings;
     private assertRateLimit;
 }

package/{src → server/src}/lib/password-reset/user-password-reset.service.js

@@ -10,37 +10,17 @@ const core_1 = require("@acorex-platform/framework-server/core");
 const providers_1 = require("@acorex-platform/framework-server/domain/providers");
 const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
 const core_2 = require("@acorex-platform/framework-shared/core");
-const module_communication_management_contracts_1 = require("@acorex-platform/module-communication-management-contracts");
-const module_content_management_contracts_1 = require("@acorex-platform/module-content-management-contracts");
-const module_organization_management_contracts_1 = require("@acorex-platform/module-organization-management-contracts");
-const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const module_communication_management_contracts_1 = require("@acorex-platform/module-communication-management-client/contracts");
+const module_content_management_contracts_1 = require("@acorex-platform/module-content-management-client/contracts");
 //#region ---- Constants ----
 const USER_ENTITY = 'SecurityManagement.User';
-const TENANT_ENTITY = 'TenantManagement.Tenant';
-const TEMPLATE_NAME = 'password-reset';
+const TEMPLATE_ID = module_content_management_contracts_1.AXM_TEXT_TEMPLATE_IDS.passwordReset;
 const EMAIL_CHANNEL = 'email-smtp';
 const EXPIRY_MINUTES = 60;
 const RATE_LIMIT_WINDOW_MS = 60000;
 const RATE_LIMIT_MAX = 5;
 //#endregion
 //#region ---- Helpers ----
-function resolvePasswordResetApiOrigin() {
-    var _a, _b, _c;
-    const fromBase = ((_a = process.env['ACOREX_API_BASE_URL']) === null || _a === void 0 ? void 0 : _a.trim()) ||
-        ((_b = process.env['DEMO_API_BASE_URL']) === null || _b === void 0 ? void 0 : _b.trim()) ||
-        '';
-    if (fromBase) {
-        try {
-            const url = new URL(fromBase.includes('://') ? fromBase : `http://${fromBase}`);
-            return url.origin;
-        }
-        catch (_d) {
-            // fall through
-        }
-    }
-    const port = ((_c = process.env['PORT']) === null || _c === void 0 ? void 0 : _c.trim()) || '5500';
-    return `http://localhost:${port}`;
-}
 function hashToken(token) {
     return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
 }
@@ -66,10 +46,9 @@ function tokensMatch(a, b) {
 //#endregion
 //#region ---- User password reset service ----
 let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordResetService {
-    constructor(entityStorage, commandExecutor, settingsStore) {
+    constructor(entityStorage, commandExecutor) {
         this.entityStorage = entityStorage;
         this.commandExecutor = commandExecutor;
-        this.settingsStore = settingsStore;
         this.logger = new common_1.Logger(UserPasswordResetService_1.name);
         this.recentRequests = new Map();
     }
@@ -79,7 +58,7 @@ let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordRe
      */
     sendPasswordResetEmail(input) {
         return tslib_1.__awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f, _g;
+            var _a, _b, _c, _d, _e, _f;
             const loginKey = ((_b = (_a = input.login) !== null && _a !== void 0 ? _a : input.userId) !== null && _b !== void 0 ? _b : '').toString().trim().toLowerCase();
             if (loginKey) {
                 this.assertRateLimit(loginKey);
@@ -107,28 +86,34 @@ let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordRe
                 expiresAt: expiresAt.toISOString(),
                 sentAt: now.toISOString(),
             };
-            yield this.entityStorage.updateOne(USER_ENTITY, user.id, { passwordReset });
+            yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, { passwordReset });
             const isAdminPath = Boolean(input.userId);
             const webOrigin = resolveWebOrigin(input.webOrigin);
             const resetLink = `${webOrigin}/auth/reset-password?token=${encodeURIComponent(rawToken)}`;
-            const tenantId = (_e = (_d = user.ownershipInfo) === null || _d === void 0 ? void 0 : _d.tenantId) === null || _e === void 0 ? void 0 : _e.trim();
-            if (!tenantId) {
-                this.logger.warn(`password-reset missing ownershipInfo.tenantId for user ${user.id}`);
+            const platformTenantId = (_d = (0, abstract_1.getPrimaryPlatformTenantId)()) === null || _d === void 0 ? void 0 : _d.trim();
+            if (!platformTenantId) {
+                this.logger.warn(`password-reset missing platform tenant id for user ${user.id}`);
                 if (isAdminPath) {
-                    return { success: false, message: 'User tenant context is required to send email.' };
+                    return { success: false, message: 'Platform tenant context is required to send email.' };
                 }
                 return { success: true, sent: false };
             }
-            const companyMerge = yield this.resolveCompanyEmailMerge(tenantId, webOrigin);
-            const merge = Object.assign(Object.assign({}, companyMerge), { userName: user.displayName || user.username || email, resetLink, expiryMinutes: String(EXPIRY_MINUTES) });
+            // Event tokens only — master Context tokens (companyName, …) come from render resolve.
+            const merge = {
+                userName: user.displayName || user.username || email,
+                resetLink,
+                expiryMinutes: EXPIRY_MINUTES,
+            };
             const renderResult = yield this.commandExecutor.execute(module_content_management_contracts_1.AXM_TEXT_TEMPLATE_RENDER_COMMAND_KEY, {
-                textTemplateName: TEMPLATE_NAME,
+                textTemplateId: TEMPLATE_ID,
+                tenantId: platformTenantId,
+                userId: user.id,
                 channel: 'email',
-                merge,
+                data: merge,
             });
-            const rendered = renderResult === null || renderResult === void 0 ? void 0 : renderResult.data;
+            const rendered = (0, core_2.runtimeCommandPayloadData)(renderResult);
             if (!(renderResult === null || renderResult === void 0 ? void 0 : renderResult.success) || !(rendered === null || rendered === void 0 ? void 0 : rendered.body)) {
-                const text = typeof ((_f = renderResult === null || renderResult === void 0 ? void 0 : renderResult.message) === null || _f === void 0 ? void 0 : _f.text) === 'string'
+                const text = typeof ((_e = renderResult === null || renderResult === void 0 ? void 0 : renderResult.message) === null || _e === void 0 ? void 0 : _e.text) === 'string'
                     ? renderResult.message.text
                     : 'Password reset template is not configured.';
                 this.logger.warn(`password-reset text template render failed: ${text}`);
@@ -146,13 +131,13 @@ let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordRe
                 recipientAddress: email,
                 recipientUserId: user.id,
                 recipientName: user.displayName || user.username,
-                tenantId,
-                definitionKey: TEMPLATE_NAME,
+                tenantId: platformTenantId,
+                definitionKey: TEMPLATE_ID,
                 correlationId: `password-reset:${user.id}:${passwordReset.sentAt}`,
                 idempotencyKey: `password-reset:${user.id}:${passwordReset.tokenHash}`,
             });
             if (!(result === null || result === void 0 ? void 0 : result.success)) {
-                const text = typeof ((_g = result === null || result === void 0 ? void 0 : result.message) === null || _g === void 0 ? void 0 : _g.text) === 'string'
+                const text = typeof ((_f = result === null || result === void 0 ? void 0 : result.message) === null || _f === void 0 ? void 0 : _f.text) === 'string'
                     ? result.message.text
                     : 'Failed to send password reset email.';
                 this.logger.warn(`password-reset send failed for user ${user.id}: ${text}`);
@@ -180,11 +165,11 @@ let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordRe
             }
             const expiresAt = Date.parse(user.passwordReset.expiresAt);
             if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) {
-                yield this.entityStorage.updateOne(USER_ENTITY, user.id, { passwordReset: null });
+                yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, { passwordReset: null });
                 return { success: false, message: 'This password reset link is invalid or has expired.' };
             }
             const password = yield (0, core_2.hashPassword)(newPassword);
-            yield this.entityStorage.updateOne(USER_ENTITY, user.id, {
+            yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, {
                 password,
                 passwordChangedAt: new Date().toISOString(),
                 passwordReset: null,
@@ -196,7 +181,7 @@ let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordRe
         return tslib_1.__awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d;
             if ((_a = input.userId) === null || _a === void 0 ? void 0 : _a.trim()) {
-                const record = yield this.entityStorage.getOne(USER_ENTITY, input.userId.trim());
+                const record = yield this.entityStorage.getOneAsEngine(USER_ENTITY, input.userId.trim());
                 return (_b = record) !== null && _b !== void 0 ? _b : null;
             }
             const login = (_c = input.login) === null || _c === void 0 ? void 0 : _c.trim().toLowerCase();
@@ -214,51 +199,6 @@ let UserPasswordResetService = UserPasswordResetService_1 = class UserPasswordRe
             return Array.isArray(items) ? items : [];
         });
     }
-    resolveCompanyEmailMerge(tenantId, webOrigin) {
-        return tslib_1.__awaiter(this, void 0, void 0, function* () {
-            const settingsValues = yield this.resolveScopedSettings(tenantId);
-            const tenant = yield this.loadTenantSnapshot(tenantId);
-            return (0, module_organization_management_contracts_1.buildCompanyEmailMergeFromOrganization)({
-                settingsValues,
-                tenant,
-                webOrigin,
-                apiOrigin: resolvePasswordResetApiOrigin(),
-            });
-        });
-    }
-    loadTenantSnapshot(tenantId) {
-        return tslib_1.__awaiter(this, void 0, void 0, function* () {
-            const id = tenantId.trim();
-            if (!id) {
-                return null;
-            }
-            try {
-                const row = (yield this.entityStorage.getOne(TENANT_ENTITY, id));
-                return row !== null && row !== void 0 ? row : null;
-            }
-            catch (_a) {
-                return null;
-            }
-        });
-    }
-    resolveScopedSettings(tenantId) {
-        return tslib_1.__awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const platformDocument = yield this.settingsStore.findByPartition({ scope: 'P', documentId: 'P' });
-            let values = Object.assign({}, ((_a = platformDocument === null || platformDocument === void 0 ? void 0 : platformDocument.values) !== null && _a !== void 0 ? _a : {}));
-            if (tenantId.trim()) {
-                const tenantDocument = yield this.settingsStore.findByPartition({
-                    scope: 'T',
-                    documentId: `T:${tenantId}`,
-                    tenantId,
-                });
-                if (tenantDocument === null || tenantDocument === void 0 ? void 0 : tenantDocument.values) {
-                    values = Object.assign(Object.assign({}, values), tenantDocument.values);
-                }
-            }
-            return values;
-        });
-    }
     assertRateLimit(key) {
         var _a;
         const now = Date.now();
@@ -275,8 +215,7 @@ exports.UserPasswordResetService = UserPasswordResetService;
 exports.UserPasswordResetService = UserPasswordResetService = UserPasswordResetService_1 = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
-        providers_1.ServerCommandExecutorService,
-        module_settings_management_server_1.SettingsManagementStoreService])
+        providers_1.ServerCommandExecutorService])
 ], UserPasswordResetService);
 //#endregion
 //# sourceMappingURL=user-password-reset.service.js.map

package/server/src/lib/password-reset/user-password-reset.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password-reset.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/password-reset/user-password-reset.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,mCAAkE;AAClE,mCAA6B;AAE7B,iEAAwF;AACxF,kFAAkG;AAClG,6EAA8H;AAC9H,iEAAiG;AACjG,0HAAsH;AACtH,8GAI8D;AAQ9D,6BAA6B;AAE7B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,WAAW,GAAG,2DAAqB,CAAC,aAAa,CAAC;AACxD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,oBAAoB,GAAG,KAAM,CAAC;AACpC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,YAAY;AAEZ,2BAA2B;AAE3B,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiB;;IACzC,MAAM,SAAS,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,EAAE,CAAC;IACnC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GACX,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,0CAAE,IAAI,EAAE;SACxC,MAAA,MAAA,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,0CAAE,IAAI,EAAE,CAAA;QAClD,uBAAuB,CAAC;IAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,YAAY;AAEZ,+CAA+C;AAGxC,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAInC,YACmB,aAA6C,EAC7C,eAA6C;QAD7C,kBAAa,GAAb,aAAa,CAAgC;QAC7C,oBAAe,GAAf,eAAe,CAA8B;QAL/C,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;QACnD,mBAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IAK3D,CAAC;IAEJ;;;OAGG;IACG,sBAAsB,CAC1B,KAAqC;;;YAErC,MAAM,QAAQ,GAAG,CAAC,MAAA,MAAA,KAAK,CAAC,KAAK,mCAAI,KAAK,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,EAAE,CAAC;gBACd,oEAAoE;gBACpE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBACxD,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;gBAC7E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,KAAM,CAAC,CAAC;YACpE,MAAM,aAAa,GAA6B;gBAC9C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;gBAC9B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE;aAC1B,CAAC;YAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAEpF,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,GAAG,SAAS,8BAA8B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAE3F,MAAM,gBAAgB,GAAG,MAAA,IAAA,qCAA0B,GAAE,0CAAE,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClF,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;gBAC3F,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,uFAAuF;YACrF,MAAM,KAAK,GAAG;gBACZ,QAAQ,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK;gBACpD,SAAS;gBACT,aAAa,EAAE,cAAc;aAC9B,CAAC;YAEJ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,0EAAoC,EAAE;gBAC5F,cAAc,EAAE,WAAW;gBAC3B,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,gCAAyB,EAAC,YAAY,CAA4C,CAAC;YACpG,IAAI,CAAC,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,CAAA,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA,EAAE,CAAC;gBAC9C,MAAM,IAAI,GACR,OAAO,CAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,0CAAE,IAAI,CAAA,KAAK,QAAQ;oBAC7C,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI;oBAC3B,CAAC,CAAC,4CAA4C,CAAC;gBACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;gBACxE,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,oFAAwC,CAAC,IAAI,EAAE;gBAC/F,KAAK,EAAE,OAAO,IAAI,gBAAgB;gBAClC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC1B,OAAO,EAAE,aAAa;gBACtB,gBAAgB,EAAE,KAAK;gBACvB,eAAe,EAAE,IAAI,CAAC,EAAE;gBACxB,aAAa,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAChD,QAAQ,EAAE,gBAAgB;gBAC1B,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,MAAM,EAAE;gBAClE,cAAc,EAAE,kBAAkB,IAAI,CAAC,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE;aACvE,CAAC,CAAC;YAEH,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAA,EAAE,CAAC;gBACrB,MAAM,IAAI,GACR,OAAO,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,0CAAE,IAAI,CAAA,KAAK,QAAQ;oBACvC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;oBACrB,CAAC,CAAC,sCAAsC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC5E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;KAAA;IAEK,qBAAqB,CACzB,KAAoC;;;YAEpC,MAAM,KAAK,GAAG,MAAA,KAAK,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,CAAC,CAAC,aAAa,0CAAE,SAAS,KAAI,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA,EAAA,CAAC,CAAC;YAChH,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;gBAC/D,QAAQ;gBACR,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC3C,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;KAAA;IAEa,WAAW,CACvB,KAAqC;;;YAErC,IAAI,MAAA,KAAK,CAAC,MAAM,0CAAE,IAAI,EAAE,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzF,OAAO,MAAC,MAAuD,mCAAI,IAAI,CAAC;YAC1E,CAAC;YAED,MAAM,KAAK,GAAG,MAAA,KAAK,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,OAAO,CACL,MAAA,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,EAAE,eACJ,OAAA,CAAA,MAAA,CAAC,CAAC,QAAQ,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,IAAI,CAAA,MAAA,CAAC,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAA,EAAA,CACxF,mCAAI,IAAI,CACV,CAAC;QACJ,CAAC;KAAA;IAEa,SAAS;;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;YACF,MAAM,KAAK,GAAG,IAAA,YAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAA4C,CAAC;YAClF,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,CAAC;KAAA;IAEO,eAAe,CAAC,GAAW;;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,oBAAoB,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,MAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;CACF,CAAA;AAhMY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;6CAMuB,qCAA8B;QAC5B,wCAA4B;GANrD,wBAAwB,CAgMpC;AAED,YAAY"}

package/server/src/lib/queries/get-permission-holders-history.query.d.ts

@@ -0,0 +1,4 @@
+import type { ReportQueryInput, ReportQueryResult } from '@acorex-platform/framework-server/report';
+import type { EffectiveAccessHistoryService } from '../effective-access-history/effective-access-history.service';
+import { type SecurityHistoryFilterScopeOptions } from './security-query.helpers';
+export declare function runGetPermissionHoldersHistoryQuery(history: EffectiveAccessHistoryService, input: ReportQueryInput, scope?: SecurityHistoryFilterScopeOptions): Promise<ReportQueryResult>;

package/server/src/lib/queries/get-permission-holders-history.query.definition.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Build-time only. Do not import from Nest modules.
+ * Source: get-permission-holders-history.query.ts
+ */
+export declare const getPermissionHoldersHistoryQueryDefinition: import("@acorex-platform/framework-shared/runtime").AXPAlignedQueryMetadataDefinition;

package/server/src/lib/queries/get-permission-holders-history.query.definition.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Build-time only. Do not import from Nest modules.
+ * Source: get-permission-holders-history.query.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPermissionHoldersHistoryQueryDefinition = void 0;
+const runtime_1 = require("@acorex-platform/framework-shared/runtime");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+exports.getPermissionHoldersHistoryQueryDefinition = (0, runtime_1.defineQuery)({
+    key: module_security_management_contracts_1.RootConfig.queries.reports.getPermissionHoldersHistory,
+    title: 'Permission holders',
+    description: 'Users who held a permission that overlaps the selected date range, reconstructed from grant Change History.',
+    executionMode: 'backend',
+    kind: 'collection',
+    filter: [
+        { name: 'permission', title: 'Permission', source: 'custom', interface: { name: 'text-editor' } },
+        { name: 'dateRange', title: 'Date range', source: 'custom', interface: { name: 'date-time-editor' } },
+        { name: 'tenantId', title: 'Tenant', source: 'custom', interface: { name: 'lookup-editor' } },
+        { name: 'applicationId', title: 'Application', source: 'custom', interface: { name: 'lookup-editor' } },
+    ],
+    sort: [
+        { name: 'username', title: 'Username', field: 'username' },
+        { name: 'displayName', title: 'Display name', field: 'displayName' },
+        { name: 'permission', title: 'Permission', field: 'permission' },
+        { name: 'validFrom', title: 'Valid from', field: 'validFrom' },
+        { name: 'validTo', title: 'Valid to', field: 'validTo' },
+    ],
+    columns: [
+        { name: 'username', title: 'Username', interface: { name: 'text-editor' } },
+        { name: 'displayName', title: 'Display name', interface: { name: 'text-editor' } },
+        { name: 'permission', title: 'Permission', interface: { name: 'text-editor' } },
+        { name: 'validFrom', title: 'Valid from', interface: { name: 'date-time-editor' } },
+        { name: 'validTo', title: 'Valid to', interface: { name: 'date-time-editor' } },
+    ],
+    categories: [runtime_1.AXP_CATALOG_DEFINITION_CATEGORY_REPORT],
+});
+//# sourceMappingURL=get-permission-holders-history.query.definition.js.map

package/server/src/lib/queries/get-permission-holders-history.query.definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-permission-holders-history.query.definition.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/queries/get-permission-holders-history.query.definition.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,uEAAgH;AAChH,gHAAmF;AAEtE,QAAA,0CAA0C,GAAG,IAAA,qBAAW,EAAC;IACpE,GAAG,EAAE,iDAAU,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B;IAC3D,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EACT,6GAA6G;IAC/G,aAAa,EAAE,SAAS;IACxB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACjG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE;QACrG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE;KACxG;IACD,IAAI,EAAE;QACJ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;QAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE;QACpE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;QAChE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE;QAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;KACzD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QAC3E,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QAClF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QAC/E,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE;QACnF,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE;KAChF;IACD,UAAU,EAAE,CAAC,gDAAsC,CAAC;CACrD,CAAC,CAAC"}

package/server/src/lib/queries/get-permission-holders-history.query.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGetPermissionHoldersHistoryQuery = runGetPermissionHoldersHistoryQuery;
+const tslib_1 = require("tslib");
+const security_query_helpers_1 = require("./security-query.helpers");
+//#region ----- Permission holders history query -----
+function runGetPermissionHoldersHistoryQuery(history_1, input_1) {
+    return tslib_1.__awaiter(this, arguments, void 0, function* (history, input, scope = {}) {
+        const filters = (0, security_query_helpers_1.extractSecurityHistoryFilters)(input.filter, scope);
+        const range = (0, security_query_helpers_1.requireHistoryRange)(filters);
+        if (!range || !filters.permission) {
+            return { items: [], total: 0 };
+        }
+        const rows = yield history.getPermissionHoldersInRange({
+            permission: filters.permission,
+            tenantId: range.tenantId,
+            applicationId: range.applicationId,
+            from: range.from,
+            to: range.to,
+        });
+        return (0, security_query_helpers_1.paginateRows)(rows, input);
+    });
+}
+//#endregion
+//# sourceMappingURL=get-permission-holders-history.query.js.map

package/server/src/lib/queries/get-permission-holders-history.query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-permission-holders-history.query.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/queries/get-permission-holders-history.query.ts"],"names":[],"mappings":";;AAWA,kFAoBC;;AA7BD,qEAKkC;AAElC,sDAAsD;AAEtD,SAAsB,mCAAmC;iEACvD,OAAsC,EACtC,KAAuB,EACvB,QAA2C,EAAE;QAE7C,MAAM,OAAO,GAAG,IAAA,sDAA6B,EAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,IAAA,4CAAmB,EAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,2BAA2B,CAAC;YACrD,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC;QAEH,OAAO,IAAA,qCAAY,EAAC,IAA4C,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;CAAA;AAED,YAAY"}

package/server/src/lib/queries/get-role-holders-history.query.d.ts

@@ -0,0 +1,4 @@
+import type { ReportQueryInput, ReportQueryResult } from '@acorex-platform/framework-server/report';
+import type { EffectiveAccessHistoryService } from '../effective-access-history/effective-access-history.service';
+import { type SecurityHistoryFilterScopeOptions } from './security-query.helpers';
+export declare function runGetRoleHoldersHistoryQuery(history: EffectiveAccessHistoryService, input: ReportQueryInput, scope?: SecurityHistoryFilterScopeOptions): Promise<ReportQueryResult>;

package/server/src/lib/queries/get-role-holders-history.query.definition.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Build-time only. Do not import from Nest modules.
+ * Source: get-role-holders-history.query.ts
+ */
+export declare const getRoleHoldersHistoryQueryDefinition: import("@acorex-platform/framework-shared/runtime").AXPAlignedQueryMetadataDefinition;