@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/security-management-entity-storage.bootstrap.js

@@ -0,0 +1,56 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityManagementEntityStorageBootstrap = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const user_assigned_roles_middleware_1 = require("./middlewares/user-assigned-roles.middleware");
+const device_sessions_active_middleware_1 = require("./middlewares/device-sessions-active.middleware");
+const device_sessions_app_scope_middleware_1 = require("./middlewares/device-sessions-app-scope.middleware");
+const device_sessions_token_revoke_middleware_1 = require("./middlewares/device-sessions-token-revoke.middleware");
+const user_effective_state_middleware_1 = require("./middlewares/user-effective-state.middleware");
+const user_invitation_list_middleware_1 = require("./middlewares/user-invitation-list.middleware");
+const user_profile_write_middleware_1 = require("./middlewares/user-profile-write.middleware");
+//#endregion
+//#region ----- Entity storage middleware bootstrap -----
+/**
+ * Ensures User middlewares join the server pipeline.
+ * Webpack can split `ENTITY_STORAGE_MIDDLEWARE` tokens so `useExisting` aliases
+ * are not discovered — register the instances the same way other modules do.
+ */
+let SecurityManagementEntityStorageBootstrap = class SecurityManagementEntityStorageBootstrap {
+    constructor(storage, userAssignedRoles, userProfileWrite, userEffectiveState, userInvitationList, deviceSessionsAppScope, deviceSessionsActive, deviceSessionsTokenRevoke) {
+        this.storage = storage;
+        this.userAssignedRoles = userAssignedRoles;
+        this.userProfileWrite = userProfileWrite;
+        this.userEffectiveState = userEffectiveState;
+        this.userInvitationList = userInvitationList;
+        this.deviceSessionsAppScope = deviceSessionsAppScope;
+        this.deviceSessionsActive = deviceSessionsActive;
+        this.deviceSessionsTokenRevoke = deviceSessionsTokenRevoke;
+    }
+    onModuleInit() {
+        this.storage.registerLateMiddleware(this.userAssignedRoles);
+        this.storage.registerLateMiddleware(this.userProfileWrite);
+        this.storage.registerLateMiddleware(this.userEffectiveState);
+        this.storage.registerLateMiddleware(this.userInvitationList);
+        this.storage.registerLateMiddleware(this.deviceSessionsAppScope);
+        this.storage.registerLateMiddleware(this.deviceSessionsActive);
+        this.storage.registerLateMiddleware(this.deviceSessionsTokenRevoke);
+    }
+};
+exports.SecurityManagementEntityStorageBootstrap = SecurityManagementEntityStorageBootstrap;
+exports.SecurityManagementEntityStorageBootstrap = SecurityManagementEntityStorageBootstrap = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        user_assigned_roles_middleware_1.UserAssignedRolesMiddleware,
+        user_profile_write_middleware_1.UserProfileWriteMiddleware,
+        user_effective_state_middleware_1.UserEffectiveStateMiddleware,
+        user_invitation_list_middleware_1.UserInvitationListMiddleware,
+        device_sessions_app_scope_middleware_1.DeviceSessionsAppScopeMiddleware,
+        device_sessions_active_middleware_1.DeviceSessionsActiveMiddleware,
+        device_sessions_token_revoke_middleware_1.DeviceSessionsTokenRevokeMiddleware])
+], SecurityManagementEntityStorageBootstrap);
+//#endregion
+//# sourceMappingURL=security-management-entity-storage.bootstrap.js.map

package/server/src/lib/security-management-entity-storage.bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-management-entity-storage.bootstrap.js","sourceRoot":"","sources":["../../../../../../libs/modules/security-management/server/src/lib/security-management-entity-storage.bootstrap.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAE7B,2CAA0D;AAC1D,iEAAwF;AAExF,iGAA2F;AAC3F,uGAAiG;AACjG,6GAAsG;AACtG,mHAA4G;AAC5G,mGAA6F;AAC7F,mGAA6F;AAC7F,+FAAyF;AAEzF,YAAY;AAEZ,yDAAyD;AAEzD;;;;GAIG;AAEI,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;IACnD,YACmB,OAAuC,EACvC,iBAA8C,EAC9C,gBAA4C,EAC5C,kBAAgD,EAChD,kBAAgD,EAChD,sBAAwD,EACxD,oBAAoD,EACpD,yBAA8D;QAP9D,YAAO,GAAP,OAAO,CAAgC;QACvC,sBAAiB,GAAjB,iBAAiB,CAA6B;QAC9C,qBAAgB,GAAhB,gBAAgB,CAA4B;QAC5C,uBAAkB,GAAlB,kBAAkB,CAA8B;QAChD,uBAAkB,GAAlB,kBAAkB,CAA8B;QAChD,2BAAsB,GAAtB,sBAAsB,CAAkC;QACxD,yBAAoB,GAApB,oBAAoB,CAAgC;QACpD,8BAAyB,GAAzB,yBAAyB,CAAqC;IAC9E,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC;CACF,CAAA;AArBY,4FAAwC;mDAAxC,wCAAwC;IADpD,IAAA,mBAAU,GAAE;6CAGiB,qCAA8B;QACpB,4DAA2B;QAC5B,0DAA0B;QACxB,8DAA4B;QAC5B,8DAA4B;QACxB,uEAAgC;QAClC,kEAA8B;QACzB,6EAAmC;GATtE,wCAAwC,CAqBpD;AAED,YAAY"}

package/server/src/lib/security-management-server.module.d.ts

@@ -0,0 +1,7 @@
+import { AXPContextDefinitionRegistry } from '@acorex-platform/framework-server/core';
+import { type OnModuleInit } from '@nestjs/common';
+export declare class SecurityManagementServerModule implements OnModuleInit {
+    private readonly contextDefinitions;
+    constructor(contextDefinitions: AXPContextDefinitionRegistry);
+    onModuleInit(): void;
+}

package/server/src/lib/security-management-server.module.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityManagementServerModule = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-server/core");
+const seed_1 = require("@acorex-platform/framework-server/domain/seed");
+const security_1 = require("@acorex-platform/framework-server/security");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const module_common_contracts_1 = require("@acorex-platform/module-common-client/contracts");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const common_1 = require("@nestjs/common");
+const effective_access_history_service_1 = require("./effective-access-history/effective-access-history.service");
+const security_management_entity_catalog_1 = require("./entities/security-management.entity-catalog");
+const security_report_handlers_1 = require("./handlers/security-report.handlers");
+const auth_oauth_clients_constants_1 = require("./identity-provider/auth-oauth-clients.constants");
+const identity_provider_catalog_service_1 = require("./identity-provider/identity-provider-catalog.service");
+const identity_provider_stub_bootstrap_1 = require("./identity-provider/identity-provider-stub.bootstrap");
+const security_management_entity_storage_bootstrap_1 = require("./security-management-entity-storage.bootstrap");
+const user_assigned_roles_middleware_1 = require("./middlewares/user-assigned-roles.middleware");
+const device_sessions_active_middleware_1 = require("./middlewares/device-sessions-active.middleware");
+const device_sessions_app_scope_middleware_1 = require("./middlewares/device-sessions-app-scope.middleware");
+const device_sessions_token_revoke_middleware_1 = require("./middlewares/device-sessions-token-revoke.middleware");
+const user_effective_state_middleware_1 = require("./middlewares/user-effective-state.middleware");
+const user_invitation_list_middleware_1 = require("./middlewares/user-invitation-list.middleware");
+const user_profile_write_middleware_1 = require("./middlewares/user-profile-write.middleware");
+const change_own_password_command_1 = require("./password-reset/change-own-password.command");
+const get_own_password_status_command_1 = require("./password-reset/get-own-password-status.command");
+const complete_password_reset_command_1 = require("./password-reset/complete-password-reset.command");
+const send_password_reset_email_command_1 = require("./password-reset/send-password-reset-email.command");
+const user_change_password_service_1 = require("./password-reset/user-change-password.service");
+const user_password_reset_service_1 = require("./password-reset/user-password-reset.service");
+const admin_reset_two_factor_command_1 = require("./two-factor/admin-reset-two-factor.command");
+const confirm_two_factor_enrollment_command_1 = require("./two-factor/confirm-two-factor-enrollment.command");
+const disable_two_factor_command_1 = require("./two-factor/disable-two-factor.command");
+const generate_two_factor_recovery_codes_command_1 = require("./two-factor/generate-two-factor-recovery-codes.command");
+const get_two_factor_status_command_1 = require("./two-factor/get-two-factor-status.command");
+const start_two_factor_enrollment_command_1 = require("./two-factor/start-two-factor-enrollment.command");
+const two_factor_gate_bootstrap_1 = require("./two-factor/two-factor-gate.bootstrap");
+const two_factor_redis_store_1 = require("./two-factor/two-factor-redis.store");
+const user_two_factor_service_1 = require("./two-factor/user-two-factor.service");
+const verify_two_factor_login_command_1 = require("./two-factor/verify-two-factor-login.command");
+const user_invitation_service_1 = require("./user-invitation/user-invitation.service");
+const invite_user_command_1 = require("./user-invitation/invite-user.command");
+const list_invite_assignable_roles_command_1 = require("./user-invitation/list-invite-assignable-roles.command");
+const list_tenant_entitled_applications_command_1 = require("./user-invitation/list-tenant-entitled-applications.command");
+const resend_invitation_command_1 = require("./user-invitation/resend-invitation.command");
+const cancel_invitation_command_1 = require("./user-invitation/cancel-invitation.command");
+const accept_invitation_command_1 = require("./user-invitation/accept-invitation.command");
+const accept_my_invitation_command_1 = require("./user-invitation/accept-my-invitation.command");
+const list_my_pending_invitations_command_1 = require("./user-invitation/list-my-pending-invitations.command");
+const decline_invitation_command_1 = require("./user-invitation/decline-invitation.command");
+const lookup_tenant_by_unique_name_command_1 = require("./user-invitation/lookup-tenant-by-unique-name.command");
+const request_tenant_membership_command_1 = require("./user-invitation/request-tenant-membership.command");
+const list_my_join_requests_command_1 = require("./user-invitation/list-my-join-requests.command");
+const cancel_my_join_request_command_1 = require("./user-invitation/cancel-my-join-request.command");
+const approve_join_request_command_1 = require("./user-invitation/approve-join-request.command");
+const reject_join_request_command_1 = require("./user-invitation/reject-join-request.command");
+const create_user_in_tenant_command_1 = require("./user-invitation/create-user-in-tenant.command");
+const password_change_history_service_1 = require("./reports/password-change-history.service");
+const security_report_definition_provider_1 = require("./reports/security-report-definition.provider");
+//#region ---- Security management backend module ----
+let SecurityManagementServerModule = class SecurityManagementServerModule {
+    constructor(contextDefinitions) {
+        this.contextDefinitions = contextDefinitions;
+    }
+    onModuleInit() {
+        this.contextDefinitions.registerAll(module_security_management_contracts_1.AXM_SECURITY_CONTEXT_DEFINITIONS);
+        // Conceptual permission keys → edition module names (Access/Setup = any-module).
+        (0, security_1.registerPermissionModulesResolver)(module_common_contracts_1.resolvePermissionModules);
+    }
+};
+exports.SecurityManagementServerModule = SecurityManagementServerModule;
+exports.SecurityManagementServerModule = SecurityManagementServerModule = tslib_1.__decorate([
+    (0, common_1.Module)({
+        imports: [seed_1.DomainEntityModule.forFeature(security_management_entity_catalog_1.securityManagementEntityCatalog), core_1.EntityStorageModule, module_settings_management_server_1.SettingsManagementServerModule],
+        providers: [
+            user_effective_state_middleware_1.UserEffectiveStateMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: user_effective_state_middleware_1.UserEffectiveStateMiddleware,
+                multi: true,
+            },
+            user_assigned_roles_middleware_1.UserAssignedRolesMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: user_assigned_roles_middleware_1.UserAssignedRolesMiddleware,
+                multi: true,
+            },
+            user_invitation_list_middleware_1.UserInvitationListMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: user_invitation_list_middleware_1.UserInvitationListMiddleware,
+                multi: true,
+            },
+            device_sessions_app_scope_middleware_1.DeviceSessionsAppScopeMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: device_sessions_app_scope_middleware_1.DeviceSessionsAppScopeMiddleware,
+                multi: true,
+            },
+            device_sessions_active_middleware_1.DeviceSessionsActiveMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: device_sessions_active_middleware_1.DeviceSessionsActiveMiddleware,
+                multi: true,
+            },
+            device_sessions_token_revoke_middleware_1.DeviceSessionsTokenRevokeMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: device_sessions_token_revoke_middleware_1.DeviceSessionsTokenRevokeMiddleware,
+                multi: true,
+            },
+            security_management_entity_storage_bootstrap_1.SecurityManagementEntityStorageBootstrap,
+            user_profile_write_middleware_1.UserProfileWriteMiddleware,
+            {
+                provide: core_1.ENTITY_STORAGE_MIDDLEWARE,
+                useExisting: user_profile_write_middleware_1.UserProfileWriteMiddleware,
+                multi: true,
+            },
+            user_password_reset_service_1.UserPasswordResetService,
+            user_change_password_service_1.UserChangePasswordService,
+            send_password_reset_email_command_1.SendPasswordResetEmailCommand,
+            complete_password_reset_command_1.CompletePasswordResetCommand,
+            change_own_password_command_1.ChangeOwnPasswordCommand,
+            get_own_password_status_command_1.GetOwnPasswordStatusCommand,
+            two_factor_redis_store_1.TwoFactorRedisStore,
+            user_two_factor_service_1.UserTwoFactorService,
+            two_factor_gate_bootstrap_1.TwoFactorGateBootstrap,
+            start_two_factor_enrollment_command_1.StartTwoFactorEnrollmentCommand,
+            confirm_two_factor_enrollment_command_1.ConfirmTwoFactorEnrollmentCommand,
+            disable_two_factor_command_1.DisableTwoFactorCommand,
+            generate_two_factor_recovery_codes_command_1.GenerateTwoFactorRecoveryCodesCommand,
+            get_two_factor_status_command_1.GetTwoFactorStatusCommand,
+            admin_reset_two_factor_command_1.AdminResetTwoFactorCommand,
+            verify_two_factor_login_command_1.VerifyTwoFactorLoginCommand,
+            user_invitation_service_1.UserInvitationService,
+            invite_user_command_1.InviteUserCommand,
+            list_tenant_entitled_applications_command_1.ListTenantEntitledApplicationsCommand,
+            list_invite_assignable_roles_command_1.ListInviteAssignableRolesCommand,
+            resend_invitation_command_1.ResendInvitationCommand,
+            cancel_invitation_command_1.CancelInvitationCommand,
+            accept_invitation_command_1.AcceptInvitationCommand,
+            accept_my_invitation_command_1.AcceptMyInvitationCommand,
+            list_my_pending_invitations_command_1.ListMyPendingInvitationsCommand,
+            decline_invitation_command_1.DeclineInvitationCommand,
+            lookup_tenant_by_unique_name_command_1.LookupTenantByUniqueNameCommand,
+            request_tenant_membership_command_1.RequestTenantMembershipCommand,
+            list_my_join_requests_command_1.ListMyJoinRequestsCommand,
+            cancel_my_join_request_command_1.CancelMyJoinRequestCommand,
+            approve_join_request_command_1.ApproveJoinRequestCommand,
+            reject_join_request_command_1.RejectJoinRequestCommand,
+            create_user_in_tenant_command_1.CreateUserInTenantCommand,
+            identity_provider_catalog_service_1.IdentityProviderCatalogService,
+            (0, identity_provider_catalog_service_1.provideAuthIdentityProviderCatalog)(),
+            identity_provider_stub_bootstrap_1.IdentityProviderStubBootstrap,
+            {
+                provide: security_1.AUTH_OAUTH_ALLOWED_CLIENT_IDS,
+                useValue: [...auth_oauth_clients_constants_1.AUTH_OAUTH_SEEDED_CLIENT_IDS],
+            },
+            // AUTH_OAUTH_REGISTERED_CLIENTS — provided by host app (demo-api) from env/CORS origins.
+            effective_access_history_service_1.EffectiveAccessHistoryService,
+            password_change_history_service_1.PasswordChangeHistoryService,
+            security_report_handlers_1.GetUserEffectiveRolesHistoryQueryHandler,
+            security_report_handlers_1.GetUserEffectivePermissionsHistoryQueryHandler,
+            security_report_handlers_1.GetRoleHoldersHistoryQueryHandler,
+            security_report_handlers_1.GetPermissionHoldersHistoryQueryHandler,
+            security_report_handlers_1.GetUserPasswordChangeHistoryQueryHandler,
+            security_report_definition_provider_1.SecurityReportDefinitionProvider,
+        ],
+        exports: [
+            user_effective_state_middleware_1.UserEffectiveStateMiddleware,
+            user_assigned_roles_middleware_1.UserAssignedRolesMiddleware,
+            user_profile_write_middleware_1.UserProfileWriteMiddleware,
+            user_invitation_list_middleware_1.UserInvitationListMiddleware,
+            device_sessions_active_middleware_1.DeviceSessionsActiveMiddleware,
+            device_sessions_token_revoke_middleware_1.DeviceSessionsTokenRevokeMiddleware,
+            core_1.ENTITY_STORAGE_MIDDLEWARE,
+            user_password_reset_service_1.UserPasswordResetService,
+            user_invitation_service_1.UserInvitationService,
+            user_two_factor_service_1.UserTwoFactorService,
+            identity_provider_catalog_service_1.IdentityProviderCatalogService,
+            security_1.AUTH_IDENTITY_PROVIDER_CATALOG,
+            security_1.AUTH_OAUTH_ALLOWED_CLIENT_IDS,
+            effective_access_history_service_1.EffectiveAccessHistoryService,
+        ],
+    }),
+    tslib_1.__metadata("design:paramtypes", [core_1.AXPContextDefinitionRegistry])
+], SecurityManagementServerModule);
+//#endregion
+//# sourceMappingURL=security-management-server.module.js.map

package/server/src/lib/security-management-server.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-management-server.module.js","sourceRoot":"","sources":["../../../../../../libs/modules/security-management/server/src/lib/security-management-server.module.ts"],"names":[],"mappings":";;;;AAAA,iEAAsI;AACtI,wEAAmF;AACnF,yEAA8J;AAC9J,gHAAyG;AACzG,sFAAoF;AACpF,0GAAoG;AACpG,2CAA0E;AAE1E,kHAA4G;AAC5G,sGAAgG;AAChG,kFAM6C;AAC7C,mGAAgG;AAChG,6GAA2I;AAC3I,2GAAqG;AACrG,iHAA0G;AAC1G,iGAA2F;AAC3F,uGAAiG;AACjG,6GAAsG;AACtG,mHAA4G;AAC5G,mGAA6F;AAC7F,mGAA6F;AAC7F,+FAAyF;AACzF,8FAAwF;AACxF,sGAA+F;AAC/F,sGAAgG;AAChG,0GAAmG;AACnG,gGAA0F;AAC1F,8FAAwF;AACxF,gGAAyF;AACzF,8GAAuG;AACvG,wFAAkF;AAClF,wHAAgH;AAChH,8FAAuF;AACvF,0GAAmG;AACnG,sFAAgF;AAChF,gFAA0E;AAC1E,kFAA4E;AAC5E,kGAA2F;AAC3F,uFAAkF;AAClF,+EAA0E;AAC1E,iHAA0G;AAC1G,2HAAoH;AACpH,2FAAsF;AACtF,2FAAsF;AACtF,2FAAsF;AACtF,iGAA2F;AAC3F,+GAAwG;AACxG,6FAAwF;AACxF,iHAAyG;AACzG,2GAAqG;AACrG,mGAA4F;AAC5F,qGAA8F;AAC9F,iGAA2F;AAC3F,+FAAyF;AACzF,mGAA4F;AAC5F,+FAAyF;AACzF,uGAAiG;AAEjG,sDAAsD;AAmH/C,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IACzC,YAA6B,kBAAgD;QAAhD,uBAAkB,GAAlB,kBAAkB,CAA8B;IAAG,CAAC;IAEjF,YAAY;QACV,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,uEAAgC,CAAC,CAAC;QACtE,iFAAiF;QACjF,IAAA,4CAAiC,EAAC,kDAAwB,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AARY,wEAA8B;yCAA9B,8BAA8B;IAjH1C,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,yBAAkB,CAAC,UAAU,CAAC,oEAA+B,CAAC,EAAE,0BAAmB,EAAE,kEAA8B,CAAC;QAC9H,SAAS,EAAE;YACT,8DAA4B;YAC5B;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,8DAA4B;gBACzC,KAAK,EAAE,IAAI;aACA;YACb,4DAA2B;YAC3B;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,4DAA2B;gBACxC,KAAK,EAAE,IAAI;aACA;YACb,8DAA4B;YAC5B;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,8DAA4B;gBACzC,KAAK,EAAE,IAAI;aACA;YACb,uEAAgC;YAChC;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,uEAAgC;gBAC7C,KAAK,EAAE,IAAI;aACA;YACb,kEAA8B;YAC9B;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,kEAA8B;gBAC3C,KAAK,EAAE,IAAI;aACA;YACb,6EAAmC;YACnC;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,6EAAmC;gBAChD,KAAK,EAAE,IAAI;aACA;YACb,uFAAwC;YACxC,0DAA0B;YAC1B;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,0DAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb,sDAAwB;YACxB,wDAAyB;YACzB,iEAA6B;YAC7B,8DAA4B;YAC5B,sDAAwB;YACxB,6DAA2B;YAC3B,4CAAmB;YACnB,8CAAoB;YACpB,kDAAsB;YACtB,qEAA+B;YAC/B,yEAAiC;YACjC,oDAAuB;YACvB,kFAAqC;YACrC,yDAAyB;YACzB,2DAA0B;YAC1B,6DAA2B;YAC3B,+CAAqB;YACrB,uCAAiB;YACjB,iFAAqC;YACrC,uEAAgC;YAChC,mDAAuB;YACvB,mDAAuB;YACvB,mDAAuB;YACvB,wDAAyB;YACzB,qEAA+B;YAC/B,qDAAwB;YACxB,sEAA+B;YAC/B,kEAA8B;YAC9B,yDAAyB;YACzB,2DAA0B;YAC1B,wDAAyB;YACzB,sDAAwB;YACxB,yDAAyB;YACzB,kEAA8B;YAC9B,IAAA,sEAAkC,GAAE;YACpC,gEAA6B;YAC7B;gBACE,OAAO,EAAE,wCAA6B;gBACtC,QAAQ,EAAE,CAAC,GAAG,2DAA4B,CAAC;aAC5C;YACD,yFAAyF;YACzF,gEAA6B;YAC7B,8DAA4B;YAC5B,mEAAwC;YACxC,yEAA8C;YAC9C,4DAAiC;YACjC,kEAAuC;YACvC,mEAAwC;YACxC,sEAAgC;SACjC;QACD,OAAO,EAAE;YACP,8DAA4B;YAC5B,4DAA2B;YAC3B,0DAA0B;YAC1B,8DAA4B;YAC5B,kEAA8B;YAC9B,6EAAmC;YACnC,gCAAyB;YACzB,sDAAwB;YACxB,+CAAqB;YACrB,8CAAoB;YACpB,kEAA8B;YAC9B,yCAA8B;YAC9B,wCAA6B;YAC7B,gEAA6B;SAC9B;KACF,CAAC;6CAEiD,mCAA4B;GADlE,8BAA8B,CAQ1C;AAED,YAAY"}

package/server/src/lib/two-factor/admin-reset-two-factor.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMAdminResetTwoFactorInput, type AXMAdminResetTwoFactorResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserTwoFactorService } from './user-two-factor.service';
+export declare class AdminResetTwoFactorCommand implements AXPCommand<AXMAdminResetTwoFactorInput, AXMAdminResetTwoFactorResult> {
+    private readonly twoFactor;
+    constructor(twoFactor: UserTwoFactorService);
+    execute(input?: AXMAdminResetTwoFactorInput): AXPCommandExecuteResultPromise<AXMAdminResetTwoFactorResult>;
+}

package/server/src/lib/two-factor/admin-reset-two-factor.command.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminResetTwoFactorCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_two_factor_service_1 = require("./user-two-factor.service");
+//#region ----- Admin reset two-factor command -----
+let AdminResetTwoFactorCommand = class AdminResetTwoFactorCommand {
+    constructor(twoFactor) {
+        this.twoFactor = twoFactor;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = { userId: '' }) {
+            const result = yield this.twoFactor.adminReset(input);
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.AdminResetTwoFactorCommand = AdminResetTwoFactorCommand;
+exports.AdminResetTwoFactorCommand = AdminResetTwoFactorCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({
+        key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.AdminResetTwoFactor,
+        auth: 'session',
+        permissions: [module_security_management_contracts_1.AXPAdministrationPermissionKeys.MaintainUsersAndRoles],
+    }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_two_factor_service_1.UserTwoFactorService])
+], AdminResetTwoFactorCommand);
+//#endregion
+//# sourceMappingURL=admin-reset-two-factor.command.js.map

package/server/src/lib/two-factor/admin-reset-two-factor.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-reset-two-factor.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/admin-reset-two-factor.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAK+D;AAE/D,uEAAiE;AAEjE,oDAAoD;AAQ7C,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAGrC,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAE1D,OAAO;qEACX,QAAqC,EAAE,MAAM,EAAE,EAAE,EAAE;YAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAdY,gEAA0B;qCAA1B,0BAA0B;IANtC,IAAA,wBAAa,EAAC;QACb,GAAG,EAAE,0EAAmC,CAAC,mBAAmB;QAC5D,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,CAAC,sEAA+B,CAAC,qBAAqB,CAAC;KACrE,CAAC;IACD,IAAA,mBAAU,GAAE;6CAI6B,8CAAoB;GAHjD,0BAA0B,CActC;AAED,YAAY"}

package/server/src/lib/two-factor/confirm-two-factor-enrollment.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMConfirmTwoFactorEnrollmentInput, type AXMConfirmTwoFactorEnrollmentResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserTwoFactorService } from './user-two-factor.service';
+export declare class ConfirmTwoFactorEnrollmentCommand implements AXPCommand<AXMConfirmTwoFactorEnrollmentInput, AXMConfirmTwoFactorEnrollmentResult> {
+    private readonly twoFactor;
+    constructor(twoFactor: UserTwoFactorService);
+    execute(input?: AXMConfirmTwoFactorEnrollmentInput): AXPCommandExecuteResultPromise<AXMConfirmTwoFactorEnrollmentResult>;
+}

package/server/src/lib/two-factor/confirm-two-factor-enrollment.command.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfirmTwoFactorEnrollmentCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_two_factor_service_1 = require("./user-two-factor.service");
+//#region ----- Confirm two-factor enrollment command -----
+let ConfirmTwoFactorEnrollmentCommand = class ConfirmTwoFactorEnrollmentCommand {
+    constructor(twoFactor) {
+        this.twoFactor = twoFactor;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = { enrollmentId: '', code: '' }) {
+            const result = yield this.twoFactor.confirmEnrollment(input);
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.ConfirmTwoFactorEnrollmentCommand = ConfirmTwoFactorEnrollmentCommand;
+exports.ConfirmTwoFactorEnrollmentCommand = ConfirmTwoFactorEnrollmentCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({
+        key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.ConfirmTwoFactorEnrollment,
+        auth: 'session',
+    }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_two_factor_service_1.UserTwoFactorService])
+], ConfirmTwoFactorEnrollmentCommand);
+//#endregion
+//# sourceMappingURL=confirm-two-factor-enrollment.command.js.map

package/server/src/lib/two-factor/confirm-two-factor-enrollment.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-two-factor-enrollment.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/confirm-two-factor-enrollment.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAI+D;AAE/D,uEAAiE;AAEjE,2DAA2D;AAOpD,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAG5C,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAE1D,OAAO;qEACX,QAA4C,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAE1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAdY,8EAAiC;4CAAjC,iCAAiC;IAL7C,IAAA,wBAAa,EAAC;QACb,GAAG,EAAE,0EAAmC,CAAC,0BAA0B;QACnE,IAAI,EAAE,SAAS;KAChB,CAAC;IACD,IAAA,mBAAU,GAAE;6CAI6B,8CAAoB;GAHjD,iCAAiC,CAc7C;AAED,YAAY"}

package/server/src/lib/two-factor/disable-two-factor.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMDisableTwoFactorInput, type AXMDisableTwoFactorResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserTwoFactorService } from './user-two-factor.service';
+export declare class DisableTwoFactorCommand implements AXPCommand<AXMDisableTwoFactorInput, AXMDisableTwoFactorResult> {
+    private readonly twoFactor;
+    constructor(twoFactor: UserTwoFactorService);
+    execute(input?: AXMDisableTwoFactorInput): AXPCommandExecuteResultPromise<AXMDisableTwoFactorResult>;
+}

package/server/src/lib/two-factor/disable-two-factor.command.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DisableTwoFactorCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_two_factor_service_1 = require("./user-two-factor.service");
+//#region ----- Disable two-factor command -----
+let DisableTwoFactorCommand = class DisableTwoFactorCommand {
+    constructor(twoFactor) {
+        this.twoFactor = twoFactor;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = {}) {
+            const result = yield this.twoFactor.disable(input);
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.DisableTwoFactorCommand = DisableTwoFactorCommand;
+exports.DisableTwoFactorCommand = DisableTwoFactorCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.DisableTwoFactor, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_two_factor_service_1.UserTwoFactorService])
+], DisableTwoFactorCommand);
+//#endregion
+//# sourceMappingURL=disable-two-factor.command.js.map

package/server/src/lib/two-factor/disable-two-factor.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disable-two-factor.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/disable-two-factor.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAI+D;AAE/D,uEAAiE;AAEjE,gDAAgD;AAIzC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGlC,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAE1D,OAAO;qEACX,QAAkC,EAAE;YAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAdY,0DAAuB;kCAAvB,uBAAuB;IAFnC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7F,IAAA,mBAAU,GAAE;6CAI6B,8CAAoB;GAHjD,uBAAuB,CAcnC;AAED,YAAY"}

package/server/src/lib/two-factor/generate-two-factor-recovery-codes.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMGenerateTwoFactorRecoveryCodesInput, type AXMGenerateTwoFactorRecoveryCodesResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserTwoFactorService } from './user-two-factor.service';
+export declare class GenerateTwoFactorRecoveryCodesCommand implements AXPCommand<AXMGenerateTwoFactorRecoveryCodesInput, AXMGenerateTwoFactorRecoveryCodesResult> {
+    private readonly twoFactor;
+    constructor(twoFactor: UserTwoFactorService);
+    execute(input?: AXMGenerateTwoFactorRecoveryCodesInput): AXPCommandExecuteResultPromise<AXMGenerateTwoFactorRecoveryCodesResult>;
+}

package/server/src/lib/two-factor/generate-two-factor-recovery-codes.command.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GenerateTwoFactorRecoveryCodesCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_two_factor_service_1 = require("./user-two-factor.service");
+//#region ----- Generate two-factor recovery codes command -----
+let GenerateTwoFactorRecoveryCodesCommand = class GenerateTwoFactorRecoveryCodesCommand {
+    constructor(twoFactor) {
+        this.twoFactor = twoFactor;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, arguments, void 0, function* (input = {}) {
+            const result = yield this.twoFactor.generateRecoveryCodes(input);
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.GenerateTwoFactorRecoveryCodesCommand = GenerateTwoFactorRecoveryCodesCommand;
+exports.GenerateTwoFactorRecoveryCodesCommand = GenerateTwoFactorRecoveryCodesCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({
+        key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.GenerateTwoFactorRecoveryCodes,
+        auth: 'session',
+    }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_two_factor_service_1.UserTwoFactorService])
+], GenerateTwoFactorRecoveryCodesCommand);
+//#endregion
+//# sourceMappingURL=generate-two-factor-recovery-codes.command.js.map

package/server/src/lib/two-factor/generate-two-factor-recovery-codes.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-two-factor-recovery-codes.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/generate-two-factor-recovery-codes.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAI+D;AAE/D,uEAAiE;AAEjE,gEAAgE;AAOzD,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAGhD,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAE1D,OAAO;qEACX,QAAgD,EAAE;YAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAdY,sFAAqC;gDAArC,qCAAqC;IALjD,IAAA,wBAAa,EAAC;QACb,GAAG,EAAE,0EAAmC,CAAC,8BAA8B;QACvE,IAAI,EAAE,SAAS;KAChB,CAAC;IACD,IAAA,mBAAU,GAAE;6CAI6B,8CAAoB;GAHjD,qCAAqC,CAcjD;AAED,YAAY"}

package/server/src/lib/two-factor/get-two-factor-status.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMGetTwoFactorStatusResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserTwoFactorService } from './user-two-factor.service';
+export declare class GetTwoFactorStatusCommand implements AXPCommand<void, AXMGetTwoFactorStatusResult> {
+    private readonly twoFactor;
+    constructor(twoFactor: UserTwoFactorService);
+    execute(): AXPCommandExecuteResultPromise<AXMGetTwoFactorStatusResult>;
+}

package/server/src/lib/two-factor/get-two-factor-status.command.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetTwoFactorStatusCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const user_two_factor_service_1 = require("./user-two-factor.service");
+//#region ----- Get two-factor status command -----
+let GetTwoFactorStatusCommand = class GetTwoFactorStatusCommand {
+    constructor(twoFactor) {
+        this.twoFactor = twoFactor;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.twoFactor.getStatus();
+            if (!result.success) {
+                return { success: false, message: { code: result.code } };
+            }
+            return { success: true, kind: 'object', data: result.data };
+        });
+    }
+};
+exports.GetTwoFactorStatusCommand = GetTwoFactorStatusCommand;
+exports.GetTwoFactorStatusCommand = GetTwoFactorStatusCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: module_security_management_contracts_1.AXMSecurityManagementServerCommands.GetTwoFactorStatus, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [user_two_factor_service_1.UserTwoFactorService])
+], GetTwoFactorStatusCommand);
+//#endregion
+//# sourceMappingURL=get-two-factor-status.command.js.map

package/server/src/lib/two-factor/get-two-factor-status.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-two-factor-status.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/get-two-factor-status.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,gFAAkF;AAClF,gHAG+D;AAE/D,uEAAiE;AAEjE,mDAAmD;AAI5C,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAE1D,OAAO;;YACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;CACF,CAAA;AAVY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,0EAAmC,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC/F,IAAA,mBAAU,GAAE;6CAE6B,8CAAoB;GADjD,yBAAyB,CAUrC;AAED,YAAY"}

package/server/src/lib/two-factor/recovery-codes.util.d.ts

@@ -0,0 +1,11 @@
+import type { AXMUserTwoFactorRecoveryCode } from '@acorex-platform/module-security-management-client/contracts';
+export declare function formatRecoveryCodeDisplay(code: string): string;
+export declare function normalizeRecoveryCode(input: string): string;
+export declare function generateRecoveryCodeSet(): Promise<{
+    plaintext: string[];
+    stored: AXMUserTwoFactorRecoveryCode[];
+}>;
+export declare function consumeRecoveryCode(codes: AXMUserTwoFactorRecoveryCode[] | undefined, input: string): Promise<{
+    matched: boolean;
+    next: AXMUserTwoFactorRecoveryCode[];
+}>;

package/server/src/lib/two-factor/recovery-codes.util.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatRecoveryCodeDisplay = formatRecoveryCodeDisplay;
+exports.normalizeRecoveryCode = normalizeRecoveryCode;
+exports.generateRecoveryCodeSet = generateRecoveryCodeSet;
+exports.consumeRecoveryCode = consumeRecoveryCode;
+const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
+const core_1 = require("@acorex-platform/framework-shared/core");
+//#region ----- Constants -----
+const RECOVERY_CODE_COUNT = 10;
+const RECOVERY_CODE_LENGTH = 8;
+/** Ambiguous chars excluded: 0 O 1 I */
+const RECOVERY_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+//#endregion
+//#region ----- Recovery codes -----
+function randomRecoveryCode() {
+    const bytes = (0, crypto_1.randomBytes)(RECOVERY_CODE_LENGTH);
+    let out = '';
+    for (let i = 0; i < RECOVERY_CODE_LENGTH; i += 1) {
+        out += RECOVERY_ALPHABET[bytes[i] % RECOVERY_ALPHABET.length];
+    }
+    return out;
+}
+function formatRecoveryCodeDisplay(code) {
+    const cleaned = code.replace(/[^A-Za-z0-9]/g, '').toUpperCase();
+    if (cleaned.length !== RECOVERY_CODE_LENGTH) {
+        return cleaned;
+    }
+    return `${cleaned.slice(0, 4)}-${cleaned.slice(4)}`;
+}
+function normalizeRecoveryCode(input) {
+    return String(input !== null && input !== void 0 ? input : '')
+        .replace(/[^A-Za-z0-9]/g, '')
+        .toUpperCase();
+}
+function generateRecoveryCodeSet() {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        const plaintext = [];
+        const stored = [];
+        for (let i = 0; i < RECOVERY_CODE_COUNT; i += 1) {
+            const code = randomRecoveryCode();
+            plaintext.push(formatRecoveryCodeDisplay(code));
+            stored.push({
+                hash: yield (0, core_1.hashPassword)(normalizeRecoveryCode(code)),
+                usedAt: null,
+            });
+        }
+        return { plaintext, stored };
+    });
+}
+function consumeRecoveryCode(codes, input) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        const normalized = normalizeRecoveryCode(input);
+        if (!normalized || !(codes === null || codes === void 0 ? void 0 : codes.length)) {
+            return { matched: false, next: codes !== null && codes !== void 0 ? codes : [] };
+        }
+        const next = codes.map((c) => (Object.assign({}, c)));
+        for (let i = 0; i < next.length; i += 1) {
+            const entry = next[i];
+            if (entry.usedAt) {
+                continue;
+            }
+            if (yield (0, core_1.verifyPassword)(normalized, entry.hash)) {
+                next[i] = Object.assign(Object.assign({}, entry), { usedAt: new Date().toISOString() });
+                return { matched: true, next };
+            }
+        }
+        return { matched: false, next };
+    });
+}
+//#endregion
+//# sourceMappingURL=recovery-codes.util.js.map

package/server/src/lib/two-factor/recovery-codes.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-codes.util.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/recovery-codes.util.ts"],"names":[],"mappings":";;AAwBA,8DAMC;AAED,sDAIC;AAED,0DAeC;AAED,kDAqBC;;AA5ED,mCAAqC;AACrC,iEAAsF;AAGtF,+BAA+B;AAE/B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,wCAAwC;AACxC,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAE7D,YAAY;AAEZ,oCAAoC;AAEpC,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,oBAAoB,CAAC,CAAC;IAChD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,GAAG,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,yBAAyB,CAAC,IAAY;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,MAAM,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;SACvB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,SAAsB,uBAAuB;;QAI3C,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM,IAAA,mBAAY,EAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;CAAA;AAED,SAAsB,mBAAmB,CACvC,KAAiD,EACjD,KAAa;;QAEb,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,MAAM,CAAA,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAM,CAAC,EAAG,CAAC,CAAC;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,IAAI,MAAM,IAAA,qBAAc,EAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,CAAC,CAAC,mCAAQ,KAAK,KAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAE,CAAC;gBACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;CAAA;AAED,YAAY"}

package/server/src/lib/two-factor/start-two-factor-enrollment.command.d.ts

@@ -0,0 +1,8 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXMStartTwoFactorEnrollmentInput, type AXMStartTwoFactorEnrollmentResult } from '@acorex-platform/module-security-management-client/contracts';
+import { UserTwoFactorService } from './user-two-factor.service';
+export declare class StartTwoFactorEnrollmentCommand implements AXPCommand<AXMStartTwoFactorEnrollmentInput, AXMStartTwoFactorEnrollmentResult> {
+    private readonly twoFactor;
+    constructor(twoFactor: UserTwoFactorService);
+    execute(input?: AXMStartTwoFactorEnrollmentInput): AXPCommandExecuteResultPromise<AXMStartTwoFactorEnrollmentResult>;
+}