@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/user-invitation/user-invitation.service.js

@@ -0,0 +1,1658 @@
+"use strict";
+var UserInvitationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const lodash_1 = require("lodash");
+const core_1 = require("@acorex-platform/framework-server/core");
+const providers_1 = require("@acorex-platform/framework-server/domain/providers");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_communication_management_contracts_1 = require("@acorex-platform/module-communication-management-client/contracts");
+const module_content_management_contracts_1 = require("@acorex-platform/module-content-management-client/contracts");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+const user_invitation_application_access_util_1 = require("./user-invitation-application-access.util");
+//#region ---- Constants ----
+const USER_ENTITY = 'SecurityManagement.User';
+const ROLE_ENTITY = 'SecurityManagement.Role';
+const USER_ROLE_ENTITY = 'SecurityManagement.UserRole';
+const TENANT_ENTITY = 'TenantManagement.Tenant';
+const TENANT_USER_ENTITY = 'TenantManagement.TenantUser';
+const APP_ACCESS_ENTITY = 'TenantManagement.TenantUserAppAccess';
+const TEMPLATE_ID = module_content_management_contracts_1.AXM_TEXT_TEMPLATE_IDS.userInvitation;
+const EMAIL_CHANNEL = 'email-smtp';
+const EXPIRY_MINUTES = 7 * 24 * 60;
+const JOIN_REQUEST_EXPIRY_MINUTES = 30 * 24 * 60;
+const ACTIVE_ACCOUNT_STATE = 'active';
+const PENDING_ACCOUNT_STATE = 'pending';
+function hashToken(token) {
+    return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+}
+function tokensMatch(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    if (a.length !== b.length) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(a, b);
+}
+function readGrantId(row) {
+    const id = row === null || row === void 0 ? void 0 : row['id'];
+    return typeof id === 'string' && id.length > 0 ? id : undefined;
+}
+function resolveWebOrigin(explicit) {
+    var _a, _b, _c;
+    const fromInput = explicit === null || explicit === void 0 ? void 0 : explicit.trim();
+    if (fromInput) {
+        return fromInput.replace(/\/$/, '');
+    }
+    const fromEnv = ((_a = process.env['ACOREX_WEB_ORIGIN']) === null || _a === void 0 ? void 0 : _a.trim()) ||
+        ((_c = (_b = process.env['CORS_ORIGINS']) === null || _b === void 0 ? void 0 : _b.split(',')[0]) === null || _c === void 0 ? void 0 : _c.trim()) ||
+        'http://localhost:4800';
+    return fromEnv.replace(/\/$/, '');
+}
+function normalizeEmail(value) {
+    return value.trim().toLowerCase();
+}
+function buildInvitation(invitedByUserId, applicationIds, roleIds, applicationRoleAssignments) {
+    const rawToken = (0, crypto_1.randomBytes)(32).toString('hex');
+    const now = new Date();
+    return {
+        rawToken,
+        invitation: Object.assign(Object.assign(Object.assign({ tokenHash: hashToken(rawToken), expiresAt: new Date(now.getTime() + EXPIRY_MINUTES * 60000).toISOString(), sentAt: now.toISOString(), invitedByUserId,
+            applicationIds }, (roleIds.length > 0 ? { roleIds } : {})), ((applicationRoleAssignments === null || applicationRoleAssignments === void 0 ? void 0 : applicationRoleAssignments.length)
+            ? { applicationRoleAssignments }
+            : {})), { source: module_security_management_contracts_1.AXM_MEMBERSHIP_INVITATION_SOURCE.Invite }),
+    };
+}
+/** Keep invite audit fields; drop the one-time token secret. */
+function invitationWithoutToken(invitation, patch) {
+    var _a;
+    const { tokenHash: _tokenHash } = invitation, rest = tslib_1.__rest(invitation, ["tokenHash"]);
+    return Object.assign(Object.assign(Object.assign({}, rest), { source: (_a = rest.source) !== null && _a !== void 0 ? _a : module_security_management_contracts_1.AXM_MEMBERSHIP_INVITATION_SOURCE.Invite }), patch);
+}
+//#endregion
+//#region ---- User invitation service ----
+let UserInvitationService = UserInvitationService_1 = class UserInvitationService {
+    constructor(entityStorage, commandExecutor) {
+        this.entityStorage = entityStorage;
+        this.commandExecutor = commandExecutor;
+        this.logger = new common_1.Logger(UserInvitationService_1.name);
+    }
+    //#region ---- Admin flows ----
+    inviteUser(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return { success: false, message: 'Tenant context is required.' };
+            }
+            const email = normalizeEmail((_b = input.email) !== null && _b !== void 0 ? _b : '');
+            if (!email.includes('@')) {
+                return { success: false, message: 'A valid email address is required.' };
+            }
+            const tenantMembershipInvite = input.tenantMembershipInvite === true;
+            const requestedAssignments = tenantMembershipInvite
+                ? (0, module_security_management_contracts_1.normalizeInviteApplicationRoleAssignments)(input.applicationRoleAssignments)
+                : [];
+            const applicationIds = yield this.resolveAuthorizedApplicationIds([
+                ...((_c = input.applicationIds) !== null && _c !== void 0 ? _c : []),
+                ...requestedAssignments.map((row) => row.applicationId),
+            ], session, tenantId, tenantMembershipInvite);
+            if (applicationIds.length === 0) {
+                return {
+                    success: false,
+                    message: 'No valid application access can be granted for this invitation.',
+                };
+            }
+            const authorizedAssignments = [];
+            for (const row of requestedAssignments) {
+                if (!applicationIds.includes(row.applicationId)) {
+                    continue;
+                }
+                const rowRoleIds = yield this.resolveAuthorizedTenantUserInviteRoleIds(row.roleIds, tenantId, row.applicationId);
+                authorizedAssignments.push({
+                    applicationId: row.applicationId,
+                    roleIds: rowRoleIds,
+                });
+            }
+            const roleIds = authorizedAssignments.length > 0
+                ? [...new Set(authorizedAssignments.flatMap((row) => row.roleIds))]
+                : yield this.resolveAuthorizedRoleIds(input.roleIds, session, tenantId, tenantMembershipInvite ? 'tenant' : 'application');
+            const displayName = ((_d = input.displayName) !== null && _d !== void 0 ? _d : '').trim() || email.split('@')[0];
+            let user = yield this.findUserByEmail(email);
+            let userAlreadyExists = false;
+            if (user === null || user === void 0 ? void 0 : user.id) {
+                userAlreadyExists = true;
+                const existingMembership = yield this.findTenantUser(tenantId, user.id);
+                if ((existingMembership === null || existingMembership === void 0 ? void 0 : existingMembership.statusId) === core_2.AXPSystemStatusType.Active) {
+                    return {
+                        success: false,
+                        message: 'This user is already an active member of the tenant.',
+                    };
+                }
+                if (!input.confirmExisting) {
+                    return {
+                        success: true,
+                        data: {
+                            userId: user.id,
+                            tenantUserId: (_e = existingMembership === null || existingMembership === void 0 ? void 0 : existingMembership.id) !== null && _e !== void 0 ? _e : '',
+                            userAlreadyExists: true,
+                            sent: false,
+                        },
+                    };
+                }
+            }
+            else {
+                const userId = (0, crypto_1.randomUUID)();
+                yield this.entityStorage.insertOneAsEngine(USER_ENTITY, {
+                    id: userId,
+                    username: email,
+                    email,
+                    displayName,
+                    accountState: PENDING_ACCOUNT_STATE,
+                    homeTenantId: tenantId,
+                    createdVia: 'invite',
+                    createdByUserId: session.userId,
+                    accessState: module_security_management_contracts_1.AXMUserAccessState.Allowed,
+                    password: yield (0, core_2.hashPassword)((0, crypto_1.randomBytes)(32).toString('hex')),
+                });
+                user = (yield this.entityStorage.getOneAsEngine(USER_ENTITY, userId));
+                if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                    return { success: false, message: 'Failed to create user.' };
+                }
+            }
+            const { rawToken, invitation } = buildInvitation(session.userId, applicationIds, roleIds, authorizedAssignments);
+            const tenantUserId = yield this.upsertPendingTenantUser(tenantId, user.id, invitation);
+            yield this.upsertPendingAppAccess(tenantId, tenantUserId, applicationIds);
+            if (authorizedAssignments.length > 0) {
+                for (const row of authorizedAssignments) {
+                    yield this.upsertInviteUserRoles({
+                        userId: user.id,
+                        tenantId,
+                        applicationId: row.applicationId,
+                        roleIds: row.roleIds,
+                    });
+                }
+            }
+            else {
+                yield this.upsertInviteUserRoles({
+                    userId: user.id,
+                    tenantId,
+                    applicationId: tenantMembershipInvite ? undefined : session.applicationId,
+                    roleIds,
+                });
+            }
+            try {
+                const sent = yield this.deliverInvitationEmail({
+                    user,
+                    email,
+                    rawToken,
+                    invitation,
+                    webOrigin: input.webOrigin,
+                });
+                yield this.maybeDeliverInvitationInApp({
+                    user,
+                    tenantId,
+                    tenantUserId,
+                    userAlreadyExists,
+                });
+                return {
+                    success: true,
+                    data: {
+                        userId: user.id,
+                        tenantUserId,
+                        userAlreadyExists,
+                        sent,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: error instanceof Error ? error.message : 'Failed to send invitation email.',
+                    data: {
+                        userId: user.id,
+                        tenantUserId,
+                        userAlreadyExists,
+                        sent: false,
+                    },
+                };
+            }
+        });
+    }
+    resendInvitation(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return { success: false, message: 'Tenant context is required.' };
+            }
+            const membership = yield this.resolveMembership(tenantId, input.tenantUserId, input.userId);
+            if (!(membership === null || membership === void 0 ? void 0 : membership.id) || !membership.userId) {
+                return { success: false, message: 'Pending invitation not found.' };
+            }
+            const user = (yield this.entityStorage.getOneAsEngine(USER_ENTITY, membership.userId));
+            const email = (_b = user === null || user === void 0 ? void 0 : user.email) === null || _b === void 0 ? void 0 : _b.trim();
+            if (!(user === null || user === void 0 ? void 0 : user.id) || !email) {
+                return { success: false, message: 'User does not have an email address.' };
+            }
+            const applicationIds = ((_d = (_c = membership.invitation) === null || _c === void 0 ? void 0 : _c.applicationIds) === null || _d === void 0 ? void 0 : _d.length)
+                ? yield this.revalidateApplicationIds(tenantId, membership.invitation.applicationIds)
+                : yield this.resolveAuthorizedApplicationIds(undefined, session, tenantId, false);
+            if (applicationIds.length === 0) {
+                return {
+                    success: false,
+                    message: 'No valid application access remains for this invitation.',
+                };
+            }
+            const existingRoleIds = Array.isArray((_e = membership.invitation) === null || _e === void 0 ? void 0 : _e.roleIds)
+                ? membership.invitation.roleIds.map((id) => String(id).trim()).filter(Boolean)
+                : [];
+            const { rawToken, invitation } = buildInvitation(session.userId, applicationIds, existingRoleIds);
+            yield this.entityStorage.updateOneAsEngine(TENANT_USER_ENTITY, membership.id, {
+                statusId: core_2.AXPSystemStatusType.Pending,
+                invitation,
+                endDate: null,
+            });
+            yield this.upsertPendingAppAccess(tenantId, membership.id, applicationIds);
+            try {
+                const sent = yield this.deliverInvitationEmail({
+                    user,
+                    email,
+                    rawToken,
+                    invitation,
+                    webOrigin: input.webOrigin,
+                });
+                yield this.maybeDeliverInvitationInApp({
+                    user,
+                    tenantId,
+                    tenantUserId: membership.id,
+                    userAlreadyExists: true,
+                });
+                return { success: true, sent };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    message: error instanceof Error ? error.message : 'Failed to send invitation email.',
+                };
+            }
+        });
+    }
+    cancelInvitation(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return { success: false, message: 'Tenant context is required.' };
+            }
+            const membership = yield this.resolveMembership(tenantId, input.tenantUserId, input.userId);
+            if (!(membership === null || membership === void 0 ? void 0 : membership.id) || !membership.userId) {
+                return { success: false, message: 'Invitation not found.' };
+            }
+            // Only pending admin-sent invites can be cancelled (not accepted / join-request).
+            if (membership.statusId !== core_2.AXPSystemStatusType.Pending ||
+                ((_b = membership.invitation) === null || _b === void 0 ? void 0 : _b.source) !== module_security_management_contracts_1.AXM_MEMBERSHIP_INVITATION_SOURCE.Invite) {
+                return {
+                    success: false,
+                    message: 'Only a pending invitation can be cancelled.',
+                };
+            }
+            yield this.resolveMembershipStatus(membership, core_2.AXPSystemStatusType.Cancelled);
+            return { success: true };
+        });
+    }
+    approveJoinRequest(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.InvalidInput,
+                    message: 'Tenant context is required.',
+                };
+            }
+            const membership = yield this.resolveMembership(tenantId, input.tenantUserId, input.userId);
+            if (!this.isPendingJoinRequest(membership) || !(membership === null || membership === void 0 ? void 0 : membership.id) || !membership.userId) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.NotPending,
+                    message: 'Join request is not pending.',
+                };
+            }
+            const tenantMembershipApprove = input.tenantMembershipApprove === true;
+            const requestedAssignments = tenantMembershipApprove
+                ? (0, module_security_management_contracts_1.normalizeInviteApplicationRoleAssignments)(input.applicationRoleAssignments)
+                : [];
+            const applicationIds = yield this.resolveAuthorizedApplicationIds([
+                ...((_b = input.applicationIds) !== null && _b !== void 0 ? _b : []),
+                ...requestedAssignments.map((row) => row.applicationId),
+            ], session, tenantId, tenantMembershipApprove);
+            if (applicationIds.length === 0) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.InvalidInput,
+                    message: 'No valid application access can be granted for this approval.',
+                };
+            }
+            const authorizedAssignments = [];
+            for (const row of requestedAssignments) {
+                if (!applicationIds.includes(row.applicationId)) {
+                    continue;
+                }
+                const rowRoleIds = yield this.resolveAuthorizedTenantUserInviteRoleIds(row.roleIds, tenantId, row.applicationId);
+                authorizedAssignments.push({
+                    applicationId: row.applicationId,
+                    roleIds: rowRoleIds,
+                });
+            }
+            const roleIds = authorizedAssignments.length > 0
+                ? [...new Set(authorizedAssignments.flatMap((row) => row.roleIds))]
+                : yield this.resolveAuthorizedRoleIds(input.roleIds, session, tenantId, tenantMembershipApprove ? 'tenant' : 'application');
+            if (authorizedAssignments.length > 0 && authorizedAssignments.some((row) => row.roleIds.length === 0)) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.InvalidInput,
+                    message: 'Each selected application must include at least one role.',
+                };
+            }
+            if (authorizedAssignments.length === 0 && roleIds.length === 0) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.InvalidInput,
+                    message: 'At least one role is required.',
+                };
+            }
+            const invitation = Object.assign(Object.assign(Object.assign(Object.assign({}, membership.invitation), { applicationIds }), (roleIds.length > 0 ? { roleIds } : {})), (authorizedAssignments.length > 0 ? { applicationRoleAssignments: authorizedAssignments } : {}));
+            yield this.entityStorage.updateOneAsEngine(TENANT_USER_ENTITY, membership.id, {
+                invitation,
+            });
+            membership.invitation = invitation;
+            yield this.upsertPendingAppAccess(tenantId, membership.id, applicationIds);
+            if (authorizedAssignments.length > 0) {
+                for (const row of authorizedAssignments) {
+                    yield this.upsertInviteUserRoles({
+                        userId: membership.userId,
+                        tenantId,
+                        applicationId: row.applicationId,
+                        roleIds: row.roleIds,
+                    });
+                }
+            }
+            else {
+                yield this.upsertInviteUserRoles({
+                    userId: membership.userId,
+                    tenantId,
+                    applicationId: tenantMembershipApprove ? undefined : session.applicationId,
+                    roleIds,
+                });
+            }
+            return this.activateMembership(membership);
+        });
+    }
+    rejectJoinRequest(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.InvalidInput,
+                    message: 'Tenant context is required.',
+                };
+            }
+            const membership = yield this.resolveMembership(tenantId, input.tenantUserId, input.userId);
+            if (!this.isPendingJoinRequest(membership) || !(membership === null || membership === void 0 ? void 0 : membership.id)) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.NotPending,
+                    message: 'Join request is not pending.',
+                };
+            }
+            yield this.resolveMembershipStatus(membership, core_2.AXPSystemStatusType.Rejected);
+            return { success: true };
+        });
+    }
+    createUserInTenant(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return { success: false, message: 'Tenant context is required.' };
+            }
+            const email = input.email ? normalizeEmail(input.email) : undefined;
+            // Prefer email as login id when present; username is fallback only.
+            const username = ((_b = email !== null && email !== void 0 ? email : input.username) !== null && _b !== void 0 ? _b : '').trim().toLowerCase();
+            if (!username) {
+                return { success: false, message: 'Username or email is required.' };
+            }
+            if (email && ((_c = (yield this.findUserByEmail(email))) === null || _c === void 0 ? void 0 : _c.id)) {
+                return {
+                    success: false,
+                    message: 'A user with this email already exists.',
+                };
+            }
+            if ((_d = (yield this.findUserByUsername(username))) === null || _d === void 0 ? void 0 : _d.id) {
+                return { success: false, message: 'A user with this username already exists.' };
+            }
+            const passwordPlain = ((_e = input.password) !== null && _e !== void 0 ? _e : '').trim();
+            if (passwordPlain.length < 6) {
+                return {
+                    success: false,
+                    message: 'A password of at least 6 characters is required.',
+                };
+            }
+            const tenantMembershipCreate = input.tenantMembershipCreate === true;
+            const createAssignments = yield this.resolveCreateInTenantRoleAssignments(input, session, tenantId, tenantMembershipCreate);
+            if (!createAssignments.ok) {
+                return { success: false, message: createAssignments.message };
+            }
+            const { applicationIds, authorizedAssignments, roleIds } = createAssignments;
+            const displayName = ((_f = input.displayName) !== null && _f !== void 0 ? _f : '').trim() || username;
+            const userId = (0, crypto_1.randomUUID)();
+            yield this.entityStorage.insertOneAsEngine(USER_ENTITY, {
+                id: userId,
+                username,
+                email: email || (username.includes('@') ? username : undefined),
+                displayName,
+                accountState: ACTIVE_ACCOUNT_STATE,
+                homeTenantId: tenantId,
+                createdVia: 'create-in-tenant',
+                accessState: module_security_management_contracts_1.AXMUserAccessState.Allowed,
+                password: yield (0, core_2.hashPassword)(passwordPlain),
+                passwordChangedAt: new Date().toISOString(),
+            });
+            const tenantUserId = (0, crypto_1.randomUUID)();
+            yield this.entityStorage.insertOneAsEngine(TENANT_USER_ENTITY, {
+                id: tenantUserId,
+                tenantId,
+                userId,
+                statusId: core_2.AXPSystemStatusType.Active,
+                startDate: new Date(),
+                invitation: null,
+            });
+            for (const applicationId of applicationIds) {
+                yield this.entityStorage.insertOneAsEngine(APP_ACCESS_ENTITY, {
+                    id: (0, crypto_1.randomUUID)(),
+                    tenantUserId,
+                    tenantId,
+                    applicationId,
+                    statusId: core_2.AXPSystemStatusType.Active,
+                    startDate: new Date(),
+                });
+            }
+            yield this.assignCreateInTenantUserRoles({
+                userId,
+                tenantId,
+                sessionApplicationId: session.applicationId,
+                tenantMembershipCreate,
+                authorizedAssignments,
+                roleIds,
+            });
+            return { success: true, data: { userId, tenantUserId } };
+        });
+    }
+    /**
+     * Create-in-tenant only: authorize apps + roles (does not call inviteUser).
+     */
+    resolveCreateInTenantRoleAssignments(input, session, tenantId, tenantMembershipCreate) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const requestedAssignments = tenantMembershipCreate
+                ? (0, module_security_management_contracts_1.normalizeCreateApplicationRoleAssignments)(input.applicationRoleAssignments)
+                : [];
+            const applicationIds = yield this.resolveAuthorizedApplicationIds([
+                ...((_a = input.applicationIds) !== null && _a !== void 0 ? _a : []),
+                ...requestedAssignments.map((row) => row.applicationId),
+            ], session, tenantId, tenantMembershipCreate);
+            if (applicationIds.length === 0) {
+                return {
+                    ok: false,
+                    message: 'No valid application access can be granted for this user.',
+                };
+            }
+            const authorizedAssignments = [];
+            for (const row of requestedAssignments) {
+                if (!applicationIds.includes(row.applicationId)) {
+                    continue;
+                }
+                const rowRoleIds = yield this.resolveAuthorizedTenantUserInviteRoleIds(row.roleIds, tenantId, row.applicationId);
+                authorizedAssignments.push({
+                    applicationId: row.applicationId,
+                    roleIds: rowRoleIds,
+                });
+            }
+            const roleIds = authorizedAssignments.length > 0
+                ? [...new Set(authorizedAssignments.flatMap((row) => row.roleIds))]
+                : yield this.resolveAuthorizedRoleIds(input.roleIds, session, tenantId, tenantMembershipCreate ? 'tenant' : 'application');
+            if (tenantMembershipCreate) {
+                if (authorizedAssignments.length === 0) {
+                    return { ok: false, message: 'Select at least one application with roles.' };
+                }
+                if (authorizedAssignments.some((row) => row.roleIds.length === 0)) {
+                    return {
+                        ok: false,
+                        message: 'Each selected application must include at least one role.',
+                    };
+                }
+            }
+            else if (roleIds.length === 0) {
+                return { ok: false, message: 'At least one role is required.' };
+            }
+            return { ok: true, applicationIds, authorizedAssignments, roleIds };
+        });
+    }
+    /** Create-in-tenant only: write UserRole grants after identity + AppAccess. */
+    assignCreateInTenantUserRoles(options) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (options.authorizedAssignments.length > 0) {
+                for (const row of options.authorizedAssignments) {
+                    yield this.upsertCreateInTenantUserRoles({
+                        userId: options.userId,
+                        tenantId: options.tenantId,
+                        applicationId: row.applicationId,
+                        roleIds: row.roleIds,
+                    });
+                }
+                return;
+            }
+            yield this.upsertCreateInTenantUserRoles({
+                userId: options.userId,
+                tenantId: options.tenantId,
+                applicationId: options.tenantMembershipCreate
+                    ? undefined
+                    : options.sessionApplicationId,
+                roleIds: options.roleIds,
+            });
+        });
+    }
+    upsertCreateInTenantUserRoles(options) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (options.roleIds.length === 0) {
+                return;
+            }
+            const scopeInfo = Object.assign({ tenantId: options.tenantId }, (((_a = options.applicationId) === null || _a === void 0 ? void 0 : _a.trim())
+                ? { applicationId: options.applicationId.trim() }
+                : {}));
+            const existing = yield this.findUserRoleGrant(options.userId, options.tenantId, options.applicationId);
+            const existingId = readGrantId(existing);
+            if (existing && existingId) {
+                const state = existing['stateInfo'];
+                if ((state === null || state === void 0 ? void 0 : state.isSystem) === true || (state === null || state === void 0 ? void 0 : state.isImmutable) === true) {
+                    return;
+                }
+                yield this.entityStorage.updateOneAsEngine(USER_ROLE_ENTITY, existingId, {
+                    roleIds: options.roleIds,
+                    scopeInfo,
+                });
+                return;
+            }
+            yield this.entityStorage.insertOneAsEngine(USER_ROLE_ENTITY, {
+                id: (0, crypto_1.randomUUID)(),
+                userId: options.userId,
+                roleIds: options.roleIds,
+                scopeInfo,
+            });
+        });
+    }
+    //#endregion
+    //#region ---- Invitee flows ----
+    /**
+     * Public page load. Does not write a password, clear the token, or change status.
+     * Unknown tokens (already accepted, resent, or never issued) are `invalid`.
+     */
+    previewInvitation(token) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const trimmed = token === null || token === void 0 ? void 0 : token.trim();
+            if (!trimmed) {
+                return { usable: false, reason: 'invalid' };
+            }
+            const membership = yield this.findMembershipByTokenHash(hashToken(trimmed));
+            if (!(membership === null || membership === void 0 ? void 0 : membership.id) ||
+                !((_a = membership.invitation) === null || _a === void 0 ? void 0 : _a.tokenHash) ||
+                membership.statusId !== core_2.AXPSystemStatusType.Pending) {
+                return { usable: false, reason: 'invalid' };
+            }
+            const expiresAt = Date.parse(membership.invitation.expiresAt);
+            if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) {
+                return { usable: false, reason: 'expired' };
+            }
+            return { usable: true, reason: 'valid' };
+        });
+    }
+    acceptInvitation(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const token = (_a = input.token) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!token) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_ACCEPT_INVITATION_ERROR_CODES.Invalid,
+                    message: 'Invitation token is required.',
+                };
+            }
+            const tokenHash = hashToken(token);
+            const membership = yield this.findMembershipByTokenHash(tokenHash);
+            const storedTokenHash = (_b = membership === null || membership === void 0 ? void 0 : membership.invitation) === null || _b === void 0 ? void 0 : _b.tokenHash;
+            if (!(membership === null || membership === void 0 ? void 0 : membership.id) || !storedTokenHash || !membership.userId) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_ACCEPT_INVITATION_ERROR_CODES.Invalid,
+                    message: 'This invitation link is invalid or has expired.',
+                };
+            }
+            if (!tokensMatch(storedTokenHash, tokenHash)) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_ACCEPT_INVITATION_ERROR_CODES.Invalid,
+                    message: 'This invitation link is invalid or has expired.',
+                };
+            }
+            return this.activateMembership(membership, input.newPassword);
+        });
+    }
+    listMyPendingInvitations() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const session = this.requireSession();
+            const userId = (_a = session.userId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!userId) {
+                return { success: false, message: 'Not signed in.' };
+            }
+            const items = [];
+            for (const membership of yield this.listTenantUsersForUser(userId)) {
+                if (membership.statusId !== core_2.AXPSystemStatusType.Pending ||
+                    !((_b = membership.invitation) === null || _b === void 0 ? void 0 : _b.tokenHash) ||
+                    !membership.id ||
+                    !membership.tenantId) {
+                    continue;
+                }
+                const tenant = yield this.getJoinableTenantById(membership.tenantId);
+                items.push({
+                    tenantUserId: membership.id,
+                    tenantId: membership.tenantId,
+                    tenantTitle: (_c = tenant === null || tenant === void 0 ? void 0 : tenant.title) !== null && _c !== void 0 ? _c : (yield this.resolveTenantTitle(membership.tenantId)),
+                    tenantLogo: tenant === null || tenant === void 0 ? void 0 : tenant.logo,
+                    invitedByUserId: membership.invitation.invitedByUserId,
+                    expiresAt: membership.invitation.expiresAt,
+                    sentAt: membership.invitation.sentAt,
+                    applicationIds: membership.invitation.applicationIds,
+                });
+            }
+            return { success: true, data: { items } };
+        });
+    }
+    acceptMyInvitation(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const session = this.requireSession();
+            const userId = (_a = session.userId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!userId) {
+                return { success: false, message: 'Not signed in.' };
+            }
+            const membership = yield this.findOwnMembershipById(userId, input.tenantUserId);
+            if (!(membership === null || membership === void 0 ? void 0 : membership.id)) {
+                return { success: false, message: 'Invitation not found.' };
+            }
+            if (membership.statusId !== core_2.AXPSystemStatusType.Pending || !membership.invitation) {
+                return { success: false, message: 'Invitation is not pending.' };
+            }
+            return this.activateMembership(membership, input.newPassword);
+        });
+    }
+    declineInvitation(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const session = this.requireSession();
+            const userId = (_a = session.userId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!userId) {
+                return { success: false, message: 'Not signed in.' };
+            }
+            const membership = yield this.findOwnMembershipById(userId, input.tenantUserId);
+            if (!(membership === null || membership === void 0 ? void 0 : membership.id)) {
+                return { success: false, message: 'Invitation not found.' };
+            }
+            if (membership.statusId !== core_2.AXPSystemStatusType.Pending || !membership.invitation) {
+                return { success: false, message: 'Invitation is not pending.' };
+            }
+            yield this.resolveMembershipStatus(membership, core_2.AXPSystemStatusType.Rejected);
+            return { success: true };
+        });
+    }
+    lookupTenantByUniqueName(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const session = this.requireSession();
+            if (!((_a = session.userId) === null || _a === void 0 ? void 0 : _a.trim())) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.NotSignedIn,
+                    message: 'Not signed in.',
+                };
+            }
+            const uniqueName = (_c = (_b = input.uniqueName) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : '';
+            if (!uniqueName) {
+                return { success: true, data: { item: null } };
+            }
+            const tenant = yield this.findActiveTenantByUniqueName(uniqueName);
+            if (!tenant) {
+                return { success: true, data: { item: null } };
+            }
+            return {
+                success: true,
+                data: {
+                    item: { id: tenant.id, name: tenant.name },
+                },
+            };
+        });
+    }
+    requestTenantMembership(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const session = this.requireSession();
+            const userId = (_a = session.userId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!userId) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.NotSignedIn,
+                    message: 'Not signed in.',
+                };
+            }
+            const uniqueName = (_c = (_b = input.uniqueName) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : '';
+            if (!uniqueName) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.InvalidInput,
+                    message: 'Organization unique name is required.',
+                };
+            }
+            const tenant = yield this.findActiveTenantByUniqueName(uniqueName);
+            if (!tenant) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.TenantNotFound,
+                    message: 'No organization matches that unique name.',
+                };
+            }
+            const existing = yield this.findTenantUser(tenant.id, userId);
+            if ((existing === null || existing === void 0 ? void 0 : existing.statusId) === core_2.AXPSystemStatusType.Active) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.AlreadyMember,
+                    message: 'You are already a member of this organization.',
+                };
+            }
+            if ((existing === null || existing === void 0 ? void 0 : existing.statusId) === core_2.AXPSystemStatusType.Pending &&
+                ((_d = existing.invitation) === null || _d === void 0 ? void 0 : _d.source) === module_security_management_contracts_1.AXM_MEMBERSHIP_INVITATION_SOURCE.Invite) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.InvitePending,
+                    message: 'You already have a pending invitation for this organization.',
+                };
+            }
+            if (this.isPendingJoinRequest(existing) && (existing === null || existing === void 0 ? void 0 : existing.id)) {
+                return {
+                    success: true,
+                    data: {
+                        tenantUserId: existing.id,
+                        tenantId: tenant.id,
+                        tenantName: tenant.name,
+                    },
+                };
+            }
+            const now = new Date();
+            const invitation = {
+                expiresAt: new Date(now.getTime() + JOIN_REQUEST_EXPIRY_MINUTES * 60000).toISOString(),
+                sentAt: now.toISOString(),
+                invitedByUserId: userId,
+                applicationIds: [],
+                source: module_security_management_contracts_1.AXM_MEMBERSHIP_INVITATION_SOURCE.JoinRequest,
+            };
+            const tenantUserId = yield this.upsertPendingTenantUser(tenant.id, userId, invitation);
+            return {
+                success: true,
+                data: {
+                    tenantUserId,
+                    tenantId: tenant.id,
+                    tenantName: tenant.name,
+                },
+            };
+        });
+    }
+    listMyJoinRequests() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const session = this.requireSession();
+            const userId = (_a = session.userId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!userId) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.NotSignedIn,
+                    message: 'Not signed in.',
+                };
+            }
+            const items = [];
+            for (const membership of yield this.listTenantUsersForUser(userId)) {
+                if (!this.isPendingJoinRequest(membership) || !membership.id || !membership.tenantId) {
+                    continue;
+                }
+                const tenant = yield this.getJoinableTenantById(membership.tenantId);
+                items.push({
+                    tenantUserId: membership.id,
+                    tenantId: membership.tenantId,
+                    tenantName: tenant === null || tenant === void 0 ? void 0 : tenant.name,
+                    tenantTitle: (_b = tenant === null || tenant === void 0 ? void 0 : tenant.title) !== null && _b !== void 0 ? _b : (yield this.resolveTenantTitle(membership.tenantId)),
+                    tenantLogo: tenant === null || tenant === void 0 ? void 0 : tenant.logo,
+                    sentAt: (_c = membership.invitation) === null || _c === void 0 ? void 0 : _c.sentAt,
+                    expiresAt: (_d = membership.invitation) === null || _d === void 0 ? void 0 : _d.expiresAt,
+                });
+            }
+            return { success: true, data: { items } };
+        });
+    }
+    cancelMyJoinRequest(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const session = this.requireSession();
+            const userId = (_a = session.userId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!userId) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.NotSignedIn,
+                    message: 'Not signed in.',
+                };
+            }
+            const membership = yield this.findOwnMembershipById(userId, input.tenantUserId);
+            if (!(membership === null || membership === void 0 ? void 0 : membership.id)) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.RequestNotFound,
+                    message: 'Join request not found.',
+                };
+            }
+            if (!this.isPendingJoinRequest(membership)) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_JOIN_REQUEST_ERROR_CODES.NotPending,
+                    message: 'Join request is not pending.',
+                };
+            }
+            yield this.resolveMembershipStatus(membership, core_2.AXPSystemStatusType.Cancelled);
+            return { success: true };
+        });
+    }
+    //#endregion
+    //#region ---- Private helpers ----
+    activateMembership(membership, newPassword) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if (!membership.id || !membership.userId || !membership.invitation) {
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_ACCEPT_INVITATION_ERROR_CODES.Invalid,
+                    message: 'This invitation link is invalid or has expired.',
+                };
+            }
+            const expiresAt = Date.parse(membership.invitation.expiresAt);
+            if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) {
+                yield this.resolveMembershipStatus(membership, core_2.AXPSystemStatusType.Expired);
+                return {
+                    success: false,
+                    code: module_security_management_contracts_1.AXM_ACCEPT_INVITATION_ERROR_CODES.Expired,
+                    message: 'This invitation link is invalid or has expired.',
+                };
+            }
+            const user = (yield this.entityStorage.getOneAsEngine(USER_ENTITY, membership.userId));
+            if (!(user === null || user === void 0 ? void 0 : user.id)) {
+                return { success: false, message: 'User not found for this invitation.' };
+            }
+            // Invite-created identities stay pending until they choose a password.
+            // Existing Active users (e.g. independent register) already have credentials.
+            const needsPassword = user.accountState === PENDING_ACCOUNT_STATE;
+            const homeTenantId = typeof user.homeTenantId === 'string' ? user.homeTenantId.trim() : '';
+            const identityPatch = {};
+            if (!homeTenantId && membership.tenantId) {
+                identityPatch['homeTenantId'] = membership.tenantId;
+            }
+            if (needsPassword) {
+                const password = newPassword !== null && newPassword !== void 0 ? newPassword : '';
+                if (password.length < 6) {
+                    return {
+                        success: false,
+                        code: module_security_management_contracts_1.AXM_ACCEPT_INVITATION_ERROR_CODES.PasswordRequired,
+                        message: 'A new password of at least 6 characters is required.',
+                    };
+                }
+                yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, Object.assign(Object.assign({}, identityPatch), { password: yield (0, core_2.hashPassword)(password), passwordChangedAt: new Date().toISOString(), accountState: ACTIVE_ACCOUNT_STATE, accessState: module_security_management_contracts_1.AXMUserAccessState.Allowed }));
+            }
+            else if (user.accountState !== ACTIVE_ACCOUNT_STATE || Object.keys(identityPatch).length > 0) {
+                yield this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, Object.assign(Object.assign({}, identityPatch), (user.accountState !== ACTIVE_ACCOUNT_STATE
+                    ? {
+                        accountState: ACTIVE_ACCOUNT_STATE,
+                        accessState: module_security_management_contracts_1.AXMUserAccessState.Allowed,
+                    }
+                    : {})));
+            }
+            const acceptedAt = new Date().toISOString();
+            yield this.entityStorage.updateOneAsEngine(TENANT_USER_ENTITY, membership.id, {
+                statusId: core_2.AXPSystemStatusType.Active,
+                invitation: invitationWithoutToken(membership.invitation, { acceptedAt }),
+                endDate: null,
+            });
+            const tenantIdForAccess = String((_a = membership.tenantId) !== null && _a !== void 0 ? _a : '').trim();
+            const entitledIds = tenantIdForAccess
+                ? new Set(yield (0, user_invitation_application_access_util_1.resolveTenantSubscribedApplicationIds)(this.entityStorage, tenantIdForAccess))
+                : new Set();
+            const tenant = tenantIdForAccess
+                ? (yield this.entityStorage.getOneAsEngine(TENANT_ENTITY, tenantIdForAccess))
+                : null;
+            const tenantActive = Boolean(tenant === null || tenant === void 0 ? void 0 : tenant['id']) && (tenant === null || tenant === void 0 ? void 0 : tenant['statusId']) !== core_2.AXPSystemStatusType.Inactive;
+            for (const row of yield this.listAppAccess(membership.id)) {
+                if (!row.id) {
+                    continue;
+                }
+                const applicationId = String((_b = row.applicationId) !== null && _b !== void 0 ? _b : '').trim();
+                const stillAllowed = tenantActive && applicationId.length > 0 && entitledIds.has(applicationId);
+                if (stillAllowed) {
+                    yield this.entityStorage.updateOneAsEngine(APP_ACCESS_ENTITY, row.id, {
+                        statusId: core_2.AXPSystemStatusType.Active,
+                        endDate: null,
+                    });
+                }
+                else {
+                    // Do not activate revoked/invalid AppAccess (ADR-TEN-001 D-06).
+                    yield this.entityStorage.updateOneAsEngine(APP_ACCESS_ENTITY, row.id, {
+                        statusId: core_2.AXPSystemStatusType.Cancelled,
+                        endDate: new Date().toISOString(),
+                    });
+                }
+            }
+            return { success: true };
+        });
+    }
+    isPendingJoinRequest(membership) {
+        var _a;
+        return (!!(membership === null || membership === void 0 ? void 0 : membership.id) &&
+            membership.statusId === core_2.AXPSystemStatusType.Pending &&
+            ((_a = membership.invitation) === null || _a === void 0 ? void 0 : _a.source) === module_security_management_contracts_1.AXM_MEMBERSHIP_INVITATION_SOURCE.JoinRequest);
+    }
+    isJoinableTenant(row) {
+        var _a;
+        if (!(row === null || row === void 0 ? void 0 : row['id'])) {
+            return false;
+        }
+        const statusId = String((_a = row['statusId']) !== null && _a !== void 0 ? _a : '');
+        return statusId !== core_2.AXPSystemStatusType.Inactive;
+    }
+    /** Exact case-insensitive match on unique `name` or any locale value of display `title`. */
+    tenantNameOrTitleMatches(row, needle) {
+        var _a;
+        const name = String((_a = row['name']) !== null && _a !== void 0 ? _a : '').trim().toLowerCase();
+        if (name === needle) {
+            return true;
+        }
+        const title = (0, core_2.coerceUnknownToMultiLanguageString)(row['title']);
+        if (typeof title === 'string') {
+            return title.trim().toLowerCase() === needle;
+        }
+        if ((0, core_2.isLocaleStringMap)(title)) {
+            return Object.values(title).some((value) => typeof value === 'string' && value.trim().toLowerCase() === needle);
+        }
+        return false;
+    }
+    findActiveTenantByUniqueName(uniqueName) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const needle = uniqueName.trim().toLowerCase();
+            if (!needle) {
+                return null;
+            }
+            const result = yield this.entityStorage.query(TENANT_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 5000 }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            const matches = (Array.isArray(items) ? items : []).filter((row) => this.isJoinableTenant(row) && this.tenantNameOrTitleMatches(row, needle));
+            if (matches.length !== 1) {
+                return null;
+            }
+            const row = matches[0];
+            return {
+                id: String(row['id']),
+                name: String((_a = row['name']) !== null && _a !== void 0 ? _a : '').trim(),
+            };
+        });
+    }
+    getJoinableTenantById(tenantId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const row = (yield this.entityStorage.getOneAsEngine(TENANT_ENTITY, tenantId));
+                if (!this.isJoinableTenant(row) || !row) {
+                    return null;
+                }
+                return {
+                    id: String(row['id']),
+                    name: String((_a = row['name']) !== null && _a !== void 0 ? _a : '').trim(),
+                    title: this.extractTenantTitle(row['title']),
+                    logo: this.extractTenantLogo(row['logo']),
+                };
+            }
+            catch (error) {
+                if (error instanceof common_1.NotFoundException) {
+                    return null;
+                }
+                throw error;
+            }
+        });
+    }
+    extractTenantTitle(title) {
+        if (typeof title === 'string' && title.trim()) {
+            return title.trim();
+        }
+        const mls = (0, core_2.coerceUnknownToMultiLanguageString)(title);
+        if (typeof mls === 'string' && mls.trim()) {
+            return mls.trim();
+        }
+        if ((0, core_2.isLocaleStringMap)(mls)) {
+            return (mls['en-US'] ||
+                mls['en'] ||
+                mls['fa-IR'] ||
+                Object.values(mls).find((value) => typeof value === 'string' && value.trim()) ||
+                undefined);
+        }
+        return undefined;
+    }
+    extractTenantLogo(logo) {
+        if (typeof logo === 'string' && logo.trim()) {
+            return logo.trim();
+        }
+        if (logo && typeof logo === 'object' && 'url' in logo) {
+            const url = logo.url;
+            if (typeof url === 'string' && url.trim()) {
+                return url.trim();
+            }
+        }
+        return undefined;
+    }
+    requireSession() {
+        const request = (0, core_1.getEntityStorageRequest)();
+        const session = request === null || request === void 0 ? void 0 : request[security_1.CURRENT_SESSION_KEY];
+        if (!(session === null || session === void 0 ? void 0 : session.userId)) {
+            throw new Error('Request is not authenticated.');
+        }
+        return session;
+    }
+    /**
+     * Product / app-scoped invite: force session application only.
+     * Tenant Users multi-app: `tenantMembershipInvite` + session edition feature,
+     * intersected with tenant subscription entitlement (ADR-TEN-001 D-05).
+     */
+    resolveAuthorizedApplicationIds(inputIds, session, tenantId, tenantMembershipInvite) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const entitled = yield (0, user_invitation_application_access_util_1.resolveTenantSubscribedApplicationIds)(this.entityStorage, tenantId);
+            const entitledSet = new Set(entitled);
+            const allowMulti = tenantMembershipInvite &&
+                (yield (0, user_invitation_application_access_util_1.sessionApplicationHasFeature)(this.entityStorage, session.applicationId, user_invitation_application_access_util_1.INVITE_MULTI_APPLICATION_FEATURE));
+            if (!allowMulti) {
+                const sessionApp = (_a = session.applicationId) === null || _a === void 0 ? void 0 : _a.trim();
+                if (!sessionApp) {
+                    return [];
+                }
+                return (0, user_invitation_application_access_util_1.filterApplicationIdsByEntitlement)([sessionApp], entitledSet);
+            }
+            const requested = this.resolveApplicationIds(inputIds, session.applicationId);
+            return (0, user_invitation_application_access_util_1.filterApplicationIdsByEntitlement)(requested, entitledSet);
+        });
+    }
+    listTenantEntitledApplications() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return { success: false, message: 'Tenant context is required.' };
+            }
+            const items = yield (0, user_invitation_application_access_util_1.resolveTenantSubscribedApplications)(this.entityStorage, tenantId);
+            return { success: true, data: { items } };
+        });
+    }
+    /**
+     * TM Tenant Users invite repeater only — overlay roles for the current tenant.
+     * Does not change Role list isolation or Security → Users invite.
+     */
+    listInviteAssignableRoles(applicationId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g;
+            const session = this.requireSession();
+            const tenantId = (_a = session.tenantId) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!tenantId) {
+                return { success: false, message: 'Tenant context is required.' };
+            }
+            const selectedApplicationId = applicationId === null || applicationId === void 0 ? void 0 : applicationId.trim();
+            const entitled = new Set(yield (0, user_invitation_application_access_util_1.resolveTenantSubscribedApplicationIds)(this.entityStorage, tenantId));
+            const filters = [
+                { field: 'scopeInfo.tenantId', operator: { type: 'equal' }, value: tenantId },
+            ];
+            if (selectedApplicationId) {
+                filters.push({
+                    field: 'scopeInfo.applicationId',
+                    operator: { type: 'equal' },
+                    value: selectedApplicationId,
+                });
+            }
+            const result = yield this.entityStorage.query(ROLE_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: 500,
+                filter: { logic: 'and', filters },
+            }));
+            const rows = (0, lodash_1.get)(result, 'items', []);
+            const items = [];
+            for (const row of Array.isArray(rows) ? rows : []) {
+                const id = String((_c = (_b = row['id']) !== null && _b !== void 0 ? _b : row['_id']) !== null && _c !== void 0 ? _c : '').trim();
+                if (!id) {
+                    continue;
+                }
+                const applicationId = String((_e = (_d = row['scopeInfo']) === null || _d === void 0 ? void 0 : _d['applicationId']) !== null && _e !== void 0 ? _e : '').trim();
+                if (!applicationId || (entitled.size > 0 && !entitled.has(applicationId))) {
+                    continue;
+                }
+                if (selectedApplicationId && applicationId !== selectedApplicationId) {
+                    continue;
+                }
+                if (!(0, module_security_management_contracts_1.isRoleAssignableForTenantUserInviteRow)(row, {
+                    tenantId,
+                    applicationId,
+                })) {
+                    continue;
+                }
+                const name = typeof row['name'] === 'string' ? row['name'] : undefined;
+                items.push({
+                    id,
+                    title: (_g = (_f = row['title']) !== null && _f !== void 0 ? _f : name) !== null && _g !== void 0 ? _g : id,
+                    name,
+                    applicationId,
+                });
+            }
+            return { success: true, data: { items } };
+        });
+    }
+    revalidateApplicationIds(tenantId, applicationIds) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const entitled = yield (0, user_invitation_application_access_util_1.resolveTenantSubscribedApplicationIds)(this.entityStorage, tenantId);
+            return (0, user_invitation_application_access_util_1.filterApplicationIdsByEntitlement)(applicationIds, entitled);
+        });
+    }
+    /**
+     * TM Tenant Users repeater: keep role ids that are overlays for tenant + that row's application.
+     * Does not change {@link resolveAuthorizedRoleIds} (Security → Users / tenant-wide invite).
+     */
+    resolveAuthorizedTenantUserInviteRoleIds(inputIds, tenantId, applicationId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const requested = [
+                ...new Set((inputIds !== null && inputIds !== void 0 ? inputIds : []).map((id) => String(id).trim()).filter(Boolean)),
+            ];
+            if (requested.length === 0) {
+                return [];
+            }
+            const result = yield this.entityStorage.query(ROLE_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: Math.max(requested.length, 50),
+                filter: {
+                    logic: 'and',
+                    filters: [{ field: 'id', operator: { type: 'in' }, value: requested }],
+                },
+            }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            const byId = new Map((Array.isArray(items) ? items : [])
+                .map((row) => {
+                var _a, _b;
+                const id = String((_b = (_a = row['id']) !== null && _a !== void 0 ? _a : row['_id']) !== null && _b !== void 0 ? _b : '').trim();
+                return id ? [id, row] : null;
+            })
+                .filter((row) => row != null));
+            return requested.filter((roleId) => {
+                const role = byId.get(roleId);
+                if (!role) {
+                    return false;
+                }
+                return (0, module_security_management_contracts_1.isRoleAssignableForTenantUserInviteRow)(role, { tenantId, applicationId });
+            });
+        });
+    }
+    /**
+     * Intersect client roleIds with Role rows the inviter may assign for this invite mode.
+     * Unknown / out-of-scope ids are dropped (not rejected) so invite still succeeds.
+     */
+    resolveAuthorizedRoleIds(inputIds, session, tenantId, mode) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const requested = [
+                ...new Set((inputIds !== null && inputIds !== void 0 ? inputIds : []).map((id) => String(id).trim()).filter(Boolean)),
+            ];
+            if (requested.length === 0) {
+                return [];
+            }
+            const result = yield this.entityStorage.query(ROLE_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: Math.max(requested.length, 50),
+                filter: {
+                    logic: 'and',
+                    filters: [{ field: 'id', operator: { type: 'in' }, value: requested }],
+                },
+            }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            const byId = new Map((Array.isArray(items) ? items : [])
+                .map((row) => {
+                var _a, _b;
+                const id = String((_b = (_a = row['id']) !== null && _a !== void 0 ? _a : row['_id']) !== null && _b !== void 0 ? _b : '').trim();
+                return id ? [id, row] : null;
+            })
+                .filter((row) => row != null));
+            const scopeApplicationId = mode === 'application' ? session.applicationId : undefined;
+            return requested.filter((roleId) => {
+                const role = byId.get(roleId);
+                if (!role) {
+                    return false;
+                }
+                return (0, module_security_management_contracts_1.isRoleAssignableForInvite)(role, mode, {
+                    tenantId,
+                    applicationId: scopeApplicationId,
+                });
+            });
+        });
+    }
+    upsertInviteUserRoles(options) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (options.roleIds.length === 0) {
+                return;
+            }
+            const scopeInfo = Object.assign({ tenantId: options.tenantId }, (((_a = options.applicationId) === null || _a === void 0 ? void 0 : _a.trim())
+                ? { applicationId: options.applicationId.trim() }
+                : {}));
+            const existing = yield this.findUserRoleGrant(options.userId, options.tenantId, options.applicationId);
+            const existingId = readGrantId(existing);
+            if (existing && existingId) {
+                const state = existing['stateInfo'];
+                if ((state === null || state === void 0 ? void 0 : state.isSystem) === true || (state === null || state === void 0 ? void 0 : state.isImmutable) === true) {
+                    return;
+                }
+                yield this.entityStorage.updateOneAsEngine(USER_ROLE_ENTITY, existingId, {
+                    roleIds: options.roleIds,
+                    scopeInfo,
+                });
+                return;
+            }
+            yield this.entityStorage.insertOneAsEngine(USER_ROLE_ENTITY, {
+                id: (0, crypto_1.randomUUID)(),
+                userId: options.userId,
+                roleIds: options.roleIds,
+                scopeInfo,
+            });
+        });
+    }
+    findUserRoleGrant(userId, tenantId, applicationId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield this.entityStorage.query(USER_ROLE_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                skip: 0,
+                take: 50,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        { field: 'userId', operator: { type: 'equal' }, value: userId },
+                        { field: 'scopeInfo.tenantId', operator: { type: 'equal' }, value: tenantId },
+                    ],
+                },
+            }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            if (!Array.isArray(items) || items.length === 0) {
+                return null;
+            }
+            const appId = applicationId === null || applicationId === void 0 ? void 0 : applicationId.trim();
+            if (appId) {
+                return ((_a = items.find((row) => {
+                    const scope = row['scopeInfo'];
+                    return (scope === null || scope === void 0 ? void 0 : scope['applicationId']) === appId;
+                })) !== null && _a !== void 0 ? _a : null);
+            }
+            const tenantWide = items.find((row) => {
+                const scope = row['scopeInfo'];
+                const rowApp = scope === null || scope === void 0 ? void 0 : scope['applicationId'];
+                return rowApp == null || rowApp === '';
+            });
+            return tenantWide !== null && tenantWide !== void 0 ? tenantWide : null;
+        });
+    }
+    resolveApplicationIds(inputIds, sessionAppId) {
+        const cleaned = [
+            ...new Set((inputIds !== null && inputIds !== void 0 ? inputIds : []).map((id) => id.trim()).filter(Boolean)),
+        ];
+        if (cleaned.length > 0) {
+            return cleaned;
+        }
+        const fallback = sessionAppId === null || sessionAppId === void 0 ? void 0 : sessionAppId.trim();
+        return fallback ? [fallback] : [];
+    }
+    listUsers() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.entityStorage.query(USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 5000 }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            return Array.isArray(items) ? items : [];
+        });
+    }
+    findUserByEmail(email) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const normalized = email.trim().toLowerCase();
+            return ((_a = (yield this.listUsers()).find((u) => {
+                var _a, _b;
+                const rowEmail = (_a = u.email) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase();
+                const rowUsername = (_b = u.username) === null || _b === void 0 ? void 0 : _b.trim().toLowerCase();
+                return rowEmail === normalized || rowUsername === normalized;
+            })) !== null && _a !== void 0 ? _a : null);
+        });
+    }
+    findUserByUsername(username) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            return ((_a = (yield this.listUsers()).find((u) => { var _a; return ((_a = u.username) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) === username; })) !== null && _a !== void 0 ? _a : null);
+        });
+    }
+    listTenantUsers() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.entityStorage.query(TENANT_USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 10000 }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            return Array.isArray(items) ? items : [];
+        });
+    }
+    listTenantUsersForUser(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return (yield this.listTenantUsers()).filter((m) => m.userId === userId);
+        });
+    }
+    findTenantUser(tenantId, userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            return ((_a = (yield this.listTenantUsers()).find((m) => m.tenantId === tenantId && m.userId === userId)) !== null && _a !== void 0 ? _a : null);
+        });
+    }
+    getTenantUserById(id) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                return ((_a = (yield this.entityStorage.getOneAsEngine(TENANT_USER_ENTITY, id))) !== null && _a !== void 0 ? _a : null);
+            }
+            catch (error) {
+                // Wrong id (e.g. User.id mistaken for TenantUser.id) must not 404 the command.
+                if (error instanceof common_1.NotFoundException) {
+                    return null;
+                }
+                throw error;
+            }
+        });
+    }
+    /** Waiting-room callers have no tenant on the session; do not use request-scoped getOne. */
+    findOwnMembershipById(userId, tenantUserId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const id = tenantUserId === null || tenantUserId === void 0 ? void 0 : tenantUserId.trim();
+            if (!id) {
+                return null;
+            }
+            const row = yield this.getTenantUserById(id);
+            return (row === null || row === void 0 ? void 0 : row.userId) === userId ? row : null;
+        });
+    }
+    resolveMembership(tenantId, tenantUserId, userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (tenantUserId === null || tenantUserId === void 0 ? void 0 : tenantUserId.trim()) {
+                const row = yield this.getTenantUserById(tenantUserId.trim());
+                if ((row === null || row === void 0 ? void 0 : row.tenantId) === tenantId) {
+                    return row;
+                }
+            }
+            if (userId === null || userId === void 0 ? void 0 : userId.trim()) {
+                return this.findTenantUser(tenantId, userId.trim());
+            }
+            return null;
+        });
+    }
+    findMembershipByTokenHash(tokenHash) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            return ((_a = (yield this.listTenantUsers()).find((m) => { var _a; return !!((_a = m.invitation) === null || _a === void 0 ? void 0 : _a.tokenHash) && tokensMatch(m.invitation.tokenHash, tokenHash); })) !== null && _a !== void 0 ? _a : null);
+        });
+    }
+    upsertPendingTenantUser(tenantId, userId, invitation) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const existing = yield this.findTenantUser(tenantId, userId);
+            if (existing === null || existing === void 0 ? void 0 : existing.id) {
+                yield this.entityStorage.updateOneAsEngine(TENANT_USER_ENTITY, existing.id, {
+                    statusId: core_2.AXPSystemStatusType.Pending,
+                    invitation,
+                    endDate: null,
+                });
+                return existing.id;
+            }
+            const id = (0, crypto_1.randomUUID)();
+            yield this.entityStorage.insertOneAsEngine(TENANT_USER_ENTITY, {
+                id,
+                tenantId,
+                userId,
+                statusId: core_2.AXPSystemStatusType.Pending,
+                startDate: new Date(),
+                invitation,
+            });
+            return id;
+        });
+    }
+    upsertPendingAppAccess(tenantId, tenantUserId, applicationIds) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!applicationIds.length) {
+                return;
+            }
+            const existing = yield this.listAppAccess(tenantUserId);
+            const byApp = new Map(existing.map((row) => [row.applicationId, row]));
+            for (const applicationId of applicationIds) {
+                const row = byApp.get(applicationId);
+                if (row === null || row === void 0 ? void 0 : row.id) {
+                    yield this.entityStorage.updateOneAsEngine(APP_ACCESS_ENTITY, row.id, {
+                        statusId: core_2.AXPSystemStatusType.Pending,
+                        endDate: null,
+                    });
+                }
+                else {
+                    yield this.entityStorage.insertOneAsEngine(APP_ACCESS_ENTITY, {
+                        id: (0, crypto_1.randomUUID)(),
+                        tenantUserId,
+                        tenantId,
+                        applicationId,
+                        statusId: core_2.AXPSystemStatusType.Pending,
+                        startDate: new Date(),
+                    });
+                }
+            }
+        });
+    }
+    listAppAccess(tenantUserId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.entityStorage.query(APP_ACCESS_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 5000 }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            return (Array.isArray(items) ? items : []).filter((row) => row.tenantUserId === tenantUserId);
+        });
+    }
+    /**
+     * Terminal invite outcomes keep invitation audit metadata (no tokenHash).
+     * Does not change User.accountState.
+     */
+    resolveMembershipStatus(membership, statusId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!membership.id) {
+                return;
+            }
+            const invitation = membership.invitation
+                ? invitationWithoutToken(membership.invitation)
+                : null;
+            yield this.entityStorage.updateOneAsEngine(TENANT_USER_ENTITY, membership.id, {
+                statusId,
+                invitation,
+                endDate: new Date(),
+            });
+            for (const row of yield this.listAppAccess(membership.id)) {
+                if (row.id) {
+                    yield this.entityStorage.updateOneAsEngine(APP_ACCESS_ENTITY, row.id, {
+                        statusId,
+                        endDate: new Date(),
+                    });
+                }
+            }
+        });
+    }
+    resolveTenantTitle(tenantId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            try {
+                const tenant = (yield this.entityStorage.getOneAsEngine(TENANT_ENTITY, tenantId));
+                return this.extractTenantTitle(tenant === null || tenant === void 0 ? void 0 : tenant.title);
+            }
+            catch (_a) {
+                return undefined;
+            }
+        });
+    }
+    maybeDeliverInvitationInApp(args) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (!args.userAlreadyExists || args.user.accountState !== ACTIVE_ACCOUNT_STATE) {
+                return;
+            }
+            try {
+                yield this.deliverInvitationInApp(args);
+            }
+            catch (error) {
+                this.logger.warn(`user-invitation in-app notify failed for user ${args.user.id}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        });
+    }
+    /**
+     * Unscoped in-app row (empty scopeInfo) for existing active users — visible in any
+     * tenant via catalog-read; inbox still filters by recipientUserId.
+     */
+    deliverInvitationInApp(args) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const recipientUserId = (_a = args.user.id) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!recipientUserId) {
+                return;
+            }
+            const tenantTitle = (yield this.resolveTenantTitle(args.tenantId)) || args.tenantId;
+            const correlationId = `membership-invitation:${args.tenantUserId}`;
+            const result = yield this.commandExecutor.execute(module_communication_management_contracts_1.AXMCommunicationManagementServerCommands.Send, {
+                title: '@security-management:users.notifications.membership-invitation.title',
+                message: {
+                    subject: '@security-management:users.notifications.membership-invitation.title',
+                    body: tenantTitle,
+                },
+                channel: 'in-app',
+                recipientUserId,
+                recipientName: args.user.displayName || args.user.username,
+                unscoped: true,
+                definitionKey: module_security_management_contracts_1.AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY,
+                correlationId,
+                idempotencyKey: `${correlationId}:${Date.now()}`,
+                priority: 'Notice',
+                // Sender session: without this, debug mode redirects delivery to the admin.
+                bypassDebugRedirect: true,
+                actions: [
+                    {
+                        title: '@security-management:users.notifications.membership-invitation.actions.review',
+                        command: {
+                            name: module_auth_contracts_1.AXMAuthCommandKeys.Account.OpenWaitingRoom,
+                            options: {
+                                source: module_security_management_contracts_1.AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE,
+                            },
+                        },
+                    },
+                ],
+            });
+            if (!(result === null || result === void 0 ? void 0 : result.success)) {
+                const text = typeof ((_b = result === null || result === void 0 ? void 0 : result.message) === null || _b === void 0 ? void 0 : _b.text) === 'string'
+                    ? result.message.text
+                    : 'Failed to send membership invitation in-app notification.';
+                throw new Error(text);
+            }
+        });
+    }
+    deliverInvitationEmail(args) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const platformTenantId = (_a = (0, abstract_1.getPrimaryPlatformTenantId)()) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!platformTenantId) {
+                this.logger.warn(`user-invitation missing platform tenant id for user ${args.user.id}`);
+                throw new Error('Platform tenant context is required to send email.');
+            }
+            const inviteLink = `${resolveWebOrigin(args.webOrigin)}/auth/accept-invitation?token=${encodeURIComponent(args.rawToken)}`;
+            const merge = {
+                userName: args.user.displayName || args.user.username || args.email,
+                inviteLink,
+                expiryDays: 7,
+                expiryMinutes: EXPIRY_MINUTES,
+            };
+            const renderResult = yield this.commandExecutor.execute(module_content_management_contracts_1.AXM_TEXT_TEMPLATE_RENDER_COMMAND_KEY, {
+                textTemplateId: TEMPLATE_ID,
+                tenantId: platformTenantId,
+                userId: args.user.id,
+                channel: 'email',
+                data: merge,
+            });
+            const rendered = (0, core_2.runtimeCommandPayloadData)(renderResult);
+            if (!(renderResult === null || renderResult === void 0 ? void 0 : renderResult.success) || !(rendered === null || rendered === void 0 ? void 0 : rendered.body)) {
+                const text = typeof ((_b = renderResult === null || renderResult === void 0 ? void 0 : renderResult.message) === null || _b === void 0 ? void 0 : _b.text) === 'string'
+                    ? renderResult.message.text
+                    : 'User invitation template is not configured.';
+                this.logger.warn(`user-invitation text template render failed: ${text}`);
+                throw new Error(text);
+            }
+            const subject = rendered.subject;
+            const body = rendered.body;
+            const result = yield this.commandExecutor.execute(module_communication_management_contracts_1.AXMCommunicationManagementServerCommands.Send, {
+                title: subject || 'You are invited',
+                message: { subject, body },
+                channel: EMAIL_CHANNEL,
+                recipientAddress: args.email,
+                recipientUserId: args.user.id,
+                recipientName: args.user.displayName || args.user.username,
+                tenantId: platformTenantId,
+                definitionKey: TEMPLATE_ID,
+                correlationId: `user-invitation:${args.user.id}:${args.invitation.sentAt}`,
+                idempotencyKey: `user-invitation:${args.user.id}:${(_c = args.invitation.tokenHash) !== null && _c !== void 0 ? _c : args.invitation.sentAt}`,
+            });
+            if (!(result === null || result === void 0 ? void 0 : result.success)) {
+                const text = typeof ((_d = result === null || result === void 0 ? void 0 : result.message) === null || _d === void 0 ? void 0 : _d.text) === 'string'
+                    ? result.message.text
+                    : 'Failed to send invitation email.';
+                this.logger.warn(`user-invitation send failed for user ${args.user.id}: ${text}`);
+                throw new Error(text);
+            }
+            return true;
+        });
+    }
+};
+exports.UserInvitationService = UserInvitationService;
+exports.UserInvitationService = UserInvitationService = UserInvitationService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        providers_1.ServerCommandExecutorService])
+], UserInvitationService);
+//#endregion
+//# sourceMappingURL=user-invitation.service.js.map