@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/contracts/src/entity-entry.policy.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policyFactory = void 0;
+var policy_entity_1 = require("./entities/policy/policy.entity");
+Object.defineProperty(exports, "policyFactory", { enumerable: true, get: function () { return policy_entity_1.policyFactory; } });
+//# sourceMappingURL=entity-entry.policy.js.map

package/contracts/src/entity-entry.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-entry.policy.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/entity-entry.policy.ts"],"names":[],"mappings":";;;AAAA,iEAAgE;AAAvD,8GAAA,aAAa,OAAA"}

package/contracts/src/entity-entry.profile.d.ts

@@ -0,0 +1 @@
+export { profileFactory } from './entities/profile/profile.entity';

package/contracts/src/entity-entry.profile.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileFactory = void 0;
+var profile_entity_1 = require("./entities/profile/profile.entity");
+Object.defineProperty(exports, "profileFactory", { enumerable: true, get: function () { return profile_entity_1.profileFactory; } });
+//# sourceMappingURL=entity-entry.profile.js.map

package/contracts/src/entity-entry.profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-entry.profile.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/entity-entry.profile.ts"],"names":[],"mappings":";;;AAAA,oEAAmE;AAA1D,gHAAA,cAAc,OAAA"}

package/contracts/src/entity-entry.role-permission.d.ts

@@ -0,0 +1 @@
+export { rolePermissionFactory } from './entities/role-permission/role-permission.entity';

package/contracts/src/entity-entry.role-permission.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rolePermissionFactory = void 0;
+var role_permission_entity_1 = require("./entities/role-permission/role-permission.entity");
+Object.defineProperty(exports, "rolePermissionFactory", { enumerable: true, get: function () { return role_permission_entity_1.rolePermissionFactory; } });
+//# sourceMappingURL=entity-entry.role-permission.js.map

package/contracts/src/entity-entry.role-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-entry.role-permission.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/entity-entry.role-permission.ts"],"names":[],"mappings":";;;AAAA,4FAA0F;AAAjF,+HAAA,qBAAqB,OAAA"}

package/contracts/src/entity-entry.roles.d.ts

@@ -0,0 +1 @@
+export { rolesFactory } from './entities/roles/roles.entity';

package/contracts/src/entity-entry.roles.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rolesFactory = void 0;
+var roles_entity_1 = require("./entities/roles/roles.entity");
+Object.defineProperty(exports, "rolesFactory", { enumerable: true, get: function () { return roles_entity_1.rolesFactory; } });
+//# sourceMappingURL=entity-entry.roles.js.map

package/contracts/src/entity-entry.roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-entry.roles.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/entity-entry.roles.ts"],"names":[],"mappings":";;;AAAA,8DAA6D;AAApD,4GAAA,YAAY,OAAA"}

package/contracts/src/entity-entry.user-role.d.ts

@@ -0,0 +1 @@
+export { userRoleFactory } from './entities/user-role/user-role.entity';

package/contracts/src/entity-entry.user-role.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userRoleFactory = void 0;
+var user_role_entity_1 = require("./entities/user-role/user-role.entity");
+Object.defineProperty(exports, "userRoleFactory", { enumerable: true, get: function () { return user_role_entity_1.userRoleFactory; } });
+//# sourceMappingURL=entity-entry.user-role.js.map

package/contracts/src/entity-entry.user-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-entry.user-role.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/entity-entry.user-role.ts"],"names":[],"mappings":";;;AAAA,0EAAwE;AAA/D,mHAAA,eAAe,OAAA"}

package/contracts/src/entity-entry.user-two-factor.d.ts

@@ -0,0 +1 @@
+export { userTwoFactorFactory } from './entities/user-two-factor/user-two-factor.entity';

package/contracts/src/entity-entry.user-two-factor.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userTwoFactorFactory = void 0;
+var user_two_factor_entity_1 = require("./entities/user-two-factor/user-two-factor.entity");
+Object.defineProperty(exports, "userTwoFactorFactory", { enumerable: true, get: function () { return user_two_factor_entity_1.userTwoFactorFactory; } });
+//# sourceMappingURL=entity-entry.user-two-factor.js.map

package/contracts/src/entity-entry.user-two-factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-entry.user-two-factor.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/entity-entry.user-two-factor.ts"],"names":[],"mappings":";;;AAAA,4FAAyF;AAAhF,8HAAA,oBAAoB,OAAA"}

package/contracts/src/entity-entry.users.d.ts

@@ -0,0 +1 @@
+export { usersFactory } from './entities/users/users.entity';

package/contracts/src/entity-entry.users.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.usersFactory = void 0;
+var users_entity_1 = require("./entities/users/users.entity");
+Object.defineProperty(exports, "usersFactory", { enumerable: true, get: function () { return users_entity_1.usersFactory; } });
+//# sourceMappingURL=entity-entry.users.js.map

package/contracts/src/entity-entry.users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-entry.users.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/entity-entry.users.ts"],"names":[],"mappings":";;;AAAA,8DAA6D;AAApD,4GAAA,YAAY,OAAA"}

package/contracts/src/features.keys.d.ts

@@ -8,4 +8,8 @@ export declare const AXPSecurityManagementFeatureKeys: {
     readonly MaxTotalUsers: "SecurityManagement:Feature:MaxTotalUsers";
     readonly ManageSessions: "SecurityManagement:Feature:ManageSessions";
     readonly ManagePolicies: "SecurityManagement:Feature:ManagePolicies";
+    /** Platform Console only — Identity Provider management menu + CRUD. */
+    readonly ManageIdentityProviders: "SecurityManagement:Feature:ManageIdentityProviders";
+    /** Self-service account deletion on the profile page. Off unless the edition enables it. */
+    readonly DeleteAccount: "SecurityManagement:Feature:DeleteAccount";
 };

package/contracts/src/features.keys.js

@@ -12,6 +12,10 @@ exports.AXPSecurityManagementFeatureKeys = {
     MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',
     ManageSessions: 'SecurityManagement:Feature:ManageSessions',
     ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',
+    /** Platform Console only — Identity Provider management menu + CRUD. */
+    ManageIdentityProviders: 'SecurityManagement:Feature:ManageIdentityProviders',
+    /** Self-service account deletion on the profile page. Off unless the edition enables it. */
+    DeleteAccount: 'SecurityManagement:Feature:DeleteAccount',
 };
 //#endregion
 //# sourceMappingURL=features.keys.js.map

package/contracts/src/features.keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"features.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/features.keys.ts"],"names":[],"mappings":";AAAA,oCAAoC;;;AAEpC;;;GAGG;AACU,QAAA,gCAAgC,GAAG;IAC9C,WAAW,EAAE,wCAAwC;IACrD,WAAW,EAAE,wCAAwC;IACrD,aAAa,EAAE,0CAA0C;IACzD,cAAc,EAAE,2CAA2C;IAC3D,cAAc,EAAE,2CAA2C;CACnD,CAAC;AAEX,YAAY"}
+{"version":3,"file":"features.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/features.keys.ts"],"names":[],"mappings":";AAAA,oCAAoC;;;AAEpC;;;GAGG;AACU,QAAA,gCAAgC,GAAG;IAC9C,WAAW,EAAE,wCAAwC;IACrD,WAAW,EAAE,wCAAwC;IACrD,aAAa,EAAE,0CAA0C;IACzD,cAAc,EAAE,2CAA2C;IAC3D,cAAc,EAAE,2CAA2C;IAC3D,wEAAwE;IACxE,uBAAuB,EAAE,oDAAoD;IAC7E,4FAA4F;IAC5F,aAAa,EAAE,0CAA0C;CACjD,CAAC;AAEX,YAAY"}

package/contracts/src/index.d.ts

@@ -1,13 +1,22 @@
-export * from './datasource.keys';
+export * from './lib/context.definitions';
 export * from './features.keys';
 export * from './menu.keys';
 export * from './permission.keys';
+export * from './ROLE_PERMISSIONS_PAGE_COMPONENT_KEY';
+export * from './USER_ROLES_PAGE_COMPONENT_KEY';
 export * from './root-config';
+export * from './manifest';
 export * from './AXM_USER_ACCESS_STATE_DEFINITION_KEY';
 export * from './AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY';
 export * from './user-access-state';
 export * from './user-effective-state';
 export * from './resolve-user-effective-state';
 export * from './user-password-reset';
+export * from './user-invitation';
+export * from './invite-assignable-roles.util';
+export * from './invite-application-role-rows.util';
+export * from './create-application-role-rows.util';
 export * from './server-commands';
+export * from './settings.keys';
+export * from './device-session-admin-scope';
 export * from './entities';

package/contracts/src/index.js

@@ -2,18 +2,27 @@
 //#region ---- Contracts barrel ----
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
-tslib_1.__exportStar(require("./datasource.keys"), exports);
+tslib_1.__exportStar(require("./lib/context.definitions"), exports);
 tslib_1.__exportStar(require("./features.keys"), exports);
 tslib_1.__exportStar(require("./menu.keys"), exports);
 tslib_1.__exportStar(require("./permission.keys"), exports);
+tslib_1.__exportStar(require("./ROLE_PERMISSIONS_PAGE_COMPONENT_KEY"), exports);
+tslib_1.__exportStar(require("./USER_ROLES_PAGE_COMPONENT_KEY"), exports);
 tslib_1.__exportStar(require("./root-config"), exports);
+tslib_1.__exportStar(require("./manifest"), exports);
 tslib_1.__exportStar(require("./AXM_USER_ACCESS_STATE_DEFINITION_KEY"), exports);
 tslib_1.__exportStar(require("./AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY"), exports);
 tslib_1.__exportStar(require("./user-access-state"), exports);
 tslib_1.__exportStar(require("./user-effective-state"), exports);
 tslib_1.__exportStar(require("./resolve-user-effective-state"), exports);
 tslib_1.__exportStar(require("./user-password-reset"), exports);
+tslib_1.__exportStar(require("./user-invitation"), exports);
+tslib_1.__exportStar(require("./invite-assignable-roles.util"), exports);
+tslib_1.__exportStar(require("./invite-application-role-rows.util"), exports);
+tslib_1.__exportStar(require("./create-application-role-rows.util"), exports);
 tslib_1.__exportStar(require("./server-commands"), exports);
+tslib_1.__exportStar(require("./settings.keys"), exports);
+tslib_1.__exportStar(require("./device-session-admin-scope"), exports);
 //#endregion
 tslib_1.__exportStar(require("./entities"), exports);
 //# sourceMappingURL=index.js.map

package/contracts/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/index.ts"],"names":[],"mappings":";AAAA,oCAAoC;;;AAEpC,4DAAkC;AAClC,0DAAgC;AAChC,sDAA4B;AAC5B,4DAAkC;AAElC,wDAA8B;AAE9B,iFAAuD;AACvD,oFAA0D;AAC1D,8DAAoC;AACpC,iEAAuC;AACvC,yEAA+C;AAC/C,gEAAsC;AACtC,4DAAkC;AAClC,YAAY;AAEZ,qDAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/index.ts"],"names":[],"mappings":";AAAA,oCAAoC;;;AAEpC,oEAA0C;AAC1C,0DAAgC;AAChC,sDAA4B;AAC5B,4DAAkC;AAClC,gFAAsD;AACtD,0EAAgD;AAEhD,wDAA8B;AAC9B,qDAA2B;AAE3B,iFAAuD;AACvD,oFAA0D;AAC1D,8DAAoC;AACpC,iEAAuC;AACvC,yEAA+C;AAC/C,gEAAsC;AACtC,4DAAkC;AAClC,yEAA+C;AAC/C,8EAAoD;AACpD,8EAAoD;AACpD,4DAAkC;AAClC,0DAAgC;AAChC,uEAA6C;AAC7C,YAAY;AAEZ,qDAA2B"}

package/contracts/src/invite-application-role-rows.util.d.ts

@@ -0,0 +1,16 @@
+/** One TM invite repeater row: application + multi-select roles for that app. */
+export interface AXMInviteApplicationRoleAssignment {
+    applicationId: string;
+    roleIds: string[];
+}
+/**
+ * Submit-time merge for the TM invite repeater.
+ * Duplicate applications (same app on two rows, different role picks) become one assignment
+ * with the union of role ids. Empty application rows are dropped. Do not unique the dropdown
+ * instead — the UI may repeat an application.
+ */
+export declare function normalizeInviteApplicationRoleAssignments(rows: unknown): AXMInviteApplicationRoleAssignment[];
+export declare function flattenInviteApplicationRoleAssignments(assignments: readonly AXMInviteApplicationRoleAssignment[]): {
+    applicationIds: string[];
+    roleIds: string[];
+};

package/contracts/src/invite-application-role-rows.util.js

@@ -0,0 +1,68 @@
+"use strict";
+//#region ----- Types -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeInviteApplicationRoleAssignments = normalizeInviteApplicationRoleAssignments;
+exports.flattenInviteApplicationRoleAssignments = flattenInviteApplicationRoleAssignments;
+//#endregion
+//#region ----- Helpers -----
+function readId(value) {
+    if (typeof value === 'string') {
+        return value.trim();
+    }
+    if (value && typeof value === 'object') {
+        const id = value.id;
+        if (typeof id === 'string') {
+            return id.trim();
+        }
+        if (typeof id === 'number') {
+            return String(id);
+        }
+        return '';
+    }
+    return value != null ? String(value).trim() : '';
+}
+function readRoleIds(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return [...new Set(value.map((id) => readId(id)).filter(Boolean))];
+}
+/**
+ * Submit-time merge for the TM invite repeater.
+ * Duplicate applications (same app on two rows, different role picks) become one assignment
+ * with the union of role ids. Empty application rows are dropped. Do not unique the dropdown
+ * instead — the UI may repeat an application.
+ */
+function normalizeInviteApplicationRoleAssignments(rows) {
+    var _a;
+    if (!Array.isArray(rows)) {
+        return [];
+    }
+    const byApp = new Map();
+    for (const row of rows) {
+        if (!row || typeof row !== 'object') {
+            continue;
+        }
+        const record = row;
+        const applicationId = readId(record['applicationId']);
+        if (!applicationId) {
+            continue;
+        }
+        const bucket = (_a = byApp.get(applicationId)) !== null && _a !== void 0 ? _a : new Set();
+        for (const roleId of readRoleIds(record['roleIds'])) {
+            bucket.add(roleId);
+        }
+        byApp.set(applicationId, bucket);
+    }
+    return [...byApp.entries()].map(([applicationId, roleIds]) => ({
+        applicationId,
+        roleIds: [...roleIds],
+    }));
+}
+function flattenInviteApplicationRoleAssignments(assignments) {
+    const applicationIds = assignments.map((row) => row.applicationId);
+    const roleIds = [...new Set(assignments.flatMap((row) => row.roleIds))];
+    return { applicationIds, roleIds };
+}
+//#endregion
+//# sourceMappingURL=invite-application-role-rows.util.js.map

package/contracts/src/invite-application-role-rows.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-application-role-rows.util.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/invite-application-role-rows.util.ts"],"names":[],"mappings":";AAAA,2BAA2B;;AA0C3B,8FA4BC;AAED,0FAMC;AAtED,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,EAAE,GAAI,KAA0B,CAAC,EAAE,CAAC;QAC1C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,yCAAyC,CACvD,IAAa;;IAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAA,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,mCAAI,IAAI,GAAG,EAAU,CAAC;QAC7D,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,aAAa;QACb,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,uCAAuC,CACrD,WAA0D;IAE1D,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,YAAY"}

package/contracts/src/invite-assignable-roles.util.d.ts

@@ -0,0 +1,34 @@
+/** Invite surface that decides which Role catalog rows are selectable. */
+export type AXMInviteRoleAssignmentMode = 'application' | 'tenant';
+export interface AXMInviteRoleScopeContext {
+    tenantId: string;
+    /** Required for application-mode filtering. */
+    applicationId?: string;
+}
+export interface AXMInviteRoleScopeInfo {
+    tenantId?: string;
+    applicationId?: string;
+}
+export declare function readInviteRoleScopeInfo(role: {
+    scopeInfo?: unknown;
+} | null | undefined): AXMInviteRoleScopeInfo;
+/**
+ * Whether a Role catalog row may appear in the invite roles multi-select.
+ *
+ * UI-only selection filter (does not change Role / RLS):
+ * - Application invite / per-app repeater row → current-tenant + that application overlays only
+ * - Tenant invite → current-tenant-wide rows only (no applicationId, no other-app overlays)
+ */
+export declare function isRoleAssignableForInvite(role: {
+    scopeInfo?: unknown;
+    stateInfo?: unknown;
+} | null | undefined, mode: AXMInviteRoleAssignmentMode, context: AXMInviteRoleScopeContext): boolean;
+/**
+ * TM Tenant Users invite repeater only: overlay for current tenant + the
+ * application chosen on that row. Independent of {@link isRoleAssignableForInvite}
+ * so Security → Users invite can change without affecting this picker.
+ */
+export declare function isRoleAssignableForTenantUserInviteRow(role: {
+    scopeInfo?: unknown;
+    stateInfo?: unknown;
+} | null | undefined, context: AXMInviteRoleScopeContext): boolean;

package/contracts/src/invite-assignable-roles.util.js

@@ -0,0 +1,75 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readInviteRoleScopeInfo = readInviteRoleScopeInfo;
+exports.isRoleAssignableForInvite = isRoleAssignableForInvite;
+exports.isRoleAssignableForTenantUserInviteRow = isRoleAssignableForTenantUserInviteRow;
+const core_1 = require("@acorex-platform/framework-shared/core");
+//#endregion
+//#region ----- Helpers -----
+function readScopeString(value) {
+    const id = (0, core_1.coerceUnknownToTrimmedString)(value);
+    return id || undefined;
+}
+function readInviteRoleScopeInfo(role) {
+    const scope = (role === null || role === void 0 ? void 0 : role.scopeInfo) && typeof role.scopeInfo === 'object'
+        ? role.scopeInfo
+        : undefined;
+    return {
+        tenantId: readScopeString(scope === null || scope === void 0 ? void 0 : scope['tenantId']),
+        applicationId: readScopeString(scope === null || scope === void 0 ? void 0 : scope['applicationId']),
+    };
+}
+function isHiddenRole(role) {
+    const state = (role === null || role === void 0 ? void 0 : role.stateInfo) && typeof role.stateInfo === 'object'
+        ? role.stateInfo
+        : undefined;
+    return (state === null || state === void 0 ? void 0 : state['isHidden']) === true;
+}
+/**
+ * Whether a Role catalog row may appear in the invite roles multi-select.
+ *
+ * UI-only selection filter (does not change Role / RLS):
+ * - Application invite / per-app repeater row → current-tenant + that application overlays only
+ * - Tenant invite → current-tenant-wide rows only (no applicationId, no other-app overlays)
+ */
+function isRoleAssignableForInvite(role, mode, context) {
+    if (isHiddenRole(role)) {
+        return false;
+    }
+    const tenantId = readScopeString(context.tenantId);
+    if (!tenantId) {
+        return false;
+    }
+    const scope = readInviteRoleScopeInfo(role);
+    if (!scope.tenantId || scope.tenantId !== tenantId) {
+        return false;
+    }
+    if (mode === 'tenant') {
+        return !scope.applicationId;
+    }
+    const applicationId = readScopeString(context.applicationId);
+    if (!applicationId) {
+        return false;
+    }
+    return scope.applicationId === applicationId;
+}
+/**
+ * TM Tenant Users invite repeater only: overlay for current tenant + the
+ * application chosen on that row. Independent of {@link isRoleAssignableForInvite}
+ * so Security → Users invite can change without affecting this picker.
+ */
+function isRoleAssignableForTenantUserInviteRow(role, context) {
+    if (isHiddenRole(role)) {
+        return false;
+    }
+    const tenantId = readScopeString(context.tenantId);
+    const applicationId = readScopeString(context.applicationId);
+    if (!tenantId || !applicationId) {
+        return false;
+    }
+    const scope = readInviteRoleScopeInfo(role);
+    return scope.tenantId === tenantId && scope.applicationId === applicationId;
+}
+//#endregion
+//# sourceMappingURL=invite-assignable-roles.util.js.map

package/contracts/src/invite-assignable-roles.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-assignable-roles.util.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/invite-assignable-roles.util.ts"],"names":[],"mappings":";AAAA,6BAA6B;;AA+B7B,0DAWC;AAiBD,8DA4BC;AAOD,wFAgBC;AA5GD,iEAAsF;AAoBtF,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,EAAE,GAAG,IAAA,mCAA4B,EAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,SAAS,CAAC;AACzB,CAAC;AAED,SAAgB,uBAAuB,CACrC,IAAgD;IAEhD,MAAM,KAAK,GACT,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,SAAS,KAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QACnD,CAAC,CAAE,IAAI,CAAC,SAAqC;QAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,UAAU,CAAC,CAAC;QAC9C,aAAa,EAAE,eAAe,CAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,eAAe,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAgD;IACpE,MAAM,KAAK,GACT,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,SAAS,KAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QACnD,CAAC,CAAE,IAAI,CAAC,SAAqC;QAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,UAAU,CAAC,MAAK,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,IAAqE,EACrE,IAAiC,EACjC,OAAkC;IAElC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,aAAa,KAAK,aAAa,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAgB,sCAAsC,CACpD,IAAqE,EACrE,OAAkC;IAElC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,CAAC;AAC9E,CAAC;AAED,YAAY"}

package/contracts/src/lib/context.definitions.d.ts

@@ -0,0 +1,2 @@
+import type { AXPContextDefinition } from '@acorex-platform/framework-shared/core';
+export declare const AXM_SECURITY_CONTEXT_DEFINITIONS: AXPContextDefinition[];

package/contracts/src/lib/context.definitions.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXM_SECURITY_CONTEXT_DEFINITIONS = void 0;
+//#region ---- User context definitions ----
+exports.AXM_SECURITY_CONTEXT_DEFINITIONS = [
+    {
+        name: 'userDisplayName',
+        title: 'User display name',
+        description: 'Human-readable name of the signed-in user (name or title from session). Used for personalized responses.',
+        order: 11,
+        capabilities: ['ai'],
+    },
+];
+//#endregion
+//# sourceMappingURL=context.definitions.js.map

package/contracts/src/lib/context.definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.definitions.js","sourceRoot":"","sources":["../../../../../../libs/modules/security-management/contracts/src/lib/context.definitions.ts"],"names":[],"mappings":";;;AAEA,4CAA4C;AAE/B,QAAA,gCAAgC,GAA2B;IACtE;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,0GAA0G;QAC5G,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,CAAC,IAAI,CAAC;KACrB;CACF,CAAC;AAEF,YAAY"}

package/contracts/src/manifest.d.ts

@@ -0,0 +1,6 @@
+import { AXPModuleManifest } from '@acorex-platform/framework-shared/core';
+/**
+ * Security Management Module Manifest.
+ * Defines module metadata, features, and provider references.
+ */
+export declare const SecurityManagementManifest: AXPModuleManifest;

package/contracts/src/manifest.js

@@ -0,0 +1,24 @@
+"use strict";
+//#region ----   Imports   ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityManagementManifest = void 0;
+const root_config_1 = require("./root-config");
+//#endregion
+//#region ----   Manifest Definition   ----
+/**
+ * Security Management Module Manifest.
+ * Defines module metadata, features, and provider references.
+ */
+exports.SecurityManagementManifest = {
+    name: root_config_1.RootConfig.module.name,
+    version: '1.0.0',
+    title: root_config_1.RootConfig.module.title,
+    icon: root_config_1.RootConfig.module.icon,
+    i18n: root_config_1.RootConfig.config.i18n,
+    type: 'platform',
+    domain: 'platform',
+    required: true,
+    // Module dependencies (optional)
+};
+//#endregion
+//# sourceMappingURL=manifest.js.map

package/contracts/src/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/manifest.ts"],"names":[],"mappings":";AAAA,+BAA+B;;;AAG/B,+CAA2C;AAE3C,YAAY;AAEZ,2CAA2C;AAE3C;;;GAGG;AACU,QAAA,0BAA0B,GAAsB;IAC3D,IAAI,EAAE,wBAAU,CAAC,MAAM,CAAC,IAAI;IAC5B,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,wBAAU,CAAC,MAAM,CAAC,KAAK;IAC9B,IAAI,EAAE,wBAAU,CAAC,MAAM,CAAC,IAAI;IAC5B,IAAI,EAAE,wBAAU,CAAC,MAAM,CAAC,IAAI;IAC5B,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,QAAQ,EAAE,IAAI;IAEd,iCAAiC;CAClC,CAAC;AAEF,YAAY"}

package/contracts/src/menu.keys.d.ts

@@ -4,5 +4,6 @@ export declare const AXPSecurityManagementMenuKeys: {
     readonly Roles: "SecurityManagement:Menu:Roles";
     readonly DeviceSessions: "SecurityManagement:Menu:DeviceSessions";
     readonly Policy: "SecurityManagement:Menu:Policy";
+    readonly IdentityProviders: "SecurityManagement:Menu:IdentityProviders";
     readonly MyProfile: "SecurityManagement:Menu:MyProfile";
 };

package/contracts/src/menu.keys.js

@@ -7,6 +7,7 @@ exports.AXPSecurityManagementMenuKeys = {
     Roles: 'SecurityManagement:Menu:Roles',
     DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',
     Policy: 'SecurityManagement:Menu:Policy',
+    IdentityProviders: 'SecurityManagement:Menu:IdentityProviders',
     MyProfile: 'SecurityManagement:Menu:MyProfile',
 };
 //# sourceMappingURL=menu.keys.js.map

package/contracts/src/menu.keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"menu.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/menu.keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,6BAA6B,GAAG;IAC3C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,+BAA+B;IACtC,KAAK,EAAE,+BAA+B;IACtC,cAAc,EAAE,wCAAwC;IACxD,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE,mCAAmC;CACtC,CAAC"}
+{"version":3,"file":"menu.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/menu.keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,6BAA6B,GAAG;IAC3C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,+BAA+B;IACtC,KAAK,EAAE,+BAA+B;IACtC,cAAc,EAAE,wCAAwC;IACxD,MAAM,EAAE,gCAAgC;IACxC,iBAAiB,EAAE,2CAA2C;IAC9D,SAAS,EAAE,mCAAmC;CACtC,CAAC"}

package/contracts/src/permission.keys.d.ts

@@ -1,28 +1,58 @@
+/**
+ * Administration capabilities used by this module.
+ * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).
+ */
+export declare const AXPAdministrationPermissionKeys: {
+    readonly Access: "Administration:Permission:Access";
+    /** Create and maintain users, roles, role assignments, and related security-access reports. */
+    readonly MaintainUsersAndRoles: "Administration:Permission:MaintainUsersAndRoles";
+    readonly ManageSessions: "Administration:Permission:ManageSessions";
+    readonly MaintainPolicies: "Administration:Permission:MaintainPolicies";
+    readonly ViewIntegrations: "Administration:Permission:ViewIntegrations";
+    readonly MaintainConnections: "Administration:Permission:MaintainConnections";
+    readonly ManageIntegrationActions: "Administration:Permission:ManageIntegrationActions";
+    readonly MaintainWorkflows: "Administration:Permission:MaintainWorkflows";
+    readonly ManageWorkflowActions: "Administration:Permission:ManageWorkflowActions";
+    readonly ViewRules: "Administration:Permission:ViewRules";
+    readonly MaintainRules: "Administration:Permission:MaintainRules";
+    readonly ManageRuleActions: "Administration:Permission:ManageRuleActions";
+    readonly MaintainAi: "Administration:Permission:MaintainAi";
+    readonly UseAiAssist: "Administration:Permission:UseAiAssist";
+    readonly MaintainDashboards: "Administration:Permission:MaintainDashboards";
+    readonly ViewJobs: "Administration:Permission:ViewJobs";
+    readonly ManageJobActions: "Administration:Permission:ManageJobActions";
+    readonly ViewObservability: "Administration:Permission:ViewObservability";
+    readonly MaintainObservability: "Administration:Permission:MaintainObservability";
+};
+/**
+ * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.
+ * Legacy nested shape kept so existing imports compile during migration.
+ */
 export declare const AXPSecurityManagementPermissionKeys: {
     readonly User: {
-        readonly Management: "SecurityManagement:Permission:User.Management";
-        readonly View: "SecurityManagement:Permission:User.View";
-        readonly Edit: "SecurityManagement:Permission:User.Edit";
-        readonly Delete: "SecurityManagement:Permission:User.Delete";
-        readonly Create: "SecurityManagement:Permission:User.Create";
+        readonly Management: "Administration:Permission:MaintainUsersAndRoles";
+        readonly View: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Edit: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Delete: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Create: "Administration:Permission:MaintainUsersAndRoles";
     };
     readonly Role: {
-        readonly Management: "SecurityManagement:Permission:Role.Management";
-        readonly View: "SecurityManagement:Permission:Role.View";
-        readonly Edit: "SecurityManagement:Permission:Role.Edit";
-        readonly Delete: "SecurityManagement:Permission:Role.Delete";
-        readonly Create: "SecurityManagement:Permission:Role.Create";
+        readonly Management: "Administration:Permission:MaintainUsersAndRoles";
+        readonly View: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Edit: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Delete: "Administration:Permission:MaintainUsersAndRoles";
+        readonly Create: "Administration:Permission:MaintainUsersAndRoles";
     };
     readonly DeviceSession: {
-        readonly Management: "SecurityManagement:Permission:DeviceSession.Management";
-        readonly View: "SecurityManagement:Permission:DeviceSession.View";
-        readonly Terminate: "SecurityManagement:Permission:DeviceSession.Terminate";
+        readonly Management: "Administration:Permission:ManageSessions";
+        readonly View: "Administration:Permission:ManageSessions";
+        readonly Terminate: "Administration:Permission:ManageSessions";
     };
     readonly Policy: {
-        readonly Management: "SecurityManagement:Permission:Policy.Management";
-        readonly View: "SecurityManagement:Permission:Policy.View";
-        readonly Edit: "SecurityManagement:Permission:Policy.Edit";
-        readonly Delete: "SecurityManagement:Permission:Policy.Delete";
-        readonly Create: "SecurityManagement:Permission:Policy.Create";
+        readonly Management: "Administration:Permission:MaintainPolicies";
+        readonly View: "Administration:Permission:MaintainPolicies";
+        readonly Edit: "Administration:Permission:MaintainPolicies";
+        readonly Delete: "Administration:Permission:MaintainPolicies";
+        readonly Create: "Administration:Permission:MaintainPolicies";
     };
 };