@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/contracts/src/settings.keys.js

@@ -0,0 +1,21 @@
+"use strict";
+//#region ----- User provisioning settings -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXM_USER_PROVISIONING_MODE_DEFAULT = exports.AXMUserProvisioningMode = exports.AXMSecurityManagementSettings = void 0;
+/** Platform settings owned by Security Management. */
+exports.AXMSecurityManagementSettings = {
+    /**
+     * Which Users-list add actions are available.
+     * `create` and `invite` are primary. `both` shows them as secondary actions.
+     */
+    UserProvisioningMode: 'SecurityManagement:Setting:User.ProvisioningMode',
+};
+exports.AXMUserProvisioningMode = {
+    Create: 'create',
+    Invite: 'invite',
+    Both: 'both',
+};
+/** Used when the platform setting has not been saved yet. */
+exports.AXM_USER_PROVISIONING_MODE_DEFAULT = exports.AXMUserProvisioningMode.Both;
+//#endregion
+//# sourceMappingURL=settings.keys.js.map

package/contracts/src/settings.keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/settings.keys.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AAEhD,sDAAsD;AACzC,QAAA,6BAA6B,GAAG;IAC3C;;;OAGG;IACH,oBAAoB,EAAE,kDAAkD;CAChE,CAAC;AAEE,QAAA,uBAAuB,GAAG;IACrC,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;CACJ,CAAC;AAIX,6DAA6D;AAChD,QAAA,kCAAkC,GAAG,+BAAuB,CAAC,IAAI,CAAC;AAE/E,YAAY"}

package/contracts/src/user-access-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-access-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/user-access-state.ts"],"names":[],"mappings":";AAAA,qCAAqC;;;AAErC;;;GAGG;AACH,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;AACrB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAED,YAAY"}
+{"version":3,"file":"user-access-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-access-state.ts"],"names":[],"mappings":";AAAA,qCAAqC;;;AAErC;;;GAGG;AACH,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;IACnB,yCAAmB,CAAA;AACrB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAED,YAAY"}

package/contracts/src/user-effective-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-effective-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/user-effective-state.ts"],"names":[],"mappings":";AAAA,kDAAkD;;;AAElD;;GAEG;AACH,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,0CAAiB,CAAA;IACjB,gDAAuB,CAAA;IACvB,8CAAqB,CAAA;IACrB,8CAAqB,CAAA;IACrB,0DAAiC,CAAA;IACjC,iEAAwC,CAAA;AAC1C,CAAC,EARW,qBAAqB,qCAArB,qBAAqB,QAQhC;AAED,YAAY"}
+{"version":3,"file":"user-effective-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-effective-state.ts"],"names":[],"mappings":";AAAA,kDAAkD;;;AAElD;;GAEG;AACH,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,0CAAiB,CAAA;IACjB,gDAAuB,CAAA;IACvB,8CAAqB,CAAA;IACrB,8CAAqB,CAAA;IACrB,0DAAiC,CAAA;IACjC,iEAAwC,CAAA;AAC1C,CAAC,EARW,qBAAqB,qCAArB,qBAAqB,QAQhC;AAED,YAAY"}

package/contracts/src/user-invitation.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Invitation challenge / audit metadata on TenantManagement.TenantUser.
+ * The raw token is never persisted — only a SHA-256 hash while the invite is pending.
+ */
+export interface AXMUserInvitationInfo {
+    /** Present only while `TenantUser.statusId` is pending; cleared after resolve. */
+    tokenHash?: string;
+    expiresAt: string;
+    sentAt: string;
+    invitedByUserId: string;
+    applicationIds?: string[];
+    /** Role ids selected at invite time (flat union; mirrored onto scoped UserRole). */
+    roleIds?: string[];
+    /** TM Tenant Users: roles grouped by application (optional audit / accept helper). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * `invite` = admin sent; `join-request` = user requested membership from waiting room;
+     * `tenant-request` = user requested creation of a new tenant (public form).
+     */
+    source: AXMMembershipInvitationSource;
+    /** Set when the invitee accepts; distinguishes accepted invite from create-in-tenant. */
+    acceptedAt?: string;
+}
+export type AXMMembershipInvitationSource = 'invite' | 'join-request' | 'tenant-request';
+export declare const AXM_MEMBERSHIP_INVITATION_SOURCE: {
+    readonly Invite: "invite";
+    readonly JoinRequest: "join-request";
+    readonly TenantRequest: "tenant-request";
+};
+/** How a User identity row was created (directory provenance). */
+export type AXMUserCreatedVia = 'invite' | 'create-in-tenant' | 'register' | 'seed' | 'idp' | 'tenant-request';
+/**
+ * In-app inbox definition for membership invites to users who already have a tenant.
+ * Inbox row action opens the auth waiting room (Approve/Decline live there).
+ */
+export declare const AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY: "security-management.membership-invitation";
+/** Query `source` value when opening waiting room from a membership-invite notification. */
+export declare const AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE: "membership-invite";

package/contracts/src/user-invitation.js

@@ -0,0 +1,18 @@
+"use strict";
+//#region ---- User invitation payload on TenantUser ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = exports.AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY = exports.AXM_MEMBERSHIP_INVITATION_SOURCE = void 0;
+exports.AXM_MEMBERSHIP_INVITATION_SOURCE = {
+    Invite: 'invite',
+    JoinRequest: 'join-request',
+    TenantRequest: 'tenant-request',
+};
+/**
+ * In-app inbox definition for membership invites to users who already have a tenant.
+ * Inbox row action opens the auth waiting room (Approve/Decline live there).
+ */
+exports.AXM_MEMBERSHIP_INVITATION_NOTIFICATION_DEFINITION_KEY = 'security-management.membership-invitation';
+/** Query `source` value when opening waiting room from a membership-invite notification. */
+exports.AXM_MEMBERSHIP_INVITE_WAITING_ROOM_SOURCE = 'membership-invite';
+//#endregion
+//# sourceMappingURL=user-invitation.js.map

package/contracts/src/user-invitation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-invitation.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-invitation.ts"],"names":[],"mappings":";AAAA,yDAAyD;;;AA4B5C,QAAA,gCAAgC,GAAG;IAC9C,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,cAAc;IAC3B,aAAa,EAAE,gBAAgB;CACvB,CAAC;AAUX;;;GAGG;AACU,QAAA,qDAAqD,GAChE,2CAAoD,CAAC;AAEvD,4FAA4F;AAC/E,QAAA,yCAAyC,GAAG,mBAA4B,CAAC;AAEtF,YAAY"}

package/contracts/src/user-password-reset.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-password-reset.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/user-password-reset.ts"],"names":[],"mappings":";AAAA,kDAAkD;;AAYlD,YAAY"}
+{"version":3,"file":"user-password-reset.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/user-password-reset.ts"],"names":[],"mappings":";AAAA,kDAAkD;;AAYlD,YAAY"}

package/package.json

@@ -1,29 +1,27 @@
 {
   "name": "@acorex-platform/module-security-management-server",
-  "version": "0.0.18",
+  "version": "2.0.0-next.42",
   "type": "commonjs",
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
+  "main": "./server/src/index.js",
+  "types": "./server/src/index.d.ts",
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@acorex-platform/framework-server": "0.0.18",
-    "@acorex-platform/framework-shared": "0.0.18",
-    "@acorex-platform/module-communication-management-server": "0.0.18",
-    "@acorex-platform/module-content-management-server": "0.0.18",
-    "@acorex-platform/module-organization-management-server": "0.0.18",
-    "@acorex-platform/module-security-management-server": "0.0.18",
-    "@acorex-platform/module-settings-management-server": "0.0.18",
-    "@acorex-platform/module-common-server": "0.0.18"
+    "@acorex-platform/framework-server": "2.0.0-next.42",
+    "@acorex-platform/framework-shared": "2.0.0-next.42",
+    "@acorex-platform/module-auth-client": "2.0.0-next.42",
+    "@acorex-platform/module-common-client": "2.0.0-next.42",
+    "@acorex-platform/module-common-server": "2.0.0-next.42",
+    "@acorex-platform/module-communication-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-content-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-organization-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-security-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-settings-management-server": "2.0.0-next.42",
+    "@nestjs/common": "^11.0.0"
   },
   "exports": {
     "./package.json": "./package.json",
     ".": {
-      "types": "./src/index.d.ts",
-      "default": "./src/index.js"
-    },
-    "./seed": {
-      "types": "./src/lib/seed/index.d.ts",
-      "default": "./src/lib/seed/index.js"
+      "types": "./server/src/index.d.ts",
+      "default": "./server/src/index.js"
     },
     "./contracts": {
       "types": "./contracts/src/index.d.ts",

package/server/src/index.d.ts

@@ -0,0 +1,3 @@
+export * from './lib/security-management-server.module';
+export { securityManagementEntityCatalog } from './lib/entities';
+export { ADMINISTRATION_REPORTS_CATEGORY_ID, SECURITY_ACCESS_CATEGORY_ID, } from './lib/reports/security-report.definitions';

package/server/src/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECURITY_ACCESS_CATEGORY_ID = exports.ADMINISTRATION_REPORTS_CATEGORY_ID = exports.securityManagementEntityCatalog = void 0;
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lib/security-management-server.module"), exports);
+var entities_1 = require("./lib/entities");
+Object.defineProperty(exports, "securityManagementEntityCatalog", { enumerable: true, get: function () { return entities_1.securityManagementEntityCatalog; } });
+var security_report_definitions_1 = require("./lib/reports/security-report.definitions");
+Object.defineProperty(exports, "ADMINISTRATION_REPORTS_CATEGORY_ID", { enumerable: true, get: function () { return security_report_definitions_1.ADMINISTRATION_REPORTS_CATEGORY_ID; } });
+Object.defineProperty(exports, "SECURITY_ACCESS_CATEGORY_ID", { enumerable: true, get: function () { return security_report_definitions_1.SECURITY_ACCESS_CATEGORY_ID; } });
+//# sourceMappingURL=index.js.map

package/server/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/src/index.ts"],"names":[],"mappings":";;;;AAAA,kFAAwD;AACxD,2CAAiE;AAAxD,2HAAA,+BAA+B,OAAA;AACxC,yFAGmD;AAFjD,iJAAA,kCAAkC,OAAA;AAClC,0IAAA,2BAA2B,OAAA"}

package/server/src/lib/effective-access-history/effective-access-history.service.d.ts

@@ -0,0 +1,35 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import type { EffectivePermissionIntervalRow, EffectiveRoleIntervalRow, PermissionHolderIntervalRow, PermissionHoldersHistoryQuery, RoleHolderIntervalRow, RoleHoldersHistoryQuery, UserEffectivePermissionsHistoryQuery, UserEffectiveRolesHistoryQuery } from './effective-access-history.types';
+/**
+ * Reconstructs historical effective roles/permissions from Change History
+ * (Common.VersionStream / VersionEntry), using the same scope scoring as runtime.
+ *
+ * When an entity type has **no** version streams (common for seed inserts that
+ * bypass history), falls back to current entity rows as open-ended intervals
+ * from `auditInfo.created.at` (or epoch) so “today / current” reports still work.
+ *
+ * v1 does **not** reconstruct TenantUser membership — membership is assumed
+ * (`hasTenantMembership: true`) so reports reflect grant assignment history.
+ */
+export declare class EffectiveAccessHistoryService {
+    private readonly storage;
+    constructor(storage: EntityStorageMiddlewareService);
+    getUserEffectiveRolesInRange(query: UserEffectiveRolesHistoryQuery): Promise<EffectiveRoleIntervalRow[]>;
+    getUserEffectivePermissionsInRange(query: UserEffectivePermissionsHistoryQuery): Promise<EffectivePermissionIntervalRow[]>;
+    getRoleHoldersInRange(query: RoleHoldersHistoryQuery): Promise<RoleHolderIntervalRow[]>;
+    getPermissionHoldersInRange(query: PermissionHoldersHistoryQuery): Promise<PermissionHolderIntervalRow[]>;
+    private collectUserRoleIntervals;
+    private buildPermissionSegmentsForUser;
+    private snapshotsAt;
+    private loadEntityStreams;
+    /**
+     * Seed / bulk inserts often have no VersionStream. Treat each current row as
+     * one open-ended state interval so overlap queries still return live grants.
+     */
+    private synthesizeStreamsFromCurrentEntities;
+    private listStreamsByEntityType;
+    private listEntriesForStream;
+    private listEntities;
+    private buildContext;
+    private toRange;
+}