@acorex/modules 21.0.0-next.39 → 21.0.0-next.41

package/fesm2022/acorex-modules-security-management.mjs

@@ -1,11 +1,11 @@
 import { AXMDeviceSessionsService, AXMDeviceSessionsServiceImpl } from '@acorex/modules/auth';
-import { createAllQueryView, AXPEntityCommandScope, AXPEntityQueryType, AXPStatusProvider, systemStatusToDefinition, AXPSystemStatusType, AXPSearchCommandProvider, createEntitySearchCommand, AXPRefreshEvent, AXP_MENU_PROVIDER, AXP_SEARCH_PROVIDER, AXP_STATUS_PROVIDERS } from '@acorex/platform/common';
+import { createAllQueryView, AXPEntityCommandScope, AXPEntityQueryType, AXPStatusProvider, AXPSystemStatusType, AXPSearchCommandProvider, createEntitySearchCommand, AXPRefreshEvent, AXP_MENU_PROVIDER, AXP_SEARCH_PROVIDER, AXP_STATUS_PROVIDERS } from '@acorex/platform/common';
 import { entityMasterCrudActions, entityMasterRecordActions, AXMEntityCrudServiceImpl, AXPEntityService, AXPEntityDefinitionRegistryService, AXP_ENTITY_DEFINITION_LOADER } from '@acorex/platform/layout/entity';
 import { AXPWidgetsCatalog, AXPWidgetGroupEnum, AXPWidgetCoreModule, AXP_WIDGET_DEFINITION_PROVIDER, AXPValueWidgetComponent, AXPColumnWidgetComponent } from '@acorex/platform/layout/widget-core';
 import * as i0 from '@angular/core';
 import { NgModule, Injectable, inject, Injector, signal, input, output, computed, ViewEncapsulation, Component, ViewChild, effect, ChangeDetectionStrategy } from '@angular/core';
-import { AXPWidgetsList, statusPlugin, AXPCommonMenuKeys } from '@acorex/modules/common';
-import { AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, AXP_MODULE_MANIFEST_PROVIDER, AXP_FEATURE_DEFINITION_PROVIDER } from '@acorex/platform/core';
+import { statusPlugin, AXPWidgetsList, AXPCommonMenuKeys } from '@acorex/modules/common';
+import { AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, AXP_MODULE_MANIFEST_PROVIDER, AXP_FEATURE_DEFINITION_PROVIDER, AXP_DATASOURCE_DEFINITION_PROVIDER } from '@acorex/platform/core';
 import { AXPSessionService, AXP_PERMISSION_DEFINITION_PROVIDER, AXPPermissionDefinitionService } from '@acorex/platform/auth';
 import { AXP_USER_AVATAR_PROVIDER, AXPThemeLayoutBlockComponent, AXPStateMessageComponent } from '@acorex/platform/layout/components';
 import { provideCommandSetups } from '@acorex/platform/runtime';
@@ -15,6 +15,7 @@ import { AXPopupService } from '@acorex/components/popup';
 import * as i8 from '@acorex/core/translation';
 import { AXTranslationService, AXTranslationModule } from '@acorex/core/translation';
 import { AXP_NAME_PROPERTY, AXP_DATA_PATH_PROPERTY, AXP_DISABLED_PROPERTY } from '@acorex/platform/layout/widgets';
+import { AXDataSource } from '@acorex/cdk/common';
 import { AXDialogService } from '@acorex/components/dialog';
 import { AXLoadingDialogService } from '@acorex/components/loading-dialog';
 import * as i1$1 from '@angular/common';
@@ -1181,39 +1182,56 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImpor
                 }]
         }] });
 
-//#region ---- User authentication state ----
+//#region ---- User access state ----
 /**
- * Read-only sign-in gate from the authentication layer (distinct from account `statusId`).
+ * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).
  * Persisted as the enum string value (e.g. `allowed`).
  */
-var AXMUserAuthenticationState;
-(function (AXMUserAuthenticationState) {
-    AXMUserAuthenticationState["Allowed"] = "allowed";
-    AXMUserAuthenticationState["Blocked"] = "blocked";
-    AXMUserAuthenticationState["Expired"] = "expired";
-})(AXMUserAuthenticationState || (AXMUserAuthenticationState = {}));
+var AXMUserAccessState;
+(function (AXMUserAccessState) {
+    AXMUserAccessState["Allowed"] = "allowed";
+    AXMUserAccessState["Blocked"] = "blocked";
+    AXMUserAccessState["Expired"] = "expired";
+})(AXMUserAccessState || (AXMUserAccessState = {}));
 //#endregion
 
-//#region ----   Imports   ----
+//#region ---- User effective (unified) state ----
+/**
+ * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).
+ */
+var AXMUserEffectiveState;
+(function (AXMUserEffectiveState) {
+    AXMUserEffectiveState["Pending"] = "pending";
+    AXMUserEffectiveState["Active"] = "active";
+    AXMUserEffectiveState["Suspended"] = "suspended";
+    AXMUserEffectiveState["Inactive"] = "inactive";
+    AXMUserEffectiveState["Archived"] = "archived";
+    AXMUserEffectiveState["SignInBlocked"] = "sign-in-blocked";
+    AXMUserEffectiveState["CredentialExpired"] = "credential-expired";
+})(AXMUserEffectiveState || (AXMUserEffectiveState = {}));
 //#endregion
-//#region ----   Definition key   ----
-/** Status provider key for `authenticationState` on SecurityManagement.User (readonly in UI; set by auth layer). */
-const AXM_USER_AUTHENTICATION_STATE_DEFINITION_KEY = 'security-management.authentication-state.user';
+
+//#region ---- Imports ----
 //#endregion
-//#region ----   User authentication state provider   ----
+//#region ---- Definition key ----
+/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */
+const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';
+//#endregion
+//#region ---- User access state provider ----
 /**
- * Sign-in readiness from the authentication subsystem (distinct from account lifecycle / `statusId`).
- * No transitions: values change only via backend/auth pipelines, not the status UI.
+ * Sign-in readiness from the authentication subsystem (distinct from account lifecycle / `accountState`).
+ * Transitions listed here are the only paths offered in the status UI and validated when executing a status change command.
  */
-class AXMUserAuthenticationStateProvider extends AXPStatusProvider {
+class AXMUserAccessStateProvider extends AXPStatusProvider {
     constructor() {
         super(...arguments);
-        this.key = AXM_USER_AUTHENTICATION_STATE_DEFINITION_KEY;
-        this.defaultStatus = AXMUserAuthenticationState.Allowed;
+        this.key = AXM_USER_ACCESS_STATE_DEFINITION_KEY;
+        this.defaultStatus = AXMUserAccessState.Allowed;
         this.statuses = [
             {
-                name: AXMUserAuthenticationState.Allowed,
-                title: '@security-management:users.entities.user.authentication.states.allowed',
+                name: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.states.allowed',
+                description: '@security-management:users.entities.user.access.descriptions.allowed',
                 icon: 'fa-light fa-circle-check',
                 color: 'success',
                 order: 1,
@@ -1221,21 +1239,132 @@ class AXMUserAuthenticationStateProvider extends AXPStatusProvider {
                 isFinal: false,
             },
             {
-                name: AXMUserAuthenticationState.Blocked,
-                title: '@security-management:users.entities.user.authentication.states.blocked',
+                name: AXMUserAccessState.Blocked,
+                title: '@security-management:users.entities.user.access.states.blocked',
+                description: '@security-management:users.entities.user.access.descriptions.blocked',
                 icon: 'fa-light fa-ban',
                 color: 'danger',
                 order: 2,
                 isInitial: false,
                 isFinal: false,
             },
-            systemStatusToDefinition(AXPSystemStatusType.Expired, {
-                title: '@security-management:users.entities.user.authentication.states.expired',
+            {
+                name: AXMUserAccessState.Expired,
+                title: '@security-management:users.entities.user.access.states.expired',
+                description: '@security-management:users.entities.user.access.descriptions.expired',
                 icon: 'fa-light fa-clock',
-                color: 'warning',
+                color: 'danger',
                 order: 3,
+                isInitial: false,
+                isFinal: true,
                 generateView: false,
-            }),
+            },
+        ];
+        this.transitions = [
+            {
+                from: AXMUserAccessState.Allowed,
+                to: AXMUserAccessState.Blocked,
+                title: '@security-management:users.entities.user.access.transitions.block-sign-in',
+            },
+            {
+                from: AXMUserAccessState.Allowed,
+                to: AXMUserAccessState.Expired,
+                title: '@security-management:users.entities.user.access.transitions.require-credential-renewal',
+            },
+            {
+                from: AXMUserAccessState.Blocked,
+                to: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.transitions.unblock-sign-in',
+            },
+            {
+                from: AXMUserAccessState.Expired,
+                to: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.transitions.restore-after-credential-renewal',
+            },
+        ];
+    }
+}
+//#endregion
+
+//#region ---- Imports ----
+//#endregion
+//#region ---- Definition key ----
+/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */
+const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';
+//#endregion
+//#region ---- User effective state provider ----
+/**
+ * Unified operational state for lists, filters, and page chrome (derived from lifecycle + sign-in gate).
+ */
+class AXMUserEffectiveStateProvider extends AXPStatusProvider {
+    constructor() {
+        super(...arguments);
+        this.key = AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY;
+        this.defaultStatus = AXMUserEffectiveState.Active;
+        this.statuses = [
+            {
+                name: AXMUserEffectiveState.Pending,
+                title: '@security-management:users.entities.user.effective.states.pending',
+                description: '@security-management:users.entities.user.effective.descriptions.pending',
+                icon: 'fa-light fa-hourglass-half',
+                color: 'warning',
+                order: 1,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Active,
+                title: '@security-management:users.entities.user.effective.states.active',
+                description: '@security-management:users.entities.user.effective.descriptions.active',
+                icon: 'fa-light fa-circle-check',
+                color: 'success',
+                order: 2,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.SignInBlocked,
+                title: '@security-management:users.entities.user.effective.states.sign-in-blocked',
+                description: '@security-management:users.entities.user.effective.descriptions.sign-in-blocked',
+                icon: 'fa-light fa-shield-halved',
+                color: 'danger',
+                order: 3,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.CredentialExpired,
+                title: '@security-management:users.entities.user.effective.states.credential-expired',
+                description: '@security-management:users.entities.user.effective.descriptions.credential-expired',
+                icon: 'fa-light fa-key',
+                color: 'danger',
+                order: 4,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Suspended,
+                title: '@security-management:users.entities.user.effective.states.suspended',
+                description: '@security-management:users.entities.user.effective.descriptions.suspended',
+                icon: 'fa-light fa-pause-circle',
+                color: 'warning',
+                order: 5,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Inactive,
+                title: '@security-management:users.entities.user.effective.states.inactive',
+                description: '@security-management:users.entities.user.effective.descriptions.inactive',
+                icon: 'fa-light fa-user-slash',
+                color: 'danger',
+                order: 6,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Archived,
+                title: '@security-management:users.entities.user.effective.states.archived',
+                description: '@security-management:users.entities.user.effective.descriptions.archived',
+                icon: 'fa-light fa-box-archive',
+                color: 'danger',
+                order: 7,
+                generateView: true,
+            },
         ];
         this.transitions = [];
     }
@@ -1261,8 +1390,38 @@ async function usersFactory() {
             {
                 ...statusPlugin,
                 options: {
-                    definition: 'security-management.status.user',
-                    field: 'statusId',
+                    definition: 'security-management.account-state.user',
+                    field: 'accountState',
+                    isPrimary: false,
+                    groupId: 'user-account-access',
+                    title: '@security-management:users.entities.user.fields.account-lifecycle.title',
+                    showInCreate: false,
+                    generate: { views: { enabled: false } },
+                },
+            },
+            {
+                ...statusPlugin,
+                options: {
+                    field: 'accessState',
+                    definition: AXM_USER_ACCESS_STATE_DEFINITION_KEY,
+                    isPrimary: false,
+                    groupId: 'user-account-access',
+                    title: '@security-management:users.entities.user.fields.access-state.title',
+                    showInCreate: false,
+                    readonly: false,
+                    generate: { views: { enabled: false } },
+                },
+            },
+            {
+                ...statusPlugin,
+                options: {
+                    field: 'effectiveState',
+                    definition: AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY,
+                    isPrimary: true,
+                    groupId: 'user-account-access',
+                    title: '@security-management:users.entities.user.fields.effective-state.title',
+                    showInCreate: false,
+                    readonly: true,
                     generate: { views: { enabled: true } },
                 },
             },
@@ -1281,8 +1440,8 @@ async function usersFactory() {
                 title: `@${i18n}:users.entities.user.groups.authorizations`,
             },
             {
-                id: 'authentication',
-                title: `@${i18n}:users.entities.user.groups.authentication`,
+                id: 'user-account-access',
+                title: '@security-management:users.entities.user.groups.account-access',
             },
         ],
         properties: [
@@ -1309,7 +1468,6 @@ async function usersFactory() {
                         type: AXPWidgetsCatalog.text,
                         options: {},
                     },
-                    // hidden: "{{  context.eval('displayName') != 'arash'  }}",
                 },
                 validations: [
                     {
@@ -1373,6 +1531,13 @@ async function usersFactory() {
                                 { source: 'id', target: 'roles.{id}' },
                                 { source: 'title', target: 'roles.{title}' },
                             ],
+                            columnResolve: {
+                                strategy: 'countOnly',
+                                countFieldPath: 'roles.length',
+                                queryKey: 'SecurityManagement:User:RolesForListColumn',
+                                queryParams: { userId: 'id' },
+                                queryResultItemsPath: 'items',
+                            },
                         },
                     },
                 },
@@ -1382,54 +1547,8 @@ async function usersFactory() {
                     },
                 ],
             },
-            {
-                name: 'authenticationState',
-                title: '@security-management:users.entities.user.fields.authentication-state.title',
-                groupId: 'authentication',
-                options: {
-                    sort: {
-                        enabled: true,
-                    },
-                    filter: {
-                        advance: {
-                            enabled: true,
-                        },
-                        inline: {
-                            enabled: true,
-                        },
-                    },
-                },
-                schema: {
-                    dataType: 'string',
-                    defaultValue: AXMUserAuthenticationState.Allowed,
-                    interface: {
-                        type: AXPWidgetsList.Advanced.Status,
-                        options: {
-                            definitionKey: AXM_USER_AUTHENTICATION_STATE_DEFINITION_KEY,
-                            readonly: true,
-                        },
-                    },
-                },
-            },
-        ],
-        columns: [
-            { name: 'username' },
-            { name: 'displayName' },
-            { name: 'roleIds', options: { dataPath: 'roles' } },
-            {
-                name: 'authenticationState',
-                title: '@security-management:users.entities.user.fields.authentication-state.title',
-                sort: { enabled: true },
-                options: {
-                    width: '140px',
-                    filterable: true,
-                    definitionKey: AXM_USER_AUTHENTICATION_STATE_DEFINITION_KEY,
-                    entity: `${RootConfig.module.name}.${RootConfig.entities.users.name}`,
-                    fieldName: 'authenticationState',
-                    readonly: true,
-                },
-            },
         ],
+        columns: [{ name: 'username' }, { name: 'displayName' }, { name: 'roleIds', options: { dataPath: 'roles' } }],
         interfaces: {
             master: {
                 create: {
@@ -1492,6 +1611,9 @@ async function usersFactory() {
                         {
                             id: 'authorizations',
                         },
+                        {
+                            id: 'user-account-access',
+                        },
                     ],
                     properties: [
                         {
@@ -1534,6 +1656,36 @@ async function usersFactory() {
                                 },
                             },
                         },
+                        {
+                            name: 'accountState',
+                            layout: {
+                                positions: {
+                                    lg: {
+                                        colSpan: 4,
+                                    },
+                                },
+                            },
+                        },
+                        {
+                            name: 'accessState',
+                            layout: {
+                                positions: {
+                                    lg: {
+                                        colSpan: 4,
+                                    },
+                                },
+                            },
+                        },
+                        {
+                            name: 'effectiveState',
+                            layout: {
+                                positions: {
+                                    lg: {
+                                        colSpan: 4,
+                                    },
+                                },
+                            },
+                        },
                     ],
                 },
                 single: {
@@ -1560,7 +1712,7 @@ async function usersFactory() {
                             },
                         },
                         {
-                            id: 'authentication',
+                            id: 'user-account-access',
                             layout: {
                                 positions: {
                                     lg: {
@@ -1612,11 +1764,31 @@ async function usersFactory() {
                             },
                         },
                         {
-                            name: 'authenticationState',
+                            name: 'accountState',
                             layout: {
                                 positions: {
                                     lg: {
-                                        colSpan: 6,
+                                        colSpan: 4,
+                                    },
+                                },
+                            },
+                        },
+                        {
+                            name: 'accessState',
+                            layout: {
+                                positions: {
+                                    lg: {
+                                        colSpan: 4,
+                                    },
+                                },
+                            },
+                        },
+                        {
+                            name: 'effectiveState',
+                            layout: {
+                                positions: {
+                                    lg: {
+                                        colSpan: 4,
                                     },
                                 },
                             },
@@ -2140,7 +2312,7 @@ const AXPPermissionsWidget = {
     type: 'view',
     categories: [],
     groups: [AXPWidgetGroupEnum.EntityWidget],
-    icon: "fa-solid fa-user-shield",
+    icon: "fa-light fa-user-shield",
     properties: [
         AXP_NAME_PROPERTY,
         AXP_DATA_PATH_PROPERTY,
@@ -2233,6 +2405,224 @@ class AXMSecurityManagementEvaluatorScopeProvider {
     }
 }
 
+class AXMUsersDataSourceDefinition {
+    constructor() {
+        this.userService = inject(AXMUsersEntityService);
+    }
+    items() {
+        return Promise.resolve([
+            {
+                name: 'users',
+                title: 'Users',
+                source: () => {
+                    return new AXDataSource({
+                        key: 'id',
+                        load: async (_) => {
+                            try {
+                                const res = await this.userService.query();
+                                return {
+                                    items: res.items.map((item) => ({
+                                        ...item,
+                                        displayName: item.displayName,
+                                    })),
+                                    total: res.total,
+                                };
+                            }
+                            catch (e) {
+                                console.log(e);
+                                throw e;
+                            }
+                        },
+                        byKey: async (key) => {
+                            return await this.userService.getOne(key);
+                        },
+                        pageSize: 100,
+                    });
+                },
+                columns: [
+                    {
+                        name: 'id',
+                        title: 'ID',
+                        datatype: 'uuid',
+                        type: AXPWidgetsCatalog.text,
+                    },
+                    {
+                        name: 'displayName',
+                        title: `Display Name`,
+                        datatype: 'string',
+                        type: AXPWidgetsCatalog.text,
+                    },
+                    {
+                        name: 'username',
+                        title: `Username`,
+                        datatype: 'string',
+                        type: AXPWidgetsCatalog.text,
+                    },
+                ],
+                filters: [
+                    {
+                        field: 'username',
+                        title: 'Username',
+                        operator: {
+                            type: 'equal',
+                        },
+                        widget: {
+                            type: AXPWidgetsCatalog.text,
+                        },
+                        filterType: {
+                            advance: true,
+                            inline: true,
+                        },
+                    },
+                ],
+                textField: {
+                    name: 'displayName',
+                    title: 'Display Name',
+                },
+                valueField: {
+                    name: 'id',
+                    title: 'ID',
+                },
+            },
+        ]);
+    }
+}
+
+//#region ----   Imports   ----
+//#endregion
+//#region ----   User account status provider   ----
+/**
+ * Account-level state for SecurityManagement.User (lifecycle / admin).
+ * Sign-in lockout is expressed as `accessState === blocked`, not as `accountState`.
+ */
+class AXMUserStatusProvider extends AXPStatusProvider {
+    constructor() {
+        super(...arguments);
+        this.key = 'security-management.account-state.user';
+        this.defaultStatus = AXPSystemStatusType.Active;
+        this.statuses = [
+            {
+                name: AXPSystemStatusType.Pending,
+                title: '@security-management:users.entities.user.states.pending',
+                description: '@security-management:users.entities.user.account.descriptions.pending',
+                icon: 'fa-light fa-envelope-open-text',
+                color: 'warning',
+                order: 1,
+                isInitial: true,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.states.active',
+                description: '@security-management:users.entities.user.account.descriptions.active',
+                icon: 'fa-light fa-user-check',
+                color: 'success',
+                order: 1,
+                isInitial: false,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Suspended,
+                title: '@security-management:users.entities.user.states.suspended',
+                description: '@security-management:users.entities.user.account.descriptions.suspended',
+                icon: 'fa-light fa-pause-circle',
+                color: 'warning',
+                order: 5,
+                isInitial: false,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.states.inactive',
+                description: '@security-management:users.entities.user.account.descriptions.inactive',
+                icon: 'fa-light fa-user-slash',
+                color: 'danger',
+                order: 2,
+                isInitial: false,
+                isFinal: false,
+                generateView: true,
+            },
+            {
+                name: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.states.archived',
+                description: '@security-management:users.entities.user.account.descriptions.archived',
+                icon: 'fa-light fa-box-archive',
+                color: 'danger',
+                order: 5,
+                isInitial: false,
+                isFinal: true,
+                generateView: true,
+            },
+        ];
+        this.transitions = [
+            {
+                from: AXPSystemStatusType.Pending,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.activate',
+            },
+            {
+                from: AXPSystemStatusType.Pending,
+                to: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.transitions.cancel-invitation',
+            },
+            {
+                from: AXPSystemStatusType.Active,
+                to: AXPSystemStatusType.Suspended,
+                title: '@security-management:users.entities.user.transitions.suspend',
+            },
+            {
+                from: AXPSystemStatusType.Suspended,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.restore',
+            },
+            {
+                from: AXPSystemStatusType.Active,
+                to: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.transitions.disable',
+            },
+            {
+                from: AXPSystemStatusType.Inactive,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.enable',
+            },
+            {
+                from: AXPSystemStatusType.Suspended,
+                to: AXPSystemStatusType.Inactive,
+                title: '@security-management:users.entities.user.transitions.disable',
+            },
+            {
+                from: AXPSystemStatusType.Active,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Suspended,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Inactive,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Pending,
+                to: AXPSystemStatusType.Archived,
+                title: '@security-management:users.entities.user.transitions.archive',
+            },
+            {
+                from: AXPSystemStatusType.Archived,
+                to: AXPSystemStatusType.Active,
+                title: '@security-management:users.entities.user.transitions.restore-archived',
+            },
+        ];
+    }
+}
+//#endregion
+
 class AXMMenuProvider {
     constructor() {
         this.entityService = inject(AXPEntityService);
@@ -2521,106 +2911,6 @@ const AXPSessionTerminateWorkflow = {
     },
 };
 
-//#region ----   Imports   ----
-//#endregion
-//#region ----   User account status provider   ----
-/**
- * Account-level status for SecurityManagement.User (lifecycle / admin).
- * Auth lockout is expressed as `authenticationState === blocked`, not as a `statusId`.
- */
-class AXMUserStatusProvider extends AXPStatusProvider {
-    constructor() {
-        super(...arguments);
-        this.key = 'security-management.status.user';
-        this.defaultStatus = AXPSystemStatusType.Active;
-        this.statuses = [
-            systemStatusToDefinition(AXPSystemStatusType.Pending, {
-                title: '@security-management:users.entities.user.states.pending',
-                generateView: true,
-            }),
-            systemStatusToDefinition(AXPSystemStatusType.Active, {
-                title: '@security-management:users.entities.user.states.active',
-                generateView: true,
-            }),
-            systemStatusToDefinition(AXPSystemStatusType.Suspended, {
-                title: '@security-management:users.entities.user.states.suspended',
-                generateView: true,
-            }),
-            systemStatusToDefinition(AXPSystemStatusType.Inactive, {
-                title: '@security-management:users.entities.user.states.inactive',
-                generateView: true,
-            }),
-            systemStatusToDefinition(AXPSystemStatusType.Archived, {
-                title: '@security-management:users.entities.user.states.archived',
-                generateView: true,
-            }),
-        ];
-        this.transitions = [
-            {
-                from: AXPSystemStatusType.Pending,
-                to: AXPSystemStatusType.Active,
-                title: '@security-management:users.entities.user.transitions.activate',
-            },
-            {
-                from: AXPSystemStatusType.Pending,
-                to: AXPSystemStatusType.Inactive,
-                title: '@security-management:users.entities.user.transitions.cancel-invitation',
-            },
-            {
-                from: AXPSystemStatusType.Active,
-                to: AXPSystemStatusType.Suspended,
-                title: '@security-management:users.entities.user.transitions.suspend',
-            },
-            {
-                from: AXPSystemStatusType.Suspended,
-                to: AXPSystemStatusType.Active,
-                title: '@security-management:users.entities.user.transitions.restore',
-            },
-            {
-                from: AXPSystemStatusType.Active,
-                to: AXPSystemStatusType.Inactive,
-                title: '@security-management:users.entities.user.transitions.disable',
-            },
-            {
-                from: AXPSystemStatusType.Inactive,
-                to: AXPSystemStatusType.Active,
-                title: '@security-management:users.entities.user.transitions.enable',
-            },
-            {
-                from: AXPSystemStatusType.Suspended,
-                to: AXPSystemStatusType.Inactive,
-                title: '@security-management:users.entities.user.transitions.disable',
-            },
-            {
-                from: AXPSystemStatusType.Active,
-                to: AXPSystemStatusType.Archived,
-                title: '@security-management:users.entities.user.transitions.archive',
-            },
-            {
-                from: AXPSystemStatusType.Suspended,
-                to: AXPSystemStatusType.Archived,
-                title: '@security-management:users.entities.user.transitions.archive',
-            },
-            {
-                from: AXPSystemStatusType.Inactive,
-                to: AXPSystemStatusType.Archived,
-                title: '@security-management:users.entities.user.transitions.archive',
-            },
-            {
-                from: AXPSystemStatusType.Pending,
-                to: AXPSystemStatusType.Archived,
-                title: '@security-management:users.entities.user.transitions.archive',
-            },
-            {
-                from: AXPSystemStatusType.Archived,
-                to: AXPSystemStatusType.Active,
-                title: '@security-management:users.entities.user.transitions.restore-archived',
-            },
-        ];
-    }
-}
-//#endregion
-
 class AXMSecurityManagementModule {
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXMSecurityManagementModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule }); }
     static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "21.2.9", ngImport: i0, type: AXMSecurityManagementModule, imports: [AXMSecurityManagementDeviceSessionsEntityModule,
@@ -2682,7 +2972,17 @@ class AXMSecurityManagementModule {
             },
             {
                 provide: AXP_STATUS_PROVIDERS,
-                useClass: AXMUserAuthenticationStateProvider,
+                useClass: AXMUserAccessStateProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_STATUS_PROVIDERS,
+                useClass: AXMUserEffectiveStateProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_DATASOURCE_DEFINITION_PROVIDER,
+                useClass: AXMUsersDataSourceDefinition,
                 multi: true,
             },
             provideCommandSetups([
@@ -2781,7 +3081,17 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImpor
                         },
                         {
                             provide: AXP_STATUS_PROVIDERS,
-                            useClass: AXMUserAuthenticationStateProvider,
+                            useClass: AXMUserAccessStateProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_STATUS_PROVIDERS,
+                            useClass: AXMUserEffectiveStateProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_DATASOURCE_DEFINITION_PROVIDER,
+                            useClass: AXMUsersDataSourceDefinition,
                             multi: true,
                         },
                         provideCommandSetups([
@@ -3305,9 +3615,42 @@ var permissionsWidgetColumn_component = /*#__PURE__*/Object.freeze({
 
 // Permission Editor Components
 
+//#region ---- Imports ----
+/**
+ * Derives the unified operational state from account lifecycle and sign-in gate.
+ * Precedence: archived → pending → inactive → suspended → access expired → access blocked → lifecycle active.
+ */
+function resolveAXMUserEffectiveState(input) {
+    const lifecycle = input.accountState;
+    const auth = input.accessState ?? AXMUserAccessState.Allowed;
+    if (lifecycle === AXPSystemStatusType.Archived) {
+        return AXMUserEffectiveState.Archived;
+    }
+    if (lifecycle === AXPSystemStatusType.Pending) {
+        return AXMUserEffectiveState.Pending;
+    }
+    if (lifecycle === AXPSystemStatusType.Inactive) {
+        return AXMUserEffectiveState.Inactive;
+    }
+    if (lifecycle === AXPSystemStatusType.Suspended) {
+        return AXMUserEffectiveState.Suspended;
+    }
+    if (auth === AXMUserAccessState.Expired) {
+        return AXMUserEffectiveState.CredentialExpired;
+    }
+    if (auth === AXMUserAccessState.Blocked) {
+        return AXMUserEffectiveState.SignInBlocked;
+    }
+    if (lifecycle === AXPSystemStatusType.Active) {
+        return AXMUserEffectiveState.Active;
+    }
+    return AXMUserEffectiveState.Active;
+}
+//#endregion
+
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { AXMPermissionsModule, AXMPolicyService, AXMPolicyServiceImpl, AXMSecurityManagementDeviceSessionsEntityModule, AXMSecurityManagementModule, AXMSecurityManagementRolesEntityModule, AXMSecurityManagementRolesEntityService, AXMSecurityManagementRolesEntityServiceImpl, AXMSecurityManagementUsersEntityModule, AXMUserAuthenticationState, AXMUsersEntityService, AXMUsersEntityServiceImpl, AXPPermissionsEditorComponent, AXPPermissionsEditorPopupComponent, AXPPermissionsWidget, AXPPermissionsWidgetColumnComponent, AXPPermissionsWidgetEditComponent, AXPPermissionsWidgetViewComponent, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, RootConfig, deviceSessionsFactory, policyFactory, rolesFactory, usersFactory };
+export { AXMPermissionsModule, AXMPolicyService, AXMPolicyServiceImpl, AXMSecurityManagementDeviceSessionsEntityModule, AXMSecurityManagementModule, AXMSecurityManagementRolesEntityModule, AXMSecurityManagementRolesEntityService, AXMSecurityManagementRolesEntityServiceImpl, AXMSecurityManagementUsersEntityModule, AXMUserAccessState, AXMUserEffectiveState, AXMUsersEntityService, AXMUsersEntityServiceImpl, AXPPermissionsEditorComponent, AXPPermissionsEditorPopupComponent, AXPPermissionsWidget, AXPPermissionsWidgetColumnComponent, AXPPermissionsWidgetEditComponent, AXPPermissionsWidgetViewComponent, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, RootConfig, deviceSessionsFactory, policyFactory, resolveAXMUserEffectiveState, rolesFactory, usersFactory };
 //# sourceMappingURL=acorex-modules-security-management.mjs.map