@acorex/modules 21.0.0-next.75 → 21.0.0-next.76

package/fesm2022/acorex-modules-security-management.mjs

@@ -1,15 +1,16 @@
-import { createAllQueryView, AXPEntityCommandScope, AXPStatusProvider, AXPSystemStatusType, AXPSearchCommandProvider, createEntitySearchCommand, AXPRefreshEvent, AXP_MENU_PROVIDER, AXP_SEARCH_PROVIDER, AXP_STATUS_PROVIDERS } from '@acorex/platform/common';
-import { entityMasterCrudActions, entityMasterRecordActions, AXPEntityService, AXPEntityDefinitionRegistryService, AXP_ENTITY_DEFINITION_LOADER } from '@acorex/platform/layout/entity';
-import { AXPWidgetsCatalog, AXPWidgetGroupEnum, AXPWidgetCoreModule, AXP_WIDGET_DEFINITION_PROVIDER, AXPValueWidgetComponent, AXPColumnWidgetComponent } from '@acorex/platform/layout/widget-core';
-import { statusPlugin, AXPWidgetsList, AXPCommonMenuKeys } from '@acorex/modules/common';
+import { createAllQueryView, AXPEntityCommandScope, entityMasterCrudActions, AXPWidgetsCatalog, entityMasterRecordActions, AXPStatusProvider, AXPSystemStatusType } from '@acorex/platform/contracts';
 import * as i0 from '@angular/core';
 import { Injectable, inject, NgModule, signal, input, output, computed, ViewEncapsulation, Component, ViewChild, effect, ChangeDetectionStrategy } from '@angular/core';
 import { AXPDataGenerator, AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, AXP_MODULE_MANIFEST_PROVIDER, AXP_FEATURE_DEFINITION_PROVIDER, AXP_DATASOURCE_DEFINITION_PROVIDER, AXP_CONTEXT_DEFINITION_PROVIDER } from '@acorex/platform/core';
+import { AXPEntityService, AXPEntityDefinitionRegistryService, AXP_ENTITY_DEFINITION_LOADER } from '@acorex/platform/layout/entity';
 import { AXPSessionService, AXP_PERMISSION_DEFINITION_PROVIDER, AXPPermissionDefinitionService } from '@acorex/platform/auth';
+import { AXPSearchCommandProvider, createEntitySearchCommand, AXPRefreshEvent, AXP_MENU_PROVIDER, AXP_SEARCH_PROVIDER, AXP_STATUS_PROVIDERS } from '@acorex/platform/common';
 import { AXP_USER_AVATAR_PROVIDER, AXPThemeLayoutBlockComponent, AXPStateMessageComponent } from '@acorex/platform/layout/components';
 import { provideCommandSetups } from '@acorex/platform/runtime';
 import * as i1 from '@acorex/platform/workflow';
 import { AXPWorkflowAction, AXPWorkflowModule, createWorkFlowEvent, AXPWorkflowService } from '@acorex/platform/workflow';
+import { AXPWidgetsList, AXPCommonMenuKeys } from '@acorex/modules/common';
+import { AXPWidgetGroupEnum, AXPWidgetCoreModule, AXP_WIDGET_DEFINITION_PROVIDER, AXPWidgetsCatalog as AXPWidgetsCatalog$1, AXPValueWidgetComponent, AXPColumnWidgetComponent } from '@acorex/platform/layout/widget-core';
 import { AXPopupService } from '@acorex/components/popup';
 import * as i8 from '@acorex/core/translation';
 import { AXTranslationService, AXTranslationModule } from '@acorex/core/translation';
@@ -84,6 +85,105 @@ const RootConfig = {
     },
 };
 
+//#region ---- Datasource keys ----
+/** Security Management datasource registry names. */
+const AXMSecurityManagementDataSourceKeys = {
+    Users: 'users',
+};
+//#endregion
+
+//#region ----   Feature Keys   ----
+/**
+ * Security Management Module Feature Keys.
+ * Defines all available features for the Security Management module.
+ */
+const AXPSecurityManagementFeatureKeys = {
+    ManageRoles: 'SecurityManagement:Feature:ManageRoles',
+    ManageUsers: 'SecurityManagement:Feature:ManageUsers',
+    MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',
+    ManageSessions: 'SecurityManagement:Feature:ManageSessions',
+    ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',
+};
+//#endregion
+
+const AXPSecurityManagementMenuKeys = {
+    Root: 'SecurityManagement:Menu',
+    Users: 'SecurityManagement:Menu:Users',
+    Roles: 'SecurityManagement:Menu:Roles',
+    DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',
+    Policy: 'SecurityManagement:Menu:Policy',
+    MyProfile: 'SecurityManagement:Menu:MyProfile',
+};
+
+//#region ----   Permission Keys   ----
+const AXPSecurityManagementPermissionKeys = {
+    User: {
+        Management: 'SecurityManagement:Permission:User.Management',
+        View: 'SecurityManagement:Permission:User.View',
+        Edit: 'SecurityManagement:Permission:User.Edit',
+        Delete: 'SecurityManagement:Permission:User.Delete',
+        Create: 'SecurityManagement:Permission:User.Create',
+    },
+    Role: {
+        Management: 'SecurityManagement:Permission:Role.Management',
+        View: 'SecurityManagement:Permission:Role.View',
+        Edit: 'SecurityManagement:Permission:Role.Edit',
+        Delete: 'SecurityManagement:Permission:Role.Delete',
+        Create: 'SecurityManagement:Permission:Role.Create',
+    },
+    DeviceSession: {
+        Management: 'SecurityManagement:Permission:DeviceSession.Management',
+        View: 'SecurityManagement:Permission:DeviceSession.View',
+        Terminate: 'SecurityManagement:Permission:DeviceSession.Terminate',
+    },
+    Policy: {
+        Management: 'SecurityManagement:Permission:Policy.Management',
+        View: 'SecurityManagement:Permission:Policy.View',
+        Edit: 'SecurityManagement:Permission:Policy.Edit',
+        Delete: 'SecurityManagement:Permission:Policy.Delete',
+        Create: 'SecurityManagement:Permission:Policy.Create',
+    },
+};
+//#endregion
+
+/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */
+const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';
+
+/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */
+const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';
+
+//#region ---- User access state ----
+/**
+ * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).
+ * Persisted as the enum string value (e.g. `allowed`).
+ */
+var AXMUserAccessState;
+(function (AXMUserAccessState) {
+    AXMUserAccessState["Allowed"] = "allowed";
+    AXMUserAccessState["Blocked"] = "blocked";
+    AXMUserAccessState["Expired"] = "expired";
+})(AXMUserAccessState || (AXMUserAccessState = {}));
+//#endregion
+
+//#region ---- User effective (unified) state ----
+/**
+ * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).
+ */
+var AXMUserEffectiveState;
+(function (AXMUserEffectiveState) {
+    AXMUserEffectiveState["Pending"] = "pending";
+    AXMUserEffectiveState["Active"] = "active";
+    AXMUserEffectiveState["Suspended"] = "suspended";
+    AXMUserEffectiveState["Inactive"] = "inactive";
+    AXMUserEffectiveState["Archived"] = "archived";
+    AXMUserEffectiveState["SignInBlocked"] = "sign-in-blocked";
+    AXMUserEffectiveState["CredentialExpired"] = "credential-expired";
+})(AXMUserEffectiveState || (AXMUserEffectiveState = {}));
+//#endregion
+
+//#region ---- Contracts barrel ----
+//#endregion
+
 async function deviceSessionsFactory() {
     const i18n = RootConfig.config.i18n;
     const entityDef = {
@@ -563,11 +663,6 @@ async function deviceSessionsFactory() {
     return entityDef;
 }
 
-var deviceSessions_entity = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    deviceSessionsFactory: deviceSessionsFactory
-});
-
 var AXMSessionStatusTypes;
 (function (AXMSessionStatusTypes) {
     AXMSessionStatusTypes["revoked"] = "revoked";
@@ -575,6 +670,12 @@ var AXMSessionStatusTypes;
     AXMSessionStatusTypes["active"] = "active";
 })(AXMSessionStatusTypes || (AXMSessionStatusTypes = {}));
 
+var index$4 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    get AXMSessionStatusTypes () { return AXMSessionStatusTypes; },
+    deviceSessionsFactory: deviceSessionsFactory
+});
+
 async function policyFactory() {
     const i18n = RootConfig.config.i18n;
     const entityDef = {
@@ -777,11 +878,6 @@ async function policyFactory() {
     return entityDef;
 }
 
-var policy_entity = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    policyFactory: policyFactory
-});
-
 // const glocbal_readonly_policy = {
 //   name: 'readonly',
 //   resource: {
@@ -823,6 +919,177 @@ var policy_entity = /*#__PURE__*/Object.freeze({
 //   ],
 // } as AXMSecurityManagementPolicyEntityModel;
 
+var index$3 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    policyFactory: policyFactory
+});
+
+async function profileFactory() {
+    const i18n = RootConfig.config.i18n;
+    const entityDef = {
+        module: RootConfig.module.name,
+        name: RootConfig.entities.profile.name,
+        title: RootConfig.entities.profile.title,
+        icon: RootConfig.entities.profile.icon,
+        formats: {
+            individual: RootConfig.entities.profile.title,
+            plural: RootConfig.entities.profile.titlePlural,
+        },
+        plugins: [
+            { name: 'history' },
+            { name: 'lock' },
+            { name: 'compare' },
+            { name: 'archive' },
+        ],
+        relatedEntities: [],
+        groups: [
+            {
+                id: 'basic-info',
+                title: `@general:terms.interface.basic-info`,
+            },
+            {
+                id: 'contact',
+                title: `@${i18n}:contactInformation`,
+            },
+            {
+                id: 'address',
+                title: `@${i18n}:addressInformation`,
+            },
+        ],
+        properties: [
+            {
+                name: 'id',
+                title: "@general:terms.common.id",
+                groupId: 'basic-info',
+                schema: {
+                    dataType: 'string',
+                    interface: {
+                        type: AXPWidgetsCatalog.text,
+                        options: { readOnly: true },
+                    },
+                },
+            },
+            {
+                name: 'username',
+                title: "@general:terms.contact.username",
+                groupId: 'basic-info',
+                schema: {
+                    dataType: 'string',
+                    interface: {
+                        type: AXPWidgetsCatalog.text,
+                    },
+                },
+                validations: [{ rule: 'required' }],
+            },
+            {
+                name: 'firstName',
+                title: "@general:terms.contact.first-name",
+                groupId: 'basic-info',
+                schema: {
+                    dataType: 'string',
+                    interface: {
+                        type: AXPWidgetsCatalog.text,
+                    },
+                },
+                validations: [{ rule: 'required' }],
+            },
+            {
+                name: 'lastName',
+                title: "@general:terms.contact.last-name",
+                groupId: 'basic-info',
+                schema: {
+                    dataType: 'string',
+                    interface: {
+                        type: AXPWidgetsCatalog.text,
+                    },
+                },
+                validations: [{ rule: 'required' }],
+            },
+            {
+                name: 'nationalCode',
+                title: "@security-management:profile.entities.profile.fields.national-code.title",
+                groupId: 'basic-info',
+                schema: {
+                    dataType: 'string',
+                    interface: {
+                        type: AXPWidgetsCatalog.text,
+                    },
+                },
+                validations: [
+                    { rule: 'required' },
+                    { rule: 'minLength', options: { value: 10 } },
+                    { rule: 'maxLength', options: { value: 10 } },
+                ],
+            },
+            {
+                name: 'password',
+                title: "@security-management:profile.entities.profile.fields.password.title",
+                groupId: 'basic-info',
+                schema: {
+                    dataType: 'string',
+                    interface: {
+                        type: AXPWidgetsCatalog.password,
+                    },
+                },
+                validations: [{ rule: 'required' }],
+            },
+        ],
+        columns: [],
+        //TODO dd
+        interfaces: {
+            master: {
+                create: {
+                    sections: [{ id: 'info' }],
+                    properties: [
+                        { name: 'id' },
+                        { name: 'username' },
+                        { name: 'firstName' },
+                        { name: 'lastName' },
+                        { name: 'nationalCode' },
+                        { name: 'password' },
+                    ],
+                },
+                update: {
+                    sections: [{ id: 'info' }],
+                    properties: [
+                        { name: 'id' },
+                        { name: 'username' },
+                        { name: 'firstName' },
+                        { name: 'lastName' },
+                        { name: 'nationalCode' },
+                        { name: 'password' },
+                    ],
+                },
+                single: {
+                    title: '{{ context.eval("firstName") + " " + context.eval("lastName") }}',
+                    sections: [{ id: 'info' }],
+                    properties: [
+                        { name: 'id' },
+                        { name: 'username' },
+                        { name: 'firstName' },
+                        { name: 'lastName' },
+                        { name: 'nationalCode' },
+                        { name: 'password' },
+                    ],
+                    actions: [...entityMasterRecordActions()],
+                },
+                list: {
+                    actions: [
+                        ...entityMasterCrudActions(),
+                    ],
+                    views: [createAllQueryView()],
+                },
+            },
+        },
+    };
+    return entityDef;
+}
+
+var index$2 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    profileFactory: profileFactory
+});
+
 async function rolesFactory() {
     const i18n = RootConfig.config.i18n;
     const entityDef = {
@@ -1072,218 +1339,29 @@ async function rolesFactory() {
                     ],
                     actions: [...entityMasterRecordActions()],
                 },
-                list: {
-                    actions: [
-                        ...entityMasterCrudActions(),
-                        {
-                            title: `@${i18n}:permissions-feature.actions.assign.title`,
-                            command: 'assign-permissions',
-                            priority: 'secondary',
-                            type: 'view',
-                            scope: AXPEntityCommandScope.Individual,
-                        },
-                    ],
-                    views: [createAllQueryView()],
-                },
-            },
-        },
-    };
-    return entityDef;
-}
-
-var roles_entity = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    rolesFactory: rolesFactory
-});
-
-//#region ---- User access state ----
-/**
- * Read-only sign-in gate from the authentication layer (distinct from account `accountState`).
- * Persisted as the enum string value (e.g. `allowed`).
- */
-var AXMUserAccessState;
-(function (AXMUserAccessState) {
-    AXMUserAccessState["Allowed"] = "allowed";
-    AXMUserAccessState["Blocked"] = "blocked";
-    AXMUserAccessState["Expired"] = "expired";
-})(AXMUserAccessState || (AXMUserAccessState = {}));
-//#endregion
-
-//#region ---- User effective (unified) state ----
-/**
- * Single operational state derived from account lifecycle and sign-in gate (persisted snapshot in mock/backend).
- */
-var AXMUserEffectiveState;
-(function (AXMUserEffectiveState) {
-    AXMUserEffectiveState["Pending"] = "pending";
-    AXMUserEffectiveState["Active"] = "active";
-    AXMUserEffectiveState["Suspended"] = "suspended";
-    AXMUserEffectiveState["Inactive"] = "inactive";
-    AXMUserEffectiveState["Archived"] = "archived";
-    AXMUserEffectiveState["SignInBlocked"] = "sign-in-blocked";
-    AXMUserEffectiveState["CredentialExpired"] = "credential-expired";
-})(AXMUserEffectiveState || (AXMUserEffectiveState = {}));
-//#endregion
-
-//#region ---- Imports ----
-//#endregion
-//#region ---- Definition key ----
-/** Status provider key for `accessState` on SecurityManagement.User (transitions define editable paths in the status UI). */
-const AXM_USER_ACCESS_STATE_DEFINITION_KEY = 'security-management.access-state.user';
-//#endregion
-//#region ---- User access state provider ----
-/**
- * Sign-in readiness from the authentication subsystem (distinct from account lifecycle / `accountState`).
- * Transitions listed here are the only paths offered in the status UI and validated when executing a status change command.
- */
-class AXMUserAccessStateProvider extends AXPStatusProvider {
-    constructor() {
-        super(...arguments);
-        this.key = AXM_USER_ACCESS_STATE_DEFINITION_KEY;
-        this.defaultStatus = AXMUserAccessState.Allowed;
-        this.statuses = [
-            {
-                name: AXMUserAccessState.Allowed,
-                title: '@security-management:users.entities.user.access.states.allowed',
-                description: '@security-management:users.entities.user.access.descriptions.allowed',
-                icon: 'fa-light fa-circle-check',
-                color: 'success',
-                order: 1,
-                isInitial: true,
-                isFinal: false,
-            },
-            {
-                name: AXMUserAccessState.Blocked,
-                title: '@security-management:users.entities.user.access.states.blocked',
-                description: '@security-management:users.entities.user.access.descriptions.blocked',
-                icon: 'fa-light fa-ban',
-                color: 'danger',
-                order: 2,
-                isInitial: false,
-                isFinal: false,
-            },
-            {
-                name: AXMUserAccessState.Expired,
-                title: '@security-management:users.entities.user.access.states.expired',
-                description: '@security-management:users.entities.user.access.descriptions.expired',
-                icon: 'fa-light fa-clock',
-                color: 'danger',
-                order: 3,
-                isInitial: false,
-                isFinal: true,
-                generateView: false,
-            },
-        ];
-        this.transitions = [
-            {
-                from: AXMUserAccessState.Allowed,
-                to: AXMUserAccessState.Blocked,
-                title: '@security-management:users.entities.user.access.transitions.block-sign-in',
-            },
-            {
-                from: AXMUserAccessState.Allowed,
-                to: AXMUserAccessState.Expired,
-                title: '@security-management:users.entities.user.access.transitions.require-credential-renewal',
-            },
-            {
-                from: AXMUserAccessState.Blocked,
-                to: AXMUserAccessState.Allowed,
-                title: '@security-management:users.entities.user.access.transitions.unblock-sign-in',
-            },
-            {
-                from: AXMUserAccessState.Expired,
-                to: AXMUserAccessState.Allowed,
-                title: '@security-management:users.entities.user.access.transitions.restore-after-credential-renewal',
-            },
-        ];
-    }
-}
-//#endregion
-
-//#region ---- Imports ----
-//#endregion
-//#region ---- Definition key ----
-/** Status provider key for persisted `effectiveState` on SecurityManagement.User (derived; read-only in UI). */
-const AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY = 'security-management.effective-state.user';
-//#endregion
-//#region ---- User effective state provider ----
-/**
- * Unified operational state for lists, filters, and page chrome (derived from lifecycle + sign-in gate).
- */
-class AXMUserEffectiveStateProvider extends AXPStatusProvider {
-    constructor() {
-        super(...arguments);
-        this.key = AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY;
-        this.defaultStatus = AXMUserEffectiveState.Active;
-        this.statuses = [
-            {
-                name: AXMUserEffectiveState.Pending,
-                title: '@security-management:users.entities.user.effective.states.pending',
-                description: '@security-management:users.entities.user.effective.descriptions.pending',
-                icon: 'fa-light fa-hourglass-half',
-                color: 'warning',
-                order: 1,
-                generateView: true,
-            },
-            {
-                name: AXMUserEffectiveState.Active,
-                title: '@security-management:users.entities.user.effective.states.active',
-                description: '@security-management:users.entities.user.effective.descriptions.active',
-                icon: 'fa-light fa-circle-check',
-                color: 'success',
-                order: 2,
-                generateView: true,
-            },
-            {
-                name: AXMUserEffectiveState.SignInBlocked,
-                title: '@security-management:users.entities.user.effective.states.sign-in-blocked',
-                description: '@security-management:users.entities.user.effective.descriptions.sign-in-blocked',
-                icon: 'fa-light fa-shield-halved',
-                color: 'danger',
-                order: 3,
-                generateView: true,
-            },
-            {
-                name: AXMUserEffectiveState.CredentialExpired,
-                title: '@security-management:users.entities.user.effective.states.credential-expired',
-                description: '@security-management:users.entities.user.effective.descriptions.credential-expired',
-                icon: 'fa-light fa-key',
-                color: 'danger',
-                order: 4,
-                generateView: true,
-            },
-            {
-                name: AXMUserEffectiveState.Suspended,
-                title: '@security-management:users.entities.user.effective.states.suspended',
-                description: '@security-management:users.entities.user.effective.descriptions.suspended',
-                icon: 'fa-light fa-pause-circle',
-                color: 'warning',
-                order: 5,
-                generateView: true,
-            },
-            {
-                name: AXMUserEffectiveState.Inactive,
-                title: '@security-management:users.entities.user.effective.states.inactive',
-                description: '@security-management:users.entities.user.effective.descriptions.inactive',
-                icon: 'fa-light fa-user-slash',
-                color: 'danger',
-                order: 6,
-                generateView: true,
-            },
-            {
-                name: AXMUserEffectiveState.Archived,
-                title: '@security-management:users.entities.user.effective.states.archived',
-                description: '@security-management:users.entities.user.effective.descriptions.archived',
-                icon: 'fa-light fa-box-archive',
-                color: 'danger',
-                order: 7,
-                generateView: true,
+                list: {
+                    actions: [
+                        ...entityMasterCrudActions(),
+                        {
+                            title: `@${i18n}:permissions-feature.actions.assign.title`,
+                            command: 'assign-permissions',
+                            priority: 'secondary',
+                            type: 'view',
+                            scope: AXPEntityCommandScope.Individual,
+                        },
+                    ],
+                    views: [createAllQueryView()],
+                },
             },
-        ];
-        this.transitions = [];
-    }
+        },
+    };
+    return entityDef;
 }
-//#endregion
+
+var index$1 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    rolesFactory: rolesFactory
+});
 
 async function usersFactory() {
     const i18n = RootConfig.config.i18n;
@@ -1302,7 +1380,7 @@ async function usersFactory() {
         },
         plugins: [
             {
-                ...statusPlugin,
+                name: 'status',
                 options: {
                     definition: 'security-management.account-state.user',
                     field: 'accountState',
@@ -1314,7 +1392,7 @@ async function usersFactory() {
                 },
             },
             {
-                ...statusPlugin,
+                name: 'status',
                 options: {
                     field: 'accessState',
                     definition: AXM_USER_ACCESS_STATE_DEFINITION_KEY,
@@ -1327,7 +1405,7 @@ async function usersFactory() {
                 },
             },
             {
-                ...statusPlugin,
+                name: 'status',
                 options: {
                     field: 'effectiveState',
                     definition: AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY,
@@ -1766,7 +1844,7 @@ async function usersFactory() {
     return entityDef;
 }
 
-var users_entity = /*#__PURE__*/Object.freeze({
+var index = /*#__PURE__*/Object.freeze({
     __proto__: null,
     usersFactory: usersFactory
 });
@@ -1784,70 +1862,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImpor
             type: Injectable
         }] });
 
-//#region ---- Datasource keys ----
-/** Security Management datasource registry names. */
-const AXMSecurityManagementDataSourceKeys = {
-    Users: 'users',
-};
-//#endregion
-
-//#region ----   Feature Keys   ----
-/**
- * Security Management Module Feature Keys.
- * Defines all available features for the Security Management module.
- */
-const AXPSecurityManagementFeatureKeys = {
-    ManageRoles: 'SecurityManagement:Feature:ManageRoles',
-    ManageUsers: 'SecurityManagement:Feature:ManageUsers',
-    MaxTotalUsers: 'SecurityManagement:Feature:MaxTotalUsers',
-    ManageSessions: 'SecurityManagement:Feature:ManageSessions',
-    ManagePolicies: 'SecurityManagement:Feature:ManagePolicies',
-};
-//#endregion
-
-const AXPSecurityManagementMenuKeys = {
-    Root: 'SecurityManagement:Menu',
-    Users: 'SecurityManagement:Menu:Users',
-    Roles: 'SecurityManagement:Menu:Roles',
-    DeviceSessions: 'SecurityManagement:Menu:DeviceSessions',
-    Policy: 'SecurityManagement:Menu:Policy',
-    MyProfile: 'SecurityManagement:Menu:MyProfile',
-};
-
-//#region ----   Permission Keys   ----
-const AXPSecurityManagementPermissionKeys = {
-    User: {
-        Management: 'SecurityManagement:Permission:User.Management',
-        View: 'SecurityManagement:Permission:User.View',
-        Edit: 'SecurityManagement:Permission:User.Edit',
-        Delete: 'SecurityManagement:Permission:User.Delete',
-        Create: 'SecurityManagement:Permission:User.Create',
-    },
-    Role: {
-        Management: 'SecurityManagement:Permission:Role.Management',
-        View: 'SecurityManagement:Permission:Role.View',
-        Edit: 'SecurityManagement:Permission:Role.Edit',
-        Delete: 'SecurityManagement:Permission:Role.Delete',
-        Create: 'SecurityManagement:Permission:Role.Create',
-    },
-    DeviceSession: {
-        Management: 'SecurityManagement:Permission:DeviceSession.Management',
-        View: 'SecurityManagement:Permission:DeviceSession.View',
-        Terminate: 'SecurityManagement:Permission:DeviceSession.Terminate',
-    },
-    Policy: {
-        Management: 'SecurityManagement:Permission:Policy.Management',
-        View: 'SecurityManagement:Permission:Policy.View',
-        Edit: 'SecurityManagement:Permission:Policy.Edit',
-        Delete: 'SecurityManagement:Permission:Policy.Delete',
-        Create: 'SecurityManagement:Permission:Policy.Create',
-    },
-};
-//#endregion
-
-//#region ---- Contracts barrel ----
-//#endregion
-
 //#region ----   Imports   ----
 //#endregion
 //#region ----   Manifest Definition   ----
@@ -1879,15 +1893,15 @@ class AXMEntityProvider {
         if (moduleName == module.name) {
             switch (entityName) {
                 case RootConfig.entities.users.name:
-                    return (await Promise.resolve().then(function () { return users_entity; })).usersFactory();
+                    return (await Promise.resolve().then(function () { return index; })).usersFactory();
                 case RootConfig.entities.roles.name:
-                    return (await Promise.resolve().then(function () { return roles_entity; })).rolesFactory();
+                    return (await Promise.resolve().then(function () { return index$1; })).rolesFactory();
                 case RootConfig.entities.profile.name:
-                    return (await import('./acorex-modules-security-management-profile.entity-BSDeLsJ1.mjs')).profileFactory();
+                    return (await Promise.resolve().then(function () { return index$2; })).profileFactory();
                 case RootConfig.entities.deviceSessions.name:
-                    return (await Promise.resolve().then(function () { return deviceSessions_entity; })).deviceSessionsFactory();
+                    return (await Promise.resolve().then(function () { return index$4; })).deviceSessionsFactory();
                 case RootConfig.entities.policy.name:
-                    return (await Promise.resolve().then(function () { return policy_entity; })).policyFactory();
+                    return (await Promise.resolve().then(function () { return index$3; })).policyFactory();
             }
         }
         return null;
@@ -2174,19 +2188,19 @@ class AXMUsersDataSourceDefinition {
                         name: 'id',
                         title: 'ID',
                         datatype: 'uuid',
-                        type: AXPWidgetsCatalog.text,
+                        type: AXPWidgetsCatalog$1.text,
                     },
                     {
                         name: 'displayName',
                         title: `Display Name`,
                         datatype: 'string',
-                        type: AXPWidgetsCatalog.text,
+                        type: AXPWidgetsCatalog$1.text,
                     },
                     {
                         name: 'username',
                         title: `Username`,
                         datatype: 'string',
-                        type: AXPWidgetsCatalog.text,
+                        type: AXPWidgetsCatalog$1.text,
                     },
                 ],
                 filters: [
@@ -2197,7 +2211,7 @@ class AXMUsersDataSourceDefinition {
                             type: 'equal',
                         },
                         widget: {
-                            type: AXPWidgetsCatalog.text,
+                            type: AXPWidgetsCatalog$1.text,
                         },
                         filterType: {
                             advance: true,
@@ -2218,6 +2232,158 @@ class AXMUsersDataSourceDefinition {
     }
 }
 
+//#region ---- Imports ----
+//#endregion
+//#region ---- User access state provider ----
+/**
+ * Sign-in readiness from the authentication subsystem (distinct from account lifecycle / `accountState`).
+ * Transitions listed here are the only paths offered in the status UI and validated when executing a status change command.
+ */
+class AXMUserAccessStateProvider extends AXPStatusProvider {
+    constructor() {
+        super(...arguments);
+        this.key = AXM_USER_ACCESS_STATE_DEFINITION_KEY;
+        this.defaultStatus = AXMUserAccessState.Allowed;
+        this.statuses = [
+            {
+                name: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.states.allowed',
+                description: '@security-management:users.entities.user.access.descriptions.allowed',
+                icon: 'fa-light fa-circle-check',
+                color: 'success',
+                order: 1,
+                isInitial: true,
+                isFinal: false,
+            },
+            {
+                name: AXMUserAccessState.Blocked,
+                title: '@security-management:users.entities.user.access.states.blocked',
+                description: '@security-management:users.entities.user.access.descriptions.blocked',
+                icon: 'fa-light fa-ban',
+                color: 'danger',
+                order: 2,
+                isInitial: false,
+                isFinal: false,
+            },
+            {
+                name: AXMUserAccessState.Expired,
+                title: '@security-management:users.entities.user.access.states.expired',
+                description: '@security-management:users.entities.user.access.descriptions.expired',
+                icon: 'fa-light fa-clock',
+                color: 'danger',
+                order: 3,
+                isInitial: false,
+                isFinal: true,
+                generateView: false,
+            },
+        ];
+        this.transitions = [
+            {
+                from: AXMUserAccessState.Allowed,
+                to: AXMUserAccessState.Blocked,
+                title: '@security-management:users.entities.user.access.transitions.block-sign-in',
+            },
+            {
+                from: AXMUserAccessState.Allowed,
+                to: AXMUserAccessState.Expired,
+                title: '@security-management:users.entities.user.access.transitions.require-credential-renewal',
+            },
+            {
+                from: AXMUserAccessState.Blocked,
+                to: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.transitions.unblock-sign-in',
+            },
+            {
+                from: AXMUserAccessState.Expired,
+                to: AXMUserAccessState.Allowed,
+                title: '@security-management:users.entities.user.access.transitions.restore-after-credential-renewal',
+            },
+        ];
+    }
+}
+//#endregion
+
+//#region ---- Imports ----
+//#endregion
+//#region ---- User effective state provider ----
+/**
+ * Unified operational state for lists, filters, and page chrome (derived from lifecycle + sign-in gate).
+ */
+class AXMUserEffectiveStateProvider extends AXPStatusProvider {
+    constructor() {
+        super(...arguments);
+        this.key = AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY;
+        this.defaultStatus = AXMUserEffectiveState.Active;
+        this.statuses = [
+            {
+                name: AXMUserEffectiveState.Pending,
+                title: '@security-management:users.entities.user.effective.states.pending',
+                description: '@security-management:users.entities.user.effective.descriptions.pending',
+                icon: 'fa-light fa-hourglass-half',
+                color: 'warning',
+                order: 1,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Active,
+                title: '@security-management:users.entities.user.effective.states.active',
+                description: '@security-management:users.entities.user.effective.descriptions.active',
+                icon: 'fa-light fa-circle-check',
+                color: 'success',
+                order: 2,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.SignInBlocked,
+                title: '@security-management:users.entities.user.effective.states.sign-in-blocked',
+                description: '@security-management:users.entities.user.effective.descriptions.sign-in-blocked',
+                icon: 'fa-light fa-shield-halved',
+                color: 'danger',
+                order: 3,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.CredentialExpired,
+                title: '@security-management:users.entities.user.effective.states.credential-expired',
+                description: '@security-management:users.entities.user.effective.descriptions.credential-expired',
+                icon: 'fa-light fa-key',
+                color: 'danger',
+                order: 4,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Suspended,
+                title: '@security-management:users.entities.user.effective.states.suspended',
+                description: '@security-management:users.entities.user.effective.descriptions.suspended',
+                icon: 'fa-light fa-pause-circle',
+                color: 'warning',
+                order: 5,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Inactive,
+                title: '@security-management:users.entities.user.effective.states.inactive',
+                description: '@security-management:users.entities.user.effective.descriptions.inactive',
+                icon: 'fa-light fa-user-slash',
+                color: 'danger',
+                order: 6,
+                generateView: true,
+            },
+            {
+                name: AXMUserEffectiveState.Archived,
+                title: '@security-management:users.entities.user.effective.states.archived',
+                description: '@security-management:users.entities.user.effective.descriptions.archived',
+                icon: 'fa-light fa-box-archive',
+                color: 'danger',
+                order: 7,
+                generateView: true,
+            },
+        ];
+        this.transitions = [];
+    }
+}
+//#endregion
+
 //#region ----   Imports   ----
 //#endregion
 //#region ----   User account status provider   ----
@@ -3384,42 +3550,9 @@ var permissionsWidgetColumn_component = /*#__PURE__*/Object.freeze({
 
 // Permission Editor Components
 
-//#region ---- Imports ----
-/**
- * Derives the unified operational state from account lifecycle and sign-in gate.
- * Precedence: archived → pending → inactive → suspended → access expired → access blocked → lifecycle active.
- */
-function resolveAXMUserEffectiveState(input) {
-    const lifecycle = input.accountState;
-    const auth = input.accessState ?? AXMUserAccessState.Allowed;
-    if (lifecycle === AXPSystemStatusType.Archived) {
-        return AXMUserEffectiveState.Archived;
-    }
-    if (lifecycle === AXPSystemStatusType.Pending) {
-        return AXMUserEffectiveState.Pending;
-    }
-    if (lifecycle === AXPSystemStatusType.Inactive) {
-        return AXMUserEffectiveState.Inactive;
-    }
-    if (lifecycle === AXPSystemStatusType.Suspended) {
-        return AXMUserEffectiveState.Suspended;
-    }
-    if (auth === AXMUserAccessState.Expired) {
-        return AXMUserEffectiveState.CredentialExpired;
-    }
-    if (auth === AXMUserAccessState.Blocked) {
-        return AXMUserEffectiveState.SignInBlocked;
-    }
-    if (lifecycle === AXPSystemStatusType.Active) {
-        return AXMUserEffectiveState.Active;
-    }
-    return AXMUserEffectiveState.Active;
-}
-//#endregion
-
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { AXMDeviceSessionsService, AXMPermissionsModule, AXMSecurityManagementDataSourceKeys, AXMSecurityManagementModule, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXPPermissionsEditorComponent, AXPPermissionsEditorPopupComponent, AXPPermissionsWidget, AXPPermissionsWidgetColumnComponent, AXPPermissionsWidgetEditComponent, AXPPermissionsWidgetViewComponent, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, RootConfig, deviceSessionsFactory, policyFactory, resolveAXMUserEffectiveState, rolesFactory, usersFactory };
+export { AXMDeviceSessionsService, AXMPermissionsModule, AXMSecurityManagementDataSourceKeys, AXMSecurityManagementModule, AXMSessionStatusTypes, AXMUserAccessState, AXMUserEffectiveState, AXM_USER_ACCESS_STATE_DEFINITION_KEY, AXM_USER_EFFECTIVE_STATE_DEFINITION_KEY, AXPPermissionsEditorComponent, AXPPermissionsEditorPopupComponent, AXPPermissionsWidget, AXPPermissionsWidgetColumnComponent, AXPPermissionsWidgetEditComponent, AXPPermissionsWidgetViewComponent, AXPSecurityManagementFeatureKeys, AXPSecurityManagementMenuKeys, AXPSecurityManagementPermissionKeys, RootConfig, deviceSessionsFactory, policyFactory, profileFactory, rolesFactory, usersFactory };
 //# sourceMappingURL=acorex-modules-security-management.mjs.map