@acorex/platform 20.6.0-next.8 → 21.0.0-next.0

package/fesm2022/acorex-platform-auth.mjs

@@ -1,8 +1,8 @@
 import * as i0 from '@angular/core';
 import { InjectionToken, Injector, Injectable, signal, inject, Input, Directive, provideAppInitializer, Optional, Inject, NgModule } from '@angular/core';
-import { of, map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, firstValueFrom, first } from 'rxjs';
-import { AXPBroadcastEventService } from '@acorex/platform/core';
+import { AXPBroadcastEventService, AXP_MODULE_PROVIDER_LOADER, AXPModuleProviderRegistry, AXP_SESSION_SERVICE } from '@acorex/platform/core';
 import { isEmpty } from 'lodash-es';
+import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, from, first } from 'rxjs';
 
 const AXP_APPLICATION_LOADER = new InjectionToken('AXP_APPLICATION_LOADER', {
     providedIn: 'root',
@@ -11,25 +11,29 @@ const AXP_APPLICATION_LOADER = new InjectionToken('AXP_APPLICATION_LOADER', {
     },
 });
 class AXPApplicationDefaultLoader {
-    getList(context) {
-        return of([
+    async getList(context) {
+        return [
             {
                 id: '1',
                 name: 'default-app',
                 title: 'Default Application',
                 version: '1.0.0',
-                editionName: 'Standard',
-                features: [],
+                edition: {
+                    id: 'default-edition-1',
+                    title: 'Standard',
+                },
             },
             {
                 id: '2',
                 name: 'default-app',
                 title: 'Default Application',
                 version: '1.0.0',
-                editionName: 'Standard',
-                features: [],
+                edition: {
+                    id: 'default-edition-2',
+                    title: 'Standard',
+                },
             },
-        ]);
+        ];
     }
 }
 
@@ -40,14 +44,14 @@ const AXP_TENANT_LOADER = new InjectionToken('AXP_TENANT_LOADER', {
     },
 });
 class AXPTenantDefaultLoader {
-    getList(context) {
-        return of([
+    async getList(context) {
+        return [
             {
                 id: '1',
                 name: 'default-tenant',
                 title: 'Default Tenant',
             },
-        ]);
+        ];
     }
 }
 
@@ -85,8 +89,8 @@ const AXP_FEATURE_LOADER = new InjectionToken('AXP_FEATURE_LOADER', {
     },
 });
 class AXPFeatureDefaultLoader {
-    getList(context) {
-        return of([]);
+    async getList(context) {
+        return [];
     }
 }
 
@@ -173,6 +177,13 @@ const AXPFeatureGuard = (route, state) => {
     }));
 };
 
+/**
+ * Optional injection token for feature checker.
+ * If provided, the checker will be called to potentially override
+ * feature enablement results based on custom logic.
+ */
+const AXP_FEATURE_CHECKER = new InjectionToken('AXP_FEATURE_CHECKER');
+
 const AXP_PERMISSION_LOADER = new InjectionToken('AXP_PERMISSION_LOADER', {
     providedIn: 'root',
     factory: () => {
@@ -180,11 +191,18 @@ const AXP_PERMISSION_LOADER = new InjectionToken('AXP_PERMISSION_LOADER', {
     }
 });
 class AXPPermissionDefaultLoader {
-    getList(context) {
-        return of([]);
+    async getList(context) {
+        return [];
     }
 }
 
+/**
+ * Optional injection token for permission checker.
+ * If provided, the checker will be called to potentially override
+ * authorization results based on custom logic.
+ */
+const AXP_PERMISSION_CHECKER = new InjectionToken('AXP_PERMISSION_CHECKER');
+
 class AXPSessionContext {
     get user() {
         return this._user;
@@ -222,6 +240,9 @@ class AXPSessionService {
         this.featureLoader = inject(AXP_FEATURE_LOADER);
         this.tenantLoader = inject(AXP_TENANT_LOADER);
         this.applicationLoader = inject(AXP_APPLICATION_LOADER);
+        this.moduleProviderLoader = inject(AXP_MODULE_PROVIDER_LOADER);
+        this.permissionChecker = inject(AXP_PERMISSION_CHECKER, { optional: true });
+        this.featureChecker = inject(AXP_FEATURE_CHECKER, { optional: true });
         this.status = new BehaviorSubject(AXPSessionStatus.Unauthenticated);
         this.status$ = this.status.asObservable().pipe(shareReplay(1));
         // Add loading state to prevent premature redirects
@@ -244,8 +265,10 @@ class AXPSessionService {
         // Add a new observable that considers loading state
         this.isAuthenticatedWithLoading$ = this.isLoading$.pipe(switchMap((loading) => {
             if (loading) {
+                // Wait for loading to complete, then return authentication status
                 return this.isLoading$.pipe(filter((isLoading) => !isLoading), switchMap(() => this.isAuthenticated$));
             }
+            // If not loading, return current authentication status
             return this.isAuthenticated$;
         }), shareReplay(1));
         this.isAuthorized$ = this.status$.pipe(map((status) => status === AXPSessionStatus.Authorized), shareReplay(1));
@@ -266,7 +289,7 @@ class AXPSessionService {
         return this.currentTenantSubject.value;
     }
     get tenants$() {
-        return this.tenantLoader.getList(this.getContext());
+        return from(this.tenantLoader.getList(this.getContext()));
     }
     get application() {
         const session = this.getSessionData();
@@ -276,7 +299,7 @@ class AXPSessionService {
         return this.currentApplicationSubject.value;
     }
     get applications$() {
-        return this.applicationLoader.getList(this.getContext());
+        return from(this.applicationLoader.getList(this.getContext()));
     }
     get permissions() {
         return this.permissionsSubject.value ?? [];
@@ -291,7 +314,18 @@ class AXPSessionService {
             if (sessionData) {
                 if (sessionData.user) {
                     this.currentUserSubject.next(sessionData.user);
+                    // Restore tenant and application from session data
+                    if (sessionData.tenant) {
+                        this.currentTenantSubject.next(sessionData.tenant);
+                    }
+                    if (sessionData.application) {
+                        this.currentApplicationSubject.next(sessionData.application);
+                    }
                     this.status.next(AXPSessionStatus.Authenticated);
+                    // Load required modules first to ensure entities are available for loaders
+                    // This is critical because loaders (like application.loader) need entities
+                    // from required modules (ApplicationManagement, TenantManagement, SecurityManagement)
+                    await this.moduleProviderLoader.loadRequiredModules();
                     await this.loadPermissions();
                     await this.loadFeatures();
                     await this.signInComplete();
@@ -409,6 +443,9 @@ class AXPSessionService {
             }
             //
             const userId = this.user?.id;
+            // Clear module provider loader cache before clearing session
+            // This ensures modules and providers from previous user are not cached
+            await this.moduleProviderLoader.clear();
             this.clearSession();
             this.eventService.publish(AXPSessionStatus.SignedOut, { id: userId });
             this.isLoading.next(false);
@@ -457,7 +494,7 @@ class AXPSessionService {
     }
     async loadPermissions() {
         try {
-            const permissions = await firstValueFrom(this.permissionLoader.getList(this.getContext()));
+            const permissions = await this.permissionLoader.getList(this.getContext());
             this.permissionsSubject.next(permissions ?? []);
         }
         catch (error) {
@@ -467,7 +504,7 @@ class AXPSessionService {
     }
     async loadFeatures() {
         try {
-            const features = await firstValueFrom(this.featureLoader.getList(this.getContext()));
+            const features = await this.featureLoader.getList(this.getContext());
             this.featuresSubject.next(features ?? []);
         }
         catch (error) {
@@ -547,26 +584,39 @@ class AXPSessionService {
         localStorage.removeItem(AXPSessionService.SESSION_KEY);
     }
     authorize(...keys) {
-        return keys.every((k) => isEmpty(k) || this.permissions.indexOf(k) > -1 || this.user?.name == 'root');
+        // Calculate base result
+        const baseResult = keys.every((k) => {
+            if (isEmpty(k))
+                return true;
+            // Check if user has the permission
+            const hasPermission = this.permissions.indexOf(k) > -1;
+            if (!hasPermission)
+                return false;
+            // Check if permission has required features (if permission definition service is available)
+            // Note: This is a lightweight check. Full feature validation happens in permission definition service.
+            return true;
+        });
+        // If permission checker is provided, use it to potentially override the result
+        if (this.permissionChecker) {
+            const context = this.getContext();
+            return this.permissionChecker.check(keys, context, baseResult);
+        }
+        return baseResult;
     }
     isFeatureEnabled(...keys) {
-        return keys.every((k) => isEmpty(k) || this.features.some((c) => c.name == k && c.value == true));
+        // Calculate base result
+        const baseResult = keys.every((k) => isEmpty(k) || this.features.some((c) => c.name == k && c.value == true));
+        // If feature checker is provided, use it to potentially override the result
+        if (this.featureChecker) {
+            const context = this.getContext();
+            return this.featureChecker.check(keys, context, baseResult);
+        }
+        return baseResult;
     }
     getToken() {
         const sessionData = this.getSessionData();
         return sessionData?.accessToken;
     }
-    checkTokenValidation() {
-        let sessionData = this.getSessionData();
-        if (sessionData && sessionData?.accessToken && sessionData.expiresIn) {
-            const expiresInDate = new Date(sessionData.expiresIn);
-            if (expiresInDate > new Date()) {
-                // Token is still valid
-                return true;
-            }
-        }
-        return false;
-    }
     getContext() {
         return new AXPSessionContext({
             user: this.user,
@@ -687,12 +737,13 @@ class AXPPermissionDefinitionGroupBuilder {
         this.context = context;
         this._group = group;
     }
-    addPermission(name, title, description) {
+    addPermission(name, title, description, requiredFeatures) {
         const permission = {
             name,
             title,
             description,
-            children: []
+            children: [],
+            requiredFeatures
         };
         this._group.permissions.push(permission);
         return new AXPPermissionDefinitionBuilder(this, permission);
@@ -712,16 +763,25 @@ class AXPPermissionDefinitionBuilder {
         this.groupBuilder = groupBuilder;
         this.permission = permission;
     }
-    addChild(name, title, description) {
+    addChild(name, title, description, requiredFeatures) {
         const permission = {
             name,
             title,
             description,
-            children: []
+            children: [],
+            requiredFeatures
         };
         this.permission.children.push(permission);
         return this;
     }
+    /**
+     * Set required features for this permission.
+     * @param features - Array of feature names (e.g., ['PlatformManagement.menu-customization'])
+     */
+    requireFeatures(...features) {
+        this.permission.requiredFeatures = features;
+        return this;
+    }
     endPermission() {
         return this.groupBuilder;
     }
@@ -736,6 +796,8 @@ const AXP_PERMISSION_DEFINITION_PROVIDER = new InjectionToken('AXP_PERMISSION_DE
 class AXPPermissionDefinitionService {
     constructor() {
         this.providers = inject(AXP_PERMISSION_DEFINITION_PROVIDER, { optional: true });
+        this.providerRegistry = inject(AXPModuleProviderRegistry);
+        this.sessionService = inject(AXPSessionService);
         this.cache = null;
     }
     async load() {
@@ -743,6 +805,7 @@ class AXPPermissionDefinitionService {
             return;
         }
         const context = new AXPPermissionDefinitionProviderContext();
+        // Load providers from DI tokens (backward compatibility)
         if (Array.isArray(this.providers)) {
             for (const provider of this.providers) {
                 if (provider instanceof Promise) {
@@ -756,7 +819,49 @@ class AXPPermissionDefinitionService {
                 }
             }
         }
-        this.cache = context.getGroupDefinitions();
+        // Load providers from registry (manifest-based, conditionally loaded)
+        const registryProviders = this.providerRegistry.getPermissionProviders();
+        for (const provider of registryProviders) {
+            await provider.define(context);
+        }
+        // Filter permissions based on required features
+        const allGroups = context.getGroupDefinitions();
+        this.cache = this.filterByFeatures(allGroups);
+    }
+    /**
+     * Filter permissions based on required features.
+     * Removes permissions that have required features that are not enabled.
+     */
+    filterByFeatures(groups) {
+        return groups.map(group => ({
+            ...group,
+            permissions: this.filterPermissions(group.permissions)
+        })).filter(group => group.permissions.length > 0);
+    }
+    /**
+     * Recursively filter permissions and their children based on required features.
+     */
+    filterPermissions(permissions) {
+        return permissions
+            .filter(permission => {
+            // Check if required features are enabled
+            if (permission.requiredFeatures && permission.requiredFeatures.length > 0) {
+                const allFeaturesEnabled = permission.requiredFeatures.every(featureName => this.sessionService.isFeatureEnabled(featureName));
+                if (!allFeaturesEnabled) {
+                    return false; // Filter out this permission
+                }
+            }
+            return true;
+        })
+            .map(permission => ({
+            ...permission,
+            children: this.filterPermissions(permission.children)
+        }))
+            .filter(permission => {
+            // Remove permissions that have no children if they were only containers
+            // (This is optional - you might want to keep parent permissions even without children)
+            return true;
+        });
     }
     async reload() {
         this.cache = null;
@@ -882,6 +987,10 @@ class AXPAuthModule {
                 const initializerFn = initializeAppState(inject(AXPSessionService));
                 return initializerFn();
             }),
+            {
+                provide: AXP_SESSION_SERVICE,
+                useExisting: AXPSessionService,
+            },
         ] }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.12", ngImport: i0, type: AXPAuthModule, decorators: [{
@@ -895,6 +1004,10 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.12", ngImpo
                             const initializerFn = initializeAppState(inject(AXPSessionService));
                             return initializerFn();
                         }),
+                        {
+                            provide: AXP_SESSION_SERVICE,
+                            useExisting: AXPSessionService,
+                        },
                     ],
                 }]
         }], ctorParameters: () => [{ type: undefined, decorators: [{
@@ -988,5 +1101,5 @@ class TimeUtil {
  * Generated bundle index. Do not edit.
  */
 
-export { AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureGuard, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPUnauthenticatedError, AXPUnauthorizedError, AXP_APPLICATION_LOADER, AXP_FEATURE_LOADER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_TENANT_LOADER, JwtUtil, PkceUtil, TimeUtil, initializeAppState };
+export { AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureGuard, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPUnauthenticatedError, AXPUnauthorizedError, AXP_APPLICATION_LOADER, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_TENANT_LOADER, JwtUtil, PkceUtil, TimeUtil, initializeAppState };
 //# sourceMappingURL=acorex-platform-auth.mjs.map