@rytass/bpm-core-nestjs-module 0.5.0 → 0.5.1

package/src/lib/bpm/bpm-root.module.d.ts

@@ -0,0 +1,155 @@
+import { DynamicModule, InjectionToken, Provider } from '@nestjs/common';
+import { ModuleMetadata } from '@nestjs/common/interfaces';
+import { BPMRootAttachmentOptions } from '../attachment/attachment-options';
+import { AttachmentStorage } from '../attachment/attachment-storage.token';
+import { BPMAuthModuleOptions } from '../bpm-auth/bpm-auth.options';
+import { BPMRootIdentityOptions } from '../identity/identity-options';
+import { BPMMemberResolver } from '../identity/member-resolver.interface';
+import { BPMRootNotificationOptions } from '../notification/notification-options';
+import { BPMRootSignatureOptions } from '../signature/signature-options';
+import { BPMWorkflowServiceTaskDispatcher } from '../workflow-engine/workflow-service-task-dispatcher.token';
+export interface BPMRootModuleOptions extends Pick<ModuleMetadata, 'imports'>, BPMRootAttachmentOptions, BPMRootIdentityOptions, BPMRootNotificationOptions, BPMRootSignatureOptions {
+    /**
+     * Host-provided storage adapter for BPM attachments.
+     *
+     * When omitted, BPM stores attachments through the local
+     * `@rytass/storages-adapter-local` adapter under `.storage/attachments`.
+     * Hosts can replace this provider with any `@rytass/storages` compatible
+     * adapter such as MinIO, S3, or GCS.
+     */
+    readonly attachmentStorageProvider?: Provider<AttachmentStorage>;
+    /**
+     * Factory that resolves the current BPM auth context from NestJS execution
+     * context.
+     *
+     * BPM guards, GraphQL decorators, and domain services use this callback to
+     * identify the current member and organization context. When omitted, BPM
+     * operations that require authentication will not receive a host session.
+     */
+    readonly authContextFactory?: BPMAuthModuleOptions['contextFactory'];
+    /**
+     * Host-provided member resolver provider.
+     *
+     * BPM uses this provider to resolve member metadata, organization identity,
+     * display names, and approver candidates without coupling
+     * `@rytass/bpm-core-nestjs-module` to a specific external identity system.
+     */
+    readonly memberResolverProvider: Provider<BPMMemberResolver>;
+    /**
+     * Host-provided dispatcher for executable workflow service tasks.
+     *
+     * When omitted, BPM sends WEBHOOK service tasks with the built-in `fetch`
+     * dispatcher. Wrapper apps can replace this provider to add auth headers,
+     * request signing, retry queues, or an outbound integration bus.
+     */
+    readonly workflowServiceTaskDispatcherProvider?: Provider<BPMWorkflowServiceTaskDispatcher>;
+}
+export interface BPMRootModuleAsyncFactoryOptions extends BPMRootAttachmentOptions, BPMRootIdentityOptions, BPMRootNotificationOptions, BPMRootSignatureOptions {
+    /**
+     * Factory that resolves the current BPM auth context from NestJS execution
+     * context.
+     *
+     * BPM guards, GraphQL decorators, and domain services use this callback to
+     * identify the current member and organization context. When omitted, BPM
+     * operations that require authentication will not receive a host session.
+     */
+    readonly authContextFactory?: BPMAuthModuleOptions['contextFactory'];
+}
+export interface BPMRootModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    /**
+     * Controller mount path used by the BPM attachment endpoints.
+     *
+     * Set at module wiring time because Nest reads controller path metadata
+     * synchronously when the application starts. Async factories cannot drive
+     * this value; only static URL routing decisions should set it. Defaults to
+     * `/attachments`.
+     */
+    readonly attachmentRoutePrefix?: string | null;
+    /**
+     * Host-provided storage adapter for BPM attachments.
+     *
+     * This provider is static at module wiring time. If secrets are required,
+     * use a Nest provider with `useFactory` / `inject` here.
+     */
+    readonly attachmentStorageProvider?: Provider<AttachmentStorage>;
+    /**
+     * Providers injected into `useFactory`.
+     *
+     * This is typically used to read Vault-backed SMTP, webhook, and auth
+     * settings before constructing the flattened BPM root options.
+     */
+    readonly inject?: readonly InjectionToken[];
+    /**
+     * Host-provided member resolver provider.
+     *
+     * BPM uses this provider to resolve member metadata, organization identity,
+     * display names, and approver candidates without coupling
+     * `@rytass/bpm-core-nestjs-module` to a specific external identity system.
+     */
+    readonly memberResolverProvider: Provider<BPMMemberResolver>;
+    /**
+     * Host-provided dispatcher for executable workflow service tasks.
+     *
+     * This provider is static at module wiring time. If secrets are required,
+     * use a Nest provider with `useFactory` / `inject` here.
+     */
+    readonly workflowServiceTaskDispatcherProvider?: Provider<BPMWorkflowServiceTaskDispatcher>;
+    /**
+     * Async factory returning BPM root options.
+     *
+     * The returned object intentionally keeps all BPM settings flat at the root
+     * level, for example `authContextFactory`, `notificationEmailSmtpHost`, and
+     * `notificationSlaSchedulerEnabled`.
+     */
+    readonly useFactory: (...args: readonly unknown[]) => BPMRootModuleAsyncFactoryOptions | Promise<BPMRootModuleAsyncFactoryOptions>;
+}
+/**
+ * Aggregate entry point that wires every BPM domain module
+ * (`BPMAuthModule`, `IdentityModule`, `OrganizationModule`, `FormModule`,
+ * `TemplateModule`, `WorkflowEngineModule`, `DelegationModule`,
+ * `NotificationModule`, `SignatureModule`, `AttachmentModule`) into a
+ * NestJS host application.
+ *
+ * Hosts call `forRoot` or `forRootAsync` once from their root `AppModule`.
+ * BPMCore does **not** own login, GraphQL setup, TypeORM bootstrap, or
+ * Vault loading — those remain the host's responsibility. See the
+ * package README sections "Embedding & auth", "Organization data
+ * ownership", and "Consumer quickstart" for the full contract.
+ *
+ * The host must avoid Nest's `app.setGlobalPrefix(...)`; BPM controllers
+ * mount at relative paths driven by their respective options (notably
+ * `attachmentRoutePrefix`).
+ *
+ * @example
+ * ```ts
+ * BPMRootModule.forRoot({
+ *   authContextFactory: readBPMAuthContextFromGqlContext,
+ *   memberResolverProvider: {
+ *     provide: BPM_MEMBER_RESOLVER,
+ *     useClass: HostMemberResolver,
+ *   },
+ *   attachmentPublicBaseUrl: process.env.BPM_PUBLIC_BASE_URL,
+ *   attachmentSignedUrlSecret: process.env.BPM_ATTACHMENT_SIGNING_SECRET,
+ * });
+ * ```
+ */
+export declare class BPMRootModule {
+    /**
+     * Static configuration. Use this when all BPM options are known at module
+     * wiring time (no async secret loading needed).
+     */
+    static forRoot(options: BPMRootModuleOptions): DynamicModule;
+    /**
+     * Async configuration. Use this when BPM options must be resolved at
+     * runtime — typically when SMTP, webhook, or signature secrets are
+     * loaded from Vault / KMS / a host `ConfigService`.
+     *
+     * Routing-time decisions such as `attachmentRoutePrefix`,
+     * `memberResolverProvider`, `attachmentStorageProvider`, and
+     * `workflowServiceTaskDispatcherProvider` are read from the top-level
+     * options object (not from the `useFactory` return value), because
+     * Nest reads controller path metadata and provider tokens synchronously
+     * during application bootstrap.
+     */
+    static forRootAsync(options: BPMRootModuleAsyncOptions): DynamicModule;
+}

package/src/lib/bpm/bpm-root.module.js

@@ -0,0 +1,170 @@
+"use strict";
+var BPMRootModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPMRootModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const attachment_module_1 = require("../attachment/attachment.module");
+const bpm_auth_module_1 = require("../bpm-auth/bpm-auth.module");
+const delegation_module_1 = require("../delegation/delegation.module");
+const form_module_1 = require("../form/form.module");
+const identity_module_1 = require("../identity/identity.module");
+const notification_module_1 = require("../notification/notification.module");
+const notification_options_module_1 = require("../notification/notification-options.module");
+const organization_module_1 = require("../organization/organization.module");
+const signature_module_1 = require("../signature/signature.module");
+const template_module_1 = require("../template/template.module");
+const workflow_engine_module_1 = require("../workflow-engine/workflow-engine.module");
+/**
+ * Aggregate entry point that wires every BPM domain module
+ * (`BPMAuthModule`, `IdentityModule`, `OrganizationModule`, `FormModule`,
+ * `TemplateModule`, `WorkflowEngineModule`, `DelegationModule`,
+ * `NotificationModule`, `SignatureModule`, `AttachmentModule`) into a
+ * NestJS host application.
+ *
+ * Hosts call `forRoot` or `forRootAsync` once from their root `AppModule`.
+ * BPMCore does **not** own login, GraphQL setup, TypeORM bootstrap, or
+ * Vault loading — those remain the host's responsibility. See the
+ * package README sections "Embedding & auth", "Organization data
+ * ownership", and "Consumer quickstart" for the full contract.
+ *
+ * The host must avoid Nest's `app.setGlobalPrefix(...)`; BPM controllers
+ * mount at relative paths driven by their respective options (notably
+ * `attachmentRoutePrefix`).
+ *
+ * @example
+ * ```ts
+ * BPMRootModule.forRoot({
+ *   authContextFactory: readBPMAuthContextFromGqlContext,
+ *   memberResolverProvider: {
+ *     provide: BPM_MEMBER_RESOLVER,
+ *     useClass: HostMemberResolver,
+ *   },
+ *   attachmentPublicBaseUrl: process.env.BPM_PUBLIC_BASE_URL,
+ *   attachmentSignedUrlSecret: process.env.BPM_ATTACHMENT_SIGNING_SECRET,
+ * });
+ * ```
+ */
+let BPMRootModule = BPMRootModule_1 = class BPMRootModule {
+    /**
+     * Static configuration. Use this when all BPM options are known at module
+     * wiring time (no async secret loading needed).
+     */
+    static forRoot(options) {
+        const featureModules = createBPMFeatureModules(options);
+        return {
+            exports: [...featureModules],
+            imports: [...(options.imports ?? []), ...featureModules],
+            module: BPMRootModule_1,
+        };
+    }
+    /**
+     * Async configuration. Use this when BPM options must be resolved at
+     * runtime — typically when SMTP, webhook, or signature secrets are
+     * loaded from Vault / KMS / a host `ConfigService`.
+     *
+     * Routing-time decisions such as `attachmentRoutePrefix`,
+     * `memberResolverProvider`, `attachmentStorageProvider`, and
+     * `workflowServiceTaskDispatcherProvider` are read from the top-level
+     * options object (not from the `useFactory` return value), because
+     * Nest reads controller path metadata and provider tokens synchronously
+     * during application bootstrap.
+     */
+    static forRootAsync(options) {
+        const authOptions = {
+            imports: options.imports,
+            inject: options.inject,
+            useFactory: async (...args) => {
+                const rootOptions = await options.useFactory(...args);
+                return createBPMAuthModuleOptions(rootOptions);
+            },
+        };
+        return {
+            exports: [
+                notification_options_module_1.NotificationOptionsModule,
+                bpm_auth_module_1.BPMAuthModule,
+                identity_module_1.IdentityModule,
+                organization_module_1.OrganizationModule,
+                attachment_module_1.AttachmentModule,
+                form_module_1.FormModule,
+                template_module_1.TemplateModule,
+                delegation_module_1.DelegationModule,
+                notification_module_1.NotificationModule,
+                signature_module_1.SignatureModule,
+                workflow_engine_module_1.WorkflowEngineModule,
+            ],
+            imports: [
+                notification_options_module_1.NotificationOptionsModule.forRootAsync({
+                    imports: options.imports,
+                    inject: options.inject,
+                    useFactory: options.useFactory,
+                }),
+                bpm_auth_module_1.BPMAuthModule.forRootAsync(authOptions),
+                identity_module_1.IdentityModule.forRootAsync({
+                    imports: options.imports,
+                    inject: options.inject,
+                    memberResolverProvider: options.memberResolverProvider,
+                    useFactory: options.useFactory,
+                }),
+                organization_module_1.OrganizationModule,
+                attachment_module_1.AttachmentModule.forRootAsync({
+                    attachmentRoutePrefix: options.attachmentRoutePrefix,
+                    imports: options.imports,
+                    inject: options.inject,
+                    storageProvider: options.attachmentStorageProvider,
+                    useFactory: options.useFactory,
+                }),
+                form_module_1.FormModule,
+                template_module_1.TemplateModule,
+                delegation_module_1.DelegationModule,
+                notification_module_1.NotificationModule,
+                signature_module_1.SignatureModule.forRootAsync({
+                    imports: options.imports,
+                    inject: options.inject,
+                    useFactory: options.useFactory,
+                }),
+                workflow_engine_module_1.WorkflowEngineModule.forRoot({
+                    imports: options.imports,
+                    serviceTaskDispatcherProvider: options.workflowServiceTaskDispatcherProvider,
+                }),
+            ],
+            module: BPMRootModule_1,
+        };
+    }
+};
+exports.BPMRootModule = BPMRootModule;
+exports.BPMRootModule = BPMRootModule = BPMRootModule_1 = tslib_1.__decorate([
+    (0, common_1.Module)({})
+], BPMRootModule);
+function createBPMFeatureModules(options) {
+    return [
+        notification_options_module_1.NotificationOptionsModule.forRoot(options),
+        bpm_auth_module_1.BPMAuthModule.forRoot(createBPMAuthModuleOptions(options)),
+        identity_module_1.IdentityModule.forRoot({
+            ...options,
+            imports: options.imports,
+            memberResolverProvider: options.memberResolverProvider,
+        }),
+        organization_module_1.OrganizationModule,
+        attachment_module_1.AttachmentModule.forRoot({
+            ...options,
+            imports: options.imports,
+            storageProvider: options.attachmentStorageProvider,
+        }),
+        form_module_1.FormModule,
+        template_module_1.TemplateModule,
+        delegation_module_1.DelegationModule,
+        notification_module_1.NotificationModule,
+        signature_module_1.SignatureModule.forRoot(options),
+        workflow_engine_module_1.WorkflowEngineModule.forRoot({
+            imports: options.imports,
+            serviceTaskDispatcherProvider: options.workflowServiceTaskDispatcherProvider,
+        }),
+    ];
+}
+function createBPMAuthModuleOptions(options) {
+    return {
+        contextFactory: options.authContextFactory,
+    };
+}
+//# sourceMappingURL=bpm-root.module.js.map

package/src/lib/bpm/bpm-root.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-root.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm/bpm-root.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AAGxB,uEAAmE;AAEnE,iEAA4D;AAK5D,uEAAmE;AACnE,qDAAiD;AAEjD,iEAA6D;AAE7D,6EAAyE;AACzE,6FAAwF;AAExF,6EAAyE;AAEzE,oEAAgE;AAChE,iEAA6D;AAC7D,sFAAiF;AAiIjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEI,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAExD,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC;YAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC;YACxD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,YAAY,CAAC,OAAkC;QACpD,MAAM,WAAW,GAA8B;YAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EACI,EAAE;gBACjC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEtD,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE;gBACP,uDAAyB;gBACzB,+BAAa;gBACb,gCAAc;gBACd,wCAAkB;gBAClB,oCAAgB;gBAChB,wBAAU;gBACV,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe;gBACf,6CAAoB;aACrB;YACD,OAAO,EAAE;gBACP,uDAAyB,CAAC,YAAY,CAAC;oBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,+BAAa,CAAC,YAAY,CAAC,WAAW,CAAC;gBACvC,gCAAc,CAAC,YAAY,CAAC;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wCAAkB;gBAClB,oCAAgB,CAAC,YAAY,CAAC;oBAC5B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,eAAe,EAAE,OAAO,CAAC,yBAAyB;oBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wBAAU;gBACV,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe,CAAC,YAAY,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,6CAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;iBAChD,CAAC;aACH;YACD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;CACF,CAAA;AA7FY,sCAAa;wBAAb,aAAa;IADzB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CA6FzB;AAED,SAAS,uBAAuB,CAC9B,OAA6B;IAE7B,OAAO;QACL,uDAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1C,+BAAa,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC1D,gCAAc,CAAC,OAAO,CAAC;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;SACvD,CAAC;QACF,wCAAkB;QAClB,oCAAgB,CAAC,OAAO,CAAC;YACvB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,yBAAyB;SACnD,CAAC;QACF,wBAAU;QACV,gCAAc;QACd,oCAAgB;QAChB,wCAAkB;QAClB,kCAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,6CAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;SAChD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgE;IAEhE,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,kBAAkB;KAC3C,CAAC;AACJ,CAAC"}

package/src/lib/bpm/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./bpm-root.module"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/bpm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm/index.ts"],"names":[],"mappings":";;;AAAA,4DAAkC"}

package/src/lib/bpm-auth/bpm-auth-context.d.ts

@@ -0,0 +1,24 @@
+import { ExecutionContext } from '@nestjs/common';
+/**
+ * The minimum authentication context BPM needs to make authorization
+ * decisions. Hosts construct this from their own session / JWT / RBAC
+ * source and surface it through `BPMRootModuleOptions.authContextFactory`.
+ *
+ * `roles` and `permissions` are matched against the string sets defined in
+ * `BPMAdminGuard` and `BPMDesignerGuard` — see the role / permission table
+ * in `libs/bpm-core/README.md` for the exact strings.
+ */
+export interface BPMAuthContext {
+    readonly memberId: string;
+    readonly metadata: Readonly<Record<string, unknown>>;
+    readonly permissions: readonly string[];
+    readonly roles: readonly string[];
+}
+export interface BPMAuthContextAccessor {
+    assertAuthenticated(context?: ExecutionContext): Promise<BPMAuthContext>;
+    getCurrentContext(context?: ExecutionContext): Promise<BPMAuthContext | null>;
+    getCurrentMemberId(context?: ExecutionContext): Promise<string>;
+}
+export declare const BPM_AUTH_CONTEXT_ACCESSOR: unique symbol;
+export declare const BPM_AUTH_MODULE_OPTIONS: unique symbol;
+export declare function readAuthenticatedBPMContext(accessor: BPMAuthContextAccessor, context?: ExecutionContext): Promise<BPMAuthContext>;

package/src/lib/bpm-auth/bpm-auth-context.extractor.d.ts

@@ -0,0 +1,4 @@
+import { ExecutionContext } from '@nestjs/common';
+import { BPMAuthContext } from './bpm-auth-context';
+export declare function attachBPMAuthContext(context: ExecutionContext | undefined, authContext: BPMAuthContext): void;
+export declare function extractBPMAuthContext(context?: ExecutionContext): BPMAuthContext | null;

package/src/lib/bpm-auth/bpm-auth-context.extractor.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attachBPMAuthContext = attachBPMAuthContext;
+exports.extractBPMAuthContext = extractBPMAuthContext;
+const graphql_1 = require("@nestjs/graphql");
+function attachBPMAuthContext(context, authContext) {
+    if (!context) {
+        return;
+    }
+    const graphqlContext = graphql_1.GqlExecutionContext.create(context).getContext();
+    if (graphqlContext) {
+        graphqlContext.bpmAuthContext = authContext;
+        if (graphqlContext.req) {
+            graphqlContext.req.bpmAuthContext = authContext;
+        }
+        return;
+    }
+    const httpRequest = context
+        .switchToHttp()
+        .getRequest();
+    if (httpRequest) {
+        httpRequest.bpmAuthContext = authContext;
+    }
+}
+function extractBPMAuthContext(context) {
+    if (!context) {
+        return null;
+    }
+    const graphqlContext = graphql_1.GqlExecutionContext.create(context).getContext();
+    const graphqlAuthContext = readBPMAuthContext(graphqlContext?.bpmAuthContext);
+    if (graphqlAuthContext) {
+        return graphqlAuthContext;
+    }
+    const requestAuthContext = readBPMAuthContext(graphqlContext?.req?.bpmAuthContext);
+    if (requestAuthContext) {
+        return requestAuthContext;
+    }
+    const httpRequest = context
+        .switchToHttp()
+        .getRequest();
+    return readBPMAuthContext(httpRequest?.bpmAuthContext);
+}
+function readBPMAuthContext(value) {
+    if (!isRecord(value)) {
+        return null;
+    }
+    const memberId = value.memberId;
+    if (typeof memberId !== 'string') {
+        return null;
+    }
+    return {
+        memberId,
+        metadata: readRecord(value.metadata),
+        permissions: readStringArray(value.permissions),
+        roles: readStringArray(value.roles),
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function readRecord(value) {
+    return isRecord(value) ? value : {};
+}
+function readStringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : [];
+}
+//# sourceMappingURL=bpm-auth-context.extractor.js.map

package/src/lib/bpm-auth/bpm-auth-context.extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-auth-context.extractor.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth-context.extractor.ts"],"names":[],"mappings":";;AAYA,oDA6BC;AAED,sDA6BC;AAvED,6CAAsD;AAWtD,SAAgB,oBAAoB,CAClC,OAAqC,EACrC,WAA2B;IAE3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAElE,CAAC;IAEJ,IAAI,cAAc,EAAE,CAAC;QACnB,cAAc,CAAC,cAAc,GAAG,WAAW,CAAC;QAE5C,IAAI,cAAc,CAAC,GAAG,EAAE,CAAC;YACvB,cAAc,CAAC,GAAG,CAAC,cAAc,GAAG,WAAW,CAAC;QAClD,CAAC;QAED,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,OAAO;SACxB,YAAY,EAAE;SACd,UAAU,EAAiC,CAAC;IAE/C,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,OAA0B;IAE1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAElE,CAAC;IACJ,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAE9E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,kBAAkB,GAAG,kBAAkB,CAC3C,cAAc,EAAE,GAAG,EAAE,cAAc,CACpC,CAAC;IAEF,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,WAAW,GAAG,OAAO;SACxB,YAAY,EAAE;SACd,UAAU,EAAiC,CAAC;IAE/C,OAAO,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAEhC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpC,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC"}

package/src/lib/bpm-auth/bpm-auth-context.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPM_AUTH_MODULE_OPTIONS = exports.BPM_AUTH_CONTEXT_ACCESSOR = void 0;
+exports.readAuthenticatedBPMContext = readAuthenticatedBPMContext;
+const common_1 = require("@nestjs/common");
+exports.BPM_AUTH_CONTEXT_ACCESSOR = Symbol('BPM_AUTH_CONTEXT_ACCESSOR');
+exports.BPM_AUTH_MODULE_OPTIONS = Symbol('BPM_AUTH_MODULE_OPTIONS');
+async function readAuthenticatedBPMContext(accessor, context) {
+    const authContext = await accessor.assertAuthenticated(context);
+    if (!authContext.memberId.trim()) {
+        throw new common_1.UnauthorizedException('BPM member id is required');
+    }
+    return authContext;
+}
+//# sourceMappingURL=bpm-auth-context.js.map

package/src/lib/bpm-auth/bpm-auth-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-auth-context.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth-context.ts"],"names":[],"mappings":";;;AA4BA,kEAWC;AAvCD,2CAAyE;AAwB5D,QAAA,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAEhE,QAAA,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAElE,KAAK,UAAU,2BAA2B,CAC/C,QAAgC,EAChC,OAA0B;IAE1B,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEhE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/src/lib/bpm-auth/bpm-auth.authorization.d.ts

@@ -0,0 +1,12 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { BPMAuthContext } from './bpm-auth-context';
+export declare class BPMAdminGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+export declare class BPMDesignerGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+export declare const BPMAdminOnly: () => ClassDecorator & MethodDecorator;
+export declare const BPMDesignerOnly: () => ClassDecorator & MethodDecorator;
+export declare function isBPMAdmin(authContext: BPMAuthContext): boolean;
+export declare function isBPMDesigner(authContext: BPMAuthContext): boolean;

package/src/lib/bpm-auth/bpm-auth.authorization.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPMDesignerOnly = exports.BPMAdminOnly = exports.BPMDesignerGuard = exports.BPMAdminGuard = void 0;
+exports.isBPMAdmin = isBPMAdmin;
+exports.isBPMDesigner = isBPMDesigner;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const bpm_auth_context_extractor_1 = require("./bpm-auth-context.extractor");
+const bpm_auth_guard_1 = require("./bpm-auth.guard");
+const ADMIN_PERMISSIONS = new Set([
+    'bpm:*',
+    'bpm:admin',
+    'bpm.admin',
+    'bpm:admin:*',
+]);
+const DESIGNER_PERMISSIONS = new Set([
+    'bpm:*',
+    'bpm:admin',
+    'bpm.admin',
+    'bpm:admin:*',
+    'bpm:design',
+    'bpm.design',
+    'bpm.form.design',
+    'bpm.template.design',
+    'bpm:form:design',
+    'bpm:template:design',
+]);
+let BPMAdminGuard = class BPMAdminGuard {
+    canActivate(context) {
+        const authContext = (0, bpm_auth_context_extractor_1.extractBPMAuthContext)(context);
+        if (authContext && isBPMAdmin(authContext)) {
+            return true;
+        }
+        throw new common_1.ForbiddenException('BPM admin permission is required');
+    }
+};
+exports.BPMAdminGuard = BPMAdminGuard;
+exports.BPMAdminGuard = BPMAdminGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], BPMAdminGuard);
+let BPMDesignerGuard = class BPMDesignerGuard {
+    canActivate(context) {
+        const authContext = (0, bpm_auth_context_extractor_1.extractBPMAuthContext)(context);
+        if (authContext && isBPMDesigner(authContext)) {
+            return true;
+        }
+        throw new common_1.ForbiddenException('BPM designer permission is required');
+    }
+};
+exports.BPMDesignerGuard = BPMDesignerGuard;
+exports.BPMDesignerGuard = BPMDesignerGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], BPMDesignerGuard);
+const BPMAdminOnly = () => (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard, BPMAdminGuard);
+exports.BPMAdminOnly = BPMAdminOnly;
+const BPMDesignerOnly = () => (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard, BPMDesignerGuard);
+exports.BPMDesignerOnly = BPMDesignerOnly;
+function isBPMAdmin(authContext) {
+    return (authContext.roles.includes('BPM_ADMIN') ||
+        authContext.permissions.some((permission) => ADMIN_PERMISSIONS.has(permission)));
+}
+function isBPMDesigner(authContext) {
+    return (isBPMAdmin(authContext) ||
+        authContext.roles.includes('BPM_DESIGNER') ||
+        authContext.permissions.some((permission) => DESIGNER_PERMISSIONS.has(permission)));
+}
+//# sourceMappingURL=bpm-auth.authorization.js.map

package/src/lib/bpm-auth/bpm-auth.authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-auth.authorization.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth.authorization.ts"],"names":[],"mappings":";;;AA8DA,gCAOC;AAED,sCAQC;;AA/ED,2CAMwB;AAExB,6EAAqE;AACrE,qDAAyD;AAEzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,OAAO;IACP,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,OAAO;IACP,WAAW;IACX,WAAW;IACX,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;CACtB,CAAC,CAAC;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GAAG,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC;CACF,CAAA;AAVY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAUzB;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GAAG,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC;CACF,CAAA;AAVY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAU5B;AAEM,MAAM,YAAY,GAAG,GAAqC,EAAE,CACjE,IAAA,kBAAS,EAAC,sCAAqB,EAAE,aAAa,CAAC,CAAC;AADrC,QAAA,YAAY,gBACyB;AAE3C,MAAM,eAAe,GAAG,GAAqC,EAAE,CACpE,IAAA,kBAAS,EAAC,sCAAqB,EAAE,gBAAgB,CAAC,CAAC;AADxC,QAAA,eAAe,mBACyB;AAErD,SAAgB,UAAU,CAAC,WAA2B;IACpD,OAAO,CACL,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAClC,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,WAA2B;IACvD,OAAO,CACL,UAAU,CAAC,WAAW,CAAC;QACvB,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC1C,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CACrC,CACF,CAAC;AACJ,CAAC"}

package/src/lib/bpm-auth/bpm-auth.decorators.d.ts

@@ -0,0 +1,3 @@
+export declare const BPMAuthenticated: () => ClassDecorator & MethodDecorator;
+export declare const BPMCurrentAuthContext: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare const BPMCurrentMemberId: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/src/lib/bpm-auth/bpm-auth.decorators.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPMCurrentMemberId = exports.BPMCurrentAuthContext = exports.BPMAuthenticated = void 0;
+const common_1 = require("@nestjs/common");
+const bpm_auth_guard_1 = require("./bpm-auth.guard");
+const bpm_auth_context_extractor_1 = require("./bpm-auth-context.extractor");
+const BPMAuthenticated = () => (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard);
+exports.BPMAuthenticated = BPMAuthenticated;
+exports.BPMCurrentAuthContext = (0, common_1.createParamDecorator)((_data, context) => (0, bpm_auth_context_extractor_1.extractBPMAuthContext)(context));
+exports.BPMCurrentMemberId = (0, common_1.createParamDecorator)((_data, context) => (0, bpm_auth_context_extractor_1.extractBPMAuthContext)(context)?.memberId ?? null);
+//# sourceMappingURL=bpm-auth.decorators.js.map

package/src/lib/bpm-auth/bpm-auth.decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-auth.decorators.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth.decorators.ts"],"names":[],"mappings":";;;AAAA,2CAIwB;AACxB,qDAAyD;AACzD,6EAAqE;AAE9D,MAAM,gBAAgB,GAAG,GAAqC,EAAE,CACrE,IAAA,kBAAS,EAAC,sCAAqB,CAAC,CAAC;AADtB,QAAA,gBAAgB,oBACM;AAEtB,QAAA,qBAAqB,GAAG,IAAA,6BAAoB,EACvD,CAAC,KAAc,EAAE,OAAyB,EAAE,EAAE,CAAC,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAC9E,CAAC;AAEW,QAAA,kBAAkB,GAAG,IAAA,6BAAoB,EACpD,CAAC,KAAc,EAAE,OAAyB,EAAE,EAAE,CAC5C,IAAA,kDAAqB,EAAC,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CACnD,CAAC"}

package/src/lib/bpm-auth/bpm-auth.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { BPMAuthContextAccessor } from './bpm-auth-context';
+export declare class BPMAuthenticatedGuard implements CanActivate {
+    private readonly authContextAccessor;
+    constructor(authContextAccessor: BPMAuthContextAccessor);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/src/lib/bpm-auth/bpm-auth.guard.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BPMAuthenticatedGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const bpm_auth_context_1 = require("./bpm-auth-context");
+const bpm_auth_context_extractor_1 = require("./bpm-auth-context.extractor");
+let BPMAuthenticatedGuard = class BPMAuthenticatedGuard {
+    constructor(authContextAccessor) {
+        this.authContextAccessor = authContextAccessor;
+    }
+    async canActivate(context) {
+        const authContext = await (0, bpm_auth_context_1.readAuthenticatedBPMContext)(this.authContextAccessor, context);
+        (0, bpm_auth_context_extractor_1.attachBPMAuthContext)(context, authContext);
+        return true;
+    }
+};
+exports.BPMAuthenticatedGuard = BPMAuthenticatedGuard;
+exports.BPMAuthenticatedGuard = BPMAuthenticatedGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, common_1.Inject)(bpm_auth_context_1.BPM_AUTH_CONTEXT_ACCESSOR)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], BPMAuthenticatedGuard);
+//# sourceMappingURL=bpm-auth.guard.js.map

package/src/lib/bpm-auth/bpm-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-auth.guard.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAKwB;AACxB,yDAI4B;AAC5B,6EAAoE;AAG7D,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YAEmB,mBAA2C;QAA3C,wBAAmB,GAAnB,mBAAmB,CAAwB;IAC3D,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,WAAW,GAAG,MAAM,IAAA,8CAA2B,EACnD,IAAI,CAAC,mBAAmB,EACxB,OAAO,CACR,CAAC;QAEF,IAAA,iDAAoB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAE3C,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAhBY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAGR,mBAAA,IAAA,eAAM,EAAC,4CAAyB,CAAC,CAAA;;GAFzB,qBAAqB,CAgBjC"}

package/src/lib/bpm-auth/bpm-auth.module.d.ts

@@ -0,0 +1,6 @@
+import { DynamicModule } from '@nestjs/common';
+import { BPMAuthModuleAsyncOptions, BPMAuthModuleOptions } from './bpm-auth.options';
+export declare class BPMAuthModule {
+    static forRoot(options?: BPMAuthModuleOptions): DynamicModule;
+    static forRootAsync(options: BPMAuthModuleAsyncOptions): DynamicModule;
+}