@valtimo/access-control-management 13.35.0 → 13.36.1

package/lib/access-control-management.module.d.ts

@@ -2,18 +2,24 @@ import * as i0 from "@angular/core";
 import * as i1 from "./components/overview/access-control-overview.component";
 import * as i2 from "./components/role-metadata-modal/role-metadata-modal.component";
 import * as i3 from "./components/editor/access-control-editor.component";
-import * as i4 from "./components/delete-role-modal/delete-role-modal.component";
-import * as i5 from "./components/export-role-modal/export-role-modal.component";
-import * as i6 from "@angular/common";
-import * as i7 from "./access-control-management-routing.module";
-import * as i8 from "carbon-components-angular";
-import * as i9 from "@angular/forms";
-import * as i10 from "@ngx-translate/core";
-import * as i11 from "@valtimo/components";
-import * as i12 from "./components/access-control-json-editor-tab/access-control-json-editor-tab.component";
-import * as i13 from "./components/access-control-overview-tab/access-control-overview-tab.component";
+import * as i4 from "./components/access-control-form-editor-tab/access-control-form-editor-tab.component";
+import * as i5 from "./components/condition-tree/condition-tree.component";
+import * as i6 from "./components/delete-role-modal/delete-role-modal.component";
+import * as i7 from "./components/export-role-modal/export-role-modal.component";
+import * as i8 from "./components/permission-form/permission-form.component";
+import * as i9 from "@angular/common";
+import * as i10 from "./access-control-management-routing.module";
+import * as i11 from "carbon-components-angular";
+import * as i12 from "@angular/forms";
+import * as i13 from "@ngx-translate/core";
+import * as i14 from "@valtimo/components";
+import * as i15 from "./components/access-control-json-editor-tab/access-control-json-editor-tab.component";
+import * as i16 from "./components/access-control-overview-tab/access-control-overview-tab.component";
+import * as i17 from "./pipes/action-label.pipe";
+import * as i18 from "./pipes/action-description.pipe";
+import * as i19 from "./pipes/action-tag-type.pipe";
 export declare class AccessControlManagementModule {
     static ɵfac: i0.ɵɵFactoryDeclaration<AccessControlManagementModule, never>;
-    static ɵmod: i0.ɵɵNgModuleDeclaration<AccessControlManagementModule, [typeof i1.AccessControlOverviewComponent, typeof i2.RoleMetadataModalComponent, typeof i3.AccessControlEditorComponent, typeof i4.DeleteRoleModalComponent, typeof i5.ExportRoleModalComponent], [typeof i6.CommonModule, typeof i7.AccessControlManagementRoutingModule, typeof i8.ButtonModule, typeof i9.FormsModule, typeof i8.ModalModule, typeof i10.TranslateModule, typeof i9.ReactiveFormsModule, typeof i8.InputModule, typeof i8.IconModule, typeof i11.ConfirmationModalModule, typeof i11.RenderInPageHeaderDirective, typeof i8.LoadingModule, typeof i8.IconModule, typeof i11.OverflowMenuComponent, typeof i11.OverflowMenuOptionComponent, typeof i11.OverflowMenuTriggerComponent, typeof i8.NotificationModule, typeof i11.CarbonListModule, typeof i8.TabsModule, typeof i12.AccessControlJsonEditorTabComponent, typeof i13.AccessControlOverviewTabComponent], never>;
+    static ɵmod: i0.ɵɵNgModuleDeclaration<AccessControlManagementModule, [typeof i1.AccessControlOverviewComponent, typeof i2.RoleMetadataModalComponent, typeof i3.AccessControlEditorComponent, typeof i4.AccessControlFormEditorTabComponent, typeof i5.ConditionTreeComponent, typeof i6.DeleteRoleModalComponent, typeof i7.ExportRoleModalComponent, typeof i8.PermissionFormComponent], [typeof i9.CommonModule, typeof i10.AccessControlManagementRoutingModule, typeof i11.ButtonModule, typeof i12.FormsModule, typeof i11.ModalModule, typeof i13.TranslateModule, typeof i12.ReactiveFormsModule, typeof i11.InputModule, typeof i11.IconModule, typeof i14.ConfirmationModalModule, typeof i14.RenderInPageHeaderDirective, typeof i14.FitPageDirective, typeof i11.LoadingModule, typeof i11.IconModule, typeof i14.OverflowMenuComponent, typeof i14.OverflowMenuOptionComponent, typeof i14.OverflowMenuTriggerComponent, typeof i11.NotificationModule, typeof i14.CarbonListModule, typeof i14.SelectModule, typeof i14.TooltipIconModule, typeof i11.TabsModule, typeof i11.ToggleModule, typeof i11.ContentSwitcherModule, typeof i11.AccordionModule, typeof i11.CheckboxModule, typeof i11.LayerModule, typeof i11.TagModule, typeof i15.AccessControlJsonEditorTabComponent, typeof i16.AccessControlOverviewTabComponent, typeof i17.ActionLabelPipe, typeof i18.ActionDescriptionPipe, typeof i19.ActionTagTypePipe], never>;
     static ɵinj: i0.ɵɵInjectorDeclaration<AccessControlManagementModule>;
 }

package/lib/components/access-control-form-editor-tab/access-control-form-editor-tab.component.d.ts

@@ -0,0 +1,69 @@
+import { ChangeDetectorRef, EventEmitter, OnChanges, OnDestroy, SimpleChanges } from '@angular/core';
+import { AbstractControl, FormArray } from '@angular/forms';
+import { EditorModel } from '@valtimo/components';
+import { IconService } from 'carbon-components-angular';
+import { AccessControlFormEditorService, PermissionSchemaMetadataService } from '../../services';
+import * as i0 from "@angular/core";
+export declare class AccessControlFormEditorTabComponent implements OnChanges, OnDestroy {
+    private readonly formEditorService;
+    private readonly metadataService;
+    private readonly iconService;
+    private readonly changeDetectorRef;
+    private _permissionList?;
+    model: EditorModel | null;
+    disabled: boolean | null;
+    roleKey: string | null;
+    validEvent: EventEmitter<boolean>;
+    valueChangeEvent: EventEmitter<string>;
+    permissionsArray: FormArray | null;
+    ready: boolean;
+    readonly $selectedIndex: import("@angular/core").WritableSignal<number>;
+    protected readonly testIds: {
+        readonly addPermissionButton: "accessControlEditorAddPermission";
+        readonly permissionListItem: "accessControlEditorPermissionListItem";
+        readonly permissionCard: "accessControlEditorPermissionCard";
+        readonly removePermissionButton: "accessControlEditorRemovePermission";
+        readonly resourceTypeSelect: "accessControlEditorResourceType";
+        readonly actionsSelect: "accessControlEditorActions";
+        readonly contextToggle: "accessControlEditorContextToggle";
+        readonly contextResourceTypeSelect: "accessControlEditorContextResourceType";
+        readonly addConditionButton: "accessControlEditorAddCondition";
+        readonly removeConditionButton: "accessControlEditorRemoveCondition";
+        readonly conditionTypeSelect: "accessControlEditorConditionType";
+        readonly conditionFieldSelect: "accessControlEditorConditionField";
+        readonly conditionOperatorSelect: "accessControlEditorConditionOperator";
+        readonly conditionValueInput: "accessControlEditorConditionValue";
+        readonly conditionPathInput: "accessControlEditorConditionPath";
+        readonly conditionClazzInput: "accessControlEditorConditionClazz";
+    };
+    private _valueChangesSubscription?;
+    private _pendingReselect;
+    constructor(formEditorService: AccessControlFormEditorService, metadataService: PermissionSchemaMetadataService, iconService: IconService, changeDetectorRef: ChangeDetectorRef);
+    ngOnChanges(changes: SimpleChanges): void;
+    ngOnDestroy(): void;
+    shortName(control: AbstractControl): string;
+    actionsOf(control: AbstractControl): string[];
+    hasConditions(control: AbstractControl): boolean;
+    hasContext(control: AbstractControl): boolean;
+    orderedPermissions(): {
+        control: AbstractControl;
+        index: number;
+    }[];
+    selectPermission(index: number): void;
+    selectedControls(): AbstractControl[];
+    addPermission(): void;
+    private scrollNewPermissionIntoView;
+    private scrollSelectedIntoView;
+    removePermission(index: number): void;
+    private rebuild;
+    private buildForm;
+    prepareSelectionReopen(): void;
+    private selectedPermissionKeys;
+    private resolveSelectedIndex;
+    private permissionKeys;
+    private applyDisabled;
+    private emitState;
+    private parsePermissions;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AccessControlFormEditorTabComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<AccessControlFormEditorTabComponent, "valtimo-access-control-form-editor-tab", never, { "model": { "alias": "model"; "required": false; }; "disabled": { "alias": "disabled"; "required": false; }; "roleKey": { "alias": "roleKey"; "required": false; }; }, { "validEvent": "validEvent"; "valueChangeEvent": "valueChangeEvent"; }, never, never, false, never>;
+}

package/lib/components/condition-tree/condition-tree.component.d.ts

@@ -0,0 +1,62 @@
+import { OnChanges, OnInit, SimpleChanges } from '@angular/core';
+import { AbstractControl, FormArray, FormGroup } from '@angular/forms';
+import { SelectItem } from '@valtimo/components';
+import { IconService } from 'carbon-components-angular';
+import { ConditionType } from '../../models';
+import { AccessControlFormEditorService } from '../../services';
+import * as i0 from "@angular/core";
+export declare class ConditionTreeComponent implements OnInit, OnChanges {
+    private readonly formEditorService;
+    private readonly iconService;
+    conditions: FormArray;
+    resourceType: string | null;
+    disabled: boolean;
+    depth: number;
+    fieldItems: SelectItem[];
+    containerTargetItems: SelectItem[];
+    operatorItems: SelectItem[];
+    valueTypeItems: SelectItem[];
+    typeItems: SelectItem[];
+    protected readonly testIds: {
+        readonly addPermissionButton: "accessControlEditorAddPermission";
+        readonly permissionListItem: "accessControlEditorPermissionListItem";
+        readonly permissionCard: "accessControlEditorPermissionCard";
+        readonly removePermissionButton: "accessControlEditorRemovePermission";
+        readonly resourceTypeSelect: "accessControlEditorResourceType";
+        readonly actionsSelect: "accessControlEditorActions";
+        readonly contextToggle: "accessControlEditorContextToggle";
+        readonly contextResourceTypeSelect: "accessControlEditorContextResourceType";
+        readonly addConditionButton: "accessControlEditorAddCondition";
+        readonly removeConditionButton: "accessControlEditorRemoveCondition";
+        readonly conditionTypeSelect: "accessControlEditorConditionType";
+        readonly conditionFieldSelect: "accessControlEditorConditionField";
+        readonly conditionOperatorSelect: "accessControlEditorConditionOperator";
+        readonly conditionValueInput: "accessControlEditorConditionValue";
+        readonly conditionPathInput: "accessControlEditorConditionPath";
+        readonly conditionClazzInput: "accessControlEditorConditionClazz";
+    };
+    get rowLayerLevel(): 1 | 2;
+    get inputLayerLevel(): 1 | 2;
+    constructor(formEditorService: AccessControlFormEditorService, iconService: IconService);
+    ngOnInit(): void;
+    ngOnChanges(changes: SimpleChanges): void;
+    groupAt(index: number): FormGroup;
+    asFormGroup(control: AbstractControl): FormGroup;
+    typeOf(index: number): ConditionType;
+    nestedConditions(index: number): FormArray;
+    containerResourceType(index: number): string | null;
+    containerResourceTypeAt(index: number): string;
+    fieldValueAt(index: number): string;
+    operatorValueAt(index: number): string;
+    clazzValueAt(index: number): string;
+    clazzManualAt(index: number): boolean;
+    addCondition(): void;
+    removeCondition(index: number): void;
+    onClazzManualToggle(index: number, manual: boolean): void;
+    onTypeChange(index: number): void;
+    private recomputeItems;
+    private collectFieldValues;
+    private collectContainerTargets;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ConditionTreeComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<ConditionTreeComponent, "valtimo-condition-tree", never, { "conditions": { "alias": "conditions"; "required": false; }; "resourceType": { "alias": "resourceType"; "required": false; }; "disabled": { "alias": "disabled"; "required": false; }; "depth": { "alias": "depth"; "required": false; }; }, {}, never, never, false, never>;
+}

package/lib/components/editor/access-control-editor.component.d.ts

@@ -2,13 +2,13 @@ import { OnDestroy, OnInit } from '@angular/core';
 import { AccessControlService } from '../../services/access-control.service';
 import { BehaviorSubject } from 'rxjs';
 import { ActivatedRoute, Router } from '@angular/router';
-import { EditorModel, PageHeaderService, PageTitleService } from '@valtimo/components';
+import { EditorModel, PageHeaderService, PageTitleService, PendingChangesComponent } from '@valtimo/components';
 import { AccessControlEditorTab, Permission, Role } from '../../models';
 import { TranslateService } from '@ngx-translate/core';
 import { AccessControlExportService } from '../../services/access-control-export.service';
 import { GlobalNotificationService } from '@valtimo/shared';
 import * as i0 from "@angular/core";
-export declare class AccessControlEditorComponent implements OnInit, OnDestroy {
+export declare class AccessControlEditorComponent extends PendingChangesComponent implements OnInit, OnDestroy {
     private readonly accessControlService;
     private readonly route;
     private readonly pageTitleService;
@@ -29,24 +29,30 @@ export declare class AccessControlEditorComponent implements OnInit, OnDestroy {
     readonly compactMode$: import("rxjs").Observable<boolean>;
     readonly $activeTab: import("@angular/core").WritableSignal<AccessControlEditorTab>;
     protected readonly AccessControlEditorTab: typeof AccessControlEditorTab;
+    private _tabs;
+    private _formEditorTab?;
     private _roleKeySubscription;
     private _roleKey;
     private readonly _updatedModelValue$;
+    private _pendingBaseline;
     constructor(accessControlService: AccessControlService, route: ActivatedRoute, pageTitleService: PageTitleService, router: Router, globalNotificationService: GlobalNotificationService, translateService: TranslateService, accessControlExportService: AccessControlExportService, pageHeaderService: PageHeaderService);
     ngOnInit(): void;
     ngOnDestroy(): void;
     onValid(valid: boolean): void;
     onValueChange(value: string): void;
+    private normalizeJson;
+    protected onCancelRedirect(): void;
+    private syncTabHeaders;
     updatePermissions(): void;
     onDelete(roles: Array<string>): void;
     showDeleteModal(): void;
     showEditModal(): void;
     onEdit(currentRoleKey: string, data: Role | null): void;
     setActiveTab(tab: AccessControlEditorTab): void;
+    private segmentsForTab;
     private restoreActiveTabFromUrl;
     exportPermissions(): void;
     private openRoleKeySubscription;
-    private getPermissions;
     private setModel;
     private disableMore;
     private enableMore;

package/lib/components/overview/access-control-overview.component.d.ts

@@ -13,6 +13,7 @@ export declare class AccessControlOverviewComponent implements OnInit {
     carbonList: CarbonListComponent;
     fields: ColumnConfig[];
     readonly roles$: Observable<Role[]>;
+    readonly existingRoleKeys$: Observable<string[]>;
     readonly loading$: Observable<boolean>;
     readonly skeleton$: BehaviorSubject<boolean>;
     readonly showAddModal$: BehaviorSubject<boolean>;

package/lib/components/permission-form/permission-form.component.d.ts

@@ -0,0 +1,69 @@
+import { AfterViewInit, ChangeDetectorRef, EventEmitter, OnDestroy, OnInit } from '@angular/core';
+import { FormArray, FormControl, FormGroup } from '@angular/forms';
+import { SelectItem } from '@valtimo/components';
+import { IconService } from 'carbon-components-angular';
+import { BehaviorSubject } from 'rxjs';
+import { AccessControlFormEditorService } from '../../services';
+import * as i0 from "@angular/core";
+export declare class PermissionFormComponent implements OnInit, AfterViewInit, OnDestroy {
+    private readonly formEditorService;
+    private readonly iconService;
+    private readonly changeDetectorRef;
+    group: FormGroup;
+    index: number;
+    disabled: boolean;
+    roleKey: string | null;
+    removeEvent: EventEmitter<void>;
+    resourceTypeItems: SelectItem[];
+    actionItems: SelectItem[];
+    contextResourceTypeItems: SelectItem[];
+    hasContextTargets: boolean;
+    readonly $loading: import("@angular/core").WritableSignal<boolean>;
+    readonly $openSection: import("@angular/core").WritableSignal<"conditions" | "resourceActions" | "context">;
+    readonly showRemoveModal$: BehaviorSubject<boolean>;
+    protected readonly testIds: {
+        readonly addPermissionButton: "accessControlEditorAddPermission";
+        readonly permissionListItem: "accessControlEditorPermissionListItem";
+        readonly permissionCard: "accessControlEditorPermissionCard";
+        readonly removePermissionButton: "accessControlEditorRemovePermission";
+        readonly resourceTypeSelect: "accessControlEditorResourceType";
+        readonly actionsSelect: "accessControlEditorActions";
+        readonly contextToggle: "accessControlEditorContextToggle";
+        readonly contextResourceTypeSelect: "accessControlEditorContextResourceType";
+        readonly addConditionButton: "accessControlEditorAddCondition";
+        readonly removeConditionButton: "accessControlEditorRemoveCondition";
+        readonly conditionTypeSelect: "accessControlEditorConditionType";
+        readonly conditionFieldSelect: "accessControlEditorConditionField";
+        readonly conditionOperatorSelect: "accessControlEditorConditionOperator";
+        readonly conditionValueInput: "accessControlEditorConditionValue";
+        readonly conditionPathInput: "accessControlEditorConditionPath";
+        readonly conditionClazzInput: "accessControlEditorConditionClazz";
+    };
+    private readonly _subscriptions;
+    private _revealTimeoutId?;
+    constructor(formEditorService: AccessControlFormEditorService, iconService: IconService, changeDetectorRef: ChangeDetectorRef);
+    get resourceTypeValue(): string;
+    get resourceShortName(): string;
+    get contextResourceTypeValue(): string | null;
+    get hasContext(): boolean;
+    get hasContextResource(): boolean;
+    get contextMode(): 'none' | 'noContext' | 'specific';
+    get actionsControl(): FormControl;
+    get selectedActions(): string[];
+    get conditionsArray(): FormArray;
+    get contextConditionsArray(): FormArray;
+    ngOnInit(): void;
+    ngAfterViewInit(): void;
+    ngOnDestroy(): void;
+    onContextModeChange(mode: 'none' | 'noContext' | 'specific'): void;
+    onActionToggle(action: string, checked: boolean): void;
+    onSectionToggle(section: 'resourceActions' | 'conditions' | 'context', event: {
+        expanded?: boolean;
+    }): void;
+    openRemoveModal(): void;
+    onRemove(): void;
+    private recomputeActionItems;
+    private recomputeContextResourceTypeItems;
+    static ɵfac: i0.ɵɵFactoryDeclaration<PermissionFormComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<PermissionFormComponent, "valtimo-permission-form", never, { "group": { "alias": "group"; "required": false; }; "index": { "alias": "index"; "required": false; }; "disabled": { "alias": "disabled"; "required": false; }; "roleKey": { "alias": "roleKey"; "required": false; }; }, { "removeEvent": "removeEvent"; }, never, never, false, never>;
+}

package/lib/components/role-metadata-modal/role-metadata-modal.component.d.ts

@@ -1,23 +1,36 @@
-import { EventEmitter } from '@angular/core';
+import { EventEmitter, OnInit } from '@angular/core';
 import { FormBuilder } from '@angular/forms';
+import { SelectItem } from '@valtimo/components';
 import { Role, RoleMetadataModal } from '../../models';
+import { AccessControlService } from '../../services';
 import * as i0 from "@angular/core";
-export declare class RoleMetadataModalComponent {
+export declare class RoleMetadataModalComponent implements OnInit {
     private readonly fb;
-    open: boolean;
+    private readonly accessControlService;
     type: RoleMetadataModal;
+    set open(value: boolean);
+    get open(): boolean;
     set defaultKeyValue(value: string);
+    usedKeys: string[] | null;
     closeEvent: EventEmitter<Role>;
+    readonly $roleKeyItems: import("@angular/core").WritableSignal<SelectItem[]>;
+    readonly $loadingRoles: import("@angular/core").WritableSignal<boolean>;
+    readonly $keyManual: import("@angular/core").WritableSignal<boolean>;
     form: import("@angular/forms").FormGroup<{
         key: import("@angular/forms").FormControl<string>;
     }>;
+    private _open;
     private _defaultKeyValue;
+    private _rolesRequested;
     get key(): import("@angular/forms").AbstractControl<string, string>;
-    constructor(fb: FormBuilder);
+    constructor(fb: FormBuilder, accessControlService: AccessControlService);
+    ngOnInit(): void;
     onCancel(): void;
     onConfirm(): void;
+    onKeyManualToggle(manual: boolean): void;
+    private loadRoleKeyItems;
     private setDefaultKeyValue;
     private resetForm;
     static ɵfac: i0.ɵɵFactoryDeclaration<RoleMetadataModalComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<RoleMetadataModalComponent, "valtimo-role-metadata-modal", never, { "open": { "alias": "open"; "required": false; }; "type": { "alias": "type"; "required": false; }; "defaultKeyValue": { "alias": "defaultKeyValue"; "required": false; }; }, { "closeEvent": "closeEvent"; }, never, never, false, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<RoleMetadataModalComponent, "valtimo-role-metadata-modal", never, { "type": { "alias": "type"; "required": false; }; "open": { "alias": "open"; "required": false; }; "defaultKeyValue": { "alias": "defaultKeyValue"; "required": false; }; "usedKeys": { "alias": "usedKeys"; "required": false; }; }, { "closeEvent": "closeEvent"; }, never, never, false, never>;
 }

package/lib/constants/access-control-editor.test-ids.d.ts

@@ -0,0 +1,19 @@
+declare const ACCESS_CONTROL_EDITOR_TEST_IDS: {
+    readonly addPermissionButton: "accessControlEditorAddPermission";
+    readonly permissionListItem: "accessControlEditorPermissionListItem";
+    readonly permissionCard: "accessControlEditorPermissionCard";
+    readonly removePermissionButton: "accessControlEditorRemovePermission";
+    readonly resourceTypeSelect: "accessControlEditorResourceType";
+    readonly actionsSelect: "accessControlEditorActions";
+    readonly contextToggle: "accessControlEditorContextToggle";
+    readonly contextResourceTypeSelect: "accessControlEditorContextResourceType";
+    readonly addConditionButton: "accessControlEditorAddCondition";
+    readonly removeConditionButton: "accessControlEditorRemoveCondition";
+    readonly conditionTypeSelect: "accessControlEditorConditionType";
+    readonly conditionFieldSelect: "accessControlEditorConditionField";
+    readonly conditionOperatorSelect: "accessControlEditorConditionOperator";
+    readonly conditionValueInput: "accessControlEditorConditionValue";
+    readonly conditionPathInput: "accessControlEditorConditionPath";
+    readonly conditionClazzInput: "accessControlEditorConditionClazz";
+};
+export { ACCESS_CONTROL_EDITOR_TEST_IDS };

package/lib/constants/access-control-labels.d.ts

@@ -1,4 +1,6 @@
 import { ConditionOperator } from '../models';
 declare const OPERATOR_LABEL: Record<ConditionOperator, string>;
 declare const NO_CONTEXT_RESOURCE_TYPE = "com.ritense.authorization.NoContext";
-export { NO_CONTEXT_RESOURCE_TYPE, OPERATOR_LABEL };
+declare const ACTION_TAG_TYPE: Record<string, string>;
+declare const DEFAULT_ACTION_TAG_TYPE = "gray";
+export { ACTION_TAG_TYPE, DEFAULT_ACTION_TAG_TYPE, NO_CONTEXT_RESOURCE_TYPE, OPERATOR_LABEL };

package/lib/constants/index.d.ts

@@ -1 +1,2 @@
+export * from './access-control-editor.test-ids';
 export * from './access-control-labels';

package/lib/models/access-control-editor-tab.model.d.ts

@@ -1,5 +1,6 @@
 declare enum AccessControlEditorTab {
     SUMMARY = "summary",
+    EDITOR = "editor",
     JSON_EDITOR = "jsonEditor"
 }
 interface AccessControlFilter {

package/lib/models/index.d.ts

@@ -1,4 +1,5 @@
 export * from './access-control-editor-tab.model';
+export * from './pbac-editor.model';
 export * from './permission.model';
 export * from './permission-schema.model';
 export * from './role.model';

package/lib/models/pbac-editor.model.d.ts

@@ -0,0 +1,10 @@
+import { PermissionCondition } from './permission.model';
+type ConditionType = 'field' | 'expression' | 'container';
+interface UpdateRolePermission {
+    resourceType: string;
+    actions: string[];
+    conditions: PermissionCondition[];
+    contextResourceType?: string;
+    contextConditions?: PermissionCondition[];
+}
+export { ConditionType, UpdateRolePermission };

package/lib/pipes/action-description.pipe.d.ts

@@ -0,0 +1,10 @@
+import { PipeTransform } from '@angular/core';
+import { TranslateService } from '@ngx-translate/core';
+import * as i0 from "@angular/core";
+export declare class ActionDescriptionPipe implements PipeTransform {
+    private readonly translateService;
+    constructor(translateService: TranslateService);
+    transform(action: string | null | undefined): string;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ActionDescriptionPipe, never>;
+    static ɵpipe: i0.ɵɵPipeDeclaration<ActionDescriptionPipe, "actionDescription", true>;
+}

package/lib/pipes/action-label.pipe.d.ts

@@ -0,0 +1,10 @@
+import { PipeTransform } from '@angular/core';
+import { TranslateService } from '@ngx-translate/core';
+import * as i0 from "@angular/core";
+export declare class ActionLabelPipe implements PipeTransform {
+    private readonly translateService;
+    constructor(translateService: TranslateService);
+    transform(action: string | null | undefined): string;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ActionLabelPipe, never>;
+    static ɵpipe: i0.ɵɵPipeDeclaration<ActionLabelPipe, "actionLabel", true>;
+}

package/lib/pipes/action-tag-type.pipe.d.ts

@@ -0,0 +1,8 @@
+import { PipeTransform } from '@angular/core';
+import { TagType } from 'carbon-components-angular';
+import * as i0 from "@angular/core";
+export declare class ActionTagTypePipe implements PipeTransform {
+    transform(action: string | null | undefined): TagType;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ActionTagTypePipe, never>;
+    static ɵpipe: i0.ɵɵPipeDeclaration<ActionTagTypePipe, "actionTagType", true>;
+}

package/lib/pipes/index.d.ts

@@ -1 +1,4 @@
+export * from './action-description.pipe';
+export * from './action-label.pipe';
+export * from './action-tag-type.pipe';
 export * from './resource-type-label.pipe';

package/lib/services/access-control-form-editor.service.d.ts

@@ -0,0 +1,37 @@
+import { FormArray, FormBuilder, FormGroup } from '@angular/forms';
+import { SelectItem } from '@valtimo/components';
+import { PbacRegistryDto } from '@valtimo/shared';
+import { ConditionType, Permission, PermissionCondition, UpdateRolePermission } from '../models';
+import * as i0 from "@angular/core";
+export declare class AccessControlFormEditorService {
+    private readonly fb;
+    private _resources;
+    private _resourceByType;
+    private _operatorKeys;
+    constructor(fb: FormBuilder);
+    setRegistry(registry: PbacRegistryDto): void;
+    buildPermissionsArray(permissions: Permission[]): FormArray;
+    createPermissionGroup(permission?: Permission): FormGroup;
+    createConditionGroup(condition?: PermissionCondition, type?: ConditionType): FormGroup;
+    serialize(permissionsArray: FormArray): UpdateRolePermission[];
+    serializePermission(group: FormGroup): UpdateRolePermission;
+    private serializeConditions;
+    resourceTypeItems(include?: string | string[] | null): SelectItem[];
+    contextResourceTypeItems(resourceType: string, include?: string | string[] | null): SelectItem[];
+    actionItems(resourceType: string, include?: string | string[] | null): SelectItem[];
+    fieldItems(resourceType: string, include?: string | string[] | null): SelectItem[];
+    containerTargetItems(resourceType: string, include?: string | string[] | null): SelectItem[];
+    operatorItems(): SelectItem[];
+    valueTypeItems(include?: string | string[] | null): SelectItem[];
+    get defaultValueType(): string;
+    isCustomValueType(clazz: string): boolean;
+    private normalizeActions;
+    private conditionField;
+    private conditionOperator;
+    private conditionValue;
+    private conditionClazz;
+    private withIncluded;
+    private sortByText;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AccessControlFormEditorService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AccessControlFormEditorService>;
+}

package/lib/services/access-control.service.d.ts

@@ -1,5 +1,5 @@
 import { HttpClient } from '@angular/common/http';
-import { ConfigService } from '@valtimo/shared';
+import { ConfigService, PbacRegistryDto } from '@valtimo/shared';
 import { BehaviorSubject, Observable } from 'rxjs';
 import { DeleteRolesRequest, Permission, PermissionSchema, Role } from '../models';
 import * as i0 from "@angular/core";
@@ -9,8 +9,10 @@ export declare class AccessControlService {
     readonly roles$: BehaviorSubject<Role[]>;
     readonly loading$: BehaviorSubject<boolean>;
     private valtimoEndpointUri;
+    private readonly apiEndpointUri;
     private get roleDtos$();
     constructor(configService: ConfigService, http: HttpClient);
+    getExternalRoles(externalRoleNamePrefix?: string): Observable<string[]>;
     addRole(role: Role): Observable<Role>;
     deleteRoles(request: DeleteRolesRequest): Observable<null>;
     dispatchAction(actionResult: Observable<Role | null>): void;
@@ -19,6 +21,7 @@ export declare class AccessControlService {
     exportRolePermissions(roles: string[]): Observable<object[]>;
     updateRolePermissions(roleKey: string, updatedPermission: object): Observable<object>;
     getPermissionSchema(): Observable<PermissionSchema>;
+    getPbacRegistry(): Observable<PbacRegistryDto>;
     updateRole(roleKey: string, request: Role): Observable<object>;
     static ɵfac: i0.ɵɵFactoryDeclaration<AccessControlService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<AccessControlService>;

package/lib/services/index.d.ts

@@ -1,2 +1,3 @@
+export * from './access-control-form-editor.service';
 export * from './access-control.service';
 export * from './permission-schema-metadata.service';

package/lib/services/permission-schema-metadata.service.d.ts

@@ -1,3 +1,4 @@
+import { PbacConditionTypeDto, PbacEntityMapperDto, PbacOperatorDto, PbacRegistryDto, PbacResourceDto } from '@valtimo/shared';
 import { Observable } from 'rxjs';
 import { PermissionSchema } from '../models';
 import { AccessControlService } from './access-control.service';
@@ -6,13 +7,30 @@ export declare class PermissionSchemaMetadataService {
     private readonly accessControlService;
     private readonly _knownResourceTypes$;
     private readonly _fieldsByResourceType$;
+    /**
+     * The full PBAC registry served by GET /api/management/v1/pbac/registry. This is the
+     * authoritative, purpose-built description of every resource type, its actions and fields,
+     * the available operators and condition types, the entity-mapper pairs that define which
+     * context resources a permission can be scoped to, and the configured roles. It drives both
+     * the read-only overview and the form-based editor.
+     */
+    readonly registry$: Observable<PbacRegistryDto>;
+    readonly resources$: Observable<PbacResourceDto[]>;
+    readonly resourceByType$: Observable<Record<string, PbacResourceDto>>;
+    /**
+     * Raw JSON schema served by GET /api/management/v1/permissions/schema. Drives validation and
+     * autocomplete in the Monaco JSON editor.
+     */
     readonly schema$: Observable<PermissionSchema>;
     readonly actionsByResourceType$: Observable<Record<string, string[]>>;
     readonly allResourceTypes$: Observable<string[]>;
+    readonly operators$: Observable<PbacOperatorDto[]>;
+    readonly conditionTypes$: Observable<PbacConditionTypeDto[]>;
+    readonly entityMappers$: Observable<PbacEntityMapperDto[]>;
+    readonly roles$: Observable<string[]>;
     constructor(accessControlService: AccessControlService);
     isResourceTypeKnown(fqn: string): boolean;
     isFieldKnown(resourceType: string, field: string): boolean;
-    private extractActionsByResourceType;
     private extractKnownResourceTypes;
     private extractFieldsByResourceType;
     static ɵfac: i0.ɵɵFactoryDeclaration<PermissionSchemaMetadataService, never>;

package/lib/utils/condition-value.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Render a stored condition value as editable text.
+ * - undefined -> empty string (no value set, e.g. a freshly-added condition)
+ * - null -> the literal "null" (so an intentional null reads as deliberate rather than an unfilled
+ *   field, and still round-trips back to null through textToValue)
+ * - string -> the raw string (so '${currentUserId}' and 'someKey' show without quotes)
+ * - everything else (number, boolean, array, object) -> its JSON representation
+ */
+declare function valueToText(value: unknown): string;
+/**
+ * Parse editable text back into a stored condition value.
+ * - empty string -> null
+ * - valid JSON (number, boolean, null, array, object, quoted string) -> the parsed value
+ * - anything else -> the raw string (so 'view' or '${currentUserId}' stay strings)
+ */
+declare function textToValue(text: string): unknown;
+export { textToValue, valueToText };

package/lib/utils/index.d.ts

@@ -1 +1,3 @@
+export * from './condition-value';
 export * from './format-condition';
+export * from './resource-name';

package/lib/utils/resource-name.d.ts

@@ -0,0 +1,4 @@
+import { SelectItem } from '@valtimo/components';
+declare function shortTypeName(fullyQualifiedName: string): string;
+declare function fqnSelectItem(fullyQualifiedName: string): SelectItem;
+export { fqnSelectItem, shortTypeName };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valtimo/access-control-management",
-  "version": "13.35.0",
+  "version": "13.36.1",
   "peerDependencies": {
     "@angular/common": "19.2.20",
     "@angular/core": "19.2.20"