@valtimo/access-control 13.37.0 → 13.39.0

package/fesm2022/valtimo-access-control.mjs

@@ -135,6 +135,7 @@ class PermissionService {
         this.QUEUE_COLLECTION_PERIOD_MS = 15;
         this._cachedResolvedPermissions = {};
         this._pendingPermissions = {};
+        this._permissionRequestsByKey = {};
         this._permissionRequestQueue = [];
     }
     requestPermission(permissionRequest, context) {
@@ -151,10 +152,40 @@ class PermissionService {
             return pendingPermissionRequest;
         }
         this._pendingPermissions[permissionRequestKey] = new Subject();
+        this._permissionRequestsByKey[permissionRequestKey] = permissionRequestWithContext;
         this.queuePermission(permissionRequestWithContext);
         this.logger.debug('Permissions: return new pending', permissionRequestKey);
         return this._pendingPermissions[permissionRequestKey].asObservable();
     }
+    /**
+     * Invalidates cached and in-flight permission results for the provided resource, so that
+     * subsequent permission requests are re-evaluated by the backend. Call this after an action
+     * that can change the outcome of permission checks (e.g. changing a task assignment).
+     *
+     * @param resource the resource type to invalidate, e.g.
+     * `com.ritense.valtimo.operaton.domain.OperatonTask`
+     * @param identifier when provided, only permissions requested with a context for this specific
+     * resource instance (or without an instance context) are invalidated; otherwise all permissions
+     * for the resource are invalidated
+     */
+    invalidateResource(resource, identifier) {
+        Object.entries(this._permissionRequestsByKey).forEach(([permissionRequestKey, permissionRequest]) => {
+            if (!this.permissionRequestMatchesResource(permissionRequest, resource, identifier)) {
+                return;
+            }
+            this.logger.debug('Permissions: invalidate permission request', permissionRequestKey);
+            delete this._cachedResolvedPermissions[permissionRequestKey];
+            delete this._pendingPermissions[permissionRequestKey];
+            delete this._permissionRequestsByKey[permissionRequestKey];
+        });
+    }
+    permissionRequestMatchesResource(permissionRequest, resource, identifier) {
+        const context = permissionRequest.context;
+        if (context?.resource === resource) {
+            return !identifier || context.identifier === identifier;
+        }
+        return permissionRequest.resource === resource;
+    }
     queuePermission(permissionRequest) {
         if (!this._permissionQueueSubscription || this._permissionQueueSubscription.closed) {
             this.logger.debug('Permissions: open new queue subscription');
@@ -172,11 +203,21 @@ class PermissionService {
                 .resolvePermissionRequestQueue(queueCopy)
                 .pipe(take(1))
                 .subscribe(resolvedPermissions => {
+                const resolvedPendingPermissions = {};
                 Object.keys(resolvedPermissions).forEach(permissionRequestKey => {
-                    this._pendingPermissions[permissionRequestKey].next(resolvedPermissions[permissionRequestKey]);
+                    const pendingPermission = this._pendingPermissions[permissionRequestKey];
+                    // requests invalidated while in flight no longer have a pending permission
+                    // and their results are discarded to prevent caching a stale value
+                    if (!pendingPermission)
+                        return;
+                    pendingPermission.next(resolvedPermissions[permissionRequestKey]);
+                    pendingPermission.complete();
+                    delete this._pendingPermissions[permissionRequestKey];
+                    resolvedPendingPermissions[permissionRequestKey] =
+                        resolvedPermissions[permissionRequestKey];
                     this.logger.debug(`Permissions: resolved pending permission request ${permissionRequestKey}`, resolvedPermissions[permissionRequestKey]);
                 });
-                this.cacheResolvedPermissions(resolvedPermissions);
+                this.cacheResolvedPermissions(resolvedPendingPermissions);
             });
         });
     }
@@ -200,6 +241,7 @@ class PermissionService {
             .subscribe(() => {
             this.clearPending();
             this.clearCache();
+            this.clearPermissionRequests();
         });
     }
     emptyQueue() {
@@ -214,6 +256,10 @@ class PermissionService {
         this.logger.debug('Permissions: clear pending');
         this._pendingPermissions = {};
     }
+    clearPermissionRequests() {
+        this.logger.debug('Permissions: clear permission requests');
+        this._permissionRequestsByKey = {};
+    }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.25", ngImport: i0, type: PermissionService, deps: [{ token: i1$1.KeycloakService }, { token: i3.NGXLogger }, { token: PermissionApiService }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "19.2.25", ngImport: i0, type: PermissionService, providedIn: 'root' }); }
 }

package/fesm2022/valtimo-access-control.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"valtimo-access-control.mjs","sources":["../../../../projects/valtimo/access-control/src/lib/models/permission.model.ts","../../../../projects/valtimo/access-control/src/lib/models/index.ts","../../../../projects/valtimo/access-control/src/lib/utils/permission.utils.ts","../../../../projects/valtimo/access-control/src/lib/utils/index.ts","../../../../projects/valtimo/access-control/src/lib/services/permission-api.service.ts","../../../../projects/valtimo/access-control/src/lib/services/permission.service.ts","../../../../projects/valtimo/access-control/src/lib/services/index.ts","../../../../projects/valtimo/access-control/src/public-api.ts","../../../../projects/valtimo/access-control/src/valtimo-access-control.ts"],"sourcesContent":["/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {Subject} from 'rxjs';\n\ninterface PermissionContext {\n  identifier: string;\n  resource: string;\n}\n\ninterface PermissionRequest {\n  action: string;\n  resource: string;\n  context?: PermissionContext;\n}\n\ntype PermissionRequestQueue = Array<PermissionRequest>;\n\ninterface PermissionResponse {\n  request: PermissionRequest;\n  available: boolean;\n}\n\ninterface CachedResolvedPermissions {\n  [permissionRequestKey: string]: boolean;\n}\n\ninterface PendingPermissions {\n  [permissionRequestKey: string]: Subject<boolean>;\n}\n\ninterface ResolvedPermissions {\n  [permissionRequestKey: string]: boolean;\n}\n\nexport {\n  CachedResolvedPermissions,\n  PendingPermissions,\n  PermissionContext,\n  PermissionRequest,\n  PermissionRequestQueue,\n  PermissionResponse,\n  ResolvedPermissions,\n};\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './permission.model';\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {PermissionRequest} from '../models';\n\nconst getPermissionRequestKey = (permissionRequest: PermissionRequest): string => {\n  const input = JSON.stringify(permissionRequest);\n  const len = input.length;\n\n  let hash = 0;\n\n  for (let i = 0; i < len; i++) {\n    hash = (hash << 5) - hash + input.charCodeAt(i);\n    hash |= 0; // to 32bit integer\n  }\n  return `${hash}`;\n};\n\nexport {getPermissionRequestKey};\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './permission.utils';\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {HttpClient} from '@angular/common/http';\nimport {Injectable} from '@angular/core';\nimport {ConfigService} from '@valtimo/shared';\nimport {map, Observable} from 'rxjs';\nimport {\n  PermissionRequest,\n  PermissionRequestQueue,\n  PermissionResponse,\n  ResolvedPermissions,\n} from '../models';\nimport {getPermissionRequestKey} from '../utils';\nimport {NGXLogger} from 'ngx-logger';\n\n@Injectable({\n  providedIn: 'root',\n})\nexport class PermissionApiService {\n  private valtimoEndpointUri: string;\n\n  constructor(\n    private readonly http: HttpClient,\n    private readonly configService: ConfigService,\n    private readonly logger: NGXLogger\n  ) {\n    this.valtimoEndpointUri = this.configService.config.valtimoApi.endpointUri;\n  }\n\n  public resolvePermissionRequestQueue(\n    permissionRequestQueue: PermissionRequestQueue\n  ): Observable<ResolvedPermissions> {\n    this.logger.debug('Permissions: request to resolve permission queue', permissionRequestQueue);\n\n    return this.requestPermission(permissionRequestQueue).pipe(\n      map((res: PermissionResponse[]) => {\n        const keys: string[] = permissionRequestQueue.map(permissionRequest =>\n          getPermissionRequestKey(permissionRequest)\n        );\n\n        return res.reduce(\n          (acc: ResolvedPermissions, curr: PermissionResponse, index: number) => ({\n            ...acc,\n            [keys[index]]: curr.available,\n          }),\n          {}\n        );\n      })\n    );\n  }\n\n  public requestPermission(request: PermissionRequest[]): Observable<PermissionResponse[]> {\n    return this.http.post<PermissionResponse[]>(\n      `${this.valtimoEndpointUri}v1/permissions`,\n      request\n    );\n  }\n}\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {Injectable} from '@angular/core';\nimport {jwtDecode} from 'jwt-decode';\nimport {KeycloakService} from 'keycloak-angular';\nimport {NGXLogger} from 'ngx-logger';\nimport {Observable, of, Subject, Subscription, switchMap, take, timer} from 'rxjs';\nimport {fromPromise} from 'rxjs/internal/observable/innerFrom';\nimport {\n  CachedResolvedPermissions,\n  PendingPermissions,\n  PermissionContext,\n  PermissionRequest,\n  PermissionRequestQueue,\n  ResolvedPermissions,\n} from '../models';\nimport {PermissionApiService} from './permission-api.service';\nimport {getPermissionRequestKey} from '../utils';\n\n@Injectable({\n  providedIn: 'root',\n})\nexport class PermissionService {\n  private readonly QUEUE_COLLECTION_PERIOD_MS = 15;\n  private _cachedResolvedPermissions: CachedResolvedPermissions = {};\n  private _pendingPermissions: PendingPermissions = {};\n  private _permissionRequestQueue: PermissionRequestQueue = [];\n  private _permissionQueueSubscription!: Subscription;\n  private _clearCacheSubscription!: Subscription;\n\n  constructor(\n    private readonly keyCloakService: KeycloakService,\n    private readonly logger: NGXLogger,\n    private readonly permissionApiService: PermissionApiService\n  ) {}\n\n  public requestPermission(\n    permissionRequest: PermissionRequest,\n    context?: PermissionContext\n  ): Observable<boolean> {\n    const permissionRequestWithContext = {...permissionRequest, context};\n    const permissionRequestKey = getPermissionRequestKey(permissionRequestWithContext);\n    const cachedResolvedPermission = this._cachedResolvedPermissions[permissionRequestKey];\n    const pendingPermissionRequest = this._pendingPermissions[permissionRequestKey];\n\n    if (Object.keys(this._cachedResolvedPermissions).includes(permissionRequestKey)) {\n      this.logger.debug(\n        'Permissions: return cached resolved permission',\n        permissionRequestKey,\n        cachedResolvedPermission\n      );\n\n      return of(cachedResolvedPermission);\n    }\n\n    if (pendingPermissionRequest) {\n      this.logger.debug('Permissions: return existing pending permission', permissionRequestKey);\n\n      return pendingPermissionRequest;\n    }\n\n    this._pendingPermissions[permissionRequestKey] = new Subject<boolean>();\n\n    this.queuePermission(permissionRequestWithContext);\n\n    this.logger.debug('Permissions: return new pending', permissionRequestKey);\n\n    return this._pendingPermissions[permissionRequestKey].asObservable();\n  }\n\n  private queuePermission(permissionRequest: PermissionRequest): void {\n    if (!this._permissionQueueSubscription || this._permissionQueueSubscription.closed) {\n      this.logger.debug('Permissions: open new queue subscription');\n\n      this.openQueueSubscription();\n    }\n\n    this._permissionRequestQueue.push(permissionRequest);\n\n    this.logger.debug(`Permissions: add request to queue: ${JSON.stringify(permissionRequest)}`);\n  }\n\n  private openQueueSubscription(): void {\n    this._permissionQueueSubscription = timer(this.QUEUE_COLLECTION_PERIOD_MS).subscribe(() => {\n      this.logger.debug('Permissions: queue timer finished');\n\n      const queueCopy = [...this._permissionRequestQueue];\n\n      this.emptyQueue();\n\n      this.permissionApiService\n        .resolvePermissionRequestQueue(queueCopy)\n        .pipe(take(1))\n        .subscribe(resolvedPermissions => {\n          Object.keys(resolvedPermissions).forEach(permissionRequestKey => {\n            this._pendingPermissions[permissionRequestKey].next(\n              resolvedPermissions[permissionRequestKey]\n            );\n            this.logger.debug(\n              `Permissions: resolved pending permission request ${permissionRequestKey}`,\n              resolvedPermissions[permissionRequestKey]\n            );\n          });\n\n          this.cacheResolvedPermissions(resolvedPermissions);\n        });\n    });\n  }\n\n  private cacheResolvedPermissions(resolvedPermissions: ResolvedPermissions): void {\n    Object.keys(resolvedPermissions).forEach(permissionRequestKey => {\n      this._cachedResolvedPermissions[permissionRequestKey] =\n        resolvedPermissions[permissionRequestKey];\n      this.logger.debug('Permissions: cache resolved permission request', permissionRequestKey);\n    });\n\n    if (!this._clearCacheSubscription || this._clearCacheSubscription.closed) {\n      this.openClearCacheSubscription();\n    }\n  }\n\n  private openClearCacheSubscription(): void {\n    this._clearCacheSubscription = fromPromise(this.keyCloakService.getToken())\n      .pipe(\n        take(1),\n        switchMap(token => {\n          const tokenExp = jwtDecode(token).exp * 1000;\n          const expiryTime = tokenExp - Date.now() - 1000;\n          return timer(expiryTime);\n        })\n      )\n      .subscribe(() => {\n        this.clearPending();\n        this.clearCache();\n      });\n  }\n\n  private emptyQueue(): void {\n    this.logger.debug('Permissions: empty queue');\n    this._permissionRequestQueue = [];\n  }\n\n  private clearCache(): void {\n    this.logger.debug('Permissions: clear cache');\n    this._cachedResolvedPermissions = {};\n  }\n\n  private clearPending(): void {\n    this.logger.debug('Permissions: clear pending');\n    this._pendingPermissions = {};\n  }\n}\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './permission.service';\nexport * from './permission-api.service';\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*\n * Public API Surface of access-control\n */\n\nexport * from './lib/models';\nexport * from './lib/services';\nexport * from './lib/utils';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":["i1","i2","i3.PermissionApiService"],"mappings":";;;;;;;;;;AAAA;;;;;;;;;;;;;;AAcG;;ACdH;;;;;;;;;;;;;;AAcG;;ACdH;;;;;;;;;;;;;;AAcG;AAIH,MAAM,uBAAuB,GAAG,CAAC,iBAAoC,KAAY;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;AAC/C,IAAA,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM;IAExB,IAAI,IAAI,GAAG,CAAC;AAEZ,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;AAC5B,QAAA,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/C,QAAA,IAAI,IAAI,CAAC,CAAC;IACZ;IACA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE;AAClB;;AC7BA;;;;;;;;;;;;;;AAcG;;MCkBU,oBAAoB,CAAA;AAG/B,IAAA,WAAA,CACmB,IAAgB,EAChB,aAA4B,EAC5B,MAAiB,EAAA;QAFjB,IAAA,CAAA,IAAI,GAAJ,IAAI;QACJ,IAAA,CAAA,aAAa,GAAb,aAAa;QACb,IAAA,CAAA,MAAM,GAAN,MAAM;AAEvB,QAAA,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW;IAC5E;AAEO,IAAA,6BAA6B,CAClC,sBAA8C,EAAA;QAE9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,sBAAsB,CAAC;AAE7F,QAAA,OAAO,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,IAAI,CACxD,GAAG,CAAC,CAAC,GAAyB,KAAI;AAChC,YAAA,MAAM,IAAI,GAAa,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,IACjE,uBAAuB,CAAC,iBAAiB,CAAC,CAC3C;AAED,YAAA,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,GAAwB,EAAE,IAAwB,EAAE,KAAa,MAAM;AACtE,gBAAA,GAAG,GAAG;gBACN,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS;aAC9B,CAAC,EACF,EAAE,CACH;QACH,CAAC,CAAC,CACH;IACH;AAEO,IAAA,iBAAiB,CAAC,OAA4B,EAAA;AACnD,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,CAAA,EAAG,IAAI,CAAC,kBAAkB,CAAA,cAAA,CAAgB,EAC1C,OAAO,CACR;IACH;+GAtCW,oBAAoB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAA,EAAA,CAAA,UAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,aAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,SAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAApB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,oBAAoB,cAFnB,MAAM,EAAA,CAAA,CAAA;;4FAEP,oBAAoB,EAAA,UAAA,EAAA,CAAA;kBAHhC,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE,MAAM;AACnB,iBAAA;;;AC/BD;;;;;;;;;;;;;;AAcG;MAsBU,iBAAiB,CAAA;AAQ5B,IAAA,WAAA,CACmB,eAAgC,EAChC,MAAiB,EACjB,oBAA0C,EAAA;QAF1C,IAAA,CAAA,eAAe,GAAf,eAAe;QACf,IAAA,CAAA,MAAM,GAAN,MAAM;QACN,IAAA,CAAA,oBAAoB,GAApB,oBAAoB;QAVtB,IAAA,CAAA,0BAA0B,GAAG,EAAE;QACxC,IAAA,CAAA,0BAA0B,GAA8B,EAAE;QAC1D,IAAA,CAAA,mBAAmB,GAAuB,EAAE;QAC5C,IAAA,CAAA,uBAAuB,GAA2B,EAAE;IAQzD;IAEI,iBAAiB,CACtB,iBAAoC,EACpC,OAA2B,EAAA;QAE3B,MAAM,4BAA4B,GAAG,EAAC,GAAG,iBAAiB,EAAE,OAAO,EAAC;AACpE,QAAA,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,4BAA4B,CAAC;QAClF,MAAM,wBAAwB,GAAG,IAAI,CAAC,0BAA0B,CAAC,oBAAoB,CAAC;QACtF,MAAM,wBAAwB,GAAG,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC;AAE/E,QAAA,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAgD,EAChD,oBAAoB,EACpB,wBAAwB,CACzB;AAED,YAAA,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACrC;QAEA,IAAI,wBAAwB,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,oBAAoB,CAAC;AAE1F,YAAA,OAAO,wBAAwB;QACjC;QAEA,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,GAAG,IAAI,OAAO,EAAW;AAEvE,QAAA,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,oBAAoB,CAAC;QAE1E,OAAO,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,YAAY,EAAE;IACtE;AAEQ,IAAA,eAAe,CAAC,iBAAoC,EAAA;QAC1D,IAAI,CAAC,IAAI,CAAC,4BAA4B,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE;AAClF,YAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC;YAE7D,IAAI,CAAC,qBAAqB,EAAE;QAC9B;AAEA,QAAA,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,iBAAiB,CAAC;AAEpD,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,mCAAA,EAAsC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA,CAAE,CAAC;IAC9F;IAEQ,qBAAqB,GAAA;AAC3B,QAAA,IAAI,CAAC,4BAA4B,GAAG,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,SAAS,CAAC,MAAK;AACxF,YAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC;YAEtD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC;YAEnD,IAAI,CAAC,UAAU,EAAE;AAEjB,YAAA,IAAI,CAAC;iBACF,6BAA6B,CAAC,SAAS;AACvC,iBAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACZ,SAAS,CAAC,mBAAmB,IAAG;gBAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAG;AAC9D,oBAAA,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,IAAI,CACjD,mBAAmB,CAAC,oBAAoB,CAAC,CAC1C;AACD,oBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,CAAA,iDAAA,EAAoD,oBAAoB,CAAA,CAAE,EAC1E,mBAAmB,CAAC,oBAAoB,CAAC,CAC1C;AACH,gBAAA,CAAC,CAAC;AAEF,gBAAA,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC;AACpD,YAAA,CAAC,CAAC;AACN,QAAA,CAAC,CAAC;IACJ;AAEQ,IAAA,wBAAwB,CAAC,mBAAwC,EAAA;QACvE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAG;AAC9D,YAAA,IAAI,CAAC,0BAA0B,CAAC,oBAAoB,CAAC;gBACnD,mBAAmB,CAAC,oBAAoB,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE,oBAAoB,CAAC;AAC3F,QAAA,CAAC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE;YACxE,IAAI,CAAC,0BAA0B,EAAE;QACnC;IACF;IAEQ,0BAA0B,GAAA;QAChC,IAAI,CAAC,uBAAuB,GAAG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE;aACvE,IAAI,CACH,IAAI,CAAC,CAAC,CAAC,EACP,SAAS,CAAC,KAAK,IAAG;YAChB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI;YAC5C,MAAM,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;AAC/C,YAAA,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,QAAA,CAAC,CAAC;aAEH,SAAS,CAAC,MAAK;YACd,IAAI,CAAC,YAAY,EAAE;YACnB,IAAI,CAAC,UAAU,EAAE;AACnB,QAAA,CAAC,CAAC;IACN;IAEQ,UAAU,GAAA;AAChB,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;AAC7C,QAAA,IAAI,CAAC,uBAAuB,GAAG,EAAE;IACnC;IAEQ,UAAU,GAAA;AAChB,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;AAC7C,QAAA,IAAI,CAAC,0BAA0B,GAAG,EAAE;IACtC;IAEQ,YAAY,GAAA;AAClB,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC;AAC/C,QAAA,IAAI,CAAC,mBAAmB,GAAG,EAAE;IAC/B;+GAhIW,iBAAiB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAA,IAAA,CAAA,eAAA,EAAA,EAAA,EAAA,KAAA,EAAAC,EAAA,CAAA,SAAA,EAAA,EAAA,EAAA,KAAA,EAAAC,oBAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAjB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,iBAAiB,cAFhB,MAAM,EAAA,CAAA,CAAA;;4FAEP,iBAAiB,EAAA,UAAA,EAAA,CAAA;kBAH7B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE,MAAM;AACnB,iBAAA;;;ACnCD;;;;;;;;;;;;;;AAcG;;ACdH;;;;;;;;;;;;;;AAcG;AAEH;;AAEG;;AClBH;;AAEG;;;;"}
+{"version":3,"file":"valtimo-access-control.mjs","sources":["../../../../projects/valtimo/access-control/src/lib/models/permission.model.ts","../../../../projects/valtimo/access-control/src/lib/models/index.ts","../../../../projects/valtimo/access-control/src/lib/utils/permission.utils.ts","../../../../projects/valtimo/access-control/src/lib/utils/index.ts","../../../../projects/valtimo/access-control/src/lib/services/permission-api.service.ts","../../../../projects/valtimo/access-control/src/lib/services/permission.service.ts","../../../../projects/valtimo/access-control/src/lib/services/index.ts","../../../../projects/valtimo/access-control/src/public-api.ts","../../../../projects/valtimo/access-control/src/valtimo-access-control.ts"],"sourcesContent":["/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {Subject} from 'rxjs';\n\ninterface PermissionContext {\n  identifier: string;\n  resource: string;\n}\n\ninterface PermissionRequest {\n  action: string;\n  resource: string;\n  context?: PermissionContext;\n}\n\ntype PermissionRequestQueue = Array<PermissionRequest>;\n\ninterface PermissionResponse {\n  request: PermissionRequest;\n  available: boolean;\n}\n\ninterface CachedResolvedPermissions {\n  [permissionRequestKey: string]: boolean;\n}\n\ninterface PendingPermissions {\n  [permissionRequestKey: string]: Subject<boolean>;\n}\n\ninterface ResolvedPermissions {\n  [permissionRequestKey: string]: boolean;\n}\n\nexport {\n  CachedResolvedPermissions,\n  PendingPermissions,\n  PermissionContext,\n  PermissionRequest,\n  PermissionRequestQueue,\n  PermissionResponse,\n  ResolvedPermissions,\n};\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './permission.model';\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {PermissionRequest} from '../models';\n\nconst getPermissionRequestKey = (permissionRequest: PermissionRequest): string => {\n  const input = JSON.stringify(permissionRequest);\n  const len = input.length;\n\n  let hash = 0;\n\n  for (let i = 0; i < len; i++) {\n    hash = (hash << 5) - hash + input.charCodeAt(i);\n    hash |= 0; // to 32bit integer\n  }\n  return `${hash}`;\n};\n\nexport {getPermissionRequestKey};\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './permission.utils';\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {HttpClient} from '@angular/common/http';\nimport {Injectable} from '@angular/core';\nimport {ConfigService} from '@valtimo/shared';\nimport {map, Observable} from 'rxjs';\nimport {\n  PermissionRequest,\n  PermissionRequestQueue,\n  PermissionResponse,\n  ResolvedPermissions,\n} from '../models';\nimport {getPermissionRequestKey} from '../utils';\nimport {NGXLogger} from 'ngx-logger';\n\n@Injectable({\n  providedIn: 'root',\n})\nexport class PermissionApiService {\n  private valtimoEndpointUri: string;\n\n  constructor(\n    private readonly http: HttpClient,\n    private readonly configService: ConfigService,\n    private readonly logger: NGXLogger\n  ) {\n    this.valtimoEndpointUri = this.configService.config.valtimoApi.endpointUri;\n  }\n\n  public resolvePermissionRequestQueue(\n    permissionRequestQueue: PermissionRequestQueue\n  ): Observable<ResolvedPermissions> {\n    this.logger.debug('Permissions: request to resolve permission queue', permissionRequestQueue);\n\n    return this.requestPermission(permissionRequestQueue).pipe(\n      map((res: PermissionResponse[]) => {\n        const keys: string[] = permissionRequestQueue.map(permissionRequest =>\n          getPermissionRequestKey(permissionRequest)\n        );\n\n        return res.reduce(\n          (acc: ResolvedPermissions, curr: PermissionResponse, index: number) => ({\n            ...acc,\n            [keys[index]]: curr.available,\n          }),\n          {}\n        );\n      })\n    );\n  }\n\n  public requestPermission(request: PermissionRequest[]): Observable<PermissionResponse[]> {\n    return this.http.post<PermissionResponse[]>(\n      `${this.valtimoEndpointUri}v1/permissions`,\n      request\n    );\n  }\n}\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {Injectable} from '@angular/core';\nimport {jwtDecode} from 'jwt-decode';\nimport {KeycloakService} from 'keycloak-angular';\nimport {NGXLogger} from 'ngx-logger';\nimport {Observable, of, Subject, Subscription, switchMap, take, timer} from 'rxjs';\nimport {fromPromise} from 'rxjs/internal/observable/innerFrom';\nimport {\n  CachedResolvedPermissions,\n  PendingPermissions,\n  PermissionContext,\n  PermissionRequest,\n  PermissionRequestQueue,\n  ResolvedPermissions,\n} from '../models';\nimport {PermissionApiService} from './permission-api.service';\nimport {getPermissionRequestKey} from '../utils';\n\n@Injectable({\n  providedIn: 'root',\n})\nexport class PermissionService {\n  private readonly QUEUE_COLLECTION_PERIOD_MS = 15;\n  private _cachedResolvedPermissions: CachedResolvedPermissions = {};\n  private _pendingPermissions: PendingPermissions = {};\n  private _permissionRequestsByKey: {[permissionRequestKey: string]: PermissionRequest} = {};\n  private _permissionRequestQueue: PermissionRequestQueue = [];\n  private _permissionQueueSubscription!: Subscription;\n  private _clearCacheSubscription!: Subscription;\n\n  constructor(\n    private readonly keyCloakService: KeycloakService,\n    private readonly logger: NGXLogger,\n    private readonly permissionApiService: PermissionApiService\n  ) {}\n\n  public requestPermission(\n    permissionRequest: PermissionRequest,\n    context?: PermissionContext\n  ): Observable<boolean> {\n    const permissionRequestWithContext = {...permissionRequest, context};\n    const permissionRequestKey = getPermissionRequestKey(permissionRequestWithContext);\n    const cachedResolvedPermission = this._cachedResolvedPermissions[permissionRequestKey];\n    const pendingPermissionRequest = this._pendingPermissions[permissionRequestKey];\n\n    if (Object.keys(this._cachedResolvedPermissions).includes(permissionRequestKey)) {\n      this.logger.debug(\n        'Permissions: return cached resolved permission',\n        permissionRequestKey,\n        cachedResolvedPermission\n      );\n\n      return of(cachedResolvedPermission);\n    }\n\n    if (pendingPermissionRequest) {\n      this.logger.debug('Permissions: return existing pending permission', permissionRequestKey);\n\n      return pendingPermissionRequest;\n    }\n\n    this._pendingPermissions[permissionRequestKey] = new Subject<boolean>();\n    this._permissionRequestsByKey[permissionRequestKey] = permissionRequestWithContext;\n\n    this.queuePermission(permissionRequestWithContext);\n\n    this.logger.debug('Permissions: return new pending', permissionRequestKey);\n\n    return this._pendingPermissions[permissionRequestKey].asObservable();\n  }\n\n  /**\n   * Invalidates cached and in-flight permission results for the provided resource, so that\n   * subsequent permission requests are re-evaluated by the backend. Call this after an action\n   * that can change the outcome of permission checks (e.g. changing a task assignment).\n   *\n   * @param resource the resource type to invalidate, e.g.\n   * `com.ritense.valtimo.operaton.domain.OperatonTask`\n   * @param identifier when provided, only permissions requested with a context for this specific\n   * resource instance (or without an instance context) are invalidated; otherwise all permissions\n   * for the resource are invalidated\n   */\n  public invalidateResource(resource: string, identifier?: string): void {\n    Object.entries(this._permissionRequestsByKey).forEach(\n      ([permissionRequestKey, permissionRequest]) => {\n        if (!this.permissionRequestMatchesResource(permissionRequest, resource, identifier)) {\n          return;\n        }\n\n        this.logger.debug('Permissions: invalidate permission request', permissionRequestKey);\n\n        delete this._cachedResolvedPermissions[permissionRequestKey];\n        delete this._pendingPermissions[permissionRequestKey];\n        delete this._permissionRequestsByKey[permissionRequestKey];\n      }\n    );\n  }\n\n  private permissionRequestMatchesResource(\n    permissionRequest: PermissionRequest,\n    resource: string,\n    identifier?: string\n  ): boolean {\n    const context = permissionRequest.context;\n\n    if (context?.resource === resource) {\n      return !identifier || context.identifier === identifier;\n    }\n\n    return permissionRequest.resource === resource;\n  }\n\n  private queuePermission(permissionRequest: PermissionRequest): void {\n    if (!this._permissionQueueSubscription || this._permissionQueueSubscription.closed) {\n      this.logger.debug('Permissions: open new queue subscription');\n\n      this.openQueueSubscription();\n    }\n\n    this._permissionRequestQueue.push(permissionRequest);\n\n    this.logger.debug(`Permissions: add request to queue: ${JSON.stringify(permissionRequest)}`);\n  }\n\n  private openQueueSubscription(): void {\n    this._permissionQueueSubscription = timer(this.QUEUE_COLLECTION_PERIOD_MS).subscribe(() => {\n      this.logger.debug('Permissions: queue timer finished');\n\n      const queueCopy = [...this._permissionRequestQueue];\n\n      this.emptyQueue();\n\n      this.permissionApiService\n        .resolvePermissionRequestQueue(queueCopy)\n        .pipe(take(1))\n        .subscribe(resolvedPermissions => {\n          const resolvedPendingPermissions: ResolvedPermissions = {};\n\n          Object.keys(resolvedPermissions).forEach(permissionRequestKey => {\n            const pendingPermission = this._pendingPermissions[permissionRequestKey];\n\n            // requests invalidated while in flight no longer have a pending permission\n            // and their results are discarded to prevent caching a stale value\n            if (!pendingPermission) return;\n\n            pendingPermission.next(resolvedPermissions[permissionRequestKey]);\n            pendingPermission.complete();\n            delete this._pendingPermissions[permissionRequestKey];\n\n            resolvedPendingPermissions[permissionRequestKey] =\n              resolvedPermissions[permissionRequestKey];\n\n            this.logger.debug(\n              `Permissions: resolved pending permission request ${permissionRequestKey}`,\n              resolvedPermissions[permissionRequestKey]\n            );\n          });\n\n          this.cacheResolvedPermissions(resolvedPendingPermissions);\n        });\n    });\n  }\n\n  private cacheResolvedPermissions(resolvedPermissions: ResolvedPermissions): void {\n    Object.keys(resolvedPermissions).forEach(permissionRequestKey => {\n      this._cachedResolvedPermissions[permissionRequestKey] =\n        resolvedPermissions[permissionRequestKey];\n      this.logger.debug('Permissions: cache resolved permission request', permissionRequestKey);\n    });\n\n    if (!this._clearCacheSubscription || this._clearCacheSubscription.closed) {\n      this.openClearCacheSubscription();\n    }\n  }\n\n  private openClearCacheSubscription(): void {\n    this._clearCacheSubscription = fromPromise(this.keyCloakService.getToken())\n      .pipe(\n        take(1),\n        switchMap(token => {\n          const tokenExp = jwtDecode(token).exp * 1000;\n          const expiryTime = tokenExp - Date.now() - 1000;\n          return timer(expiryTime);\n        })\n      )\n      .subscribe(() => {\n        this.clearPending();\n        this.clearCache();\n        this.clearPermissionRequests();\n      });\n  }\n\n  private emptyQueue(): void {\n    this.logger.debug('Permissions: empty queue');\n    this._permissionRequestQueue = [];\n  }\n\n  private clearCache(): void {\n    this.logger.debug('Permissions: clear cache');\n    this._cachedResolvedPermissions = {};\n  }\n\n  private clearPending(): void {\n    this.logger.debug('Permissions: clear pending');\n    this._pendingPermissions = {};\n  }\n\n  private clearPermissionRequests(): void {\n    this.logger.debug('Permissions: clear permission requests');\n    this._permissionRequestsByKey = {};\n  }\n}\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './permission.service';\nexport * from './permission-api.service';\n","/*\n * Copyright 2015-2025 Ritense BV, the Netherlands.\n *\n * Licensed under EUPL, Version 1.2 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" basis,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*\n * Public API Surface of access-control\n */\n\nexport * from './lib/models';\nexport * from './lib/services';\nexport * from './lib/utils';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":["i1","i2","i3.PermissionApiService"],"mappings":";;;;;;;;;;AAAA;;;;;;;;;;;;;;AAcG;;ACdH;;;;;;;;;;;;;;AAcG;;ACdH;;;;;;;;;;;;;;AAcG;AAIH,MAAM,uBAAuB,GAAG,CAAC,iBAAoC,KAAY;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;AAC/C,IAAA,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM;IAExB,IAAI,IAAI,GAAG,CAAC;AAEZ,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE;AAC5B,QAAA,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/C,QAAA,IAAI,IAAI,CAAC,CAAC;IACZ;IACA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE;AAClB;;AC7BA;;;;;;;;;;;;;;AAcG;;MCkBU,oBAAoB,CAAA;AAG/B,IAAA,WAAA,CACmB,IAAgB,EAChB,aAA4B,EAC5B,MAAiB,EAAA;QAFjB,IAAA,CAAA,IAAI,GAAJ,IAAI;QACJ,IAAA,CAAA,aAAa,GAAb,aAAa;QACb,IAAA,CAAA,MAAM,GAAN,MAAM;AAEvB,QAAA,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW;IAC5E;AAEO,IAAA,6BAA6B,CAClC,sBAA8C,EAAA;QAE9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,sBAAsB,CAAC;AAE7F,QAAA,OAAO,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,IAAI,CACxD,GAAG,CAAC,CAAC,GAAyB,KAAI;AAChC,YAAA,MAAM,IAAI,GAAa,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,IACjE,uBAAuB,CAAC,iBAAiB,CAAC,CAC3C;AAED,YAAA,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,GAAwB,EAAE,IAAwB,EAAE,KAAa,MAAM;AACtE,gBAAA,GAAG,GAAG;gBACN,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS;aAC9B,CAAC,EACF,EAAE,CACH;QACH,CAAC,CAAC,CACH;IACH;AAEO,IAAA,iBAAiB,CAAC,OAA4B,EAAA;AACnD,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,CAAA,EAAG,IAAI,CAAC,kBAAkB,CAAA,cAAA,CAAgB,EAC1C,OAAO,CACR;IACH;+GAtCW,oBAAoB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAA,EAAA,CAAA,UAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,aAAA,EAAA,EAAA,EAAA,KAAA,EAAA,EAAA,CAAA,SAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAApB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,oBAAoB,cAFnB,MAAM,EAAA,CAAA,CAAA;;4FAEP,oBAAoB,EAAA,UAAA,EAAA,CAAA;kBAHhC,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE,MAAM;AACnB,iBAAA;;;AC/BD;;;;;;;;;;;;;;AAcG;MAsBU,iBAAiB,CAAA;AAS5B,IAAA,WAAA,CACmB,eAAgC,EAChC,MAAiB,EACjB,oBAA0C,EAAA;QAF1C,IAAA,CAAA,eAAe,GAAf,eAAe;QACf,IAAA,CAAA,MAAM,GAAN,MAAM;QACN,IAAA,CAAA,oBAAoB,GAApB,oBAAoB;QAXtB,IAAA,CAAA,0BAA0B,GAAG,EAAE;QACxC,IAAA,CAAA,0BAA0B,GAA8B,EAAE;QAC1D,IAAA,CAAA,mBAAmB,GAAuB,EAAE;QAC5C,IAAA,CAAA,wBAAwB,GAAwD,EAAE;QAClF,IAAA,CAAA,uBAAuB,GAA2B,EAAE;IAQzD;IAEI,iBAAiB,CACtB,iBAAoC,EACpC,OAA2B,EAAA;QAE3B,MAAM,4BAA4B,GAAG,EAAC,GAAG,iBAAiB,EAAE,OAAO,EAAC;AACpE,QAAA,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,4BAA4B,CAAC;QAClF,MAAM,wBAAwB,GAAG,IAAI,CAAC,0BAA0B,CAAC,oBAAoB,CAAC;QACtF,MAAM,wBAAwB,GAAG,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC;AAE/E,QAAA,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE;YAC/E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAgD,EAChD,oBAAoB,EACpB,wBAAwB,CACzB;AAED,YAAA,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACrC;QAEA,IAAI,wBAAwB,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,oBAAoB,CAAC;AAE1F,YAAA,OAAO,wBAAwB;QACjC;QAEA,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,GAAG,IAAI,OAAO,EAAW;AACvE,QAAA,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,GAAG,4BAA4B;AAElF,QAAA,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,oBAAoB,CAAC;QAE1E,OAAO,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,YAAY,EAAE;IACtE;AAEA;;;;;;;;;;AAUG;IACI,kBAAkB,CAAC,QAAgB,EAAE,UAAmB,EAAA;AAC7D,QAAA,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CACnD,CAAC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,KAAI;AAC5C,YAAA,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACnF;YACF;YAEA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,oBAAoB,CAAC;AAErF,YAAA,OAAO,IAAI,CAAC,0BAA0B,CAAC,oBAAoB,CAAC;AAC5D,YAAA,OAAO,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC;AACrD,YAAA,OAAO,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC;AAC5D,QAAA,CAAC,CACF;IACH;AAEQ,IAAA,gCAAgC,CACtC,iBAAoC,EACpC,QAAgB,EAChB,UAAmB,EAAA;AAEnB,QAAA,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO;AAEzC,QAAA,IAAI,OAAO,EAAE,QAAQ,KAAK,QAAQ,EAAE;YAClC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;QACzD;AAEA,QAAA,OAAO,iBAAiB,CAAC,QAAQ,KAAK,QAAQ;IAChD;AAEQ,IAAA,eAAe,CAAC,iBAAoC,EAAA;QAC1D,IAAI,CAAC,IAAI,CAAC,4BAA4B,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE;AAClF,YAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC;YAE7D,IAAI,CAAC,qBAAqB,EAAE;QAC9B;AAEA,QAAA,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,iBAAiB,CAAC;AAEpD,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,mCAAA,EAAsC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA,CAAE,CAAC;IAC9F;IAEQ,qBAAqB,GAAA;AAC3B,QAAA,IAAI,CAAC,4BAA4B,GAAG,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,SAAS,CAAC,MAAK;AACxF,YAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC;YAEtD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC;YAEnD,IAAI,CAAC,UAAU,EAAE;AAEjB,YAAA,IAAI,CAAC;iBACF,6BAA6B,CAAC,SAAS;AACvC,iBAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACZ,SAAS,CAAC,mBAAmB,IAAG;gBAC/B,MAAM,0BAA0B,GAAwB,EAAE;gBAE1D,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAG;oBAC9D,MAAM,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC;;;AAIxE,oBAAA,IAAI,CAAC,iBAAiB;wBAAE;oBAExB,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;oBACjE,iBAAiB,CAAC,QAAQ,EAAE;AAC5B,oBAAA,OAAO,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC;oBAErD,0BAA0B,CAAC,oBAAoB,CAAC;wBAC9C,mBAAmB,CAAC,oBAAoB,CAAC;AAE3C,oBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,CAAA,iDAAA,EAAoD,oBAAoB,CAAA,CAAE,EAC1E,mBAAmB,CAAC,oBAAoB,CAAC,CAC1C;AACH,gBAAA,CAAC,CAAC;AAEF,gBAAA,IAAI,CAAC,wBAAwB,CAAC,0BAA0B,CAAC;AAC3D,YAAA,CAAC,CAAC;AACN,QAAA,CAAC,CAAC;IACJ;AAEQ,IAAA,wBAAwB,CAAC,mBAAwC,EAAA;QACvE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAG;AAC9D,YAAA,IAAI,CAAC,0BAA0B,CAAC,oBAAoB,CAAC;gBACnD,mBAAmB,CAAC,oBAAoB,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE,oBAAoB,CAAC;AAC3F,QAAA,CAAC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE;YACxE,IAAI,CAAC,0BAA0B,EAAE;QACnC;IACF;IAEQ,0BAA0B,GAAA;QAChC,IAAI,CAAC,uBAAuB,GAAG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE;aACvE,IAAI,CACH,IAAI,CAAC,CAAC,CAAC,EACP,SAAS,CAAC,KAAK,IAAG;YAChB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI;YAC5C,MAAM,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;AAC/C,YAAA,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,QAAA,CAAC,CAAC;aAEH,SAAS,CAAC,MAAK;YACd,IAAI,CAAC,YAAY,EAAE;YACnB,IAAI,CAAC,UAAU,EAAE;YACjB,IAAI,CAAC,uBAAuB,EAAE;AAChC,QAAA,CAAC,CAAC;IACN;IAEQ,UAAU,GAAA;AAChB,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;AAC7C,QAAA,IAAI,CAAC,uBAAuB,GAAG,EAAE;IACnC;IAEQ,UAAU,GAAA;AAChB,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC;AAC7C,QAAA,IAAI,CAAC,0BAA0B,GAAG,EAAE;IACtC;IAEQ,YAAY,GAAA;AAClB,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC;AAC/C,QAAA,IAAI,CAAC,mBAAmB,GAAG,EAAE;IAC/B;IAEQ,uBAAuB,GAAA;AAC7B,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC;AAC3D,QAAA,IAAI,CAAC,wBAAwB,GAAG,EAAE;IACpC;+GA7LW,iBAAiB,EAAA,IAAA,EAAA,CAAA,EAAA,KAAA,EAAAA,IAAA,CAAA,eAAA,EAAA,EAAA,EAAA,KAAA,EAAAC,EAAA,CAAA,SAAA,EAAA,EAAA,EAAA,KAAA,EAAAC,oBAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA,CAAA;AAAjB,IAAA,SAAA,IAAA,CAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,iBAAiB,cAFhB,MAAM,EAAA,CAAA,CAAA;;4FAEP,iBAAiB,EAAA,UAAA,EAAA,CAAA;kBAH7B,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE,MAAM;AACnB,iBAAA;;;ACnCD;;;;;;;;;;;;;;AAcG;;ACdH;;;;;;;;;;;;;;AAcG;AAEH;;AAEG;;AClBH;;AAEG;;;;"}

package/lib/services/permission.service.d.ts

@@ -11,11 +11,25 @@ export declare class PermissionService {
     private readonly QUEUE_COLLECTION_PERIOD_MS;
     private _cachedResolvedPermissions;
     private _pendingPermissions;
+    private _permissionRequestsByKey;
     private _permissionRequestQueue;
     private _permissionQueueSubscription;
     private _clearCacheSubscription;
     constructor(keyCloakService: KeycloakService, logger: NGXLogger, permissionApiService: PermissionApiService);
     requestPermission(permissionRequest: PermissionRequest, context?: PermissionContext): Observable<boolean>;
+    /**
+     * Invalidates cached and in-flight permission results for the provided resource, so that
+     * subsequent permission requests are re-evaluated by the backend. Call this after an action
+     * that can change the outcome of permission checks (e.g. changing a task assignment).
+     *
+     * @param resource the resource type to invalidate, e.g.
+     * `com.ritense.valtimo.operaton.domain.OperatonTask`
+     * @param identifier when provided, only permissions requested with a context for this specific
+     * resource instance (or without an instance context) are invalidated; otherwise all permissions
+     * for the resource are invalidated
+     */
+    invalidateResource(resource: string, identifier?: string): void;
+    private permissionRequestMatchesResource;
     private queuePermission;
     private openQueueSubscription;
     private cacheResolvedPermissions;
@@ -23,6 +37,7 @@ export declare class PermissionService {
     private emptyQueue;
     private clearCache;
     private clearPending;
+    private clearPermissionRequests;
     static ɵfac: i0.ɵɵFactoryDeclaration<PermissionService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<PermissionService>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valtimo/access-control",
-  "version": "13.37.0",
+  "version": "13.39.0",
   "peerDependencies": {
     "@angular/common": "19.2.25",
     "@angular/core": "19.2.25"