@authup/server-core 1.0.0-beta.30 → 1.0.0-beta.32

package/dist/core/entities/user-role/types.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/entities/user-role/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/entities/user-role/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/identity/entities/client/types.d.ts

@@ -1,5 +1,8 @@
 import type { Client } from '@authup/core-kit';
-import type { IEntityRepository } from '../../../entities/types.ts';
-export interface IClientIdentityRepository extends IEntityRepository<Client> {
+export interface IClientIdentityRepository {
+    findOneById(id: string): Promise<Client | null>;
+    findOneByName(name: string, realm?: string): Promise<Client | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<Client | null>;
+    findOneBy(where: Record<string, any>): Promise<Client | null>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/entities/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB,CAAC,MAAM,CAAC;CAE3E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,WAAW,yBAAyB;IACtC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5E,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjE"}

package/dist/core/identity/entities/robot/types.d.ts

@@ -1,5 +1,8 @@
 import type { Robot } from '@authup/core-kit';
-import type { IEntityRepository } from '../../../entities/index.ts';
-export interface IRobotIdentityRepository extends IEntityRepository<Robot> {
+export interface IRobotIdentityRepository {
+    findOneById(id: string): Promise<Robot | null>;
+    findOneByName(name: string, realm?: string): Promise<Robot | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<Robot | null>;
+    findOneBy(where: Record<string, any>): Promise<Robot | null>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/entities/robot/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/robot/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB,CAAC,KAAK,CAAC;CAEzE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/robot/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,WAAW,wBAAwB;IACrC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC/C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACnE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC3E,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;CAChE"}

package/dist/core/identity/entities/user/types.d.ts

@@ -1,7 +1,10 @@
 import type { User } from '@authup/core-kit';
 import type { IdentityProviderMapperElement } from '../../provider/index.ts';
-import type { IEntityRepository } from '../../../entities/index.ts';
-export interface IUserIdentityRepository extends IEntityRepository<User> {
+export interface IUserIdentityRepository {
+    findOneById(id: string): Promise<User | null>;
+    findOneByName(name: string, realm?: string): Promise<User | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<User | null>;
+    findOneBy(where: Record<string, any>): Promise<User | null>;
     savePermissions(user: User, items: IdentityProviderMapperElement[]): Promise<void>;
     saveRoles(user: User, items: IdentityProviderMapperElement[]): Promise<void>;
     saveOneWithEA(user: Partial<User>, extraAttributes: Record<string, any>): Promise<User>;

package/dist/core/identity/entities/user/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB,CAAC,IAAI,CAAC;IACpE,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpF,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/entities/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAE7E,MAAM,WAAW,uBAAuB;IACpC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAClE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC1E,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAE5D,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5F"}

package/dist/core/identity/index.d.ts

@@ -1,4 +1,7 @@
 export * from './entities/index.ts';
+export * from './password-recovery/index.ts';
+export * from './permission/index.ts';
 export * from './provider/index.ts';
+export * from './registration/index.ts';
 export * from './resolver/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}

package/dist/core/identity/index.js

@@ -5,6 +5,9 @@
  *  view the LICENSE file that was distributed with this source code.
  */
 export * from "./entities/index.js";
+export * from "./password-recovery/index.js";
+export * from "./permission/index.js";
 export * from "./provider/index.js";
+export * from "./registration/index.js";
 export * from "./resolver/index.js";
 //# sourceMappingURL=index.js.map

package/dist/core/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}

package/dist/core/identity/password-recovery/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/password-recovery/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/password-recovery/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./service.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/identity/password-recovery/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/password-recovery/service.d.ts

@@ -0,0 +1,15 @@
+import type { IPasswordRecoveryService, PasswordForgotResult, PasswordRecoveryServiceContext, PasswordRecoveryServiceOptions, PasswordResetResult } from './types.ts';
+import type { IMailClient } from '../../mail/types.ts';
+import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+export declare class PasswordRecoveryService implements IPasswordRecoveryService {
+    protected options: PasswordRecoveryServiceOptions;
+    protected repository: IUserRepository;
+    protected realmRepository: IRealmRepository;
+    protected mailClient: IMailClient;
+    constructor(ctx: PasswordRecoveryServiceContext);
+    forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult>;
+    resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
+    private runForgotPasswordValidator;
+    private runResetPasswordValidator;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/password-recovery/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwDxE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA4C9D,0BAA0B;YA0C1B,yBAAyB;CAiE1C"}

package/dist/core/identity/password-recovery/service.js

@@ -0,0 +1,173 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { BadRequestError, NotFoundError } from '@ebec/http';
+import { createValidationChain, createValidator } from '@validup/adapter-validator';
+import { randomBytes } from 'node:crypto';
+import { Container } from 'validup';
+import { UserCredentialsService } from "../../authentication/credential/entities/user/module.js";
+export class PasswordRecoveryService {
+    options;
+    repository;
+    realmRepository;
+    mailClient;
+    constructor(ctx) {
+        this.options = ctx.options;
+        this.repository = ctx.repository;
+        this.realmRepository = ctx.realmRepository;
+        this.mailClient = ctx.mailClient;
+    }
+    async forgotPassword(data) {
+        if (!this.options.passwordRecoveryEnabled) {
+            throw new BadRequestError('Password recovery is not enabled.');
+        }
+        if (!this.options.emailVerificationEnabled) {
+            throw new BadRequestError('Email verification is not enabled, but required to reset a password.');
+        }
+        const validated = await this.runForgotPasswordValidator(data);
+        const realm = await this.realmRepository.resolve(validated.realm_id, true);
+        const where = {
+            ...(validated.name ? { name: validated.name } : {}),
+            ...(validated.email ? { email: validated.email } : {}),
+            realm_id: realm.id,
+        };
+        const entity = await this.repository.findOneByWithEmail(where);
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        const merged = this.repository.merge(entity, {
+            reset_expires: new Date(Date.now() + (1000 * 60 * 30)).toISOString(),
+            reset_hash: randomBytes(32).toString('hex'),
+        });
+        await this.repository.save(merged);
+        try {
+            await this.mailClient.send({
+                to: entity.email,
+                subject: 'Forgot Password - Reset code',
+                html: `
+                <p>Please use the code below to reset your account password.</p>
+                <p>${merged.reset_hash}</p>
+                `,
+            });
+        }
+        catch {
+            this.repository.merge(merged, {
+                reset_hash: null,
+                reset_expires: null,
+            });
+            await this.repository.save(merged);
+            throw new BadRequestError('Password recovery failed. Could not send reset email.');
+        }
+        return {
+            reset_expires: merged.reset_expires,
+        };
+    }
+    async resetPassword(data) {
+        if (!this.options.passwordRecoveryEnabled) {
+            throw new BadRequestError('Password recovery is not enabled.');
+        }
+        const validated = await this.runResetPasswordValidator(data);
+        await this.repository.validateJoinColumns(validated);
+        const realm = await this.realmRepository.resolve(validated.realm_id, true);
+        const where = {
+            ...(validated.name ? { name: validated.name } : {}),
+            ...(validated.email ? { email: validated.email } : {}),
+            reset_hash: validated.token,
+            realm_id: realm.id,
+        };
+        const entity = await this.repository.findOneBy(where);
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {
+            throw new BadRequestError('Reset token has expired.');
+        }
+        const credentialsService = new UserCredentialsService();
+        const hashedPassword = await credentialsService.protect(validated.password);
+        const merged = this.repository.merge(entity, {
+            reset_at: new Date().toISOString(),
+            reset_hash: null,
+            reset_expires: null,
+            password: hashedPassword,
+        });
+        await this.repository.save(merged);
+        return {
+            reset_at: merged.reset_at,
+        };
+    }
+    async runForgotPasswordValidator(data) {
+        const validator = new Container({});
+        const oneOfContainer = new Container({
+            oneOf: true,
+        });
+        oneOfContainer.mount('email', createValidator(() => {
+            const chain = createValidationChain();
+            return chain
+                .exists()
+                .notEmpty()
+                .isEmail();
+        }));
+        oneOfContainer.mount('name', createValidator(() => {
+            const chain = createValidationChain();
+            return chain
+                .exists()
+                .notEmpty()
+                .isString();
+        }));
+        validator.mount(oneOfContainer);
+        validator.mount('realm_id', { optional: true }, createValidator(() => {
+            const chain = createValidationChain();
+            return chain.exists()
+                .isUUID()
+                .optional({ values: 'null' });
+        }));
+        return validator.run(data);
+    }
+    async runResetPasswordValidator(data) {
+        const validator = new Container({});
+        const oneOfContainer = new Container({
+            oneOf: true,
+        });
+        oneOfContainer.mount('email', createValidator(() => {
+            const chain = createValidationChain();
+            return chain
+                .exists()
+                .notEmpty()
+                .isEmail();
+        }));
+        oneOfContainer.mount('name', createValidator(() => {
+            const chain = createValidationChain();
+            return chain
+                .exists()
+                .notEmpty()
+                .isString();
+        }));
+        validator.mount(oneOfContainer);
+        validator.mount('realm_id', { optional: true }, createValidator(() => {
+            const chain = createValidationChain();
+            return chain
+                .exists()
+                .isUUID()
+                .optional({ values: 'null' });
+        }));
+        validator.mount('token', createValidator(() => {
+            const chain = createValidationChain();
+            return chain
+                .exists()
+                .notEmpty()
+                .isLength({ min: 3, max: 256 });
+        }));
+        validator.mount('password', createValidator(() => {
+            const chain = createValidationChain();
+            return chain
+                .exists()
+                .notEmpty()
+                .isLength({ min: 5, max: 512 });
+        }));
+        return validator.run(data);
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/core/identity/password-recovery/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AAWjG,MAAM,OAAO,uBAAuB;IACtB,OAAO,CAAiC;IAExC,UAAU,CAAkB;IAE5B,eAAe,CAAmB;IAElC,UAAU,CAAc;IAElC,YAAY,GAAmC;QAC3C,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAyB;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,IAAI,eAAe,CAAC,sEAAsE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE3E,MAAM,KAAK,GAAwB;YAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,QAAQ,EAAE,KAAK,CAAC,EAAE;SACrB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE;YACzC,aAAa,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;YACpE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACvB,EAAE,EAAE,MAAM,CAAC,KAAK;gBAChB,OAAO,EAAE,8BAA8B;gBACvC,IAAI,EAAE;;qBAED,MAAM,CAAC,UAAU;iBACrB;aACJ,CAAC,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE;gBAC1B,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEnC,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAC;QACvF,CAAC;QAED,OAAO;YACH,aAAa,EAAE,MAAM,CAAC,aAAc;SACvC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAyB;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAErD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE3E,MAAM,KAAK,GAAwB;YAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,UAAU,EAAE,SAAS,CAAC,KAAK;YAC3B,QAAQ,EAAE,KAAK,CAAC,EAAE;SACrB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACxD,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE;YACzC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,cAAc;SAC3B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnC,OAAO;YACH,QAAQ,EAAE,MAAM,CAAC,QAAS;SAC7B,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAC,IAAyB;QAC9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAM,EAAE,CAAC,CAAC;QAEzC,MAAM,cAAc,GAAG,IAAI,SAAS,CAAC;YACjC,KAAK,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE;YAC/C,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC,CAAC;QAEJ,cAAc,CAAC,KAAK,CAChB,MAAM,EACN,eAAe,CAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE,CAAC;QACpB,CAAC,CAAC,CACL,CAAC;QAEF,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEhC,SAAS,CAAC,KAAK,CACX,UAAU,EACV,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,eAAe,CAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,MAAM,EAAE;iBAChB,MAAM,EAAE;iBACR,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CACL,CAAC;QAEF,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,IAAyB;QAC7D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAM,EAAE,CAAC,CAAC;QAEzC,MAAM,cAAc,GAAG,IAAI,SAAS,CAAC;YACjC,KAAK,EAAE,IAAI;SACd,CAAC,CAAC;QACH,cAAc,CAAC,KAAK,CAChB,OAAO,EACP,eAAe,CAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC,CACL,CAAC;QACF,cAAc,CAAC,KAAK,CAChB,MAAM,EACN,eAAe,CAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE,CAAC;QACpB,CAAC,CAAC,CACL,CAAC;QAEF,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEhC,SAAS,CAAC,KAAK,CACX,UAAU,EACV,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,eAAe,CAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,MAAM,EAAE;iBACR,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CACL,CAAC;QAEF,SAAS,CAAC,KAAK,CACX,OAAO,EACP,eAAe,CAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CACL,CAAC;QAEF,SAAS,CAAC,KAAK,CACX,UAAU,EACV,eAAe,CAAC,GAAG,EAAE;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,KAAK;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CACL,CAAC;QAEF,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACJ"}

package/dist/core/identity/password-recovery/types.d.ts

@@ -0,0 +1,23 @@
+import type { IMailClient } from '../../mail/types.ts';
+import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+export type PasswordRecoveryServiceOptions = {
+    passwordRecoveryEnabled?: boolean;
+    emailVerificationEnabled?: boolean;
+};
+export type PasswordRecoveryServiceContext = {
+    options: PasswordRecoveryServiceOptions;
+    mailClient: IMailClient;
+    repository: IUserRepository;
+    realmRepository: IRealmRepository;
+};
+export type PasswordForgotResult = {
+    reset_expires: string;
+};
+export type PasswordResetResult = {
+    reset_at: string;
+};
+export interface IPasswordRecoveryService {
+    forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult>;
+    resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/password-recovery/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}

package/dist/core/identity/password-recovery/types.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/identity/password-recovery/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/identity/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./module.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/identity/permission/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/module.d.ts

@@ -0,0 +1,20 @@
+import type { IdentityPolicyData, PolicyWithType } from '@authup/access';
+import type { PermissionBinding } from '@authup/core-kit';
+import type { IIdentityBindingRepository, IIdentityPermissionProvider, IRoleBindingRepository, IdentityPermissionProviderContext, ResolveJunctionPolicyOptions } from './types.ts';
+export declare class IdentityPermissionProvider implements IIdentityPermissionProvider {
+    protected clientRepository: IIdentityBindingRepository;
+    protected userRepository: IIdentityBindingRepository;
+    protected roleRepository: IRoleBindingRepository;
+    protected robotRepository: IIdentityBindingRepository;
+    constructor(ctx: IdentityPermissionProviderContext);
+    isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
+    resolveJunctionPolicy(identity: IdentityPolicyData, options: ResolveJunctionPolicyOptions): Promise<PolicyWithType | undefined>;
+    getFor(identity: IdentityPolicyData): Promise<PermissionBinding[]>;
+    getForClient(identity: IdentityPolicyData): Promise<PermissionBinding[]>;
+    getForUser(identity: IdentityPolicyData): Promise<PermissionBinding[]>;
+    getForRobot(identity: IdentityPolicyData): Promise<PermissionBinding[]>;
+    getForRole(identity: IdentityPolicyData): Promise<PermissionBinding[]>;
+    private reduceBindingsByIdentityClient;
+    private reduceEntitiesByIdentityClient;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/permission/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EACR,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,iCAAiC,EACjC,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;IAEvD,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC;IAErD,SAAS,CAAC,cAAc,EAAE,sBAAsB,CAAC;IAEjD,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC;gBAE1C,GAAG,EAAE,iCAAiC;IAO5C,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IA2BpF,qBAAqB,CACvB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAmChC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAmBnE,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAczE,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAkBvE,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAkBxE,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAK7E,OAAO,CAAC,8BAA8B;IAWtC,OAAO,CAAC,8BAA8B;CAUzC"}

package/dist/core/identity/permission/module.js

@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { isPermissionBindingEqual, mergePermissionBindings } from '@authup/core-kit';
+export class IdentityPermissionProvider {
+    clientRepository;
+    userRepository;
+    roleRepository;
+    robotRepository;
+    constructor(ctx) {
+        this.clientRepository = ctx.clientRepository;
+        this.userRepository = ctx.userRepository;
+        this.roleRepository = ctx.roleRepository;
+        this.robotRepository = ctx.robotRepository;
+    }
+    async isSuperset(parent, child) {
+        const parentBindings = await this.getFor(parent);
+        const childBindings = await this.getFor(child);
+        const parentMerged = mergePermissionBindings(parentBindings);
+        const childMerged = mergePermissionBindings(childBindings);
+        for (const childItem of childMerged) {
+            const parentItem = parentMerged.find((p) => isPermissionBindingEqual(p, childItem));
+            if (!parentItem) {
+                return false;
+            }
+            if (parentItem.policies && parentItem.policies.length > 0 &&
+                (!childItem.policies || childItem.policies.length === 0)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    async resolveJunctionPolicy(identity, options) {
+        const bindings = await this.getFor(identity);
+        const matching = bindings.filter((b) => {
+            if (b.permission.name !== options.name) {
+                return false;
+            }
+            if (typeof options.realmId !== 'undefined') {
+                if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) {
+                    return false;
+                }
+            }
+            if (typeof options.clientId !== 'undefined') {
+                if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) {
+                    return false;
+                }
+            }
+            return true;
+        });
+        if (matching.length === 0) {
+            return undefined;
+        }
+        const merged = mergePermissionBindings(matching);
+        if (merged.length > 0 && merged[0].policies && merged[0].policies.length > 0) {
+            return merged[0].policies[0];
+        }
+        return undefined;
+    }
+    async getFor(identity) {
+        switch (identity.type) {
+            case 'client': {
+                return this.getForClient(identity);
+            }
+            case 'user': {
+                return this.getForUser(identity);
+            }
+            case 'robot': {
+                return this.getForRobot(identity);
+            }
+            case 'role': {
+                return this.getForRole(identity);
+            }
+        }
+        return [];
+    }
+    async getForClient(identity) {
+        const bindings = await this.clientRepository.getBoundPermissions(identity.id);
+        const roles = await this.clientRepository.getBoundRoles(identity.id);
+        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
+        if (roleBindings.length === 0) {
+            return bindings;
+        }
+        return [
+            ...bindings,
+            ...roleBindings,
+        ];
+    }
+    async getForUser(identity) {
+        const bindings = await this.userRepository.getBoundPermissions(identity.id)
+            .then((data) => this.reduceBindingsByIdentityClient(data, identity));
+        const roles = await this.userRepository.getBoundRoles(identity.id)
+            .then((data) => this.reduceEntitiesByIdentityClient(data, identity));
+        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
+        if (roleBindings.length === 0) {
+            return bindings;
+        }
+        return [
+            ...bindings,
+            ...roleBindings,
+        ];
+    }
+    async getForRobot(identity) {
+        const bindings = await this.robotRepository.getBoundPermissions(identity.id)
+            .then((data) => this.reduceBindingsByIdentityClient(data, identity));
+        const roles = await this.robotRepository.getBoundRoles(identity.id)
+            .then((data) => this.reduceEntitiesByIdentityClient(data, identity));
+        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
+        if (roleBindings.length === 0) {
+            return bindings;
+        }
+        return [
+            ...bindings,
+            ...roleBindings,
+        ];
+    }
+    async getForRole(identity) {
+        return this.roleRepository.getBoundPermissions(identity.id)
+            .then((data) => this.reduceBindingsByIdentityClient(data, identity));
+    }
+    reduceBindingsByIdentityClient(bindings, identity) {
+        if (!identity.clientId) {
+            return bindings;
+        }
+        return bindings.filter((binding) => binding.permission.client_id === identity.clientId);
+    }
+    reduceEntitiesByIdentityClient(entities, identity) {
+        if (!identity.clientId) {
+            return entities;
+        }
+        return entities.filter((entity) => entity.client_id === identity.clientId);
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/identity/permission/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AASrF,MAAM,OAAO,0BAA0B;IACzB,gBAAgB,CAA6B;IAE7C,cAAc,CAA6B;IAE3C,cAAc,CAAyB;IAEvC,eAAe,CAA6B;IAEtD,YAAY,GAAsC;QAC9C,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA0B,EAAE,KAAyB;QAClE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/C,MAAM,YAAY,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;QAE3D,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,EAAE,SAAS,CAAC,CAChD,CAAC;YAEF,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,IACI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACrD,CAAC,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAC1D,CAAC;gBACC,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,qBAAqB,CACvB,QAA4B,EAC5B,OAAqC;QAErC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACnC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;gBACzC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;oBAChE,OAAO,KAAK,CAAC;gBACjB,CAAC;YACL,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC1C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC;oBAClE,OAAO,KAAK,CAAC;gBACjB,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAEjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAA4B;QACrC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACZ,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACV,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACX,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACV,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAA4B;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,OAAO;YACH,GAAG,QAAQ;YACX,GAAG,YAAY;SAClB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAA4B;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;aACtE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC7D,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEzE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,OAAO;YACH,GAAG,QAAQ;YACX,GAAG,YAAY;SAClB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAA4B;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;aACvE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC9D,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEzE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,OAAO;YACH,GAAG,QAAQ;YACX,GAAG,YAAY;SAClB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAA4B;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;aACtD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,8BAA8B,CAClC,QAA6B,EAC7B,QAA4B;QAE5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5F,CAAC;IAEO,8BAA8B,CAClC,QAAa,EACb,QAA4B;QAE5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/E,CAAC;CACJ"}

package/dist/core/identity/permission/types.d.ts

@@ -0,0 +1,27 @@
+import type { PermissionBinding, Role } from '@authup/core-kit';
+import type { IdentityPolicyData, PolicyWithType } from '@authup/access';
+export type ResolveJunctionPolicyOptions = {
+    name: string;
+    realmId?: string | null;
+    clientId?: string | null;
+};
+export interface IIdentityPermissionProvider {
+    getFor(identity: IdentityPolicyData): Promise<PermissionBinding[]>;
+    isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
+    resolveJunctionPolicy(identity: IdentityPolicyData, options: ResolveJunctionPolicyOptions): Promise<PolicyWithType | undefined>;
+}
+export interface IIdentityBindingRepository {
+    getBoundPermissions(entity: string): Promise<PermissionBinding[]>;
+    getBoundRoles(entity: string): Promise<Role[]>;
+}
+export interface IRoleBindingRepository {
+    getBoundPermissions(entity: string | Role): Promise<PermissionBinding[]>;
+    getBoundPermissionsForMany(entities: (string | Role)[]): Promise<PermissionBinding[]>;
+}
+export type IdentityPermissionProviderContext = {
+    clientRepository: IIdentityBindingRepository;
+    userRepository: IIdentityBindingRepository;
+    robotRepository: IIdentityBindingRepository;
+    roleRepository: IRoleBindingRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEzE,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACnE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACnI;AAED,MAAM,WAAW,0BAA0B;IACvC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAClE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,sBAAsB;IACnC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACzE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,cAAc,EAAE,0BAA0B,CAAC;IAC3C,eAAe,EAAE,0BAA0B,CAAC;IAC5C,cAAc,EAAE,sBAAsB,CAAC;CAC1C,CAAC"}

package/dist/core/identity/permission/types.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/identity/permission/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/identity/provider/account/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACH,aAAa,EAEhB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE7I,qBAAa,8BAA+B,YAAW,+BAA+B;IAClF,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,UAAU,EAAG,uBAAuB,CAAC;IAE/C,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;IAE1D,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;gBAE5B,GAAG,EAAE,qCAAqC;IAUhD,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmC1E,QAAQ,CACV,QAAQ,EAAE,wBAAwB,EAClC,IAAI,CAAC,EAAE,IAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IAuFV,kBAAkB,CACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+ElB,eAAe,CACjB,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;IAOR,SAAS,CACX,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;CAMjB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACH,aAAa,EAEhB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE7I,qBAAa,8BAA+B,YAAW,+BAA+B;IAClF,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,UAAU,EAAG,uBAAuB,CAAC;IAE/C,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;IAE1D,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;gBAE5B,GAAG,EAAE,qCAAqC;IAUhD,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmC1E,QAAQ,CACV,QAAQ,EAAE,wBAAwB,EAClC,IAAI,CAAC,EAAE,IAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IAsFV,kBAAkB,CACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+ElB,eAAe,CACjB,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;IAOR,SAAS,CACX,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;CAMjB"}