@authup/server-core 1.0.0-beta.30 → 1.0.0-beta.32

package/dist/core/provisioning/strategy/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../../src/core/provisioning/strategy/validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,OAAO,6BAA8B,SAAQ,SAAqC;IACpF,YAAY,UAAwD,EAAE;QAClE,KAAK,CAAC;YACF,GAAG,OAAO;YACV,KAAK,EAAE,IAAI;SACd,CAAC,CAAC;IACP,CAAC;IAES,UAAU;QAChB,KAAK,CAAC,UAAU,EAAE,CAAC;QAEnB,MAAM,cAAc,GAAG,IAAI,SAAS,EAAmC,CAAC;QACxE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CACxC,CAAC;aACI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CACvB,CAAC,CAAC;QACH,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAC9C,CAAC;aACI,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE,CAClB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAE3B,MAAM,YAAY,GAAG,IAAI,SAAS,EAAqC,CAAC;QACxE,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CACtC,CAAC;aACI,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CACjD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;CACJ"}

package/dist/core/provisioning/synchronizer/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,8BAAsB,4BAA4B,CAAC,CAAC,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAGnF,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAQ/C,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAC7C"}

package/dist/core/provisioning/synchronizer/base.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export class BaseProvisioningSynchronizer {
+    // Sequential to avoid race conditions on concurrent upserts.
+    // Can be switched to Promise.all() if callers guarantee unique inputs.
+    async synchronizeMany(input) {
+        const output = [];
+        for (const entity of input) {
+            output.push(await this.synchronize(entity));
+        }
+        return output;
+    }
+}
+//# sourceMappingURL=base.js.map

package/dist/core/provisioning/synchronizer/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,OAAgB,4BAA4B;IAC9C,6DAA6D;IAC7D,uEAAuE;IACvE,KAAK,CAAC,eAAe,CAAC,KAAU;QAC5B,MAAM,MAAM,GAAQ,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;CAGJ"}

package/dist/core/provisioning/synchronizer/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/client/module.d.ts

@@ -0,0 +1,22 @@
+import type { ClientPermission, ClientRole, Permission, Role } from '@authup/core-kit';
+import type { IClientRepository } from '../../../entities/index.ts';
+import type { ClientProvisioningEntity } from '../../entities/client';
+import type { PermissionProvisioningEntity } from '../../entities/permission';
+import type { RoleProvisioningEntity } from '../../entities/role';
+import type { IProvisioningSynchronizer } from '../../types.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import { ProvisioningEntityResolver } from '../entity-resolver.ts';
+import { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';
+import type { ClientProvisioningSynchronizerContext } from './types.ts';
+export declare class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {
+    protected clientRepository: IClientRepository;
+    protected permissionResolver: ProvisioningEntityResolver<Permission>;
+    protected roleResolver: ProvisioningEntityResolver<Role>;
+    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;
+    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;
+    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
+    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
+    constructor(ctx: ClientProvisioningSynchronizerContext);
+    synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/client/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EACjD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EACR,iBAAiB,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EACR,yBAAyB,EAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEjF,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;gBAElE,GAAG,EAAE,qCAAqC;IAuBhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA0GxF"}

package/dist/core/provisioning/synchronizer/client/module.js

@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2026-2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { pickRecord } from '@authup/kit';
+import { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from "../../strategy/index.js";
+import { BaseProvisioningSynchronizer } from "../base.js";
+import { ProvisioningEntityResolver } from "../entity-resolver.js";
+import { ProvisioningJunctionSynchronizer } from "../junction-synchronizer.js";
+export class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer {
+    clientRepository;
+    permissionResolver;
+    roleResolver;
+    permissionJunction;
+    roleJunction;
+    permissionSynchronizer;
+    roleSynchronizer;
+    constructor(ctx) {
+        super();
+        this.clientRepository = ctx.clientRepository;
+        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
+        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);
+        this.permissionJunction = new ProvisioningJunctionSynchronizer({
+            repository: ctx.clientPermissionRepository,
+            ownerKey: 'client_id',
+            ownerRealmKey: 'client_realm_id',
+        });
+        this.roleJunction = new ProvisioningJunctionSynchronizer({
+            repository: ctx.clientRoleRepository,
+            ownerKey: 'client_id',
+            ownerRealmKey: 'client_realm_id',
+        });
+        this.permissionSynchronizer = ctx.permissionSynchronizer;
+        this.roleSynchronizer = ctx.roleSynchronizer;
+    }
+    async synchronize(input) {
+        const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+        let attributes = await this.clientRepository.findOneBy({
+            name: input.attributes.name,
+            realm_id: input.attributes.realm_id || null,
+        });
+        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+            if (attributes) {
+                await this.clientRepository.remove(attributes);
+            }
+            return { ...input, attributes: attributes || input.attributes };
+        }
+        if (attributes) {
+            switch (strategy.type) {
+                case ProvisioningEntityStrategyType.MERGE:
+                    attributes = this.clientRepository.merge(attributes, strategy.attributes ?
+                        pickRecord(input.attributes, strategy.attributes) :
+                        input.attributes);
+                    attributes = await this.clientRepository.save(attributes);
+                    break;
+                case ProvisioningEntityStrategyType.REPLACE:
+                    input.attributes.id = attributes.id;
+                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));
+                    break;
+            }
+        }
+        else {
+            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));
+        }
+        // Permissions (Global + Realm)
+        const permissions = [
+            ...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions),
+            ...(attributes.realm_id ?
+                await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realm_id) :
+                []),
+        ];
+        if (permissions.length > 0) {
+            await this.permissionJunction.synchronize(attributes, permissions, 'permission_id', 'permission_realm_id');
+        }
+        // Roles (Global + Realm)
+        const roles = [
+            ...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles),
+            ...(attributes.realm_id ?
+                await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realm_id) :
+                []),
+        ];
+        if (roles.length > 0) {
+            await this.roleJunction.synchronize(attributes, roles, 'role_id', 'role_realm_id');
+        }
+        // Containers
+        if (input.relations && input.relations.permissions) {
+            const children = input.relations.permissions.map((child) => {
+                child.attributes.client_id = attributes.id;
+                child.attributes.client = attributes;
+                return child;
+            });
+            await this.permissionSynchronizer.synchronizeMany(children);
+        }
+        if (input.relations && input.relations.roles) {
+            const children = input.relations.roles.map((child) => {
+                child.attributes.client_id = attributes.id;
+                child.attributes.client = attributes;
+                return child;
+            });
+            await this.roleSynchronizer.synchronizeMany(children);
+        }
+        return {
+            ...input,
+            attributes,
+        };
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/provisioning/synchronizer/client/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EAAE,8BAA8B,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAK9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAG/E,MAAM,OAAO,8BAA+B,SAAQ,4BAAsD;IAC5F,gBAAgB,CAAoB;IAEpC,kBAAkB,CAAyC;IAE3D,YAAY,CAAmC;IAE/C,kBAAkB,CAAqD;IAEvE,YAAY,CAA+C;IAE3D,sBAAsB,CAA0D;IAEhF,gBAAgB,CAAoD;IAE9E,YAAY,GAA0C;QAClD,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAE7C,IAAI,CAAC,kBAAkB,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACnF,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEvE,IAAI,CAAC,kBAAkB,GAAG,IAAI,gCAAgC,CAAC;YAC3D,UAAU,EAAE,GAAG,CAAC,0BAA0B;YAC1C,QAAQ,EAAE,WAAW;YACrB,aAAa,EAAE,iBAAiB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,gCAAgC,CAAC;YACrD,UAAU,EAAE,GAAG,CAAC,oBAAoB;YACpC,QAAQ,EAAE,WAAW;YACrB,aAAa,EAAE,iBAAiB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,GAAG,GAAG,CAAC,sBAAsB,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA+B;QAC7C,MAAM,QAAQ,GAAG,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAErE,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACnD,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;YAC3B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI;SAC9C,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAA8B,CAAC,MAAM,EAAE,CAAC;YAC1D,IAAI,UAAU,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,UAAU,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACb,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,8BAA8B,CAAC,KAAK;oBACrC,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CACpC,UAAU,EACV,QAAQ,CAAC,UAAU,CAAC,CAAC;wBACjB,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;wBACnD,KAAK,CAAC,UAAU,CACvB,CAAC;oBACF,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC1D,MAAM;gBACV,KAAK,8BAA8B,CAAC,OAAO;oBACvC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;oBACpC,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;oBAC9F,MAAM;YACd,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,+BAA+B;QAC/B,MAAM,WAAW,GAAG;YAChB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAC1C,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,iBAAiB,CACvD;YACD,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACtC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,gBAAgB,EACnD,UAAU,CAAC,QAAQ,CACtB,CAAC,CAAC;gBACH,EAAE,CAAC;SACV,CAAC;QAEF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CACrC,UAAU,EACV,WAAW,EACX,eAAe,EACf,qBAAqB,CACxB,CAAC;QACN,CAAC;QAED,yBAAyB;QACzB,MAAM,KAAK,GAAG;YACV,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CACpC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,CACjD;YACD,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAChC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,UAAU,EAC7C,UAAU,CAAC,QAAQ,CACtB,CAAC,CAAC;gBACH,EAAE,CAAC;SACV,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAC/B,UAAU,EACV,KAAK,EACL,SAAS,EACT,eAAe,CAClB,CAAC;QACN,CAAC;QAED,aAAa;QAEb,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvD,KAAK,CAAC,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAC;gBAC3C,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC;gBACrC,OAAO,KAAK,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjD,KAAK,CAAC,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAC;gBAC3C,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC;gBACrC,OAAO,KAAK,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO;YACH,GAAG,KAAK;YACR,UAAU;SACb,CAAC;IACN,CAAC;CACJ"}

package/dist/core/provisioning/synchronizer/client/types.d.ts

@@ -0,0 +1,14 @@
+import type { IClientPermissionRepository, IClientRepository, IClientRoleRepository, IPermissionRepository, IRoleRepository } from '../../../entities/index.ts';
+import type { PermissionProvisioningEntity } from '../../entities/permission';
+import type { RoleProvisioningEntity } from '../../entities/role';
+import type { IProvisioningSynchronizer } from '../../types.ts';
+export type ClientProvisioningSynchronizerContext = {
+    clientRepository: IClientRepository;
+    clientRoleRepository: IClientRoleRepository;
+    clientPermissionRepository: IClientPermissionRepository;
+    roleRepository: IRoleRepository;
+    permissionRepository: IPermissionRepository;
+    roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
+    permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/client/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EACR,yBAAyB,EAE5B,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,qCAAqC,GAAG;IAChD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,cAAc,EAAE,eAAe,CAAC;IAChC,oBAAoB,EAAE,qBAAqB,CAAC;IAE5C,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;CACnF,CAAC"}

package/dist/core/provisioning/synchronizer/client/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts

@@ -0,0 +1,10 @@
+import type { ObjectLiteral } from '@authup/kit';
+import type { IEntityRepository } from '../../entities/index.ts';
+export declare class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {
+    protected repository: IEntityRepository<T>;
+    constructor(repository: IEntityRepository<T>);
+    resolveGlobal(names?: string[]): Promise<T[]>;
+    resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]>;
+    resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]>;
+}
+//# sourceMappingURL=entity-resolver.d.ts.map

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,qBAAa,0BAA0B,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC3E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAE/B,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAItC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAoB7C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAoBxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAmBpG"}

package/dist/core/provisioning/synchronizer/entity-resolver.js

@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export class ProvisioningEntityResolver {
+    repository;
+    constructor(repository) {
+        this.repository = repository;
+    }
+    async resolveGlobal(names) {
+        if (!names || names.length === 0) {
+            return [];
+        }
+        const hasWildcard = names.includes('*');
+        if (hasWildcard) {
+            return this.repository.findManyBy({
+                realm_id: null,
+                client_id: null,
+            });
+        }
+        return this.repository.findManyBy({
+            name: names,
+            realm_id: null,
+            client_id: null,
+        });
+    }
+    async resolveRealm(names, realmId) {
+        if (!names || names.length === 0) {
+            return [];
+        }
+        const hasWildcard = names.includes('*');
+        if (hasWildcard) {
+            return this.repository.findManyBy({
+                realm_id: realmId,
+                client_id: null,
+            });
+        }
+        return this.repository.findManyBy({
+            name: names,
+            realm_id: realmId,
+            client_id: null,
+        });
+    }
+    async resolveClient(names, realmId, clientId) {
+        if (!names || names.length === 0) {
+            return [];
+        }
+        const hasWildcard = names.includes('*');
+        if (hasWildcard) {
+            return this.repository.findManyBy({
+                realm_id: realmId,
+                client_id: clientId,
+            });
+        }
+        return this.repository.findManyBy({
+            name: names,
+            realm_id: realmId,
+            client_id: clientId,
+        });
+    }
+}
+//# sourceMappingURL=entity-resolver.js.map

package/dist/core/provisioning/synchronizer/entity-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-resolver.js","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAO,0BAA0B;IACzB,UAAU,CAAuB;IAE3C,YAAY,UAAgC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAgB;QAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,WAAW,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;aAClB,CAAC,CAAC;QACP,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9B,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA2B,EAAE,OAAe;QAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,WAAW,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC9B,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,IAAI;aAClB,CAAC,CAAC;QACP,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9B,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA2B,EAAE,OAAe,EAAE,QAAgB;QAC9E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,WAAW,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC9B,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,QAAQ;aACtB,CAAC,CAAC;QACP,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9B,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,QAAQ;SACtB,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/core/provisioning/synchronizer/index.d.ts

@@ -0,0 +1,12 @@
+export * from './client/index.ts';
+export * from './entity-resolver.ts';
+export * from './junction-synchronizer.ts';
+export * from './permission/index.ts';
+export * from './policy/index.ts';
+export * from './realm/index.ts';
+export * from './role/index.ts';
+export * from './root/index.ts';
+export * from './robot/index.ts';
+export * from './scope/index.ts';
+export * from './user/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}

package/dist/core/provisioning/synchronizer/index.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./client/index.js";
+export * from "./entity-resolver.js";
+export * from "./junction-synchronizer.js";
+export * from "./permission/index.js";
+export * from "./policy/index.js";
+export * from "./realm/index.js";
+export * from "./role/index.js";
+export * from "./root/index.js";
+export * from "./robot/index.js";
+export * from "./scope/index.js";
+export * from "./user/index.js";
+//# sourceMappingURL=index.js.map

package/dist/core/provisioning/synchronizer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}

package/dist/core/provisioning/synchronizer/junction-synchronizer.d.ts

@@ -0,0 +1,19 @@
+import type { ObjectLiteral } from '@authup/kit';
+import type { IEntityRepository } from '../../entities/index.ts';
+export type ProvisioningJunctionSynchronizerContext<T extends ObjectLiteral = ObjectLiteral> = {
+    repository: IEntityRepository<T>;
+    ownerKey: string;
+    ownerRealmKey: string;
+};
+export declare class ProvisioningJunctionSynchronizer<T extends ObjectLiteral = ObjectLiteral> {
+    protected ctx: ProvisioningJunctionSynchronizerContext<T>;
+    constructor(ctx: ProvisioningJunctionSynchronizerContext<T>);
+    synchronize(owner: {
+        id: string;
+        realm_id?: string | null;
+    }, targets: Array<{
+        id: string;
+        realm_id?: string | null;
+    }>, targetKey: string, targetRealmKey: string, extraAttributes?: Record<string, unknown>): Promise<void>;
+}
+//# sourceMappingURL=junction-synchronizer.d.ts.map

package/dist/core/provisioning/synchronizer/junction-synchronizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-synchronizer.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,uCAAuC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IAC3F,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBAAa,gCAAgC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjF,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC,CAAC;gBAE9C,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAIrD,WAAW,CACb,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAC/C,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,EACxD,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC;CAqBnB"}

package/dist/core/provisioning/synchronizer/junction-synchronizer.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export class ProvisioningJunctionSynchronizer {
+    ctx;
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    async synchronize(owner, targets, targetKey, targetRealmKey, extraAttributes) {
+        for (const target of targets) {
+            const existing = await this.ctx.repository.findOneBy({
+                [this.ctx.ownerKey]: owner.id,
+                [targetKey]: target.id,
+            });
+            if (!existing) {
+                const entity = this.ctx.repository.create({
+                    [this.ctx.ownerKey]: owner.id,
+                    [this.ctx.ownerRealmKey]: owner.realm_id,
+                    [targetKey]: target.id,
+                    [targetRealmKey]: target.realm_id,
+                    ...(extraAttributes || {}),
+                });
+                await this.ctx.repository.save(entity);
+            }
+        }
+    }
+}
+//# sourceMappingURL=junction-synchronizer.js.map

package/dist/core/provisioning/synchronizer/junction-synchronizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-synchronizer.js","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,OAAO,gCAAgC;IAC/B,GAAG,CAA6C;IAE1D,YAAY,GAA+C;QACvD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CACb,KAA+C,EAC/C,OAAwD,EACxD,SAAiB,EACjB,cAAsB,EACtB,eAAyC;QAEzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAE3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBACjD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,EAAE;gBAC7B,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE;aACzB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;oBACtC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,EAAE;oBAC7B,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,QAAQ;oBACxC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE;oBACtB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,QAAQ;oBACjC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;iBACf,CAAC,CAAC;gBAEjB,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}

package/dist/core/provisioning/synchronizer/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/permission/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/permission/module.d.ts

@@ -0,0 +1,10 @@
+import type { IPermissionRepository } from '../../../entities/index.ts';
+import type { PermissionProvisioningEntity } from '../../entities/permission';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import type { PermissionProvisioningSynchronizerContext } from './types.ts';
+export declare class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {
+    protected repository: IPermissionRepository;
+    constructor(ctx: PermissionProvisioningSynchronizerContext);
+    synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/permission/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,kCAAmC,SAAQ,4BAA4B,CAAC,4BAA4B,CAAC;IAC9G,SAAS,CAAC,UAAU,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,yCAAyC;IAMpD,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC;CA0ChG"}

package/dist/core/provisioning/synchronizer/permission/module.js

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2026-2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { pickRecord } from '@authup/kit';
+import { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from "../../strategy/index.js";
+import { BaseProvisioningSynchronizer } from "../base.js";
+export class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer {
+    repository;
+    constructor(ctx) {
+        super();
+        this.repository = ctx.repository;
+    }
+    async synchronize(input) {
+        const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+        let attributes = await this.repository.findOneBy({
+            name: input.attributes.name,
+            realm_id: input.attributes.realm_id || null,
+            client_id: input.attributes.client_id || null,
+        });
+        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+            if (attributes) {
+                await this.repository.remove(attributes);
+            }
+            return { ...input, attributes: attributes || input.attributes };
+        }
+        if (attributes) {
+            switch (strategy.type) {
+                case ProvisioningEntityStrategyType.MERGE:
+                    attributes = this.repository.merge(attributes, strategy.attributes ?
+                        pickRecord(input.attributes, strategy.attributes) :
+                        input.attributes);
+                    attributes = await this.repository.save(attributes);
+                    break;
+                case ProvisioningEntityStrategyType.REPLACE:
+                    input.attributes.id = attributes.id;
+                    attributes = await this.repository.save(this.repository.create(input.attributes));
+                    break;
+            }
+        }
+        else {
+            attributes = await this.repository.save(this.repository.create(input.attributes));
+        }
+        return {
+            ...input,
+            attributes,
+        };
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/provisioning/synchronizer/permission/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,8BAA8B,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAC9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAG1D,MAAM,OAAO,kCAAmC,SAAQ,4BAA0D;IACpG,UAAU,CAAyB;IAE7C,YAAY,GAA8C;QACtD,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAmC;QACjD,MAAM,QAAQ,GAAG,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAErE,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC7C,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;YAC3B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI;YAC3C,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,IAAI,IAAI;SAChD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAA8B,CAAC,MAAM,EAAE,CAAC;YAC1D,IAAI,UAAU,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,UAAU,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACb,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,8BAA8B,CAAC,KAAK;oBACrC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAC9B,UAAU,EACV,QAAQ,CAAC,UAAU,CAAC,CAAC;wBACjB,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;wBACnD,KAAK,CAAC,UAAU,CACvB,CAAC;oBAEF,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACpD,MAAM;gBACV,KAAK,8BAA8B,CAAC,OAAO;oBACvC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;oBACpC,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;oBAClF,MAAM;YACd,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,OAAO;YACH,GAAG,KAAK;YACR,UAAU;SACb,CAAC;IACN,CAAC;CACJ"}

package/dist/core/provisioning/synchronizer/permission/types.d.ts

@@ -0,0 +1,5 @@
+import type { IPermissionRepository } from '../../../entities/index.ts';
+export type PermissionProvisioningSynchronizerContext = {
+    repository: IPermissionRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,qBAAqB,CAAC;CACrC,CAAC"}

package/dist/core/provisioning/synchronizer/permission/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/provisioning/synchronizer/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/policy/module.d.ts

@@ -0,0 +1,15 @@
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPolicyRepository } from '../../../entities/index.ts';
+import type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import type { PolicyProvisioningSynchronizerContext } from './types.ts';
+export declare class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {
+    protected repository: IPolicyRepository;
+    protected permissionPolicyRepository: IPermissionPolicyRepository;
+    constructor(ctx: PolicyProvisioningSynchronizerContext);
+    synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity>;
+    private synchronizeChildren;
+    private cleanupStaleChildren;
+    private cleanupStaleChild;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/policy/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,qCAAqC;IAOhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;YA2BvE,mBAAmB;YAgBnB,oBAAoB;YAkBpB,iBAAiB;CAgBlC"}

package/dist/core/provisioning/synchronizer/policy/module.js

@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { BaseProvisioningSynchronizer } from "../base.js";
+export class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer {
+    repository;
+    permissionPolicyRepository;
+    constructor(ctx) {
+        super();
+        this.repository = ctx.repository;
+        this.permissionPolicyRepository = ctx.permissionPolicyRepository;
+    }
+    async synchronize(input) {
+        let entity = await this.repository.findOneBy({
+            name: input.attributes.name,
+            realm_id: input.attributes.realm_id || null,
+        });
+        if (entity) {
+            entity = this.repository.merge(entity, {
+                type: input.attributes.type,
+                built_in: input.attributes.built_in,
+                parent_id: input.attributes.parent_id,
+                parent: input.attributes.parent,
+            });
+            await this.repository.saveWithEA(entity, input.extraAttributes);
+        }
+        else {
+            entity = this.repository.create(input.attributes);
+            await this.repository.saveWithEA(entity, input.extraAttributes);
+        }
+        await this.synchronizeChildren(entity.id, input.children || []);
+        return {
+            ...input,
+            attributes: entity,
+        };
+    }
+    async synchronizeChildren(parentId, children = []) {
+        const declaredNames = children.map((c) => c.attributes.name);
+        await children.reduce(async (prev, child) => {
+            await prev;
+            child.attributes.parent_id = parentId;
+            child.attributes.parent = { id: parentId };
+            await this.synchronize(child);
+        }, Promise.resolve());
+        await this.cleanupStaleChildren(parentId, declaredNames);
+    }
+    async cleanupStaleChildren(parentId, declaredNames) {
+        const existingChildren = await this.repository.findManyBy({
+            parent_id: parentId,
+        });
+        const staleChildren = existingChildren.filter((child) => !declaredNames.includes(child.name));
+        await staleChildren.reduce(async (prev, child) => {
+            await prev;
+            await this.cleanupStaleChild(child);
+        }, Promise.resolve());
+    }
+    async cleanupStaleChild(child) {
+        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({
+            policy_id: child.id,
+        });
+        if (referencingJunctions.length === 0) {
+            await this.repository.deleteFromTree(child);
+        }
+        else {
+            const detached = this.repository.merge(child, {
+                parent_id: null,
+                parent: null,
+                built_in: false,
+            });
+            await this.repository.saveWithEA(detached);
+        }
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/provisioning/synchronizer/policy/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAG1D,MAAM,OAAO,8BAA+B,SAAQ,4BAAsD;IAC5F,UAAU,CAAoB;IAE9B,0BAA0B,CAA8B;IAElE,YAAY,GAA0C;QAClD,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,0BAA0B,GAAG,GAAG,CAAC,0BAA0B,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA+B;QAC7C,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YACzC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;YAC3B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI;SAC9C,CAAC,CAAC;QAEH,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE;gBACnC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;gBAC3B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;gBACnC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;gBACrC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;aAClC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAEhE,OAAO;YACH,GAAG,KAAK;YACR,UAAU,EAAE,MAAM;SACrB,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC7B,QAAgB,EAChB,WAAuC,EAAE;QAEzC,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE7D,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,IAAI,CAAC;YACX,KAAK,CAAC,UAAU,CAAC,SAAS,GAAG,QAAQ,CAAC;YACtC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAS,CAAC;YAClD,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAEtB,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAC9B,QAAgB,EAChB,aAAqC;QAErC,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YACtD,SAAS,EAAE,QAAQ;SACtB,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CACjD,CAAC;QAEF,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,IAAI,CAAC;YACX,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACzC,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC;YAC1E,SAAS,EAAE,KAAK,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC1C,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;CACJ"}

package/dist/core/provisioning/synchronizer/policy/types.d.ts

@@ -0,0 +1,7 @@
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPolicyRepository } from '../../../entities/index.ts';
+export type PolicyProvisioningSynchronizerContext = {
+    repository: IPolicyRepository;
+    permissionPolicyRepository: IPermissionPolicyRepository;
+};
+//# sourceMappingURL=types.d.ts.map