@authup/server-core 1.0.0-beta.30 → 1.0.0-beta.32

package/dist/adapters/http/controllers/entities/identity-provide-role/module.d.ts

@@ -1,10 +1,18 @@
-import type { Request, Response } from 'routup';
 import type { IdentityProviderRoleMapping } from '@authup/core-kit';
+import type { Request, Response } from 'routup';
+import type { IIdentityPermissionProvider, IIdentityProviderRoleMappingRepository } from '../../../../../core/index.ts';
+export type OAuth2ProviderRoleControllerContext = {
+    repository: IIdentityProviderRoleMappingRepository;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
 export declare class OAuth2ProviderRoleController {
-    getProviders(req: Request, res: Response): Promise<IdentityProviderRoleMapping[]>;
-    getProvider(id: string, req: Request, res: Response): Promise<IdentityProviderRoleMapping>;
-    editProvider(id: string, user: NonNullable<IdentityProviderRoleMapping>, req: Request, res: Response): Promise<IdentityProviderRoleMapping>;
-    dropProvider(id: string, req: Request, res: Response): Promise<IdentityProviderRoleMapping>;
-    addProvider(user: NonNullable<IdentityProviderRoleMapping>, req: Request, res: Response): Promise<IdentityProviderRoleMapping>;
+    protected repository: IIdentityProviderRoleMappingRepository;
+    protected identityPermissionProvider: IIdentityPermissionProvider;
+    constructor(ctx: OAuth2ProviderRoleControllerContext);
+    getProviders(req: Request, res: Response): Promise<any>;
+    getProvider(id: string, req: Request, res: Response): Promise<any>;
+    editProvider(id: string, user: NonNullable<IdentityProviderRoleMapping>, req: Request, res: Response): Promise<any>;
+    dropProvider(id: string, req: Request, res: Response): Promise<any>;
+    addProvider(user: NonNullable<IdentityProviderRoleMapping>, req: Request, res: Response): Promise<any>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/identity-provide-role/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provide-role/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAUpE,qBAEa,4BAA4B;IAE/B,YAAY,CACF,GAAG,EAAE,OAAO,EACP,GAAG,EAAE,QAAQ,GAC/B,OAAO,CAAC,2BAA2B,EAAE,CAAC;IAKnC,WAAW,CACA,EAAE,EAAE,MAAM,EACP,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC/B,OAAO,CAAC,2BAA2B,CAAC;IAKjC,YAAY,CACD,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,WAAW,CAAC,2BAA2B,CAAC,EAC3C,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC/B,OAAO,CAAC,2BAA2B,CAAC;IAKjC,YAAY,CACD,EAAE,EAAE,MAAM,EACP,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC/B,OAAO,CAAC,2BAA2B,CAAC;IAKjC,WAAW,CACJ,IAAI,EAAE,WAAW,CAAC,2BAA2B,CAAC,EACvC,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC/B,OAAO,CAAC,2BAA2B,CAAC;CAG1C"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provide-role/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIhD,OAAO,KAAK,EAAE,2BAA2B,EAAE,sCAAsC,EAAE,MAAM,8BAA8B,CAAC;AAUxH,MAAM,MAAM,mCAAmC,GAAG;IAC9C,UAAU,EAAE,sCAAsC,CAAC;IACnD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAEa,4BAA4B;IACrC,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC;IAE7D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,mCAAmC;IAM9C,YAAY,CACF,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC3B,OAAO,CAAC,GAAG,CAAC;IAmBT,WAAW,CACA,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC3B,OAAO,CAAC,GAAG,CAAC;IAsBT,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,CAAC,2BAA2B,CAAC,EAC3C,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC3B,OAAO,CAAC,GAAG,CAAC;IAoCT,YAAY,CACD,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC3B,OAAO,CAAC,GAAG,CAAC;IA8BT,WAAW,CACJ,IAAI,EAAE,WAAW,CAAC,2BAA2B,CAAC,EAC3C,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ,GAC3B,OAAO,CAAC,GAAG,CAAC;CAsDlB"}

package/dist/adapters/http/controllers/entities/identity-provide-role/module.js

@@ -17,23 +17,140 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { DBody, DController, DDelete, DGet, DPath, DPost, DRequest, DResponse, DTags, } from '@routup/decorators';
-import { createOauth2ProviderRoleRouteHandler, deleteOauth2ProvideRoleRouteHandler, getManyIdentityProviderRoleRouteHandler, getOneIdentityProviderRoleRouteHandler, updateOauth2ProviderRoleRouteHandler, } from "./handlers/index.js";
+import { BuiltInPolicyType, PolicyData } from '@authup/access';
+import { BadRequestError, ForbiddenError, NotFoundError } from '@ebec/http';
+import { PermissionName } from '@authup/core-kit';
+import { send, sendAccepted, sendCreated } from 'routup';
+import { useRequestQuery } from '@routup/basic/query';
+import { RoutupContainerAdapter } from '@validup/adapter-routup';
 import { ForceLoggedInMiddleware } from "../../../middleware/index.js";
+import { IdentityProviderRoleMappingRequestValidator } from "./utils/index.js";
+import { RequestHandlerOperation, useRequestIdentityOrFail, useRequestParamID, useRequestPermissionEvaluator, } from "../../../request/index.js";
 let OAuth2ProviderRoleController = class OAuth2ProviderRoleController {
+    repository;
+    identityPermissionProvider;
+    constructor(ctx) {
+        this.repository = ctx.repository;
+        this.identityPermissionProvider = ctx.identityPermissionProvider;
+    }
     async getProviders(req, res) {
-        return getManyIdentityProviderRoleRouteHandler(req, res);
+        const permissionEvaluator = useRequestPermissionEvaluator(req);
+        await permissionEvaluator.preEvaluateOneOf({
+            name: [
+                PermissionName.IDENTITY_PROVIDER_READ,
+                PermissionName.IDENTITY_PROVIDER_UPDATE,
+                PermissionName.IDENTITY_PROVIDER_DELETE,
+            ],
+        });
+        const { data, meta } = await this.repository.findMany(useRequestQuery(req));
+        return send(res, {
+            data,
+            meta,
+        });
     }
     async getProvider(id, req, res) {
-        return getOneIdentityProviderRoleRouteHandler(req, res);
+        const permissionEvaluator = useRequestPermissionEvaluator(req);
+        await permissionEvaluator.preEvaluateOneOf({
+            name: [
+                PermissionName.IDENTITY_PROVIDER_READ,
+                PermissionName.IDENTITY_PROVIDER_UPDATE,
+                PermissionName.IDENTITY_PROVIDER_DELETE,
+            ],
+        });
+        const paramId = useRequestParamID(req);
+        const entity = await this.repository.findOneBy({ id: paramId });
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        return send(res, entity);
     }
     async editProvider(id, user, req, res) {
-        return updateOauth2ProviderRoleRouteHandler(req, res);
+        const paramId = useRequestParamID(req);
+        const permissionEvaluator = useRequestPermissionEvaluator(req);
+        await permissionEvaluator.preEvaluate({
+            name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,
+        });
+        const validator = new IdentityProviderRoleMappingRequestValidator();
+        const validatorAdapter = new RoutupContainerAdapter(validator);
+        const data = await validatorAdapter.run(req, {
+            group: RequestHandlerOperation.UPDATE,
+        });
+        await this.repository.validateJoinColumns(data);
+        let entity = await this.repository.findOneBy({ id: paramId });
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        entity = this.repository.merge(entity, data);
+        await permissionEvaluator.evaluate({
+            name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,
+            input: new PolicyData({
+                [BuiltInPolicyType.ATTRIBUTES]: entity,
+            }),
+        });
+        await this.repository.save(entity);
+        return sendAccepted(res, entity);
     }
     async dropProvider(id, req, res) {
-        return deleteOauth2ProvideRoleRouteHandler(req, res);
+        const paramId = useRequestParamID(req);
+        const permissionEvaluator = useRequestPermissionEvaluator(req);
+        await permissionEvaluator.preEvaluate({
+            name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,
+        });
+        const entity = await this.repository.findOneBy({ id: paramId });
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        await permissionEvaluator.evaluate({
+            name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,
+            input: new PolicyData({
+                [BuiltInPolicyType.ATTRIBUTES]: entity,
+            }),
+        });
+        const { id: entityId } = entity;
+        await this.repository.remove(entity);
+        entity.id = entityId;
+        return sendAccepted(res);
     }
     async addProvider(user, req, res) {
-        return createOauth2ProviderRoleRouteHandler(req, res);
+        const permissionEvaluator = useRequestPermissionEvaluator(req);
+        await permissionEvaluator.preEvaluate({
+            name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,
+        });
+        const validator = new IdentityProviderRoleMappingRequestValidator();
+        const validatorAdapter = new RoutupContainerAdapter(validator);
+        const data = await validatorAdapter.run(req, {
+            group: RequestHandlerOperation.CREATE,
+        });
+        await this.repository.validateJoinColumns(data);
+        if (data.provider) {
+            data.provider_realm_id = data.provider.realm_id;
+        }
+        if (data.role) {
+            data.role_realm_id = data.role.realm_id;
+        }
+        if (data.role_realm_id &&
+            data.provider_realm_id &&
+            data.role_realm_id !== data.provider_realm_id) {
+            throw new BadRequestError('It is not possible to map an identity provider to a role of another realm.');
+        }
+        await permissionEvaluator.evaluate({
+            name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,
+            input: new PolicyData({
+                [BuiltInPolicyType.ATTRIBUTES]: data,
+            }),
+        });
+        const identity = useRequestIdentityOrFail(req);
+        const hasPermissions = await this.identityPermissionProvider.isSuperset(identity, {
+            type: 'role',
+            id: data.role_id,
+            clientId: data.role.client_id,
+        });
+        if (!hasPermissions) {
+            throw new ForbiddenError('You don\'t own the required permissions.');
+        }
+        const entity = this.repository.create(data);
+        await this.repository.save(entity);
+        return sendCreated(res, entity);
     }
 };
 __decorate([
@@ -83,7 +200,8 @@ __decorate([
 ], OAuth2ProviderRoleController.prototype, "addProvider", null);
 OAuth2ProviderRoleController = __decorate([
     DTags('identity-provider'),
-    DController('/identity-provider-role-mappings')
+    DController('/identity-provider-role-mappings'),
+    __metadata("design:paramtypes", [Object])
 ], OAuth2ProviderRoleController);
 export { OAuth2ProviderRoleController };
 //# sourceMappingURL=module.js.map

package/dist/adapters/http/controllers/entities/identity-provide-role/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provide-role/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EACH,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,GAC9E,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACH,oCAAoC,EACpC,mCAAmC,EACnC,uCAAuC,EACvC,sCAAsC,EACtC,oCAAoC,GACvC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAIhE,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAE/B,AAAN,KAAK,CAAC,YAAY,CACF,GAAY,EACP,GAAa;QAE9B,OAAO,uCAAuC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CACA,EAAU,EACP,GAAY,EACX,GAAa;QAE9B,OAAO,sCAAsC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACD,EAAU,EACV,IAA8C,EAC3C,GAAY,EACX,GAAa;QAE9B,OAAO,oCAAoC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACD,EAAU,EACP,GAAY,EACX,GAAa;QAE9B,OAAO,mCAAmC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CACJ,IAA8C,EACvC,GAAY,EACX,GAAa;QAE9B,OAAO,oCAAoC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;CACJ,CAAA;AA3CS;IADL,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;IAER,WAAA,QAAQ,EAAE,CAAA;IACN,WAAA,SAAS,EAAE,CAAA;;;;gEAGnB;AAGK;IADL,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAEZ,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACP,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;+DAGnB;AAGK;IADL,KAAK,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEpC,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;gEAGnB;AAGK;IADL,OAAO,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEtC,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACP,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;gEAGnB;AAGK;IADL,KAAK,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEhC,WAAA,KAAK,EAAE,CAAA;IACH,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;+DAGnB;AA5CQ,4BAA4B;IAFxC,KAAK,CAAC,mBAAmB,CAAC;IAC1B,WAAW,CAAC,kCAAkC,CAAC;GACnC,4BAA4B,CA6CxC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provide-role/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EACH,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,GAC9E,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,2CAA2C,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EACH,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,GAChC,MAAM,2BAA2B,CAAC;AAS5B,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAC3B,UAAU,CAAyC;IAEnD,0BAA0B,CAA8B;IAElE,YAAY,GAAwC;QAChD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,0BAA0B,GAAG,GAAG,CAAC,0BAA0B,CAAC;IACrE,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACF,GAAY,EACX,GAAa;QAE1B,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,mBAAmB,CAAC,gBAAgB,CAAC;YACvC,IAAI,EAAE;gBACF,cAAc,CAAC,sBAAsB;gBACrC,cAAc,CAAC,wBAAwB;gBACvC,cAAc,CAAC,wBAAwB;aAC1C;SACJ,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC,GAAG,EAAE;YACb,IAAI;YACJ,IAAI;SACP,CAAC,CAAC;IACP,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CACA,EAAU,EACX,GAAY,EACX,GAAa;QAE1B,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,mBAAmB,CAAC,gBAAgB,CAAC;YACvC,IAAI,EAAE;gBACF,cAAc,CAAC,sBAAsB;gBACrC,cAAc,CAAC,wBAAwB;gBACvC,cAAc,CAAC,wBAAwB;aAC1C;SACJ,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACD,EAAU,EACd,IAA8C,EAC3C,GAAY,EACX,GAAa;QAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,mBAAmB,CAAC,WAAW,CAAC;YAClC,IAAI,EAAE,cAAc,CAAC,6BAA6B;SACrD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,2CAA2C,EAAE,CAAC;QACpE,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YACzC,KAAK,EAAE,uBAAuB,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE7C,MAAM,mBAAmB,CAAC,QAAQ,CAAC;YAC/B,IAAI,EAAE,cAAc,CAAC,6BAA6B;YAClD,KAAK,EAAE,IAAI,UAAU,CAAC;gBAClB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM;aACzC,CAAC;SACL,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnC,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACD,EAAU,EACX,GAAY,EACX,GAAa;QAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,mBAAmB,CAAC,WAAW,CAAC;YAClC,IAAI,EAAE,cAAc,CAAC,6BAA6B;SACrD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,mBAAmB,CAAC,QAAQ,CAAC;YAC/B,IAAI,EAAE,cAAc,CAAC,6BAA6B;YAClD,KAAK,EAAE,IAAI,UAAU,CAAC;gBAClB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM;aACzC,CAAC;SACL,CAAC,CAAC;QAEH,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAEhC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC;QAErB,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CACJ,IAA8C,EAC3C,GAAY,EACX,GAAa;QAE1B,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,mBAAmB,CAAC,WAAW,CAAC;YAClC,IAAI,EAAE,cAAc,CAAC,6BAA6B;SACrD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,2CAA2C,EAAE,CAAC;QACpE,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAE/D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YACzC,KAAK,EAAE,uBAAuB,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpD,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5C,CAAC;QAED,IACI,IAAI,CAAC,aAAa;YAClB,IAAI,CAAC,iBAAiB;YACtB,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,iBAAiB,EAC/C,CAAC;YACC,MAAM,IAAI,eAAe,CAAC,4EAA4E,CAAC,CAAC;QAC5G,CAAC;QAED,MAAM,mBAAmB,CAAC,QAAQ,CAAC;YAC/B,IAAI,EAAE,cAAc,CAAC,6BAA6B;YAClD,KAAK,EAAE,IAAI,UAAU,CAAC;gBAClB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI;aACvC,CAAC;SACL,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,QAAQ,EAAE;YAC9E,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,IAAI,CAAC,OAAO;YAChB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,0CAA0C,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnC,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;CACJ,CAAA;AArLS;IADL,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;IAER,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;gEAiBf;AAGK;IADL,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAEZ,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;+DAoBf;AAGK;IADL,KAAK,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEpC,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;gEAkCf;AAGK;IADL,OAAO,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEtC,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;gEA4Bf;AAGK;IADL,KAAK,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEhC,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,SAAS,EAAE,CAAA;;;;+DAsDf;AA/LQ,4BAA4B;IAFxC,KAAK,CAAC,mBAAmB,CAAC;IAC1B,WAAW,CAAC,kCAAkC,CAAC;;GACnC,4BAA4B,CAgMxC"}

package/dist/adapters/http/controllers/entities/identity-provide-role/utils/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/entities/identity-provide-role/utils/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EACR,iCAAiC,EACpC,MAAM,0CAA0C,CAAC;AAGlD,qBAAa,2CAA4C,SAAQ,SAAS,CAC1E,iCAAiC,CAChC;IACG,SAAS,CAAC,UAAU;CAyDvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/controllers/entities/identity-provide-role/utils/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EACR,iCAAiC,EACpC,MAAM,0CAA0C,CAAC;AAGlD,qBAAa,2CAA4C,SAAQ,SAAS,CACtE,iCAAiC,CACpC;IACG,SAAS,CAAC,UAAU;CAyDvB"}

package/dist/adapters/http/controllers/entities/identity-provider/index.d.ts

@@ -1,3 +1,2 @@
-export * from './handlers/index.ts';
 export * from './module.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/identity-provider/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/identity-provider/index.js

@@ -4,6 +4,5 @@
  * For the full copyright and license information,
  * view the LICENSE file that was distributed with this source code.
  */
-export * from "./handlers/index.js";
 export * from "./module.js";
 //# sourceMappingURL=index.js.map

package/dist/adapters/http/controllers/entities/identity-provider/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts

@@ -1,23 +1,27 @@
 import type { Request, Response } from 'routup';
-import { IdentityProvider } from '@authup/core-kit';
-import { type IIdentityProviderAccountManager, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IdentityGrantType, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
+import type { IdentityProvider } from '@authup/core-kit';
+import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
+import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';
 export declare class IdentityProviderController {
     protected options: IdentityProviderControllerOptions;
+    protected repository: IIdentityProviderRepository;
+    protected realmRepository: IRealmRepository;
     protected accountManager: IIdentityProviderAccountManager;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected codeRequestValidator: OAuth2AuthorizationCodeRequestValidator;
     protected stateManager: IOAuth2AuthorizationStateManager;
-    protected identityGrant: IdentityGrantType;
+    protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
     constructor(ctx: IdentityProviderControllerContext);
-    getProviders(req: any, res: any): Promise<IdentityProvider[]>;
-    getProvider(id: string, req: any, res: any): Promise<IdentityProvider>;
-    editProvider(id: string, user: NonNullable<IdentityProvider>, req: any, res: any): Promise<IdentityProvider>;
-    put(id: string, user: NonNullable<IdentityProvider>, req: any, res: any): Promise<IdentityProvider>;
-    dropProvider(id: string, req: any, res: any): Promise<IdentityProvider>;
-    addProvider(user: NonNullable<IdentityProvider>, req: any, res: any): Promise<IdentityProvider>;
+    getProviders(req: any, res: any): Promise<any>;
+    getProvider(id: string, req: any, res: any): Promise<any>;
+    editProvider(id: string, user: NonNullable<IdentityProvider>, req: any, res: any): Promise<any>;
+    put(id: string, user: NonNullable<IdentityProvider>, req: any, res: any): Promise<any>;
+    dropProvider(id: string, req: any, res: any): Promise<any>;
+    addProvider(user: NonNullable<IdentityProvider>, req: any, res: any): Promise<any>;
     authorizeOut(_id: string, req: any, res: any): Promise<void>;
     authorizeIn(_id: string, req: Request, res: Response): Promise<void>;
+    private write;
     private resolve;
     private saveAuthorizationState;
     private verifyAuthorizationState;

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIhD,OAAO,EACH,gBAAgB,EAKnB,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EACH,KAAK,+BAA+B,EACpC,uCAAuC,EACvC,gCAAgC,EAChC,iBAAiB,EACjB,uCAAuC,EAE1C,MAAM,8BAA8B,CAAC;AAUtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,aAAa,EAAG,iBAAiB,CAAC;gBAIhC,GAAG,EAAE,iCAAiC;IAiB5C,YAAY,CACF,GAAG,EAAE,GAAG,EACH,GAAG,EAAE,GAAG,GAC1B,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAKxB,WAAW,CACA,EAAE,EAAE,MAAM,EACP,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IAKtB,YAAY,CACD,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAChC,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAOvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAChC,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACP,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAKvB,WAAW,CACJ,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAC5B,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACzB,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACL,GAAG,EAAE,MAAM,EACR,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG;IAmDnB,WAAW,CACJ,GAAG,EAAE,MAAM,EACR,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ;YAwGhB,OAAO;YAoBP,sBAAsB;YAatB,wBAAwB;CAazC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIhD,OAAO,KAAK,EACR,gBAAgB,EAAiC,MAAM,kBAAkB,CAAC;AAQ9E,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAE1C,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;gBAI1C,GAAG,EAAE,iCAAiC;IAc5C,YAAY,CACF,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IA8BT,WAAW,CACA,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IA8BT,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAChC,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACrB,OAAO,CAAC,GAAG,CAAC;IAKV,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAChC,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACrB,OAAO,CAAC,GAAG,CAAC;IAKV,YAAY,CACD,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACrB,OAAO,CAAC,GAAG,CAAC;IA6BV,WAAW,CACJ,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAChC,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACrB,OAAO,CAAC,GAAG,CAAC;IAOV,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG;IAkDnB,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,GAAG,EAAE,OAAO,EACX,GAAG,EAAE,QAAQ;YA2EhB,KAAK;YA0FL,OAAO;YAYP,sBAAsB;YAatB,wBAAwB;CAazC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.js

@@ -16,68 +16,121 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+import { BuiltInPolicyType, PolicyData } from '@authup/access';
+import { base64URLDecode, isUUID } from '@authup/kit';
 import { DBody, DController, DDelete, DGet, DPath, DPost, DPut, DRequest, DResponse, DTags, } from '@routup/decorators';
-import { getRequestHeader, getRequestHostName, getRequestIP, sendRedirect, } from 'routup';
-import { IdentityType, isOAuth2IdentityProvider, isOpenIDIdentityProvider, } from '@authup/core-kit';
-import { useDataSource } from 'typeorm-extension';
+import { getRequestHeader, getRequestIP, send, sendAccepted, sendCreated, sendRedirect, useRequestParam, } from 'routup';
+import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, ValidatorGroup, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from '@authup/core-kit';
 import { BadRequestError, NotFoundError } from '@ebec/http';
 import { useRequestQuery } from '@routup/basic/query';
 import { OAuth2Error } from '@authup/specs';
-import { base64URLDecode } from '@authup/kit';
 import { URL } from 'node:url';
-import { setResponseCookie } from '@routup/basic/cookie';
-import { CookieName } from '@authup/core-http-kit';
-import { IdentityGrantType, OAuth2AuthorizationCodeRequestValidator, createIdentityProviderOAuth2Authenticator, } from "../../../../../core/index.js";
-import { useRequestParamID } from "../../../request/index.js";
+import { RoutupContainerAdapter } from '@validup/adapter-routup';
+import { OAuth2AuthorizationCodeRequestValidator, createIdentityProviderOAuth2Authenticator, } from "../../../../../core/index.js";
+import { getRequestBodyRealmID, getRequestParamID, useRequestIdentityOrFail, useRequestParamID, useRequestPermissionEvaluator, } from "../../../request/index.js";
 import { ForceLoggedInMiddleware } from "../../../middleware/index.js";
-import { deleteIdentityProviderRouteHandler, getManyIdentityProviderRouteHandler, getOneIdentityProviderRouteHandler, writeIdentityProviderRouteHandler, } from "./handlers/index.js";
-import { IdentityProviderRepository } from "../../../../database/domains/index.js";
 let IdentityProviderController = class IdentityProviderController {
     options;
+    repository;
+    realmRepository;
     accountManager;
     codeRequestVerifier;
     codeRequestValidator;
     stateManager;
-    identityGrant;
+    codeIssuer;
     // ---------------------------------------------------------
     constructor(ctx) {
         this.options = ctx.options;
+        this.repository = ctx.repository;
+        this.realmRepository = ctx.realmRepository;
         this.accountManager = ctx.accountManager;
+        this.codeIssuer = ctx.codeIssuer;
         this.codeRequestVerifier = ctx.codeRequestVerifier;
         this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
         this.stateManager = ctx.stateManager;
-        this.identityGrant = new IdentityGrantType({
-            accessTokenIssuer: ctx.accessTokenIssuer,
-            refreshTokenIssuer: ctx.refreshTokenIssuer,
-            sessionManager: ctx.sessionManager,
-        });
     }
     // ---------------------------------------------------------
     async getProviders(req, res) {
-        return getManyIdentityProviderRouteHandler(req, res);
+        const { data, meta } = await this.repository.findMany(useRequestQuery(req));
+        try {
+            const permissionEvaluator = useRequestPermissionEvaluator(req);
+            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });
+            for (const datum of data) {
+                try {
+                    await permissionEvaluator.evaluate({
+                        name: PermissionName.IDENTITY_PROVIDER_READ,
+                        input: new PolicyData({
+                            [BuiltInPolicyType.ATTRIBUTES]: datum,
+                        }),
+                    });
+                }
+                catch {
+                    // do nothing
+                }
+            }
+        }
+        catch {
+            // do nothing
+        }
+        return send(res, {
+            data,
+            meta,
+        });
     }
     async getProvider(id, req, res) {
-        return getOneIdentityProviderRouteHandler(req, res);
+        const paramId = useRequestParamID(req, {
+            isUUID: false,
+        });
+        const entity = await this.repository.findOneByIdOrName(paramId, useRequestParam(req, 'realmId'));
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        try {
+            const permissionEvaluator = useRequestPermissionEvaluator(req);
+            await permissionEvaluator.evaluate({
+                name: PermissionName.IDENTITY_PROVIDER_READ,
+                input: new PolicyData({
+                    [BuiltInPolicyType.ATTRIBUTES]: entity,
+                }),
+            });
+        }
+        catch {
+            // do nothing
+        }
+        return send(res, entity);
     }
     async editProvider(id, user, req, res) {
-        return writeIdentityProviderRouteHandler(req, res, {
-            updateOnly: true,
-        });
+        return this.write(req, res, { updateOnly: true });
     }
     async put(id, user, req, res) {
-        return writeIdentityProviderRouteHandler(req, res);
+        return this.write(req, res);
     }
     async dropProvider(id, req, res) {
-        return deleteIdentityProviderRouteHandler(req, res);
+        const paramId = useRequestParamID(req);
+        const permissionEvaluator = useRequestPermissionEvaluator(req);
+        await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });
+        const entity = await this.repository.findOneBy({ id: paramId });
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        await permissionEvaluator.evaluate({
+            name: PermissionName.IDENTITY_PROVIDER_DELETE,
+            input: new PolicyData({
+                [BuiltInPolicyType.ATTRIBUTES]: entity,
+            }),
+        });
+        const { id: entityId } = entity;
+        await this.repository.remove(entity);
+        entity.id = entityId;
+        return sendAccepted(res, entity);
     }
     async addProvider(user, req, res) {
-        return writeIdentityProviderRouteHandler(req, res);
+        return this.write(req, res);
     }
     // ---------------------------------------------------------
     async authorizeOut(_id, req, res) {
         const id = useRequestParamID(req);
-        const dataSource = await useDataSource();
-        const entity = await this.resolve(dataSource, id);
+        const entity = await this.resolve(id);
         if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {
             throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');
         }
@@ -96,7 +149,7 @@ let IdentityProviderController = class IdentityProviderController {
             try {
                 codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));
             }
-            catch (e) {
+            catch {
                 throw OAuth2Error.requestInvalid('The code request is malformed and can not be parsed.');
             }
             const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);
@@ -113,8 +166,7 @@ let IdentityProviderController = class IdentityProviderController {
     }
     async authorizeIn(_id, req, res) {
         const id = useRequestParamID(req);
-        const dataSource = await useDataSource();
-        const entity = await this.resolve(dataSource, id);
+        const entity = await this.resolve(id);
         if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {
             throw new Error(`The provider protocol ${entity.protocol} is not valid.`);
         }
@@ -135,62 +187,112 @@ let IdentityProviderController = class IdentityProviderController {
             },
         });
         const user = await authenticator.authenticate(code);
-        const token = await this.identityGrant.runWith({
+        const realm = await this.realmRepository.resolve(entity.realm_id, true);
+        const authorizationCode = await this.codeIssuer.issue({
+            response_type: 'code',
+            client_id: data.codeRequest?.client_id,
+            redirect_uri: data.codeRequest?.redirect_uri,
+            scope: data.codeRequest?.scope,
+        }, {
             type: IdentityType.USER,
             data: {
                 ...user,
-                realm: entity.realm,
+                realm,
             },
-        }, {
-            ipAddress: getRequestIP(req, { trustProxy: true }),
-            userAgent: getRequestHeader(req, 'user-agent'),
-        });
-        const domainsRaw = [
-            ...this.options.cookieDomains,
-        ];
-        const requestHostName = getRequestHostName(req, {
-            trustProxy: true,
         });
-        if (requestHostName) {
-            domainsRaw.push(requestHostName);
-        }
-        const domains = [...new Set(domainsRaw)];
-        for (let i = 0; i < domains.length; i++) {
-            setResponseCookie(res, CookieName.ACCESS_TOKEN, token.access_token, {
-                domain: domains[i],
-                maxAge: this.options.accessTokenMaxAge * 1000,
-            });
-            if (token.refresh_token) {
-                setResponseCookie(res, CookieName.REFRESH_TOKEN, token.refresh_token, {
-                    domain: domains[i],
-                    maxAge: this.options.refreshTokenMaxAge * 1000,
-                });
-            }
-        }
         if (data.codeRequest) {
             const codeRequestKeys = Object.keys(data.codeRequest);
             const url = new URL('/authorize', this.options.baseURL);
-            for (let i = 0; i < codeRequestKeys.length; i++) {
-                const codeRequestKey = codeRequestKeys[i];
+            for (const codeRequestKey_ of codeRequestKeys) {
+                const codeRequestKey = codeRequestKey_;
                 if (data.codeRequest[codeRequestKey]) {
                     url.searchParams.set(codeRequestKey, data.codeRequest[codeRequestKey]);
                 }
             }
+            url.searchParams.set('code', authorizationCode.id);
             return sendRedirect(res, url.href);
         }
-        return sendRedirect(res, this.options.baseURL);
+        const url = new URL(this.options.baseURL);
+        url.searchParams.set('code', authorizationCode.id);
+        return sendRedirect(res, url.href);
     }
     // ---------------------------------------------------------
-    async resolve(dataSource, id) {
-        const repository = new IdentityProviderRepository(dataSource);
-        const entity = await repository.findOneWithEA({
-            relations: {
-                realm: true,
-            },
-            where: {
-                id,
-            },
+    async write(req, res, options = {}) {
+        let group;
+        const id = getRequestParamID(req, { isUUID: false });
+        const realmId = getRequestBodyRealmID(req);
+        let entity;
+        if (id) {
+            const where = {};
+            if (isUUID(id)) {
+                where.id = id;
+            }
+            else {
+                where.name = id;
+            }
+            if (realmId) {
+                where.realm_id = realmId;
+            }
+            entity = await this.repository.findOneBy(where);
+            if (!entity && options.updateOnly) {
+                throw new NotFoundError();
+            }
+        }
+        else if (options.updateOnly) {
+            throw new NotFoundError();
+        }
+        const permissionEvaluator = useRequestPermissionEvaluator(req);
+        if (entity) {
+            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });
+            group = ValidatorGroup.UPDATE;
+        }
+        else {
+            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });
+            group = ValidatorGroup.CREATE;
+        }
+        const validator = new RoutupContainerAdapter(new IdentityProviderValidator());
+        const data = await validator.run(req, {
+            group,
         });
+        const attributesValidator = new RoutupContainerAdapter(new IdentityProviderAttributesValidator());
+        const attributes = await attributesValidator.run(req);
+        await this.repository.validateJoinColumns(data);
+        if (entity) {
+            await permissionEvaluator.evaluate({
+                name: PermissionName.IDENTITY_PROVIDER_UPDATE,
+                input: new PolicyData({
+                    [BuiltInPolicyType.ATTRIBUTES]: {
+                        ...entity,
+                        ...data,
+                    },
+                }),
+            });
+        }
+        else {
+            if (!data.realm_id) {
+                const identity = useRequestIdentityOrFail(req);
+                data.realm_id = identity.realmId;
+            }
+            await permissionEvaluator.evaluate({
+                name: PermissionName.IDENTITY_PROVIDER_CREATE,
+                input: new PolicyData({
+                    [BuiltInPolicyType.ATTRIBUTES]: data,
+                }),
+            });
+        }
+        await this.repository.checkUniqueness(data, entity || undefined);
+        if (entity) {
+            entity = this.repository.merge(entity, data);
+            await this.repository.saveWithEA(entity, attributes);
+            return sendAccepted(res, entity);
+        }
+        entity = this.repository.create(data);
+        await this.repository.saveWithEA(entity, attributes);
+        return sendCreated(res, entity);
+    }
+    // ---------------------------------------------------------
+    async resolve(id) {
+        const entity = await this.repository.findOneById(id);
         if (!entity) {
             throw new NotFoundError();
         }