@authup/server-core 1.0.0-beta.30 → 1.0.0-beta.33

package/dist/core/entities/permission/service.js

@@ -0,0 +1,262 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { BuiltInPolicyType, PolicyData, SystemPolicyName } from '@authup/access';
+import { isPropertySet, isUUID } from '@authup/kit';
+import { AuthupError } from '@authup/errors';
+import { BadRequestError, NotFoundError } from '@ebec/http';
+import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ValidatorGroup, } from '@authup/core-kit';
+import { AbstractEntityService } from "../service.js";
+const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
+    PermissionName.REALM_CREATE,
+    PermissionName.REALM_UPDATE,
+    PermissionName.REALM_DELETE,
+];
+/**
+ * CUD permissions for global-capable entity types.
+ * These get system.realm-bound to prevent realm_admin from
+ * creating/modifying/deleting global entities.
+ * All other permissions get system.realm-or-global.
+ */
+const REALM_ADMIN_BOUND_PERMISSIONS = [
+    PermissionName.ROLE_CREATE,
+    PermissionName.ROLE_UPDATE,
+    PermissionName.ROLE_DELETE,
+    PermissionName.PERMISSION_CREATE,
+    PermissionName.PERMISSION_UPDATE,
+    PermissionName.PERMISSION_DELETE,
+    PermissionName.SCOPE_CREATE,
+    PermissionName.SCOPE_UPDATE,
+    PermissionName.SCOPE_DELETE,
+];
+export class PermissionService extends AbstractEntityService {
+    repository;
+    realmRepository;
+    roleRepository;
+    rolePermissionRepository;
+    policyRepository;
+    permissionPolicyRepository;
+    validator;
+    constructor(ctx) {
+        super();
+        this.repository = ctx.repository;
+        this.realmRepository = ctx.realmRepository;
+        this.roleRepository = ctx.roleRepository;
+        this.rolePermissionRepository = ctx.rolePermissionRepository;
+        this.policyRepository = ctx.policyRepository;
+        this.permissionPolicyRepository = ctx.permissionPolicyRepository;
+        this.validator = new PermissionValidator();
+    }
+    async getMany(query, actor) {
+        await actor.permissionEvaluator.preEvaluateOneOf({
+            name: [
+                PermissionName.PERMISSION_READ,
+                PermissionName.PERMISSION_UPDATE,
+                PermissionName.PERMISSION_DELETE,
+            ],
+        });
+        return this.repository.findMany(query);
+    }
+    async getOne(idOrName, actor, realm) {
+        await actor.permissionEvaluator.preEvaluateOneOf({
+            name: [
+                PermissionName.PERMISSION_READ,
+                PermissionName.PERMISSION_UPDATE,
+                PermissionName.PERMISSION_DELETE,
+            ],
+        });
+        const entity = await this.repository.findOneByIdOrName(idOrName, realm);
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        return entity;
+    }
+    async create(data, actor) {
+        const { entity } = await this.save(undefined, data, actor);
+        return entity;
+    }
+    async update(idOrName, data, actor) {
+        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });
+        return entity;
+    }
+    async save(idOrName, data, actor, options = {}) {
+        let group;
+        const realm = typeof data.realm_id === 'string' ?
+            await this.realmRepository.resolve(data.realm_id) :
+            undefined;
+        let entity;
+        if (idOrName) {
+            const where = {};
+            if (isUUID(idOrName)) {
+                where.id = idOrName;
+            }
+            else {
+                where.name = idOrName;
+            }
+            if (realm) {
+                where.realm_id = realm.id;
+            }
+            entity = await this.repository.findOneBy(where);
+            if (!entity && options.updateOnly) {
+                throw new NotFoundError();
+            }
+        }
+        else if (options.updateOnly) {
+            throw new NotFoundError();
+        }
+        if (entity) {
+            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+            group = ValidatorGroup.UPDATE;
+        }
+        else {
+            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });
+            group = ValidatorGroup.CREATE;
+        }
+        const validated = await this.validator.run(data, { group });
+        await this.repository.validateJoinColumns(validated);
+        if (entity) {
+            if (entity.built_in &&
+                isPropertySet(validated, 'name') &&
+                entity.name !== validated.name) {
+                throw new BadRequestError('The name of a built-in permission can not be changed.');
+            }
+            await actor.permissionEvaluator.evaluate({
+                name: PermissionName.PERMISSION_UPDATE,
+                input: new PolicyData({
+                    [BuiltInPolicyType.ATTRIBUTES]: {
+                        ...entity,
+                        ...validated,
+                    },
+                }),
+            });
+            await this.repository.checkUniqueness(validated, entity);
+            entity = this.repository.merge(entity, validated);
+            await this.repository.save(entity);
+            return {
+                entity,
+                created: false,
+            };
+        }
+        if (!isPropertySet(validated, 'realm_id') && actor.identity) {
+            validated.realm_id = this.getActorRealmId(actor) || null;
+        }
+        await actor.permissionEvaluator.evaluate({
+            name: PermissionName.PERMISSION_CREATE,
+            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),
+        });
+        await this.repository.checkUniqueness(validated);
+        entity = this.repository.create(validated);
+        entity = await this.repository.save(entity);
+        await this.assignDefaultPolicy(entity);
+        await this.assignToAdminRole(entity);
+        await this.assignToRealmAdminRoles(entity);
+        return {
+            entity,
+            created: true,
+        };
+    }
+    async delete(id, actor) {
+        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
+        const entity = await this.repository.findOneBy({ id });
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        if (entity.built_in) {
+            throw new BadRequestError('A built-in permission can not be deleted.');
+        }
+        await actor.permissionEvaluator.evaluate({
+            name: PermissionName.PERMISSION_DELETE,
+            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),
+        });
+        const { id: entityId } = entity;
+        await this.repository.remove(entity);
+        entity.id = entityId;
+        return entity;
+    }
+    /**
+     * Assign the system.default policy to a newly created permission.
+     * This ensures all permissions are evaluated with the baseline security
+     * policy (identity, permission-binding, realm-match) by default.
+     */
+    async assignDefaultPolicy(permission) {
+        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);
+        if (!defaultPolicy) {
+            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);
+        }
+        const entry = this.permissionPolicyRepository.create({
+            permission_id: permission.id,
+            permission_realm_id: permission.realm_id,
+            policy_id: defaultPolicy.id,
+            policy_realm_id: defaultPolicy.realm_id,
+        });
+        await this.permissionPolicyRepository.save(entry);
+    }
+    /**
+     * Assign a newly created permission to the global admin role.
+     * The admin role receives every permission without policy restrictions.
+     */
+    async assignToAdminRole(permission) {
+        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);
+        if (!adminRole) {
+            return;
+        }
+        const entry = this.rolePermissionRepository.create({
+            role_id: adminRole.id,
+            role_realm_id: adminRole.realm_id,
+            permission_id: permission.id,
+            permission_realm_id: permission.realm_id,
+        });
+        await this.rolePermissionRepository.save(entry);
+    }
+    /**
+     * Assign a newly created permission to all matching realm_admin roles.
+     *
+     * Uses differentiated junction policies:
+     * - CUD on global-capable entity types → system.realm-bound
+     * - Everything else → system.realm-or-global
+     *
+     * Eligible permissions:
+     * - Built-in authup permissions (global) — assigned to all realm_admin roles
+     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm
+     *
+     * Excluded:
+     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)
+     * - Custom global permissions (non-built-in with realm_id: null)
+     *
+     * Fails closed: skips assignment entirely if required policies are not found.
+     */
+    async assignToRealmAdminRoles(permission) {
+        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name)) {
+            return;
+        }
+        const isBuiltIn = Object.values(PermissionName).includes(permission.name);
+        if (!permission.realm_id && !isBuiltIn) {
+            return;
+        }
+        const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name) ?
+            SystemPolicyName.REALM_BOUND :
+            SystemPolicyName.REALM_OR_GLOBAL;
+        const policy = await this.policyRepository.findOneByName(policyName);
+        if (!policy) {
+            return;
+        }
+        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });
+        for (const role of realmAdminRoles) {
+            if (permission.realm_id && permission.realm_id !== role.realm_id) {
+                continue;
+            }
+            const entry = this.rolePermissionRepository.create({
+                role_id: role.id,
+                role_realm_id: role.realm_id,
+                permission_id: permission.id,
+                permission_realm_id: permission.realm_id,
+                policy_id: policy.id,
+            });
+            await this.rolePermissionRepository.save(entry);
+        }
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/core/entities/permission/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../src/core/entities/permission/service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACH,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,GACjB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAItD,MAAM,gCAAgC,GAAG;IACrC,cAAc,CAAC,YAAY;IAC3B,cAAc,CAAC,YAAY;IAC3B,cAAc,CAAC,YAAY;CAC9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,6BAA6B,GAAG;IAClC,cAAc,CAAC,WAAW;IAC1B,cAAc,CAAC,WAAW;IAC1B,cAAc,CAAC,WAAW;IAC1B,cAAc,CAAC,iBAAiB;IAChC,cAAc,CAAC,iBAAiB;IAChC,cAAc,CAAC,iBAAiB;IAChC,cAAc,CAAC,YAAY;IAC3B,cAAc,CAAC,YAAY;IAC3B,cAAc,CAAC,YAAY;CAC9B,CAAC;AAWF,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAC9C,UAAU,CAAwB;IAElC,eAAe,CAAmB;IAElC,cAAc,CAAkB;IAEhC,wBAAwB,CAA4B;IAEpD,gBAAgB,CAAoB;IAEpC,0BAA0B,CAA8B;IAExD,SAAS,CAAsB;IAEzC,YAAY,GAA6B;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;QACzC,IAAI,CAAC,wBAAwB,GAAG,GAAG,CAAC,wBAAwB,CAAC;QAC7D,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,0BAA0B,GAAG,GAAG,CAAC,0BAA0B,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAAO,CACT,KAA0B,EAC1B,KAAmB;QAEnB,MAAM,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YAC7C,IAAI,EAAE;gBACF,cAAc,CAAC,eAAe;gBAC9B,cAAc,CAAC,iBAAiB;gBAChC,cAAc,CAAC,iBAAiB;aACnC;SACJ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CACR,QAAgB,EAChB,KAAmB,EACnB,KAAc;QAEd,MAAM,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YAC7C,IAAI,EAAE;gBACF,cAAc,CAAC,eAAe;gBAC9B,cAAc,CAAC,iBAAiB;gBAChC,cAAc,CAAC,iBAAiB;aACnC;SACJ,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAyB,EACzB,KAAmB;QAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CACR,QAAgB,EAChB,IAAyB,EACzB,KAAmB;QAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CACN,QAA4B,EAC5B,IAAyB,EACzB,KAAmB,EACnB,UAAoC,EAAE;QAKtC,IAAI,KAAa,CAAC;QAElB,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC7C,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnD,SAAS,CAAC;QAEd,IAAI,MAAqC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,KAAK,GAAwB,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnB,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACJ,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;YAC1B,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACR,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC;YAC9B,CAAC;YAED,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,aAAa,EAAE,CAAC;YAC9B,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACxF,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC;QAClC,CAAC;aAAM,CAAC;YACJ,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACxF,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,CAAC;YACT,IACI,MAAM,CAAC,QAAQ;gBACf,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC;gBAChC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAChC,CAAC;gBACC,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAC;YACvF,CAAC;YAED,MAAM,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC;gBACrC,IAAI,EAAE,cAAc,CAAC,iBAAiB;gBACtC,KAAK,EAAE,IAAI,UAAU,CAAC;oBAClB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE;wBAC5B,GAAG,MAAM;wBACT,GAAG,SAAS;qBACf;iBACJ,CAAC;aACL,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAEzD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAElD,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEnC,OAAO;gBACH,MAAM;gBACN,OAAO,EAAE,KAAK;aACjB,CAAC;QACN,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1D,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACrC,IAAI,EAAE,cAAc,CAAC,iBAAiB;YACtC,KAAK,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;SACvE,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEjD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAE3C,OAAO;YACH,MAAM;YACN,OAAO,EAAE,IAAI;SAChB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CACR,EAAU,EACV,KAAmB;QAEnB,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACrC,IAAI,EAAE,cAAc,CAAC,iBAAiB;YACtC,KAAK,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACpE,CAAC,CAAC;QAEH,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAChC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC;QAErB,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,UAAsB;QACpD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1F,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,MAAM,IAAI,WAAW,CAAC,OAAO,gBAAgB,CAAC,OAAO,4FAA4F,CAAC,CAAC;QACvJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC;YACjD,aAAa,EAAE,UAAU,CAAC,EAAE;YAC5B,mBAAmB,EAAE,UAAU,CAAC,QAAQ;YACxC,SAAS,EAAE,aAAa,CAAC,EAAE;YAC3B,eAAe,EAAE,aAAa,CAAC,QAAQ;SAC1C,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAAC,UAAsB;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,OAAO;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;YAC/C,OAAO,EAAE,SAAS,CAAC,EAAE;YACrB,aAAa,EAAE,SAAS,CAAC,QAAQ;YACjC,aAAa,EAAE,UAAU,CAAC,EAAE;YAC5B,mBAAmB,EAAE,UAAU,CAAC,QAAQ;SAC3C,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,uBAAuB,CAAC,UAAsB;QACxD,IAAI,gCAAgC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAsB,CAAC,EAAE,CAAC;YAC/E,OAAO;QACX,CAAC;QAED,MAAM,SAAS,GAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAsB,CAAC,CAAC,CAAC;YAC1F,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC9B,gBAAgB,CAAC,eAAe,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO;QACX,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE9F,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/D,SAAS;YACb,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;gBAC/C,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,aAAa,EAAE,IAAI,CAAC,QAAQ;gBAC5B,aAAa,EAAE,UAAU,CAAC,EAAE;gBAC5B,mBAAmB,EAAE,UAAU,CAAC,QAAQ;gBACxC,SAAS,EAAE,MAAM,CAAC,EAAE;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/core/entities/permission/types.d.ts

@@ -0,0 +1,20 @@
+import type { Permission } from '@authup/core-kit';
+import type { ActorContext } from '../actor/types.ts';
+import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+export interface IPermissionRepository extends IEntityRepository<Permission> {
+    checkUniqueness(data: Partial<Permission>, existing?: Permission): Promise<void>;
+}
+export interface IPermissionService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Permission>>;
+    getOne(idOrName: string, actor: ActorContext, realm?: string): Promise<Permission>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<Permission>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext): Promise<Permission>;
+    save(idOrName: string | undefined, data: Record<string, any>, actor: ActorContext, options?: {
+        updateOnly?: boolean;
+    }): Promise<{
+        entity: Permission;
+        created: boolean;
+    }>;
+    delete(id: string, actor: ActorContext): Promise<Permission>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB,CAAC,UAAU,CAAC;IACxE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9G,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChE"}

package/dist/core/entities/permission/types.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/entities/permission/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/entities/permission/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/entities/permission-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/permission-policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/permission-policy/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./service.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/entities/permission-policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/permission-policy/service.d.ts

@@ -0,0 +1,17 @@
+import type { PermissionPolicy } from '@authup/core-kit';
+import type { ActorContext } from '../actor/types.ts';
+import { AbstractEntityService } from '../service.ts';
+import type { EntityRepositoryFindManyResult } from '../types.ts';
+import type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';
+export type PermissionPolicyServiceContext = {
+    repository: IPermissionPolicyRepository;
+};
+export declare class PermissionPolicyService extends AbstractEntityService implements IPermissionPolicyService {
+    protected repository: IPermissionPolicyRepository;
+    constructor(ctx: PermissionPolicyServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<PermissionPolicy>>;
+    getOne(id: string, actor: ActorContext): Promise<PermissionPolicy>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<PermissionPolicy>;
+    delete(id: string, actor: ActorContext): Promise<PermissionPolicy>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/permission-policy/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;gBAEtC,GAAG,EAAE,8BAA8B;IAKzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAwBtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAmB/B"}

package/dist/core/entities/permission-policy/service.js

@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { BuiltInPolicyType, PolicyData } from '@authup/access';
+import { NotFoundError } from '@ebec/http';
+import { PermissionName } from '@authup/core-kit';
+import { AbstractEntityService } from "../service.js";
+export class PermissionPolicyService extends AbstractEntityService {
+    repository;
+    constructor(ctx) {
+        super();
+        this.repository = ctx.repository;
+    }
+    async getMany(query, actor) {
+        await actor.permissionEvaluator.preEvaluateOneOf({
+            name: [
+                PermissionName.PERMISSION_READ,
+                PermissionName.PERMISSION_UPDATE,
+            ],
+        });
+        return this.repository.findMany(query);
+    }
+    async getOne(id, actor) {
+        await actor.permissionEvaluator.preEvaluateOneOf({
+            name: [
+                PermissionName.PERMISSION_READ,
+                PermissionName.PERMISSION_UPDATE,
+            ],
+        });
+        const entity = await this.repository.findOneBy({ id });
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        return entity;
+    }
+    async create(data, actor) {
+        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+        await this.repository.validateJoinColumns(data);
+        if (data.permission) {
+            data.permission_realm_id = data.permission.realm_id;
+        }
+        if (data.policy) {
+            data.policy_realm_id = data.policy.realm_id;
+        }
+        await actor.permissionEvaluator.evaluate({
+            name: PermissionName.PERMISSION_UPDATE,
+            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data }),
+        });
+        let entity = this.repository.create(data);
+        entity = await this.repository.save(entity);
+        return entity;
+    }
+    async delete(id, actor) {
+        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+        const entity = await this.repository.findOneBy({ id });
+        if (!entity) {
+            throw new NotFoundError();
+        }
+        await actor.permissionEvaluator.evaluate({
+            name: PermissionName.PERMISSION_UPDATE,
+            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),
+        });
+        const { id: entityId } = entity;
+        await this.repository.remove(entity);
+        entity.id = entityId;
+        return entity;
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/core/entities/permission-policy/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAQtD,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IACpD,UAAU,CAA8B;IAElD,YAAY,GAAmC;QAC3C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CACT,KAA0B,EAC1B,KAAmB;QAEnB,MAAM,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YAC7C,IAAI,EAAE;gBACF,cAAc,CAAC,eAAe;gBAC9B,cAAc,CAAC,iBAAiB;aACnC;SACJ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CACR,EAAU,EACV,KAAmB;QAEnB,MAAM,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YAC7C,IAAI,EAAE;gBACF,cAAc,CAAC,eAAe;gBAC9B,cAAc,CAAC,iBAAiB;aACnC;SACJ,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAyB,EACzB,KAAmB;QAEnB,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAExF,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,MAAM,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACrC,IAAI,EAAE,cAAc,CAAC,iBAAiB;YACtC,KAAK,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;SAClE,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CACR,EAAU,EACV,KAAmB;QAEnB,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACrC,IAAI,EAAE,cAAc,CAAC,iBAAiB;YACtC,KAAK,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACpE,CAAC,CAAC;QAEH,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAChC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC;QAErB,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ"}

package/dist/core/entities/permission-policy/types.d.ts

@@ -0,0 +1,12 @@
+import type { PermissionPolicy } from '@authup/core-kit';
+import type { ActorContext } from '../actor/types.ts';
+import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+export interface IPermissionPolicyRepository extends IEntityRepository<PermissionPolicy> {
+}
+export interface IPermissionPolicyService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<PermissionPolicy>>;
+    getOne(id: string, actor: ActorContext): Promise<PermissionPolicy>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<PermissionPolicy>;
+    delete(id: string, actor: ActorContext): Promise<PermissionPolicy>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/permission-policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,2BAA4B,SAAQ,iBAAiB,CAAC,gBAAgB,CAAC;CACvF;AAED,MAAM,WAAW,wBAAwB;IACrC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACtE"}

package/dist/core/entities/permission-policy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/entities/policy/attributes-validator.d.ts

@@ -0,0 +1,17 @@
+import { AttributeNamesPolicyValidator, AttributesPolicyValidator, DatePolicyValidator, TimePolicyValidator } from '@authup/access';
+import type { ContainerOptions } from 'validup';
+import { Container } from 'validup';
+type PolicyContainerRunOptions<T> = ContainerOptions<T> & {
+    attributeNames?: string[];
+};
+export declare class PolicyAttributesValidator extends Container<Record<string, any>> {
+    protected attributeNames: string[];
+    protected attributesOptionsValidator: AttributesPolicyValidator;
+    protected attributeNamesOptionsValidator: AttributeNamesPolicyValidator;
+    protected dateOptionsValidator: DatePolicyValidator;
+    protected timeOptionsValidator: TimePolicyValidator;
+    constructor(options: PolicyContainerRunOptions<Record<string, any>>);
+    run(data: Record<string, any>): Promise<Record<string, any>>;
+}
+export {};
+//# sourceMappingURL=attributes-validator.d.ts.map

package/dist/core/entities/policy/attributes-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes-validator.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/attributes-validator.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,6BAA6B,EAC7B,yBAAyB,EAEzB,mBAAmB,EACnB,mBAAmB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,KAAK,yBAAyB,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACtD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B,CAAC;AAEF,qBAAa,yBAA0B,SAAQ,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzE,SAAS,CAAC,cAAc,EAAG,MAAM,EAAE,CAAC;IAEpC,SAAS,CAAC,0BAA0B,EAAG,yBAAyB,CAAC;IAEjE,SAAS,CAAC,8BAA8B,EAAG,6BAA6B,CAAC;IAEzE,SAAS,CAAC,oBAAoB,EAAG,mBAAmB,CAAC;IAErD,SAAS,CAAC,oBAAoB,EAAG,mBAAmB,CAAC;gBAEzC,OAAO,EAAE,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAWpD,GAAG,CACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAmBnC"}

package/dist/core/entities/policy/attributes-validator.js

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2022.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { AttributeNamesPolicyValidator, AttributesPolicyValidator, BuiltInPolicyType, DatePolicyValidator, TimePolicyValidator, } from '@authup/access';
+import { omitRecord } from '@authup/kit';
+import { Container } from 'validup';
+export class PolicyAttributesValidator extends Container {
+    attributeNames;
+    attributesOptionsValidator;
+    attributeNamesOptionsValidator;
+    dateOptionsValidator;
+    timeOptionsValidator;
+    constructor(options) {
+        super(options);
+        this.attributeNames = options.attributeNames || [];
+        this.attributesOptionsValidator = new AttributesPolicyValidator();
+        this.attributeNamesOptionsValidator = new AttributeNamesPolicyValidator();
+        this.dateOptionsValidator = new DatePolicyValidator();
+        this.timeOptionsValidator = new TimePolicyValidator();
+    }
+    async run(data) {
+        switch (data.type) {
+            case BuiltInPolicyType.ATTRIBUTES: {
+                return this.attributesOptionsValidator.run(data);
+            }
+            case BuiltInPolicyType.ATTRIBUTE_NAMES: {
+                return this.attributeNamesOptionsValidator.run(data);
+            }
+            case BuiltInPolicyType.DATE: {
+                return this.dateOptionsValidator.run(data);
+            }
+            case BuiltInPolicyType.TIME: {
+                return this.timeOptionsValidator.run(data);
+            }
+            default: {
+                return omitRecord(data, this.attributeNames);
+            }
+        }
+    }
+}
+//# sourceMappingURL=attributes-validator.js.map

package/dist/core/entities/policy/attributes-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes-validator.js","sourceRoot":"","sources":["../../../../src/core/entities/policy/attributes-validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACH,6BAA6B,EAC7B,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAMpC,MAAM,OAAO,yBAA0B,SAAQ,SAA8B;IAC/D,cAAc,CAAY;IAE1B,0BAA0B,CAA6B;IAEvD,8BAA8B,CAAiC;IAE/D,oBAAoB,CAAuB;IAE3C,oBAAoB,CAAuB;IAErD,YAAY,OAAuD;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,0BAA0B,GAAG,IAAI,yBAAyB,EAAE,CAAC;QAClE,IAAI,CAAC,8BAA8B,GAAG,IAAI,6BAA6B,EAAE,CAAC;QAC1E,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC1D,CAAC;IAEQ,KAAK,CAAC,GAAG,CACd,IAAyB;QAEzB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChC,OAAO,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,KAAK,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC;gBACrC,OAAO,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzD,CAAC;YACD,KAAK,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YACD,KAAK,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACjD,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}

package/dist/core/entities/policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/policy/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./service.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/entities/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/entities/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/policy/service.d.ts

@@ -0,0 +1,32 @@
+import { PolicyValidator } from '@authup/core-kit';
+import type { Policy } from '@authup/core-kit';
+import type { ActorContext } from '../actor/types.ts';
+import type { IRealmRepository } from '../realm/types.ts';
+import { AbstractEntityService } from '../service.ts';
+import type { EntityRepositoryFindManyResult } from '../types.ts';
+import { PolicyAttributesValidator } from './attributes-validator.ts';
+import type { IPolicyRepository, IPolicyService } from './types.ts';
+export type PolicyServiceContext = {
+    repository: IPolicyRepository;
+    realmRepository: IRealmRepository;
+};
+export declare class PolicyService extends AbstractEntityService implements IPolicyService {
+    protected repository: IPolicyRepository;
+    protected realmRepository: IRealmRepository;
+    protected validator: PolicyValidator;
+    protected attributesValidator: PolicyAttributesValidator;
+    constructor(ctx: PolicyServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Policy>>;
+    getOne(idOrName: string, actor: ActorContext, realm?: string): Promise<Policy>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<Policy>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext): Promise<Policy>;
+    save(idOrName: string | undefined, data: Record<string, any>, actor: ActorContext, options?: {
+        updateOnly?: boolean;
+    }): Promise<{
+        entity: Policy;
+        created: boolean;
+    }>;
+    private validate;
+    delete(id: string, actor: ActorContext): Promise<Policy>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/policy/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IAErC,SAAS,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;gBAE7C,GAAG,EAAE,oBAAoB;IAQ/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;YA8FY,QAAQ;IAqBhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CA4BrB"}