@authup/server-core 1.0.0-beta.30 → 1.0.0-beta.33

package/dist/core/provisioning/synchronizer/user/module.js

@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 2026-2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { buildUserFakeEmail } from '@authup/core-kit';
+import { pickRecord } from '@authup/kit';
+import { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from "../../strategy/index.js";
+import { BaseProvisioningSynchronizer } from "../base.js";
+import { ProvisioningEntityResolver } from "../entity-resolver.js";
+import { ProvisioningJunctionSynchronizer } from "../junction-synchronizer.js";
+export class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer {
+    userRepository;
+    clientRepository;
+    permissionResolver;
+    roleResolver;
+    permissionJunction;
+    roleJunction;
+    constructor(ctx) {
+        super();
+        this.userRepository = ctx.userRepository;
+        this.clientRepository = ctx.clientRepository;
+        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
+        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);
+        this.permissionJunction = new ProvisioningJunctionSynchronizer({
+            repository: ctx.userPermissionRepository,
+            ownerKey: 'user_id',
+            ownerRealmKey: 'user_realm_id',
+        });
+        this.roleJunction = new ProvisioningJunctionSynchronizer({
+            repository: ctx.userRoleRepository,
+            ownerKey: 'user_id',
+            ownerRealmKey: 'user_realm_id',
+        });
+    }
+    async synchronize(input) {
+        const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+        let attributes = await this.userRepository.findOneBy({
+            name: input.attributes.name,
+            realm_id: input.attributes.realm_id || null,
+            client_id: input.attributes.client_id || null,
+        });
+        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+            if (attributes) {
+                await this.userRepository.remove(attributes);
+            }
+            return {
+                ...input,
+                attributes: attributes || input.attributes,
+            };
+        }
+        if (attributes) {
+            switch (strategy.type) {
+                case ProvisioningEntityStrategyType.MERGE:
+                    if (strategy.attributes &&
+                        strategy.attributes.includes('email')) {
+                        input.attributes.email = input.attributes.email ||
+                            attributes.email ||
+                            buildUserFakeEmail(input.attributes.name || attributes.name);
+                    }
+                    attributes = this.userRepository.merge(attributes, strategy.attributes ?
+                        pickRecord(input.attributes, strategy.attributes) :
+                        input.attributes);
+                    attributes = await this.userRepository.save(attributes);
+                    break;
+                case ProvisioningEntityStrategyType.REPLACE:
+                    input.attributes.email = input.attributes.email ||
+                        attributes.email ||
+                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);
+                    input.attributes.id = attributes.id;
+                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));
+                    break;
+            }
+        }
+        else {
+            if (!input.attributes.email && input.attributes.name) {
+                input.attributes.email = buildUserFakeEmail(input.attributes.name);
+            }
+            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));
+        }
+        // Permissions (Global, Realm & Client)
+        const permissions = [
+            ...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions),
+            ...(attributes.realm_id ?
+                await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realm_id) :
+                []),
+        ];
+        if (input.relations && input.relations.clientPermissions) {
+            const clientKeys = Object.keys(input.relations.clientPermissions);
+            for (const clientKey of clientKeys) {
+                const client = await this.clientRepository.findOneBy({
+                    name: clientKey,
+                    realm_id: attributes.realm_id,
+                });
+                if (client) {
+                    const entities = await this.permissionResolver.resolveClient(input.relations.clientPermissions[clientKey], attributes.realm_id, client.id);
+                    permissions.push(...entities);
+                }
+            }
+        }
+        if (permissions.length > 0) {
+            await this.permissionJunction.synchronize(attributes, permissions, 'permission_id', 'permission_realm_id');
+        }
+        // Roles (Global, Realm & Client)
+        const roles = [
+            ...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles),
+            ...(attributes.realm_id ?
+                await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realm_id) :
+                []),
+        ];
+        if (input.relations && input.relations.clientRoles) {
+            const clientKeys = Object.keys(input.relations.clientRoles);
+            for (const clientKey of clientKeys) {
+                const client = await this.clientRepository.findOneBy({
+                    name: clientKey,
+                    realm_id: attributes.realm_id,
+                });
+                if (client) {
+                    const entities = await this.roleResolver.resolveClient(input.relations.clientRoles[clientKey], attributes.realm_id, client.id);
+                    roles.push(...entities);
+                }
+            }
+        }
+        if (roles.length > 0) {
+            await this.roleJunction.synchronize(attributes, roles, 'role_id', 'role_realm_id');
+        }
+        return {
+            ...input,
+            attributes,
+        };
+    }
+}
+//# sourceMappingURL=module.js.map

package/dist/core/provisioning/synchronizer/user/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAC9G,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAG/E,MAAM,OAAO,4BAA6B,SAAQ,4BAAoD;IACxF,cAAc,CAAkB;IAEhC,gBAAgB,CAAoB;IAEpC,kBAAkB,CAAyC;IAE3D,YAAY,CAAmC;IAE/C,kBAAkB,CAAmD;IAErE,YAAY,CAA6C;IAEnE,YAAY,GAAwC;QAChD,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAE7C,IAAI,CAAC,kBAAkB,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACnF,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEvE,IAAI,CAAC,kBAAkB,GAAG,IAAI,gCAAgC,CAAC;YAC3D,UAAU,EAAE,GAAG,CAAC,wBAAwB;YACxC,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,eAAe;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,gCAAgC,CAAC;YACrD,UAAU,EAAE,GAAG,CAAC,kBAAkB;YAClC,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,eAAe;SACjC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA6B;QAC3C,MAAM,QAAQ,GAAG,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAErE,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YACjD,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;YAC3B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI;YAC3C,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,IAAI,IAAI;SAChD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAA8B,CAAC,MAAM,EAAE,CAAC;YAC1D,IAAI,UAAU,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC;YACD,OAAO;gBACH,GAAG,KAAK;gBACR,UAAU,EAAE,UAAU,IAAI,KAAK,CAAC,UAAU;aAC7C,CAAC;QACN,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACb,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,8BAA8B,CAAC,KAAK;oBACrC,IACI,QAAQ,CAAC,UAAU;wBACnB,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EACvC,CAAC;wBACC,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK;4BAC3C,UAAU,CAAC,KAAK;4BAChB,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;oBACrE,CAAC;oBAED,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAClC,UAAU,EACV,QAAQ,CAAC,UAAU,CAAC,CAAC;wBACjB,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;wBACnD,KAAK,CAAC,UAAU,CACvB,CAAC;oBAEF,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACxD,MAAM;gBACV,KAAK,8BAA8B,CAAC,OAAO;oBACvC,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK;wBAC3C,UAAU,CAAC,KAAK;wBAChB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBAEpF,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;oBACpC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;oBAC1F,MAAM;YACd,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACnD,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvE,CAAC;YAED,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9F,CAAC;QAED,uCAAuC;QACvC,MAAM,WAAW,GAAkB;YAC/B,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAC1C,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,iBAAiB,CACvD;YACD,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACtC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,gBAAgB,EACnD,UAAU,CAAC,QAAQ,CACtB,CAAC,CAAC;gBACH,EAAE,CAAC;SACV,CAAC;QAEF,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;oBACjD,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,UAAU,CAAC,QAAQ;iBAChC,CAAC,CAAC;gBAEH,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CACxD,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC5C,UAAU,CAAC,QAAQ,EACnB,MAAM,CAAC,EAAE,CACZ,CAAC;oBACF,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CACrC,UAAU,EACV,WAAW,EACX,eAAe,EACf,qBAAqB,CACxB,CAAC;QACN,CAAC;QAED,iCAAiC;QACjC,MAAM,KAAK,GAAY;YACnB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CACpC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,CACjD;YACD,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAChC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,UAAU,EAC7C,UAAU,CAAC,QAAQ,CACtB,CAAC,CAAC;gBACH,EAAE,CAAC;SACV,CAAC;QAEF,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;oBACjD,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,UAAU,CAAC,QAAQ;iBAChC,CAAC,CAAC;gBAEH,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAClD,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,EACtC,UAAU,CAAC,QAAQ,EACnB,MAAM,CAAC,EAAE,CACZ,CAAC;oBACF,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC5B,CAAC;YACL,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAC/B,UAAU,EACV,KAAK,EACL,SAAS,EACT,eAAe,CAClB,CAAC;QACN,CAAC;QAED,OAAO;YACH,GAAG,KAAK;YACR,UAAU;SACb,CAAC;IACN,CAAC;CACJ"}

package/dist/core/provisioning/synchronizer/user/types.d.ts

@@ -0,0 +1,10 @@
+import type { IClientRepository, IPermissionRepository, IRoleRepository, IUserPermissionRepository, IUserRepository, IUserRoleRepository } from '../../../entities/index.ts';
+export type UserProvisioningSynchronizerContext = {
+    userRepository: IUserRepository;
+    userRoleRepository: IUserRoleRepository;
+    userPermissionRepository: IUserPermissionRepository;
+    clientRepository: IClientRepository;
+    roleRepository: IRoleRepository;
+    permissionRepository: IPermissionRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/user/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,mCAAmC,GAAG;IAC9C,cAAc,EAAE,eAAe,CAAC;IAChC,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,wBAAwB,EAAE,yBAAyB,CAAC;IAEpD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,oBAAoB,EAAE,qBAAqB,CAAC;CAC/C,CAAC"}

package/dist/core/provisioning/synchronizer/user/types.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/provisioning/synchronizer/user/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/user/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/provisioning/types.d.ts

@@ -0,0 +1,10 @@
+import type { RootProvisioningEntity } from './entities/index.ts';
+import type { IContainer } from 'eldin';
+export interface IProvisioningSource {
+    load(container: IContainer): Promise<RootProvisioningEntity>;
+}
+export interface IProvisioningSynchronizer<T> {
+    synchronize(input: T): Promise<T>;
+    synchronizeMany(input: T[]): Promise<T[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C"}

package/dist/core/provisioning/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/security/index.d.ts

@@ -0,0 +1,2 @@
+export * from './policy/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/security/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC"}

package/dist/core/security/index.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (c) 2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./policy/index.js";
+//# sourceMappingURL=index.js.map

package/dist/core/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/security/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,mBAAmB,CAAC"}

package/dist/core/security/policy/engine.d.ts

@@ -0,0 +1,6 @@
+import { PolicyEngine as BasePolicyEngine } from '@authup/access';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+export declare class PolicyEngine extends BasePolicyEngine {
+    constructor(identityPermissionProvider: IIdentityPermissionProvider);
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/core/security/policy/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/engine.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAA8C,MAAM,gBAAgB,CAAC;AAC9G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAGtF,qBAAa,YAAa,SAAQ,gBAAgB;gBAClC,0BAA0B,EAAE,2BAA2B;CAKtE"}

package/dist/core/security/policy/engine.js

@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { PolicyEngine as BasePolicyEngine, BuiltInPolicyType, PolicyDefaultEvaluators } from '@authup/access';
+import { PermissionBindingPolicyEvaluator } from "./evaluator.js";
+export class PolicyEngine extends BasePolicyEngine {
+    constructor(identityPermissionProvider) {
+        super(PolicyDefaultEvaluators);
+        this.registerEvaluator(BuiltInPolicyType.PERMISSION_BINDING, new PermissionBindingPolicyEvaluator(identityPermissionProvider));
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/core/security/policy/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../../src/core/security/policy/engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAElE,MAAM,OAAO,YAAa,SAAQ,gBAAgB;IAC9C,YAAY,0BAAuD;QAC/D,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE/B,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,IAAI,gCAAgC,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACnI,CAAC;CACJ"}

package/dist/core/security/policy/evaluator.d.ts

@@ -0,0 +1,14 @@
+import type { IPolicyEvaluator, PolicyEvaluationContext, PolicyEvaluationResult } from '@authup/access';
+import { AttributesPolicyEvaluator, IdentityPolicyEvaluator, PermissionBindingPolicyValidator } from '@authup/access';
+import type { PermissionBinding } from '@authup/core-kit';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
+    protected validator: PermissionBindingPolicyValidator;
+    protected identityEvaluator: IdentityPolicyEvaluator;
+    protected attributesEvaluator: AttributesPolicyEvaluator;
+    protected identityPermissionProvider: IIdentityPermissionProvider;
+    constructor(identityPermissionProvider: IIdentityPermissionProvider);
+    accessData(ctx: PolicyEvaluationContext): Promise<PermissionBinding | null>;
+    evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
+}
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/core/security/policy/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAER,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EAEzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACH,yBAAyB,EAEzB,uBAAuB,EACvB,gCAAgC,EAKnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAO7D,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAiB5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA4E5G"}

package/dist/core/security/policy/evaluator.js

@@ -0,0 +1,98 @@
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+import { AttributesPolicyEvaluator, BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, definePolicyIssueItem, maybeInvertPolicyOutcome, } from '@authup/access';
+import { mergePermissionBindings } from '@authup/core-kit';
+export class PermissionBindingPolicyEvaluator {
+    validator;
+    identityEvaluator;
+    attributesEvaluator;
+    identityPermissionProvider;
+    constructor(identityPermissionProvider) {
+        this.validator = new PermissionBindingPolicyValidator();
+        this.identityEvaluator = new IdentityPolicyEvaluator();
+        this.attributesEvaluator = new AttributesPolicyEvaluator();
+        this.identityPermissionProvider = identityPermissionProvider;
+    }
+    async accessData(ctx) {
+        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {
+            return null;
+        }
+        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {
+            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);
+        }
+        const data = ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);
+        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);
+        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);
+        return data;
+    }
+    async evaluate(value, ctx) {
+        const policy = await this.validator.run(value);
+        const identity = await this.identityEvaluator.accessData(ctx);
+        if (!identity) {
+            return {
+                success: false,
+                issues: [
+                    definePolicyIssueItem({
+                        code: PolicyIssueCode.DATA_MISSING,
+                        message: 'The data property identity is missing',
+                        path: ctx.path,
+                    }),
+                ],
+            };
+        }
+        const binding = await this.accessData(ctx);
+        if (!binding) {
+            return {
+                success: false,
+                issues: [
+                    definePolicyIssueItem({
+                        code: PolicyIssueCode.DATA_MISSING,
+                        message: 'The data property permission is missing',
+                        path: ctx.path,
+                    }),
+                ],
+            };
+        }
+        const identityBindings = await this.identityPermissionProvider.getFor(identity)
+            .then((bindings) => bindings.filter((item) => {
+            if (item.permission.name !== binding.permission.name) {
+                return false;
+            }
+            return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&
+                (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);
+        }));
+        if (identityBindings.length === 0) {
+            return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+        }
+        const bindingsMerged = mergePermissionBindings(identityBindings);
+        if (bindingsMerged.length === 0) {
+            return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+        }
+        const policies = bindingsMerged
+            .flatMap((b) => b.policies || []);
+        if (policies.length === 0) {
+            return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+        }
+        if (!ctx.evaluators) {
+            return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+        }
+        const compositePolicy = {
+            children: policies,
+            type: BuiltInPolicyType.COMPOSITE,
+        };
+        const engine = new PolicyEngine(ctx.evaluators);
+        const outcome = await engine.evaluate(compositePolicy, {
+            ...ctx,
+            path: [...(ctx.path || []), compositePolicy.type],
+        });
+        return {
+            ...outcome,
+            success: maybeInvertPolicyOutcome(outcome.success, policy.invert),
+        };
+    }
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/core/security/policy/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EACH,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,gCAAgC,EAChC,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,MAAM,OAAO,gCAAgC;IAC/B,SAAS,CAAoC;IAE7C,iBAAiB,CAA0B;IAE3C,mBAAmB,CAA6B;IAEhD,0BAA0B,CAA8B;IAElE,YAAY,0BAAuD;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,gCAAgC,EAAE,CAAC;QACxD,IAAI,CAAC,iBAAiB,GAAG,IAAI,uBAAuB,EAAE,CAAC;QACvD,IAAI,CAAC,mBAAmB,GAAG,IAAI,yBAAyB,EAAE,CAAC;QAC3D,IAAI,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAA4B;QACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7D,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAoB,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAEnF,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA0B,EAAE,GAA4B;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE;oBACJ,qBAAqB,CAAC;wBAClB,IAAI,EAAE,eAAe,CAAC,YAAY;wBAClC,OAAO,EAAE,uCAAuC;wBAChD,IAAI,EAAE,GAAG,CAAC,IAAI;qBACjB,CAAC;iBACL;aACJ,CAAC;QACN,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE;oBACJ,qBAAqB,CAAC;wBAClB,IAAI,EAAE,eAAe,CAAC,YAAY;wBAClC,OAAO,EAAE,yCAAyC;wBAClD,IAAI,EAAE,GAAG,CAAC,IAAI;qBACjB,CAAC;iBACL;aACJ,CAAC;QACN,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC1E,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACzC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC;gBAC/E,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC,CAAC;QAER,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;QACjE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,QAAQ,GAAsB,cAAc;aAC7C,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,eAAe,GAAqC;YACtD,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,iBAAiB,CAAC,SAAS;SACpC,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE;YACnD,GAAG,GAAG;YACN,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC;SACpD,CAAC,CAAC;QAEH,OAAO;YACH,GAAG,OAAO;YACV,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;SACpE,CAAC;IACN,CAAC;CACJ"}

package/dist/core/security/policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './engine.ts';
+export * from './evaluator.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/security/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/core/security/policy/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */
+export * from "./engine.js";
+export * from "./evaluator.js";
+//# sourceMappingURL=index.js.map

package/dist/core/security/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/security/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,4 @@ export * from './app/index.ts';
 export * from './cli/commands/index.ts';
 export * from './adapters/database/index.ts';
 export * from './adapters/http/index.ts';
-export * from './security/index.ts';
-export * from './services/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,kBAAkB,CAAC;AAE1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,kBAAkB,CAAC;AAE1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC"}

package/dist/index.js

@@ -9,6 +9,4 @@ export * from "./app/index.js";
 export * from "./cli/commands/index.js";
 export * from "./adapters/database/index.js";
 export * from "./adapters/http/index.js";
-export * from "./security/index.js";
-export * from "./services/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,kBAAkB,CAAC;AAE1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,kBAAkB,CAAC;AAE1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC"}