@authup/server-core 1.0.0-beta.35 → 1.0.0-beta.36

package/dist/{commands-C1vz08cL.mjs → commands-D5p6u-xJ.mjs}

@@ -1,7 +1,7 @@
 import { Application, Application as Application$1 } from "orkos";
 import { TypedToken } from "eldin";
 import { BeforeInsert, BeforeUpdate, Column, CreateDateColumn, DataSource, Entity, EntityNotFoundError, EventSubscriber, FindOptionsUtils, In, Index, InstanceChecker, IsNull, JoinColumn, LessThan, ManyToOne, PrimaryGeneratedColumn, Repository, Tree, TreeChildren, TreeParent, TreeRepository, TreeRepositoryUtils, Unique, UpdateDateColumn } from "typeorm";
-import { ClientError, ClientValidator, EntityDefaultEventName, EntityType, IdentityProviderAttributesValidator, IdentityProviderMappingSyncMode, IdentityProviderPreset, IdentityProviderProtocol, IdentityProviderValidator, IdentityType, PermissionName, PermissionValidator, PolicyValidator, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, RealmValidator, RobotError, RobotValidator, RoleValidator, ScopeName, ScopeValidator, UserError, UserValidator, ValidatorGroup, buildEntityChannelName, buildEntityNamespaceName, buildIdentityProviderAuthorizeCallbackPath, buildUserFakeEmail, isLdapIdentityProvider, isOAuth2IdentityProvider, isOpenIDIdentityProvider, isPolicy, isPolicyNameValid, isUserFakeEmail } from "@authup/core-kit";
+import { ClientError, ClientPermissionValidator, ClientRoleValidator, ClientScopeValidator, ClientValidator, EntityDefaultEventName, EntityType, IdentityProviderAttributesValidator, IdentityProviderMappingSyncMode, IdentityProviderPreset, IdentityProviderProtocol, IdentityProviderRoleMappingValidator, IdentityProviderValidator, IdentityType, PermissionName, PermissionPolicyValidator, PermissionValidator, PolicyValidator, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, RealmValidator, RobotError, RobotPermissionValidator, RobotRoleValidator, RobotValidator, RolePermissionValidator, RoleValidator, ScopeName, ScopeValidator, UserError, UserPermissionValidator, UserRoleValidator, UserValidator, ValidatorGroup, buildEntityChannelName, buildEntityNamespaceName, buildIdentityProviderAuthorizeCallbackPath, buildUserFakeEmail, isLdapIdentityProvider, isOAuth2IdentityProvider, isOpenIDIdentityProvider, isPolicy, isPolicyNameValid, isUserFakeEmail } from "@authup/core-kit";
 import { AsymmetricKey, CryptoAsymmetricAlgorithm, DomainEventPublisher, DomainEventRedisPublisher, DomainEventSocketPublisher, MemoryCache, RedisCache, buildCacheKey, buildRedisKeyPath, compare, createAsymmetricKeyPair, createLogger, createNoopLogger, createRedisClient, escapeRedisKey, extractTokenHeader, extractTokenPayload, hash, setLoggerFactory, signToken, useLogger, verifyToken } from "@authup/server-kit";
 import { singa } from "singa";
 import { AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PermissionEvaluator, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyIssueCode, SystemPolicyName, TimePolicyValidator, buildPermissionKey, definePolicyEvaluationContext, definePolicyIssueItem, isPermissionPolicyBindingEqual, maybeInvertPolicyOutcome, mergePermissionPolicyBindings } from "@authup/access";
@@ -4437,10 +4437,12 @@ var ClientService = class extends AbstractEntityService {
 var ClientPermissionService = class extends AbstractEntityService {
 	repository;
 	identityPermissionProvider;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new ClientPermissionValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.CLIENT_PERMISSION_CREATE, PermissionName.CLIENT_PERMISSION_DELETE] });
@@ -4454,32 +4456,37 @@ var ClientPermissionService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.permission) {
-			data.permission_realm_id = data.permission.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			client_id: validated.client_id,
+			permission_id: validated.permission_id
+		})) throw new ConflictError("The client-permission assignment already exists.");
+		if (validated.permission) {
+			validated.permission_realm_id = validated.permission.realm_id;
 			await actor.permissionEvaluator.preEvaluate({
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
 		}
-		if (data.client) data.client_realm_id = data.client.realm_id;
-		if (data.permission && actor.identity && typeof data.policy_id === "undefined") {
+		if (validated.client) validated.client_realm_id = validated.client.realm_id;
+		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
 			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
-			if (junctionPolicy) data.policy_id = junctionPolicy.id;
+			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -4515,9 +4522,13 @@ var ClientPermissionService = class extends AbstractEntityService {
 //#region src/core/entities/client-role/service.ts
 var ClientRoleService = class extends AbstractEntityService {
 	repository;
+	identityPermissionProvider;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new ClientRoleValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -4539,14 +4550,29 @@ var ClientRoleService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.role) data.role_realm_id = data.role.realm_id;
-		if (data.client) data.client_realm_id = data.client.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			role_id: validated.role_id,
+			client_id: validated.client_id
+		})) throw new ConflictError("The client-role assignment already exists.");
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.client) validated.client_realm_id = validated.client.realm_id;
+		if (validated.role && actor.identity) {
+			if (!await this.identityPermissionProvider.isSuperset({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				type: "role",
+				id: validated.role_id,
+				clientId: validated.role.client_id
+			})) throw new ForbiddenError("You don't own the required permissions.");
+		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_ROLE_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -4568,9 +4594,11 @@ var ClientRoleService = class extends AbstractEntityService {
 //#region src/core/entities/client-scope/service.ts
 var ClientScopeService = class extends AbstractEntityService {
 	repository;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.validator = new ClientScopeValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -4592,14 +4620,19 @@ var ClientScopeService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.client) data.client_realm_id = data.client.realm_id;
-		if (data.scope) data.scope_realm_id = data.scope.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			client_id: validated.client_id,
+			scope_id: validated.scope_id
+		})) throw new ConflictError("The client-scope assignment already exists.");
+		if (validated.client) validated.client_realm_id = validated.client.realm_id;
+		if (validated.scope) validated.scope_realm_id = validated.scope.realm_id;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_SCOPE_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -4775,6 +4808,10 @@ var PermissionService = class extends AbstractEntityService {
 	*/ async assignDefaultPolicy(permission) {
 		const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);
 		if (!defaultPolicy) throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);
+		if (await this.permissionPolicyRepository.findOneBy({
+			permission_id: permission.id,
+			policy_id: defaultPolicy.id
+		})) return;
 		const entry = this.permissionPolicyRepository.create({
 			permission_id: permission.id,
 			permission_realm_id: permission.realm_id,
@@ -4789,6 +4826,10 @@ var PermissionService = class extends AbstractEntityService {
 	*/ async assignToAdminRole(permission) {
 		const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);
 		if (!adminRole) return;
+		if (await this.rolePermissionRepository.findOneBy({
+			role_id: adminRole.id,
+			permission_id: permission.id
+		})) return;
 		const entry = this.rolePermissionRepository.create({
 			role_id: adminRole.id,
 			role_realm_id: adminRole.realm_id,
@@ -4823,6 +4864,10 @@ var PermissionService = class extends AbstractEntityService {
 		const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });
 		for (const role of realmAdminRoles) {
 			if (permission.realm_id && permission.realm_id !== role.realm_id) continue;
+			if (await this.rolePermissionRepository.findOneBy({
+				role_id: role.id,
+				permission_id: permission.id
+			})) continue;
 			const entry = this.rolePermissionRepository.create({
 				role_id: role.id,
 				role_realm_id: role.realm_id,
@@ -4838,9 +4883,11 @@ var PermissionService = class extends AbstractEntityService {
 //#region src/core/entities/permission-policy/service.ts
 var PermissionPolicyService = class extends AbstractEntityService {
 	repository;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.validator = new PermissionPolicyValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.PERMISSION_READ, PermissionName.PERMISSION_UPDATE] });
@@ -4854,14 +4901,19 @@ var PermissionPolicyService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.permission) data.permission_realm_id = data.permission.realm_id;
-		if (data.policy) data.policy_realm_id = data.policy.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			permission_id: validated.permission_id,
+			policy_id: validated.policy_id
+		})) throw new ConflictError("The permission-policy assignment already exists.");
+		if (validated.permission) validated.permission_realm_id = validated.permission.realm_id;
+		if (validated.policy) validated.policy_realm_id = validated.policy.realm_id;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -5272,10 +5324,12 @@ var RobotService = class extends AbstractEntityService {
 var RobotPermissionService = class extends AbstractEntityService {
 	repository;
 	identityPermissionProvider;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new RobotPermissionValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.ROBOT_PERMISSION_CREATE, PermissionName.ROBOT_PERMISSION_DELETE] });
@@ -5289,32 +5343,37 @@ var RobotPermissionService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROBOT_PERMISSION_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.permission) {
-			data.permission_realm_id = data.permission.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			permission_id: validated.permission_id,
+			robot_id: validated.robot_id
+		})) throw new ConflictError("The robot-permission assignment already exists.");
+		if (validated.permission) {
+			validated.permission_realm_id = validated.permission.realm_id;
 			await actor.permissionEvaluator.preEvaluate({
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
 		}
-		if (data.robot) data.robot_realm_id = data.robot.realm_id;
-		if (data.permission && actor.identity && typeof data.policy_id === "undefined") {
+		if (validated.robot) validated.robot_realm_id = validated.robot.realm_id;
+		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
 			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
-			if (junctionPolicy) data.policy_id = junctionPolicy.id;
+			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROBOT_PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -5350,9 +5409,13 @@ var RobotPermissionService = class extends AbstractEntityService {
 //#region src/core/entities/robot-role/service.ts
 var RobotRoleService = class extends AbstractEntityService {
 	repository;
+	identityPermissionProvider;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new RobotRoleValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -5374,14 +5437,29 @@ var RobotRoleService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROBOT_ROLE_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.role) data.role_realm_id = data.role.realm_id;
-		if (data.robot) data.robot_realm_id = data.robot.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			role_id: validated.role_id,
+			robot_id: validated.robot_id
+		})) throw new ConflictError("The robot-role assignment already exists.");
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.robot) validated.robot_realm_id = validated.robot.realm_id;
+		if (validated.role && actor.identity) {
+			if (!await this.identityPermissionProvider.isSuperset({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				type: "role",
+				id: validated.role_id,
+				clientId: validated.role.client_id
+			})) throw new ForbiddenError("You don't own the required permissions.");
+		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROBOT_ROLE_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -5602,10 +5680,12 @@ var RoleAttributeService = class extends AbstractEntityService {
 var RolePermissionService = class extends AbstractEntityService {
 	repository;
 	identityPermissionProvider;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new RolePermissionValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.ROLE_PERMISSION_DELETE, PermissionName.ROLE_PERMISSION_READ] });
@@ -5619,32 +5699,37 @@ var RolePermissionService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.permission) {
-			data.permission_realm_id = data.permission.realm_id;
-			if (!data.role || data.role.name !== ROLE_ADMIN_NAME) await actor.permissionEvaluator.preEvaluate({
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			role_id: validated.role_id,
+			permission_id: validated.permission_id
+		})) throw new ConflictError("The role-permission assignment already exists.");
+		if (validated.permission) {
+			validated.permission_realm_id = validated.permission.realm_id;
+			if (!validated.role || validated.role.name !== ROLE_ADMIN_NAME) await actor.permissionEvaluator.preEvaluate({
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
 		}
-		if (data.role) data.role_realm_id = data.role.realm_id;
-		if (data.permission && actor.identity && typeof data.policy_id === "undefined") {
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
 			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
-			if (junctionPolicy) data.policy_id = junctionPolicy.id;
+			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROLE_PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -6034,10 +6119,12 @@ var UserAttributeService = class extends AbstractEntityService {
 var UserPermissionService = class extends AbstractEntityService {
 	repository;
 	identityPermissionProvider;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new UserPermissionValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -6059,32 +6146,37 @@ var UserPermissionService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.permission) {
-			data.permission_realm_id = data.permission.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			permission_id: validated.permission_id,
+			user_id: validated.user_id
+		})) throw new ConflictError("The user-permission assignment already exists.");
+		if (validated.permission) {
+			validated.permission_realm_id = validated.permission.realm_id;
 			await actor.permissionEvaluator.preEvaluate({
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
 		}
-		if (data.user) data.user_realm_id = data.user.realm_id;
-		if (data.permission && actor.identity && typeof data.policy_id === "undefined") {
+		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
 			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
-				name: data.permission.name,
-				realmId: data.permission.realm_id,
-				clientId: data.permission.client_id
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
 			});
-			if (junctionPolicy) data.policy_id = junctionPolicy.id;
+			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -6120,9 +6212,13 @@ var UserPermissionService = class extends AbstractEntityService {
 //#region src/core/entities/user-role/service.ts
 var UserRoleService = class extends AbstractEntityService {
 	repository;
+	identityPermissionProvider;
+	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new UserRoleValidator();
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -6144,14 +6240,29 @@ var UserRoleService = class extends AbstractEntityService {
 	}
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.role) data.role_realm_id = data.role.realm_id;
-		if (data.user) data.user_realm_id = data.user.realm_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			role_id: validated.role_id,
+			user_id: validated.user_id
+		})) throw new ConflictError("The user-role assignment already exists.");
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.role && actor.identity) {
+			if (!await this.identityPermissionProvider.isSuperset({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				type: "role",
+				id: validated.role_id,
+				clientId: validated.role.client_id
+			})) throw new ForbiddenError("You don't own the required permissions.");
+		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_ROLE_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
-		let entity = this.repository.create(data);
+		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
 		return entity;
 	}
@@ -6170,6 +6281,92 @@ var UserRoleService = class extends AbstractEntityService {
 	}
 };
 //#endregion
+//#region src/core/entities/identity-provider-role-mapping/service.ts
+var IdentityProviderRoleMappingService = class extends AbstractEntityService {
+	repository;
+	identityPermissionProvider;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new IdentityProviderRoleMappingValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.IDENTITY_PROVIDER_READ,
+			PermissionName.IDENTITY_PROVIDER_UPDATE,
+			PermissionName.IDENTITY_PROVIDER_DELETE
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.IDENTITY_PROVIDER_READ,
+			PermissionName.IDENTITY_PROVIDER_UPDATE,
+			PermissionName.IDENTITY_PROVIDER_DELETE
+		] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			provider_id: validated.provider_id,
+			role_id: validated.role_id
+		})) throw new ConflictError("The identity-provider-role-mapping already exists.");
+		if (validated.provider) validated.provider_realm_id = validated.provider.realm_id;
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new BadRequestError("It is not possible to map an identity provider to a role of another realm.");
+		if (validated.role && actor.identity) {
+			if (!await this.identityPermissionProvider.isSuperset({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				type: "role",
+				id: validated.role_id,
+				clientId: validated.role.client_id
+			})) throw new ForbiddenError("You don't own the required permissions.");
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async update(id, data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
+		await this.repository.validateJoinColumns(validated);
+		const merged = this.repository.merge(entity, validated);
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged })
+		});
+		return this.repository.save(merged);
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
 //#region src/core/oauth2/authorization/code/issuer/module.ts
 var OAuth2AuthorizationCodeIssuer = class {
 	repository;
@@ -11762,7 +11959,8 @@ var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
 	constructor(ctx) {
 		super(ctx);
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
-		this.requestValidator = new RoutupContainerAdapter(new OAuth2AuthorizationCodeRequestValidator());
+		const validator = new OAuth2AuthorizationCodeRequestValidator();
+		this.requestValidator = new RoutupContainerAdapter(validator);
 	}
 	async authorizeWithRequest(req) {
 		const codeRequestValidated = await this.validateWithRequest(req);
@@ -12585,12 +12783,8 @@ function _ts_param$25(paramIndex, decorator) {
 }
 var ClientRoleController = class {
 	service;
-	repository;
-	identityPermissionProvider;
 	constructor(ctx) {
 		this.service = ctx.service;
-		this.repository = ctx.repository;
-		this.identityPermissionProvider = ctx.identityPermissionProvider;
 	}
 	async getMany(req, res) {
 		const actor = buildActorContext(req);
@@ -12602,15 +12796,6 @@ var ClientRoleController = class {
 	}
 	async add(data, req, res) {
 		const actor = buildActorContext(req);
-		await this.repository.validateJoinColumns(data);
-		if (data.role) {
-			const identity = useRequestIdentityOrFail(req);
-			if (!await this.identityPermissionProvider.isSuperset(identity, {
-				type: "role",
-				id: data.role.id,
-				clientId: data.role.client_id
-			})) throw new ForbiddenError("You don't own the required permissions.");
-		}
 		return sendCreated(res, await this.service.create(data, actor));
 	}
 	async getOne(id, req, res) {
@@ -13119,28 +13304,6 @@ IdentityProviderController = _ts_decorate$25([
 	_ts_metadata$25("design:paramtypes", [typeof IdentityProviderControllerContext === "undefined" ? Object : IdentityProviderControllerContext])
 ], IdentityProviderController);
 //#endregion
-//#region src/adapters/http/controllers/entities/identity-provide-role/utils/validator.ts
-var IdentityProviderRoleMappingRequestValidator = class extends Container {
-	initialize() {
-		super.initialize();
-		this.mount("provider_id", { group: RequestHandlerOperation.CREATE }, createValidator$1(() => {
-			return createValidationChain().exists().isUUID();
-		}));
-		this.mount("role_id", { group: RequestHandlerOperation.CREATE }, createValidator$1(() => {
-			return createValidationChain().exists().isUUID();
-		}));
-		this.mount("name", { optional: true }, createValidator$1(() => {
-			return createValidationChain().isString().optional({ values: "null" });
-		}));
-		this.mount("value", { optional: true }, createValidator$1(() => {
-			return createValidationChain().isString().optional({ values: "null" });
-		}));
-		this.mount("value_is_regex", { optional: true }, createValidator$1(() => {
-			return createValidationChain().isBoolean();
-		}));
-	}
-};
-//#endregion
 //#region src/adapters/http/controllers/entities/identity-provide-role/module.ts
 function _ts_decorate$24(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -13156,100 +13319,46 @@ function _ts_param$22(paramIndex, decorator) {
 		decorator(target, key, paramIndex);
 	};
 }
-var OAuth2ProviderRoleController = class {
-	repository;
-	identityPermissionProvider;
+var IdentityProviderRoleMappingController = class {
+	service;
 	constructor(ctx) {
-		this.repository = ctx.repository;
-		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.service = ctx.service;
 	}
-	async getProviders(req, res) {
-		await useRequestPermissionEvaluator(req).preEvaluateOneOf({ name: [
-			PermissionName.IDENTITY_PROVIDER_READ,
-			PermissionName.IDENTITY_PROVIDER_UPDATE,
-			PermissionName.IDENTITY_PROVIDER_DELETE
-		] });
-		const { data, meta } = await this.repository.findMany(useRequestQuery(req));
+	async getMany(req, res) {
+		const actor = buildActorContext(req);
+		const { data, meta } = await this.service.getMany(useRequestQuery(req), actor);
 		return send(res, {
 			data,
 			meta
 		});
 	}
-	async getProvider(id, req, res) {
-		await useRequestPermissionEvaluator(req).preEvaluateOneOf({ name: [
-			PermissionName.IDENTITY_PROVIDER_READ,
-			PermissionName.IDENTITY_PROVIDER_UPDATE,
-			PermissionName.IDENTITY_PROVIDER_DELETE
-		] });
-		const paramId = useRequestParamID(req);
-		const entity = await this.repository.findOneBy({ id: paramId });
-		if (!entity) throw new NotFoundError();
-		return send(res, entity);
+	async getOne(id, req, res) {
+		const actor = buildActorContext(req);
+		return send(res, await this.service.getOne(id, actor));
 	}
-	async editProvider(id, user, req, res) {
-		const paramId = useRequestParamID(req);
-		const permissionEvaluator = useRequestPermissionEvaluator(req);
-		await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });
-		const data = await new RoutupContainerAdapter(new IdentityProviderRoleMappingRequestValidator()).run(req, { group: RequestHandlerOperation.UPDATE });
-		await this.repository.validateJoinColumns(data);
-		let entity = await this.repository.findOneBy({ id: paramId });
-		if (!entity) throw new NotFoundError();
-		entity = this.repository.merge(entity, data);
-		await permissionEvaluator.evaluate({
-			name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
-		});
-		await this.repository.save(entity);
-		return sendAccepted(res, entity);
+	async add(data, req, res) {
+		const actor = buildActorContext(req);
+		return sendCreated(res, await this.service.create(data, actor));
 	}
-	async dropProvider(id, req, res) {
-		const paramId = useRequestParamID(req);
-		const permissionEvaluator = useRequestPermissionEvaluator(req);
-		await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });
-		const entity = await this.repository.findOneBy({ id: paramId });
-		if (!entity) throw new NotFoundError();
-		await permissionEvaluator.evaluate({
-			name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
-		});
-		const { id: entityId } = entity;
-		await this.repository.remove(entity);
-		entity.id = entityId;
-		return sendAccepted(res);
+	async edit(id, data, req, res) {
+		const actor = buildActorContext(req);
+		return sendAccepted(res, await this.service.update(id, data, actor));
 	}
-	async addProvider(user, req, res) {
-		const permissionEvaluator = useRequestPermissionEvaluator(req);
-		await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });
-		const data = await new RoutupContainerAdapter(new IdentityProviderRoleMappingRequestValidator()).run(req, { group: RequestHandlerOperation.CREATE });
-		await this.repository.validateJoinColumns(data);
-		if (data.provider) data.provider_realm_id = data.provider.realm_id;
-		if (data.role) data.role_realm_id = data.role.realm_id;
-		if (data.role_realm_id && data.provider_realm_id && data.role_realm_id !== data.provider_realm_id) throw new BadRequestError("It is not possible to map an identity provider to a role of another realm.");
-		await permissionEvaluator.evaluate({
-			name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
-		});
-		const identity = useRequestIdentityOrFail(req);
-		if (!await this.identityPermissionProvider.isSuperset(identity, {
-			type: "role",
-			id: data.role_id,
-			clientId: data.role.client_id
-		})) throw new ForbiddenError("You don't own the required permissions.");
-		const entity = this.repository.create(data);
-		await this.repository.save(entity);
-		return sendCreated(res, entity);
+	async drop(id, req, res) {
+		const actor = buildActorContext(req);
+		return sendAccepted(res, await this.service.delete(id, actor));
 	}
 };
 _ts_decorate$24([
-	DGet("", []),
+	DGet("", [ForceLoggedInMiddleware]),
 	_ts_param$22(0, DRequest()),
 	_ts_param$22(1, DResponse()),
 	_ts_metadata$24("design:type", Function),
 	_ts_metadata$24("design:paramtypes", [typeof Request === "undefined" ? Object : Request, typeof Response === "undefined" ? Object : Response]),
 	_ts_metadata$24("design:returntype", Promise)
-], OAuth2ProviderRoleController.prototype, "getProviders", null);
+], IdentityProviderRoleMappingController.prototype, "getMany", null);
 _ts_decorate$24([
-	DGet("/:id", []),
+	DGet("/:id", [ForceLoggedInMiddleware]),
 	_ts_param$22(0, DPath("id")),
 	_ts_param$22(1, DRequest()),
 	_ts_param$22(2, DResponse()),
@@ -13260,54 +13369,54 @@ _ts_decorate$24([
 		typeof Response === "undefined" ? Object : Response
 	]),
 	_ts_metadata$24("design:returntype", Promise)
-], OAuth2ProviderRoleController.prototype, "getProvider", null);
+], IdentityProviderRoleMappingController.prototype, "getOne", null);
 _ts_decorate$24([
-	DPost("/:id", [ForceLoggedInMiddleware]),
-	_ts_param$22(0, DPath("id")),
-	_ts_param$22(1, DBody()),
-	_ts_param$22(2, DRequest()),
-	_ts_param$22(3, DResponse()),
+	DPost("", [ForceLoggedInMiddleware]),
+	_ts_param$22(0, DBody()),
+	_ts_param$22(1, DRequest()),
+	_ts_param$22(2, DResponse()),
 	_ts_metadata$24("design:type", Function),
 	_ts_metadata$24("design:paramtypes", [
-		String,
-		typeof NonNullable === "undefined" ? Object : NonNullable,
+		Object,
 		typeof Request === "undefined" ? Object : Request,
 		typeof Response === "undefined" ? Object : Response
 	]),
 	_ts_metadata$24("design:returntype", Promise)
-], OAuth2ProviderRoleController.prototype, "editProvider", null);
+], IdentityProviderRoleMappingController.prototype, "add", null);
 _ts_decorate$24([
-	DDelete("/:id", [ForceLoggedInMiddleware]),
+	DPost("/:id", [ForceLoggedInMiddleware]),
 	_ts_param$22(0, DPath("id")),
-	_ts_param$22(1, DRequest()),
-	_ts_param$22(2, DResponse()),
+	_ts_param$22(1, DBody()),
+	_ts_param$22(2, DRequest()),
+	_ts_param$22(3, DResponse()),
 	_ts_metadata$24("design:type", Function),
 	_ts_metadata$24("design:paramtypes", [
 		String,
+		Object,
 		typeof Request === "undefined" ? Object : Request,
 		typeof Response === "undefined" ? Object : Response
 	]),
 	_ts_metadata$24("design:returntype", Promise)
-], OAuth2ProviderRoleController.prototype, "dropProvider", null);
+], IdentityProviderRoleMappingController.prototype, "edit", null);
 _ts_decorate$24([
-	DPost("", [ForceLoggedInMiddleware]),
-	_ts_param$22(0, DBody()),
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param$22(0, DPath("id")),
 	_ts_param$22(1, DRequest()),
 	_ts_param$22(2, DResponse()),
 	_ts_metadata$24("design:type", Function),
 	_ts_metadata$24("design:paramtypes", [
-		typeof NonNullable === "undefined" ? Object : NonNullable,
+		String,
 		typeof Request === "undefined" ? Object : Request,
 		typeof Response === "undefined" ? Object : Response
 	]),
 	_ts_metadata$24("design:returntype", Promise)
-], OAuth2ProviderRoleController.prototype, "addProvider", null);
-OAuth2ProviderRoleController = _ts_decorate$24([
+], IdentityProviderRoleMappingController.prototype, "drop", null);
+IdentityProviderRoleMappingController = _ts_decorate$24([
 	DTags("identity-provider"),
 	DController("/identity-provider-role-mappings"),
 	_ts_metadata$24("design:type", Function),
-	_ts_metadata$24("design:paramtypes", [typeof OAuth2ProviderRoleControllerContext === "undefined" ? Object : OAuth2ProviderRoleControllerContext])
-], OAuth2ProviderRoleController);
+	_ts_metadata$24("design:paramtypes", [typeof IdentityProviderRoleMappingControllerContext === "undefined" ? Object : IdentityProviderRoleMappingControllerContext])
+], IdentityProviderRoleMappingController);
 //#endregion
 //#region src/adapters/http/controllers/entities/permission/module.ts
 function _ts_decorate$23(decorators, target, key, desc) {
@@ -13676,7 +13785,8 @@ var AuthorizeController = class {
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
-		this.codeRequestValidator = new RoutupContainerAdapter(new OAuth2AuthorizationCodeRequestValidator());
+		const validator = new OAuth2AuthorizationCodeRequestValidator();
+		this.codeRequestValidator = new RoutupContainerAdapter(validator);
 		this.authorizer = new HTTPOAuth2Authorizer({
 			codeRequestVerifier: this.codeRequestVerifier,
 			accessTokenIssuer: ctx.accessTokenIssuer,
@@ -14832,12 +14942,8 @@ function _ts_param$9(paramIndex, decorator) {
 }
 var RobotRoleController = class {
 	service;
-	repository;
-	identityPermissionProvider;
 	constructor(ctx) {
 		this.service = ctx.service;
-		this.repository = ctx.repository;
-		this.identityPermissionProvider = ctx.identityPermissionProvider;
 	}
 	async getMany(req, res) {
 		const actor = buildActorContext(req);
@@ -14849,15 +14955,6 @@ var RobotRoleController = class {
 	}
 	async add(data, req, res) {
 		const actor = buildActorContext(req);
-		await this.repository.validateJoinColumns(data);
-		if (data.role) {
-			const identity = useRequestIdentityOrFail(req);
-			if (!await this.identityPermissionProvider.isSuperset(identity, {
-				type: "role",
-				id: data.role_id,
-				clientId: data.role.client_id
-			})) throw new ForbiddenError("You don't own the required permissions.");
-		}
 		return sendCreated(res, await this.service.create(data, actor));
 	}
 	async getOne(id, req, res) {
@@ -16181,12 +16278,8 @@ function _ts_param(paramIndex, decorator) {
 }
 var UserRoleController = class {
 	service;
-	repository;
-	identityPermissionProvider;
 	constructor(ctx) {
 		this.service = ctx.service;
-		this.repository = ctx.repository;
-		this.identityPermissionProvider = ctx.identityPermissionProvider;
 	}
 	async getMany(req, res) {
 		const actor = buildActorContext(req);
@@ -16198,15 +16291,6 @@ var UserRoleController = class {
 	}
 	async add(data, req, res) {
 		const actor = buildActorContext(req);
-		await this.repository.validateJoinColumns(data);
-		if (data.role) {
-			const identity = useRequestIdentityOrFail(req);
-			if (!await this.identityPermissionProvider.isSuperset(identity, {
-				type: "role",
-				id: data.role_id,
-				clientId: data.role.client_id
-			})) throw new ForbiddenError("You don't own the required permissions.");
-		}
 		return sendCreated(res, await this.service.create(data, actor));
 	}
 	async getOne(id, req, res) {
@@ -17481,12 +17565,10 @@ var HTTPControllerModule = class {
 		}) });
 	}
 	createClientRoleController(container) {
-		const repository = new ClientRoleRepositoryAdapter(container.resolve(ClientRoleEntity));
-		return new ClientRoleController({
-			service: new ClientRoleService({ repository }),
-			repository,
+		return new ClientRoleController({ service: new ClientRoleService({
+			repository: new ClientRoleRepositoryAdapter(container.resolve(ClientRoleEntity)),
 			identityPermissionProvider: this.createIdentityPermissionProvider(container)
-		});
+		}) });
 	}
 	createClientScopeController(container) {
 		return new ClientScopeController({ service: new ClientScopeService({ repository: new ClientScopeRepositoryAdapter(container.resolve(ClientScopeEntity)) }) });
@@ -17498,12 +17580,10 @@ var HTTPControllerModule = class {
 		}) });
 	}
 	createRobotRoleController(container) {
-		const repository = new RobotRoleRepositoryAdapter(container.resolve(RobotRoleEntity));
-		return new RobotRoleController({
-			service: new RobotRoleService({ repository }),
-			repository,
+		return new RobotRoleController({ service: new RobotRoleService({
+			repository: new RobotRoleRepositoryAdapter(container.resolve(RobotRoleEntity)),
 			identityPermissionProvider: this.createIdentityPermissionProvider(container)
-		});
+		}) });
 	}
 	createRoleAttributeController(container) {
 		return new RoleAttributeController({ service: new RoleAttributeService({ repository: new RoleAttributeRepositoryAdapter(container.resolve(RoleAttributeEntity)) }) });
@@ -17548,12 +17628,10 @@ var HTTPControllerModule = class {
 		}) });
 	}
 	createUserRoleController(container) {
-		const repository = new UserRoleRepositoryAdapter(container.resolve(UserRoleEntity));
-		return new UserRoleController({
-			service: new UserRoleService({ repository }),
-			repository,
+		return new UserRoleController({ service: new UserRoleService({
+			repository: new UserRoleRepositoryAdapter(container.resolve(UserRoleEntity)),
 			identityPermissionProvider: this.createIdentityPermissionProvider(container)
-		});
+		}) });
 	}
 	createPolicyController(container) {
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
@@ -17574,10 +17652,10 @@ var HTTPControllerModule = class {
 		});
 	}
 	createIdentityProviderRoleController(container) {
-		return new OAuth2ProviderRoleController({
+		return new IdentityProviderRoleMappingController({ service: new IdentityProviderRoleMappingService({
 			repository: new IdentityProviderRoleMappingRepositoryAdapter(container.resolve(IdentityProviderRoleMappingEntity)),
 			identityPermissionProvider: this.createIdentityPermissionProvider(container)
-		});
+		}) });
 	}
 	createJwkController(container) {
 		return new JwkController({ repository: container.resolve(DatabaseInjectionKey.DataSource).getRepository(KeyEntity) });
@@ -18463,6 +18541,6 @@ function defineCLIStartCommand() {
 	});
 }
 //#endregion
-export { RobotController as $, ModuleName as $n, PermissionEntity as $r, getRequestBodyRealmID as $t, OAuth2InjectionToken as A, ClientPermissionRepositoryAdapter as An, IdentityProviderEntity as Ar, registerBasicMiddleware as At, ScopeController as B, unsetDataSourceSync as Bn, RoleRepository as Br, HTTPClientCredentialsGrant as Bt, RobotIdentityRepository as C, PolicyRepositoryAdapter as Cn, UserAttributeSubscriber as Cr, ClientController as Ct, IdentityProviderAttributeMappingRepository as D, IdentityProviderRepositoryAdapter as Dn, IdentityProviderRepository as Dr, createLoggerMiddleware as Dt, IdentityProviderPermissionMappingRepository as E, PermissionRepositoryAdapter as En, IdentityProviderSubscriber as Er, registerPrometheusMiddleware as Et, UserPermissionRequestValidator as F, LoggerInjectionKey as Fn, ClientSubscriber as Fr, AuthorizationMiddleware as Ft, RolePermissionController as G, AuthenticationModule as Gn, ClientPermissionSubscriber as Gr, setRequestToken as Gt, PolicyAttributesValidator as H, DataSourceOptionsBuilder as Hn, RolePermissionEntity as Hr, guessOauth2GrantTypeByRequest as Ht, UserPermissionController as I, isDatabaseTypeSupported as In, ClientRepository as Ir, HTTPRobotCredentialsGrant as It, RoleController as J, ConfigModule as Jn, PolicyRepository as Jr, useRequestScopes as Jt, RoleAttributeRequestValidator as K, SessionRepository as Kn, ClientPermissionEntity as Kr, useRequestToken as Kt, UserAttributeRequestValidator as L, isDatabaseTypeSupportedForEnvironment as Ln, ClientRoleSubscriber as Lr, HTTPOAuth2RefreshTokenGrant as Lt, createHttpServer as M, RealmRepositoryAdapter as Mn, ClientScopeEntity as Mr, ForceUserLoggedInMiddleware as Mt, UserRoleRequestValidator as N, DatabaseModule as Nn, ScopeSubscriber as Nr, ForceLoggedInMiddleware as Nt, IdentityProviderAccountRepository as O, ClientScopeRepositoryAdapter as On, IdentityProviderAttributeSubscriber as Or, registerErrorMiddleware as Ot, UserRoleController as P, LoggerModule as Pn, ScopeEntity as Pr, createAuthorizationMiddleware as Pt, RobotPermissionController as Q, ConfigInjectionKey as Qn, PermissionSubscriber as Qr, useRequestParamID as Qt, UserAttributeController as R, DatabaseConflictError as Rn, ClientRoleEntity as Rr, HTTPPasswordGrant as Rt, UserIdentityRepository as S, RobotRepositoryAdapter as Sn, UserPermissionEntity as Sr, ClientPermissionController as St, IdentityProviderRoleMappingRepository as T, PermissionPolicyRepositoryAdapter as Tn, UserEntity as Tr, registerRateLimitMiddleware as Tt, PolicyController as U, DatabaseQueryResultCache as Un, RoleAttributeEntity as Ur, HTTPOAuth2Authorizer as Ut, PolicyValidator$1 as V, useDataSourceSync as Vn, RolePermissionSubscriber as Vr, HTTPOAuth2AuthorizeGrant as Vt, RolePermissionRequestValidator as W, DatabaseInjectionKey as Wn, RoleEntity as Wr, RequestPermissionEvaluator as Wt, RobotRoleController as X, normalizeConfig as Xn, PolicyAttributeEntity as Xr, getRequestStringParam as Xt, RobotRoleRequestValidator as Y, readConfigRaw as Yn, PolicyAttributeSubscriber as Yr, getRequestParamID as Yt, RobotPermissionRequestValidator as Z, ConfigEnvironmentVariableName as Zn, PolicyEntity as Zr, getRequestStringParamOrFail as Zt, MailInjectionKey as _, RolePermissionRepositoryAdapter as _n, UserSubscriber as _r, ClientScopeRequestValidator as _t, defineCLISwaggerCommand as a, RealmEntity as ai, useRequestIdentityOrFail as an, RobotRepository as ar, PasswordForgotController as at, LdapModule as b, RobotRoleRepositoryAdapter as bn, UserRoleEntity as br, ClientRoleRequestValidator as bt, ApplicationBuilder as c, RequestHandlerOperation as cn, RobotRoleSubscriber as cr, getJwkRouteHandler as ct, ProvisionerModule as d, IdentityProviderRoleMappingRepositoryAdapter as dn, IdentityProviderRoleSubscriber as dr, ActivateController as dt, ClientEntity as ei, buildActorContext as en, CacheInjectionKey as er, RealmController as et, FileProvisioningSource as f, UserRoleRepositoryAdapter as fn, IdentityProviderRoleMappingEntity as fr, PermissionPolicyController as ft, MailModule as g, ScopeRepositoryAdapter as gn, IdentityProviderAccountEntity as gr, IdentityProviderController as gt, HTTPModule as h, UserRepositoryAdapter as hn, IdentityProviderAccountSubscriber as hr, IdentityProviderRoleMappingRequestValidator as ht, defineCLIHealthCheckCommand as i, RealmRepository as ii, useRequestIdentity as in, RobotSubscriber as ir, PasswordResetController as it, Swagger as j, ClientRepositoryAdapter as jn, ClientScopeSubscriber as jr, registerAssetsMiddleware as jt, IdentityInjectionKey as k, ClientRoleRepositoryAdapter as kn, IdentityProviderAttributeEntity as kr, registerCorsMiddleware as kt, SwaggerModule as l, HTTPInjectionKey as ln, RobotRoleEntity as lr, getJwksRouteHandler as lt, DefaultProvisioningSource as m, UserAttributeRepositoryAdapter as mn, IdentityProviderAttributeMappingEntity as mr, OAuth2ProviderRoleController as mt, defineCLIResetCommand as n, RealmSubscriber as ni, isRequestIdentityMasterRealmMember as nn, PermissionPolicyEntity as nr, StatusController as nt, Application$1 as o, AuthenticationInjectionKey as oi, setRequestPermissionEvaluator as on, RobotPermissionSubscriber as or, OpenIDController as ot, CompositeProvisioningSource as p, UserPermissionRepositoryAdapter as pn, IdentityProviderPermissionMappingEntity as pr, PermissionController as pt, RoleAttributeController as q, CacheModule as qn, PolicySubscriber as qr, setRequestScopes as qt, defineCLIMigrationCommand as r, CachePrefix as ri, setRequestIdentity as rn, SessionEntity as rr, RegisterController as rt, createApplication as s, useRequestPermissionEvaluator as sn, RobotPermissionEntity as sr, JwkController as st, defineCLIStartCommand as t, KeyEntity as ti, RequestIdentity as tn, RoleAttributeSubscriber as tr, TokenController as tt, RuntimeModule as u, ComponentsModule as un, RobotEntity as ur, AuthorizeController as ut, OAuth2Module as v, RoleAttributeRepositoryAdapter as vn, UserRepository as vr, ClientScopeController as vt, ClientIdentityRepository as w, PermissionDatabaseProvider as wn, UserAttributeEntity as wr, createSwaggerMiddleware as wt, LDAPInjectionKey as x, RobotPermissionRepositoryAdapter as xn, UserPermissionSubscriber as xr, ClientPermissionRequestValidator as xt, IdentityModule as y, RoleRepositoryAdapter as yn, UserRoleSubscriber as yr, ClientRoleController as yt, UserController as z, setDataSourceSync as zn, RoleSubscriber as zr, HTTPOAuth2IdentityGrantType as zt };
+export { RobotController as $, CacheInjectionKey as $n, ClientEntity as $r, buildActorContext as $t, OAuth2InjectionToken as A, ClientRepositoryAdapter as An, ClientScopeSubscriber as Ar, registerAssetsMiddleware as At, ScopeController as B, useDataSourceSync as Bn, RolePermissionSubscriber as Br, HTTPOAuth2AuthorizeGrant as Bt, RobotIdentityRepository as C, PermissionDatabaseProvider as Cn, UserAttributeEntity as Cr, createSwaggerMiddleware as Ct, IdentityProviderAttributeMappingRepository as D, ClientScopeRepositoryAdapter as Dn, IdentityProviderAttributeSubscriber as Dr, registerErrorMiddleware as Dt, IdentityProviderPermissionMappingRepository as E, IdentityProviderRepositoryAdapter as En, IdentityProviderRepository as Er, createLoggerMiddleware as Et, UserPermissionRequestValidator as F, isDatabaseTypeSupported as Fn, ClientRepository as Fr, HTTPRobotCredentialsGrant as Ft, RolePermissionController as G, SessionRepository as Gn, ClientPermissionEntity as Gr, useRequestToken as Gt, PolicyAttributesValidator as H, DatabaseQueryResultCache as Hn, RoleAttributeEntity as Hr, HTTPOAuth2Authorizer as Ht, UserPermissionController as I, isDatabaseTypeSupportedForEnvironment as In, ClientRoleSubscriber as Ir, HTTPOAuth2RefreshTokenGrant as It, RoleController as J, readConfigRaw as Jn, PolicyAttributeSubscriber as Jr, getRequestParamID as Jt, RoleAttributeRequestValidator as K, CacheModule as Kn, PolicySubscriber as Kr, setRequestScopes as Kt, UserAttributeRequestValidator as L, DatabaseConflictError as Ln, ClientRoleEntity as Lr, HTTPPasswordGrant as Lt, createHttpServer as M, DatabaseModule as Mn, ScopeSubscriber as Mr, ForceLoggedInMiddleware as Mt, UserRoleRequestValidator as N, LoggerModule as Nn, ScopeEntity as Nr, createAuthorizationMiddleware as Nt, IdentityProviderAccountRepository as O, ClientRoleRepositoryAdapter as On, IdentityProviderAttributeEntity as Or, registerCorsMiddleware as Ot, UserRoleController as P, LoggerInjectionKey as Pn, ClientSubscriber as Pr, AuthorizationMiddleware as Pt, RobotPermissionController as Q, ModuleName as Qn, PermissionEntity as Qr, getRequestBodyRealmID as Qt, UserAttributeController as R, setDataSourceSync as Rn, RoleSubscriber as Rr, HTTPOAuth2IdentityGrantType as Rt, UserIdentityRepository as S, PolicyRepositoryAdapter as Sn, UserAttributeSubscriber as Sr, ClientController as St, IdentityProviderRoleMappingRepository as T, PermissionRepositoryAdapter as Tn, IdentityProviderSubscriber as Tr, registerPrometheusMiddleware as Tt, PolicyController as U, DatabaseInjectionKey as Un, RoleEntity as Ur, RequestPermissionEvaluator as Ut, PolicyValidator$1 as V, DataSourceOptionsBuilder as Vn, RolePermissionEntity as Vr, guessOauth2GrantTypeByRequest as Vt, RolePermissionRequestValidator as W, AuthenticationModule as Wn, ClientPermissionSubscriber as Wr, setRequestToken as Wt, RobotRoleController as X, ConfigEnvironmentVariableName as Xn, PolicyEntity as Xr, getRequestStringParamOrFail as Xt, RobotRoleRequestValidator as Y, normalizeConfig as Yn, PolicyAttributeEntity as Yr, getRequestStringParam as Yt, RobotPermissionRequestValidator as Z, ConfigInjectionKey as Zn, PermissionSubscriber as Zr, useRequestParamID as Zt, MailInjectionKey as _, RoleAttributeRepositoryAdapter as _n, UserRepository as _r, ClientScopeController as _t, defineCLISwaggerCommand as a, AuthenticationInjectionKey as ai, setRequestPermissionEvaluator as an, RobotPermissionSubscriber as ar, PasswordForgotController as at, LdapModule as b, RobotPermissionRepositoryAdapter as bn, UserPermissionSubscriber as br, ClientPermissionRequestValidator as bt, ApplicationBuilder as c, HTTPInjectionKey as cn, RobotRoleEntity as cr, getJwkRouteHandler as ct, ProvisionerModule as d, UserRoleRepositoryAdapter as dn, IdentityProviderRoleMappingEntity as dr, ActivateController as dt, KeyEntity as ei, RequestIdentity as en, RoleAttributeSubscriber as er, RealmController as et, FileProvisioningSource as f, UserPermissionRepositoryAdapter as fn, IdentityProviderPermissionMappingEntity as fr, PermissionPolicyController as ft, MailModule as g, RolePermissionRepositoryAdapter as gn, UserSubscriber as gr, ClientScopeRequestValidator as gt, HTTPModule as h, ScopeRepositoryAdapter as hn, IdentityProviderAccountEntity as hr, IdentityProviderController as ht, defineCLIHealthCheckCommand as i, RealmEntity as ii, useRequestIdentityOrFail as in, RobotRepository as ir, PasswordResetController as it, Swagger as j, RealmRepositoryAdapter as jn, ClientScopeEntity as jr, ForceUserLoggedInMiddleware as jt, IdentityInjectionKey as k, ClientPermissionRepositoryAdapter as kn, IdentityProviderEntity as kr, registerBasicMiddleware as kt, SwaggerModule as l, ComponentsModule as ln, RobotEntity as lr, getJwksRouteHandler as lt, DefaultProvisioningSource as m, UserRepositoryAdapter as mn, IdentityProviderAccountSubscriber as mr, IdentityProviderRoleMappingController as mt, defineCLIResetCommand as n, CachePrefix as ni, setRequestIdentity as nn, SessionEntity as nr, StatusController as nt, Application$1 as o, useRequestPermissionEvaluator as on, RobotPermissionEntity as or, OpenIDController as ot, CompositeProvisioningSource as p, UserAttributeRepositoryAdapter as pn, IdentityProviderAttributeMappingEntity as pr, PermissionController as pt, RoleAttributeController as q, ConfigModule as qn, PolicyRepository as qr, useRequestScopes as qt, defineCLIMigrationCommand as r, RealmRepository as ri, useRequestIdentity as rn, RobotSubscriber as rr, RegisterController as rt, createApplication as s, RequestHandlerOperation as sn, RobotRoleSubscriber as sr, JwkController as st, defineCLIStartCommand as t, RealmSubscriber as ti, isRequestIdentityMasterRealmMember as tn, PermissionPolicyEntity as tr, TokenController as tt, RuntimeModule as u, IdentityProviderRoleMappingRepositoryAdapter as un, IdentityProviderRoleSubscriber as ur, AuthorizeController as ut, OAuth2Module as v, RoleRepositoryAdapter as vn, UserRoleSubscriber as vr, ClientRoleController as vt, ClientIdentityRepository as w, PermissionPolicyRepositoryAdapter as wn, UserEntity as wr, registerRateLimitMiddleware as wt, LDAPInjectionKey as x, RobotRepositoryAdapter as xn, UserPermissionEntity as xr, ClientPermissionController as xt, IdentityModule as y, RobotRoleRepositoryAdapter as yn, UserRoleEntity as yr, ClientRoleRequestValidator as yt, UserController as z, unsetDataSourceSync as zn, RoleRepository as zr, HTTPClientCredentialsGrant as zt };
 
-//# sourceMappingURL=commands-C1vz08cL.mjs.map
+//# sourceMappingURL=commands-D5p6u-xJ.mjs.map