@authup/server-core 1.0.0-beta.35 → 1.0.0-beta.37

package/dist/core/entities/permission/service.mjs

@@ -0,0 +1,238 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData, SystemPolicyName } from "@authup/access";
+import { isPropertySet, isUUID } from "@authup/kit";
+import { BadRequestError, NotFoundError } from "@ebec/http";
+import { AuthupError } from "@authup/errors";
+//#region src/core/entities/permission/service.ts
+const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
+	PermissionName.REALM_CREATE,
+	PermissionName.REALM_UPDATE,
+	PermissionName.REALM_DELETE
+];
+/**
+* CUD permissions that get system.realm-bound on realm_admin.
+* Covers direct entity types (both global-capable and realm-only).
+*
+* Junction entity CUD (e.g. user_role, role_permission) intentionally
+* use realm-or-global instead, because their attributes include
+* multiple realm_id fields (e.g. user_realm_id + role_realm_id).
+* With attribute_name_strict: false, realm-bound would reject
+* junctions where one side is global (realm_id: null).
+*/ const REALM_ADMIN_BOUND_PERMISSIONS = [
+	PermissionName.CLIENT_CREATE,
+	PermissionName.CLIENT_UPDATE,
+	PermissionName.CLIENT_DELETE,
+	PermissionName.IDENTITY_PROVIDER_CREATE,
+	PermissionName.IDENTITY_PROVIDER_UPDATE,
+	PermissionName.IDENTITY_PROVIDER_DELETE,
+	PermissionName.PERMISSION_CREATE,
+	PermissionName.PERMISSION_UPDATE,
+	PermissionName.PERMISSION_DELETE,
+	PermissionName.ROBOT_CREATE,
+	PermissionName.ROBOT_UPDATE,
+	PermissionName.ROBOT_DELETE,
+	PermissionName.ROLE_CREATE,
+	PermissionName.ROLE_UPDATE,
+	PermissionName.ROLE_DELETE,
+	PermissionName.SCOPE_CREATE,
+	PermissionName.SCOPE_UPDATE,
+	PermissionName.SCOPE_DELETE,
+	PermissionName.USER_CREATE,
+	PermissionName.USER_UPDATE,
+	PermissionName.USER_DELETE
+];
+var PermissionService = class extends AbstractEntityService {
+	repository;
+	realmRepository;
+	roleRepository;
+	rolePermissionRepository;
+	policyRepository;
+	permissionPolicyRepository;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+		this.roleRepository = ctx.roleRepository;
+		this.rolePermissionRepository = ctx.rolePermissionRepository;
+		this.policyRepository = ctx.policyRepository;
+		this.permissionPolicyRepository = ctx.permissionPolicyRepository;
+		this.validator = new PermissionValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.PERMISSION_READ,
+			PermissionName.PERMISSION_UPDATE,
+			PermissionName.PERMISSION_DELETE
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(idOrName, actor, realm) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.PERMISSION_READ,
+			PermissionName.PERMISSION_UPDATE,
+			PermissionName.PERMISSION_DELETE
+		] });
+		const entity = await this.repository.findOneByIdOrName(idOrName, realm);
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		const { entity } = await this.save(void 0, data, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor) {
+		const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });
+		return entity;
+	}
+	async save(idOrName, data, actor, options = {}) {
+		let group;
+		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		let entity;
+		if (idOrName) {
+			const where = {};
+			if (isUUID(idOrName)) where.id = idOrName;
+			else where.name = idOrName;
+			if (realm) where.realm_id = realm.id;
+			entity = await this.repository.findOneBy(where);
+			if (!entity && options.updateOnly) throw new NotFoundError();
+		} else if (options.updateOnly) throw new NotFoundError();
+		if (entity) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+			group = ValidatorGroup.UPDATE;
+		} else {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });
+			group = ValidatorGroup.CREATE;
+		}
+		const validated = await this.validator.run(data, { group });
+		await this.repository.validateJoinColumns(validated);
+		if (entity) {
+			if (entity.built_in && isPropertySet(validated, "name") && entity.name !== validated.name) throw new BadRequestError("The name of a built-in permission can not be changed.");
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.PERMISSION_UPDATE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...validated
+				} })
+			});
+			await this.repository.checkUniqueness(validated, entity);
+			entity = this.repository.merge(entity, validated);
+			await this.repository.save(entity);
+			return {
+				entity,
+				created: false
+			};
+		}
+		if (!isPropertySet(validated, "realm_id") && actor.identity) validated.realm_id = this.getActorRealmId(actor) || null;
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		await this.repository.checkUniqueness(validated);
+		entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		await this.assignDefaultPolicy(entity);
+		await this.assignToAdminRole(entity);
+		await this.assignToRealmAdminRoles(entity);
+		return {
+			entity,
+			created: true
+		};
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		if (entity.built_in) throw new BadRequestError("A built-in permission can not be deleted.");
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	/**
+	* Assign the system.default policy to a newly created permission.
+	* This ensures all permissions are evaluated with the baseline security
+	* policy (identity, permission-binding, realm-match) by default.
+	*/ async assignDefaultPolicy(permission) {
+		const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);
+		if (!defaultPolicy) throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);
+		if (await this.permissionPolicyRepository.findOneBy({
+			permission_id: permission.id,
+			policy_id: defaultPolicy.id
+		})) return;
+		const entry = this.permissionPolicyRepository.create({
+			permission_id: permission.id,
+			permission_realm_id: permission.realm_id,
+			policy_id: defaultPolicy.id,
+			policy_realm_id: defaultPolicy.realm_id
+		});
+		await this.permissionPolicyRepository.save(entry);
+	}
+	/**
+	* Assign a newly created permission to the global admin role.
+	* The admin role receives every permission without policy restrictions.
+	*/ async assignToAdminRole(permission) {
+		const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);
+		if (!adminRole) return;
+		if (await this.rolePermissionRepository.findOneBy({
+			role_id: adminRole.id,
+			permission_id: permission.id
+		})) return;
+		const entry = this.rolePermissionRepository.create({
+			role_id: adminRole.id,
+			role_realm_id: adminRole.realm_id,
+			permission_id: permission.id,
+			permission_realm_id: permission.realm_id
+		});
+		await this.rolePermissionRepository.save(entry);
+	}
+	/**
+	* Assign a newly created permission to all matching realm_admin roles.
+	*
+	* Uses differentiated junction policies:
+	* - CUD on global-capable entity types → system.realm-bound
+	* - Everything else → system.realm-or-global
+	*
+	* Eligible permissions:
+	* - Built-in authup permissions (global) — assigned to all realm_admin roles
+	* - Realm-scoped permissions — assigned to the realm_admin in the matching realm
+	*
+	* Excluded:
+	* - Realm CRUD permissions (realm_create, realm_update, realm_delete)
+	* - Custom global permissions (non-built-in with realm_id: null)
+	*
+	* Fails closed: skips assignment entirely if required policies are not found.
+	*/ async assignToRealmAdminRoles(permission) {
+		if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name)) return;
+		const isBuiltIn = Object.values(PermissionName).includes(permission.name);
+		if (!permission.realm_id && !isBuiltIn) return;
+		const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name) ? SystemPolicyName.REALM_BOUND : SystemPolicyName.REALM_OR_GLOBAL;
+		const policy = await this.policyRepository.findOneByName(policyName);
+		if (!policy) return;
+		const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });
+		for (const role of realmAdminRoles) {
+			if (permission.realm_id && permission.realm_id !== role.realm_id) continue;
+			if (await this.rolePermissionRepository.findOneBy({
+				role_id: role.id,
+				permission_id: permission.id
+			})) continue;
+			const entry = this.rolePermissionRepository.create({
+				role_id: role.id,
+				role_realm_id: role.realm_id,
+				permission_id: permission.id,
+				permission_realm_id: permission.realm_id,
+				policy_id: policy.id
+			});
+			await this.rolePermissionRepository.save(entry);
+		}
+	}
+};
+//#endregion
+export { PermissionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/permission/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","SystemPolicyName","isPropertySet","isUUID","AuthupError","BadRequestError","NotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ValidatorGroup","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","merge","created","identity","getActorRealmId","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","includes","isBuiltIn","Object","values","policyName","REALM_BOUND","REALM_OR_GLOBAL","policy","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, SystemPolicyName } from '@authup/access';\nimport { isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError } from '@authup/errors';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n    ValidatorGroup,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * CUD permissions that get system.realm-bound on realm_admin.\n * Covers direct entity types (both global-capable and realm-only).\n *\n * Junction entity CUD (e.g. user_role, role_permission) intentionally\n * use realm-or-global instead, because their attributes include\n * multiple realm_id fields (e.g. user_realm_id + role_realm_id).\n * With attribute_name_strict: false, realm-bound would reject\n * junctions where one side is global (realm_id: null).\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new NotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new NotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new BadRequestError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated junction policies:\n     * - CUD on global-capable entity types → system.realm-bound\n     * - Everything else → system.realm-or-global\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     *\n     * Fails closed: skips assignment entirely if required policies are not found.\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            SystemPolicyName.REALM_BOUND :\n            SystemPolicyName.REALM_OR_GLOBAL;\n\n        const policy = await this.policyRepository.findOneByName(policyName);\n        if (!policy) {\n            return;\n        }\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;AA6BA,MAAMc,mCAAmC;CACrCN,eAAeO;CACfP,eAAeQ;CACfR,eAAeS;CAClB;;;;;;;;;;GAYD,MAAMC,gCAAgC;CAClCV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;CACf9B,eAAe+B;CAClB;AAWD,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;AACvC,SAAK;AACL,OAAKP,aAAaO,IAAIP;AACtB,OAAKC,kBAAkBM,IAAIN;AAC3B,OAAKC,iBAAiBK,IAAIL;AAC1B,OAAKC,2BAA2BI,IAAIJ;AACpC,OAAKC,mBAAmBG,IAAIH;AAC5B,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAItC,qBAAAA;;CAGzB,MAAMwC,QACFC,OACAC,OACmD;AACnD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF9C,eAAe+C;GACf/C,eAAekB;GACflB,eAAemB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKc,WAAWe,SAASN,MAAAA;;CAGpC,MAAMO,OACFC,UACAP,OACAQ,OACmB;AACnB,QAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF9C,eAAe+C;GACf/C,eAAekB;GACflB,eAAemB;GAClB,EACL,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,MAAAA;AACjE,MAAI,CAACC,OACD,OAAM,IAAIrD,eAAAA;AAGd,SAAOqD;;CAGX,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,MAAAA;AACpD,SAAOS;;CAGX,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,MAAK,CAAA;AAC7E,SAAOP;;CAGX,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,SAAQ,GAChDL,KAAAA;EAEJ,IAAIL;AACJ,MAAIF,UAAU;GACV,MAAMc,QAA6B,EAAC;AACpC,OAAIpE,OAAOsD,SAAAA,CACPc,OAAMC,KAAKf;OAEXc,OAAMlB,OAAOI;AAGjB,OAAIC,MACAa,OAAMF,WAAWX,MAAMc;AAG3Bb,YAAS,MAAM,KAAKnB,WAAWiC,UAAUF,MAAAA;AACzC,OAAI,CAACZ,UAAUQ,QAAQD,WACnB,OAAM,IAAI5D,eAAAA;aAEP6D,QAAQD,WACf,OAAM,IAAI5D,eAAAA;AAGd,MAAIqD,QAAQ;AACR,SAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM9C,eAAekB,mBAAkB,CAAA;AACrF2C,WAAQzD,eAAegE;SACpB;AACH,SAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM9C,eAAeiB,mBAAkB,CAAA;AACrF4C,WAAQzD,eAAeiE;;EAG3B,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,OAAM,CAAA;AAEzD,QAAM,KAAK5B,WAAWuC,oBAAoBF,UAAAA;AAE1C,MAAIlB,QAAQ;AACR,OACIA,OAAOqB,YACP9E,cAAc2E,WAAW,OAAA,IACzBlB,OAAON,SAASwB,UAAUxB,KAE1B,OAAM,IAAIhD,gBAAgB,wDAAA;AAG9B,SAAM6C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM9C,eAAekB;IACrByD,OAAO,IAAIlF,WAAW,GACjBD,kBAAkBoF,aAAa;KAC5B,GAAGxB;KACH,GAAGkB;KACP,EACJ,CAAA;IACJ,CAAA;AAEA,SAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWlB,OAAAA;AAEjDA,YAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,UAAAA;AAEvC,SAAM,KAAKrC,WAAWuB,KAAKJ,OAAAA;AAE3B,UAAO;IACHA;IACA2B,SAAS;IACb;;AAGJ,MAAI,CAACpF,cAAc2E,WAAW,WAAA,IAAe3B,MAAMqC,SAC/CV,WAAUR,WAAW,KAAKmB,gBAAgBtC,MAAAA,IAAU;AAGxD,QAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM9C,eAAeiB;GACrB0D,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaN,WAAU,CAAA;GACtE,CAAA;AAEA,QAAM,KAAKrC,WAAW4C,gBAAgBP,UAAAA;AAEtClB,WAAS,KAAKnB,WAAWqB,OAAOgB,UAAAA;AAChClB,WAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,OAAAA;AAEpC,QAAM,KAAK8B,oBAAoB9B,OAAAA;AAC/B,QAAM,KAAK+B,kBAAkB/B,OAAAA;AAC7B,QAAM,KAAKgC,wBAAwBhC,OAAAA;AAEnC,SAAO;GACHA;GACA2B,SAAS;GACb;;CAGJ,MAAMM,OACFpB,IACAtB,OACmB;AACnB,QAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM9C,eAAemB,mBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACb,OACD,OAAM,IAAIrD,eAAAA;AAGd,MAAIqD,OAAOqB,SACP,OAAM,IAAI3E,gBAAgB,4CAAA;AAG9B,QAAM6C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM9C,eAAemB;GACrBwD,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaxB,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEa,IAAIqB,aAAalC;AACzB,QAAM,KAAKnB,WAAWsD,OAAOnC,OAAAA;AAC7BA,SAAOa,KAAKqB;AAEZ,SAAOlC;;;;;;IAQX,MAAc8B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKpD,iBAAiBqD,cAAchG,iBAAiBiG,QAAO;AACxF,MAAI,CAACF,cACD,OAAM,IAAI5F,YAAY,OAAOH,iBAAiBiG,QAAQ,4FAA2F;AAOrJ,MAAIC,MAJmB,KAAKtD,2BAA2B4B,UAAU;GAC7D2B,eAAeL,WAAWvB;GAC1B6B,WAAWL,cAAcxB;GAC7B,CAAA,CAEI;EAGJ,MAAM8B,QAAQ,KAAKzD,2BAA2BgB,OAAO;GACjDuC,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GAChCgC,WAAWL,cAAcxB;GACzBgC,iBAAiBR,cAAc3B;GACnC,CAAA;AACA,QAAM,KAAKxB,2BAA2BkB,KAAKuC,MAAAA;;;;;IAO/C,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAK/D,eAAeuD,cAAcxF,gBAAAA;AAC1D,MAAI,CAACgG,UACD;AAOJ,MAAIN,MAJmB,KAAKxD,yBAAyB8B,UAAU;GAC3DiC,SAASD,UAAUjC;GACnB4B,eAAeL,WAAWvB;GAC9B,CAAA,CAEI;EAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;GAC/C6C,SAASD,UAAUjC;GACnBmC,eAAeF,UAAUpC;GACzB+B,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GACpC,CAAA;AACA,QAAM,KAAK1B,yBAAyBoB,KAAKuC,MAAAA;;;;;;;;;;;;;;;;;;IAoB7C,MAAcX,wBAAwBI,YAAuC;AACzE,MAAIlF,iCAAiC+F,SAASb,WAAW1C,KAAI,CACzD;EAGJ,MAAMwD,YAAY,OAAQE,OAAOxG,eAAAA,CAA6BqG,SAASb,WAAW1C,KAAI;AACtF,MAAI,CAAC0C,WAAW1B,YAAY,CAACwC,UACzB;EAGJ,MAAMG,aAAa/F,8BAA8B2F,SAASb,WAAW1C,KAAI,GACrEpD,iBAAiBgH,cACjBhH,iBAAiBiH;EAErB,MAAMC,SAAS,MAAM,KAAKvE,iBAAiBqD,cAAce,WAAAA;AACzD,MAAI,CAACG,OACD;EAGJ,MAAMC,kBAAkB,MAAM,KAAK1E,eAAe2E,WAAW,EAAEhE,MAAM3C,uBAAsB,CAAA;AAE3F,OAAK,MAAM4G,QAAQF,iBAAiB;AAChC,OAAIrB,WAAW1B,YAAY0B,WAAW1B,aAAaiD,KAAKjD,SACpD;AAOJ,OAAI8B,MAJmB,KAAKxD,yBAAyB8B,UAAU;IAC3DiC,SAASY,KAAK9C;IACd4B,eAAeL,WAAWvB;IAC9B,CAAA,CAEI;GAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;IAC/C6C,SAASY,KAAK9C;IACdmC,eAAeW,KAAKjD;IACpB+B,eAAeL,WAAWvB;IAC1B+B,qBAAqBR,WAAW1B;IAChCgC,WAAWc,OAAO3C;IACtB,CAAA;AACA,SAAM,KAAK7B,yBAAyBoB,KAAKuC,MAAAA"}

package/dist/core/entities/permission/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/permission-policy/index.mjs

@@ -0,0 +1,2 @@
+import { PermissionPolicyService } from "./service.mjs";
+export { PermissionPolicyService };

package/dist/core/entities/permission-policy/service.d.ts

@@ -1,3 +1,4 @@
+import { PermissionPolicyValidator } from '@authup/core-kit';
 import type { PermissionPolicy } from '@authup/core-kit';
 import type { ActorContext } from '../actor/types.ts';
 import { AbstractEntityService } from '../service.ts';
@@ -8,6 +9,7 @@ export type PermissionPolicyServiceContext = {
 };
 export declare class PermissionPolicyService extends AbstractEntityService implements IPermissionPolicyService {
     protected repository: IPermissionPolicyRepository;
+    protected validator: PermissionPolicyValidator;
     constructor(ctx: PermissionPolicyServiceContext);
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<PermissionPolicy>>;
     getOne(id: string, actor: ActorContext): Promise<PermissionPolicy>;

package/dist/core/entities/permission-policy/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;gBAEtC,GAAG,EAAE,8BAA8B;IAKzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAwBtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAmB/B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,yBAAyB,EAAkB,MAAM,kBAAkB,CAAC;AAC7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAMzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAkCtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAmB/B"}

package/dist/core/entities/permission-policy/service.mjs

@@ -0,0 +1,59 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName, PermissionPolicyValidator, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { ConflictError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/permission-policy/service.ts
+var PermissionPolicyService = class extends AbstractEntityService {
+	repository;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.validator = new PermissionPolicyValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.PERMISSION_READ, PermissionName.PERMISSION_UPDATE] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.PERMISSION_READ, PermissionName.PERMISSION_UPDATE] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			permission_id: validated.permission_id,
+			policy_id: validated.policy_id
+		})) throw new ConflictError("The permission-policy assignment already exists.");
+		if (validated.permission) validated.permission_realm_id = validated.permission.realm_id;
+		if (validated.policy) validated.policy_realm_id = validated.policy.realm_id;
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { PermissionPolicyService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/permission-policy/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","NotFoundError","PermissionName","PermissionPolicyValidator","ValidatorGroup","AbstractEntityService","PermissionPolicyService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","policy_id","permission","permission_realm_id","realm_id","policy","policy_realm_id","evaluate","input","ATTRIBUTES","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, NotFoundError } from '@ebec/http';\nimport { PermissionName, PermissionPolicyValidator, ValidatorGroup } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\n\nexport type PermissionPolicyServiceContext = {\n    repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends AbstractEntityService implements IPermissionPolicyService {\n    protected repository: IPermissionPolicyRepository;\n\n    protected validator: PermissionPolicyValidator;\n\n    constructor(ctx: PermissionPolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new PermissionPolicyValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            policy_id: validated.policy_id,\n        });\n        if (existing) {\n            throw new ConflictError('The permission-policy assignment already exists.');\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n        }\n\n        if (validated.policy) {\n            validated.policy_realm_id = validated.policy.realm_id;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAoBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,SAAK;AACL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,YAAY,IAAIL,2BAAAA;;CAGzB,MAAMO,QACFC,OACAC,OACyD;AACzD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,iBACfd,eAAee,kBAClB,EACL,CAAA;AAEA,SAAO,KAAKV,WAAWW,SAASP,MAAAA;;CAGpC,MAAMQ,OACFC,IACAR,OACyB;AACzB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,iBACfd,eAAee,kBAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIpB,eAAAA;AAGd,SAAOoB;;CAGX,MAAME,OACFC,MACAZ,OACyB;AACzB,QAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAee,mBAAkB,CAAA;EAErF,MAAMS,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAOxB,eAAeyB,QAAO,CAAA;AAEhF,QAAM,KAAKtB,WAAWuB,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAKxB,WAAWe,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,WAAWP,UAAUO;GACzB,CAAA,CAEI,OAAM,IAAIjC,cAAc,mDAAA;AAG5B,MAAI0B,UAAUQ,WACVR,WAAUS,sBAAsBT,UAAUQ,WAAWE;AAGzD,MAAIV,UAAUW,OACVX,WAAUY,kBAAkBZ,UAAUW,OAAOD;AAGjD,QAAMxB,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMb,eAAee;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAaf,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIL,SAAS,KAAKd,WAAWgB,OAAOG,UAAAA;AACpCL,WAAS,MAAM,KAAKd,WAAWmC,KAAKrB,OAAAA;AAEpC,SAAOA;;CAGX,MAAMsB,OACFvB,IACAR,OACyB;AACzB,QAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAee,mBAAkB,CAAA;EAErF,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIpB,eAAAA;AAGd,QAAMW,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMb,eAAee;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAapB,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAIwB,aAAavB;AACzB,QAAM,KAAKd,WAAWsC,OAAOxB,OAAAA;AAC7BA,SAAOD,KAAKwB;AAEZ,SAAOvB"}

package/dist/core/entities/permission-policy/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/policy/attributes-validator.mjs

@@ -0,0 +1,32 @@
+import { AttributeNamesPolicyValidator, AttributesPolicyValidator, BuiltInPolicyType, DatePolicyValidator, TimePolicyValidator } from "@authup/access";
+import { omitRecord } from "@authup/kit";
+import { Container } from "validup";
+//#region src/core/entities/policy/attributes-validator.ts
+var PolicyAttributesValidator = class extends Container {
+	attributeNames;
+	attributesOptionsValidator;
+	attributeNamesOptionsValidator;
+	dateOptionsValidator;
+	timeOptionsValidator;
+	constructor(options) {
+		super(options);
+		this.attributeNames = options.attributeNames || [];
+		this.attributesOptionsValidator = new AttributesPolicyValidator();
+		this.attributeNamesOptionsValidator = new AttributeNamesPolicyValidator();
+		this.dateOptionsValidator = new DatePolicyValidator();
+		this.timeOptionsValidator = new TimePolicyValidator();
+	}
+	async run(data) {
+		switch (data.type) {
+			case BuiltInPolicyType.ATTRIBUTES: return this.attributesOptionsValidator.run(data);
+			case BuiltInPolicyType.ATTRIBUTE_NAMES: return this.attributeNamesOptionsValidator.run(data);
+			case BuiltInPolicyType.DATE: return this.dateOptionsValidator.run(data);
+			case BuiltInPolicyType.TIME: return this.timeOptionsValidator.run(data);
+			default: return omitRecord(data, this.attributeNames);
+		}
+	}
+};
+//#endregion
+export { PolicyAttributesValidator };
+
+//# sourceMappingURL=attributes-validator.mjs.map

package/dist/core/entities/policy/attributes-validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes-validator.mjs","names":["AttributeNamesPolicyValidator","AttributesPolicyValidator","BuiltInPolicyType","DatePolicyValidator","TimePolicyValidator","omitRecord","Container","PolicyAttributesValidator","attributeNames","attributesOptionsValidator","attributeNamesOptionsValidator","dateOptionsValidator","timeOptionsValidator","options","run","data","type","ATTRIBUTES","ATTRIBUTE_NAMES","DATE","TIME"],"sources":["../../../../src/core/entities/policy/attributes-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AttributeNamesPolicyValidator,\n    AttributesPolicyValidator,\n    BuiltInPolicyType,\n    DatePolicyValidator,\n    TimePolicyValidator,\n} from '@authup/access';\nimport { omitRecord } from '@authup/kit';\nimport type { ContainerOptions } from 'validup';\nimport { Container } from 'validup';\n\ntype PolicyContainerRunOptions<T> = ContainerOptions<T> & {\n    attributeNames?: string[]\n};\n\nexport class PolicyAttributesValidator extends Container<Record<string, any>> {\n    protected attributeNames : string[];\n\n    protected attributesOptionsValidator : AttributesPolicyValidator;\n\n    protected attributeNamesOptionsValidator : AttributeNamesPolicyValidator;\n\n    protected dateOptionsValidator : DatePolicyValidator;\n\n    protected timeOptionsValidator : TimePolicyValidator;\n\n    constructor(options: PolicyContainerRunOptions<Record<string, any>>) {\n        super(options);\n\n        this.attributeNames = options.attributeNames || [];\n\n        this.attributesOptionsValidator = new AttributesPolicyValidator();\n        this.attributeNamesOptionsValidator = new AttributeNamesPolicyValidator();\n        this.dateOptionsValidator = new DatePolicyValidator();\n        this.timeOptionsValidator = new TimePolicyValidator();\n    }\n\n    override async run(\n        data: Record<string, any>,\n    ) : Promise<Record<string, any>> {\n        switch (data.type) {\n            case BuiltInPolicyType.ATTRIBUTES: {\n                return this.attributesOptionsValidator.run(data);\n            }\n            case BuiltInPolicyType.ATTRIBUTE_NAMES: {\n                return this.attributeNamesOptionsValidator.run(data);\n            }\n            case BuiltInPolicyType.DATE: {\n                return this.dateOptionsValidator.run(data);\n            }\n            case BuiltInPolicyType.TIME: {\n                return this.timeOptionsValidator.run(data);\n            }\n            default: {\n                return omitRecord(data, this.attributeNames);\n            }\n        }\n    }\n}\n"],"mappings":";;;;AAsBA,IAAaO,4BAAb,cAA+CD,UAAAA;CACjCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,SAAyD;AACjE,QAAMA,QAAAA;AAEN,OAAKL,iBAAiBK,QAAQL,kBAAkB,EAAE;AAElD,OAAKC,6BAA6B,IAAIR,2BAAAA;AACtC,OAAKS,iCAAiC,IAAIV,+BAAAA;AAC1C,OAAKW,uBAAuB,IAAIR,qBAAAA;AAChC,OAAKS,uBAAuB,IAAIR,qBAAAA;;CAGpC,MAAeU,IACXC,MAC6B;AAC7B,UAAQA,KAAKC,MAAb;GACI,KAAKd,kBAAkBe,WACnB,QAAO,KAAKR,2BAA2BK,IAAIC,KAAAA;GAE/C,KAAKb,kBAAkBgB,gBACnB,QAAO,KAAKR,+BAA+BI,IAAIC,KAAAA;GAEnD,KAAKb,kBAAkBiB,KACnB,QAAO,KAAKR,qBAAqBG,IAAIC,KAAAA;GAEzC,KAAKb,kBAAkBkB,KACnB,QAAO,KAAKR,qBAAqBE,IAAIC,KAAAA;GAEzC,QACI,QAAOV,WAAWU,MAAM,KAAKP,eAAc"}

package/dist/core/entities/policy/index.mjs

@@ -0,0 +1,2 @@
+import { PolicyService } from "./service.mjs";
+export { PolicyService };

package/dist/core/entities/policy/service.mjs

@@ -0,0 +1,128 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PolicyAttributesValidator } from "./attributes-validator.mjs";
+import { PermissionName, PolicyValidator, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { extendObject, isPropertySet, isUUID, removeObjectProperty } from "@authup/kit";
+import { BadRequestError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/policy/service.ts
+var PolicyService = class extends AbstractEntityService {
+	repository;
+	realmRepository;
+	validator;
+	attributesValidator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+		this.validator = new PolicyValidator();
+		this.attributesValidator = new PolicyAttributesValidator({});
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.PERMISSION_READ,
+			PermissionName.PERMISSION_UPDATE,
+			PermissionName.PERMISSION_DELETE
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(idOrName, actor, realm) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.PERMISSION_READ,
+			PermissionName.PERMISSION_UPDATE,
+			PermissionName.PERMISSION_DELETE
+		] });
+		const entity = await this.repository.findOneByIdOrName(idOrName, realm);
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		const { entity } = await this.save(void 0, data, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor) {
+		const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });
+		return entity;
+	}
+	async save(idOrName, data, actor, options = {}) {
+		let group;
+		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		let entity;
+		if (idOrName) {
+			const where = {};
+			if (isUUID(idOrName)) where.id = idOrName;
+			else where.name = idOrName;
+			if (realm) where.realm_id = realm.id;
+			entity = await this.repository.findOneBy(where);
+			if (!entity && options.updateOnly) throw new NotFoundError();
+		} else if (options.updateOnly) throw new NotFoundError();
+		if (entity) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+			group = ValidatorGroup.UPDATE;
+		} else {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });
+			group = ValidatorGroup.CREATE;
+		}
+		const validated = await this.validate(data, group);
+		await this.repository.validateJoinColumns(validated);
+		if (validated.parent && validated.parent.type !== BuiltInPolicyType.COMPOSITE) throw new BadRequestError("The parent policy must be of type group.");
+		if (entity) {
+			if (entity.built_in) throw new BadRequestError("A built-in policy can not be updated.");
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.PERMISSION_UPDATE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...validated
+				} })
+			});
+			await this.repository.checkUniqueness(validated, entity);
+			extendObject(entity, validated);
+			await this.repository.saveWithEA(entity);
+			return {
+				entity,
+				created: false
+			};
+		}
+		if (!isPropertySet(validated, "realm_id") && actor.identity) validated.realm_id = this.getActorRealmId(actor) || null;
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		await this.repository.checkUniqueness(validated);
+		entity = this.repository.create(validated);
+		await this.repository.saveWithEA(entity);
+		return {
+			entity,
+			created: true
+		};
+	}
+	async validate(data, group) {
+		const validated = await this.validator.run(data, { group });
+		extendObject(validated, await this.attributesValidator.run(data));
+		if (Array.isArray(data.children)) {
+			if (data.type === BuiltInPolicyType.COMPOSITE) {
+				const promises = data.children.map((child) => this.validate(child, group));
+				validated.children = await Promise.all(promises);
+			}
+		}
+		return validated;
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		if (entity.built_in) throw new BadRequestError("A built-in policy can not be deleted.");
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.deleteFromTree(entity);
+		entity.id = entityId;
+		removeObjectProperty(entity, "children");
+		return entity;
+	}
+};
+//#endregion
+export { PolicyService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/policy/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","extendObject","isPropertySet","isUUID","removeObjectProperty","BadRequestError","NotFoundError","PermissionName","PolicyValidator","ValidatorGroup","AbstractEntityService","PolicyAttributesValidator","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","saveWithEA","created","identity","getActorRealmId","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport {\n \n    extendObject, \n    isPropertySet, \n    isUUID, \n    removeObjectProperty, \n} from '@authup/kit';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport {\n    PermissionName,\n    PolicyValidator,\n    ValidatorGroup,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\n\nexport type PolicyServiceContext = {\n    repository: IPolicyRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n    protected repository: IPolicyRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: PolicyValidator;\n\n    protected attributesValidator: PolicyAttributesValidator;\n\n    constructor(ctx: PolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new PolicyValidator();\n        this.attributesValidator = new PolicyAttributesValidator({});\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Policy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Policy,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Policy | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new NotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new NotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validate(data, group);\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (\n            validated.parent &&\n            validated.parent.type !== BuiltInPolicyType.COMPOSITE\n        ) {\n            throw new BadRequestError('The parent policy must be of type group.');\n        }\n\n        if (entity) {\n            if (entity.built_in) {\n                throw new BadRequestError('A built-in policy can not be updated.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            extendObject(entity, validated);\n\n            await this.repository.saveWithEA(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.saveWithEA(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    private async validate(\n        data: Record<string, any>,\n        group: string,\n    ): Promise<Policy> {\n        const validated = await this.validator.run(data, { group });\n\n        const attributes = await this.attributesValidator.run(data);\n        extendObject(validated, attributes);\n\n        if (Array.isArray(data.children)) {\n            if (data.type === BuiltInPolicyType.COMPOSITE) {\n                const promises = data.children.map(\n                    (child) => this.validate(child, group),\n                );\n                validated.children = await Promise.all(promises);\n            }\n        }\n\n        return validated;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in policy can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.deleteFromTree(entity);\n\n        entity.id = entityId;\n\n        // todo: remove after PolicyEntity - parent delete on cascade\n        removeObjectProperty(entity, 'children');\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;AAkCA,IAAaa,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;AACnC,SAAK;AACL,OAAKJ,aAAaI,IAAIJ;AACtB,OAAKC,kBAAkBG,IAAIH;AAC3B,OAAKC,YAAY,IAAIP,iBAAAA;AACrB,OAAKQ,sBAAsB,IAAIL,0BAA0B,EAAC,CAAA;;CAG9D,MAAMO,QACFC,OACAC,OAC+C;AAC/C,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKb,WAAWc,SAASR,MAAAA;;CAGpC,MAAMS,OACFC,UACAT,OACAU,OACe;AACf,QAAMV,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;GAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKlB,WAAWmB,kBAAkBH,UAAUC,MAAAA;AACjE,MAAI,CAACC,OACD,OAAM,IAAIzB,eAAAA;AAGd,SAAOyB;;CAGX,MAAME,OACFC,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,MAAAA;AACpD,SAAOW;;CAGX,MAAMM,OACFR,UACAK,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMd,OAAO,EAAEkB,YAAY,MAAK,CAAA;AAC7E,SAAOP;;CAGX,MAAMI,KACFN,UACAK,MACAd,OACAmB,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK3B,gBAAgB4B,QAAQR,KAAKO,SAAQ,GAChDL,KAAAA;EAEJ,IAAIL;AACJ,MAAIF,UAAU;GACV,MAAMc,QAA6B,EAAC;AACpC,OAAIxC,OAAO0B,SAAAA,CACPc,OAAMC,KAAKf;OAEXc,OAAMpB,OAAOM;AAGjB,OAAIC,MACAa,OAAMF,WAAWX,MAAMc;AAG3Bb,YAAS,MAAM,KAAKlB,WAAWgC,UAAUF,MAAAA;AACzC,OAAI,CAACZ,UAAUQ,QAAQD,WACnB,OAAM,IAAIhC,eAAAA;aAEPiC,QAAQD,WACf,OAAM,IAAIhC,eAAAA;AAGd,MAAIyB,QAAQ;AACR,SAAMX,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMhB,eAAekB,mBAAkB,CAAA;AACrFe,WAAQ/B,eAAesC;SACpB;AACH,SAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMhB,eAAeyC,mBAAkB,CAAA;AACrFR,WAAQ/B,eAAewC;;EAG3B,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,MAAAA;AAE5C,QAAM,KAAK3B,WAAWuC,oBAAoBF,UAAAA;AAE1C,MACIA,UAAUG,UACVH,UAAUG,OAAOC,SAASvD,kBAAkBwD,UAE5C,OAAM,IAAIlD,gBAAgB,2CAAA;AAG9B,MAAI0B,QAAQ;AACR,OAAIA,OAAOyB,SACP,OAAM,IAAInD,gBAAgB,wCAAA;AAG9B,SAAMe,MAAMC,oBAAoBoC,SAAS;IACrClC,MAAMhB,eAAekB;IACrBiC,OAAO,IAAI1D,WAAW,GACjBD,kBAAkB4D,aAAa;KAC5B,GAAG5B;KACH,GAAGmB;KACP,EACJ,CAAA;IACJ,CAAA;AAEA,SAAM,KAAKrC,WAAW+C,gBAAgBV,WAAWnB,OAAAA;AAEjD9B,gBAAa8B,QAAQmB,UAAAA;AAErB,SAAM,KAAKrC,WAAWgD,WAAW9B,OAAAA;AAEjC,UAAO;IACHA;IACA+B,SAAS;IACb;;AAGJ,MAAI,CAAC5D,cAAcgD,WAAW,WAAA,IAAe9B,MAAM2C,SAC/Cb,WAAUT,WAAW,KAAKuB,gBAAgB5C,MAAAA,IAAU;AAGxD,QAAMA,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMhB,eAAeyC;GACrBU,OAAO,IAAI1D,WAAW,GAAGD,kBAAkB4D,aAAaT,WAAU,CAAA;GACtE,CAAA;AAEA,QAAM,KAAKrC,WAAW+C,gBAAgBV,UAAAA;AAEtCnB,WAAS,KAAKlB,WAAWoB,OAAOiB,UAAAA;AAChC,QAAM,KAAKrC,WAAWgD,WAAW9B,OAAAA;AAEjC,SAAO;GACHA;GACA+B,SAAS;GACb;;CAGJ,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKnC,UAAUkD,IAAI/B,MAAM,EAAEM,OAAM,CAAA;AAGzDvC,eAAaiD,WAAWgB,MADC,KAAKlD,oBAAoBiD,IAAI/B,KAAAA,CAC9BgC;AAExB,MAAIC,MAAMC,QAAQlC,KAAKmC,SAAQ;OACvBnC,KAAKoB,SAASvD,kBAAkBwD,WAAW;IAC3C,MAAMe,WAAWpC,KAAKmC,SAASE,KAC1BC,UAAU,KAAKrB,SAASqB,OAAOhC,MAAAA,CAAAA;AAEpCU,cAAUmB,WAAW,MAAMI,QAAQC,IAAIJ,SAAAA;;;AAI/C,SAAOpB;;CAGX,MAAMyB,OACF/B,IACAxB,OACe;AACf,QAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMhB,eAAemB,mBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACb,OACD,OAAM,IAAIzB,eAAAA;AAGd,MAAIyB,OAAOyB,SACP,OAAM,IAAInD,gBAAgB,wCAAA;AAG9B,QAAMe,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMhB,eAAemB;GACrBgC,OAAO,IAAI1D,WAAW,GAAGD,kBAAkB4D,aAAa5B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEa,IAAIgC,aAAa7C;AAEzB,QAAM,KAAKlB,WAAWgE,eAAe9C,OAAAA;AAErCA,SAAOa,KAAKgC;AAGZxE,uBAAqB2B,QAAQ,WAAA;AAE7B,SAAOA"}

package/dist/core/entities/policy/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/realm/index.mjs

@@ -0,0 +1,2 @@
+import { RealmService } from "./service.mjs";
+export { RealmService };