@authup/server-core 1.0.0-beta.35 → 1.0.0-beta.37

package/dist/core/entities/user/service.mjs

@@ -0,0 +1,176 @@
+import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName, UserValidator, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { isUUID, removeObjectProperty } from "@authup/kit";
+import { BadRequestError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/user/service.ts
+var UserService = class extends AbstractEntityService {
+	repository;
+	realmRepository;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+		this.validator = new UserValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_READ,
+			PermissionName.USER_UPDATE,
+			PermissionName.USER_DELETE
+		] });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.id) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluateOneOf({
+					name: [
+						PermissionName.USER_READ,
+						PermissionName.USER_UPDATE,
+						PermissionName.USER_DELETE
+					],
+					input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(idOrName, actor, query, realmId) {
+		let isMe = false;
+		if (actor.identity && actor.identity.type === "user") {
+			if (actor.identity.data.id === idOrName || actor.identity.data.name === idOrName) isMe = true;
+		}
+		if (!isMe) await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_READ,
+			PermissionName.USER_UPDATE,
+			PermissionName.USER_DELETE
+		] });
+		const resolvedId = isMe ? actor.identity.data.id : idOrName;
+		const entity = await this.repository.findOne(resolvedId, query, realmId);
+		if (!entity) throw new NotFoundError();
+		if (!isMe) await actor.permissionEvaluator.evaluateOneOf({
+			name: [
+				PermissionName.USER_READ,
+				PermissionName.USER_UPDATE,
+				PermissionName.USER_DELETE
+			],
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		return entity;
+	}
+	async create(data, actor) {
+		const { entity } = await this.save(void 0, data, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor) {
+		const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });
+		return entity;
+	}
+	async save(idOrName, data, actor, options = {}) {
+		let group;
+		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		let entity;
+		if (idOrName) {
+			const where = {};
+			if (isUUID(idOrName)) where.id = idOrName;
+			else where.name = idOrName;
+			if (realm) where.realm_id = realm.id;
+			entity = await this.repository.findOneBy(where);
+			if (!entity && options.updateOnly) throw new NotFoundError();
+		} else if (options.updateOnly) throw new NotFoundError();
+		let hasAbility;
+		if (entity) {
+			try {
+				await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });
+				hasAbility = true;
+			} catch (e) {
+				if (!actor.identity || actor.identity.type !== "user" || actor.identity.data.id !== entity.id) throw e;
+			}
+			group = ValidatorGroup.UPDATE;
+		} else {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });
+			hasAbility = true;
+			group = ValidatorGroup.CREATE;
+		}
+		const validated = await this.validator.run(data, { group });
+		await this.repository.validateJoinColumns(validated);
+		if (!hasAbility) {
+			removeObjectProperty(validated, "name_locked");
+			removeObjectProperty(validated, "active");
+			removeObjectProperty(validated, "status");
+			removeObjectProperty(validated, "status_message");
+		}
+		const credentialsService = new UserCredentialsService();
+		if (entity) {
+			const originalName = entity.name;
+			const originalNameLocked = entity.name_locked;
+			entity = this.repository.merge(entity, validated);
+			if (validated.name && validated.name !== originalName) {
+				if (validated.name_locked) entity.name_locked = validated.name_locked;
+				if (originalNameLocked && validated.name_locked !== false) entity.name = originalName;
+			}
+			if (hasAbility) await actor.permissionEvaluator.evaluate({
+				name: PermissionName.USER_UPDATE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...validated
+				} })
+			});
+			if (validated.password) entity.password = await credentialsService.protect(validated.password);
+			await this.repository.save(entity);
+			return {
+				entity,
+				created: false
+			};
+		}
+		if (!validated.realm_id) {
+			const actorRealmId = this.getActorRealmId(actor);
+			if (actorRealmId) validated.realm_id = actorRealmId;
+		}
+		entity = this.repository.create(validated);
+		if (hasAbility) await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		if (validated.password) entity.password = await credentialsService.protect(validated.password);
+		await this.repository.save(entity);
+		return {
+			entity,
+			created: true
+		};
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });
+		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === id) throw new BadRequestError("The own user can not be deleted.");
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { UserService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/user/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","isUUID","removeObjectProperty","BadRequestError","NotFoundError","PermissionName","UserValidator","ValidatorGroup","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","input","ATTRIBUTES","getOne","idOrName","realmId","isMe","resolvedId","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","hasAbility","preEvaluate","e","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","merge","evaluate","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { isUUID, removeObjectProperty } from '@authup/kit';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport {\n    PermissionName,\n    UserValidator,\n    ValidatorGroup,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_READ,\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        let isMe = false;\n        if (actor.identity && actor.identity.type === 'user') {\n            if (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            ) {\n                isMe = true;\n            }\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({\n                name: [\n                    PermissionName.USER_READ,\n                    PermissionName.USER_UPDATE,\n                    PermissionName.USER_DELETE,\n                ],\n            });\n        }\n\n        const resolvedId = isMe ? actor.identity!.data.id : idOrName;\n        const entity = await this.repository.findOne(resolvedId, query, realmId);\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: [\n                    PermissionName.USER_READ,\n                    PermissionName.USER_UPDATE,\n                    PermissionName.USER_DELETE,\n                ],\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new NotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new NotFoundError();\n        }\n\n        let hasAbility: boolean | undefined;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n                hasAbility = true;\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n            hasAbility = true;\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (!hasAbility) {\n            removeObjectProperty(validated, 'name_locked');\n            removeObjectProperty(validated, 'active');\n            removeObjectProperty(validated, 'status');\n            removeObjectProperty(validated, 'status_message');\n        }\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.name_locked;\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.name_locked) {\n                    entity.name_locked = validated.name_locked;\n                }\n\n                if (originalNameLocked && validated.name_locked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (hasAbility) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    input: new PolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        if (hasAbility) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_CREATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new BadRequestError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;AA4BA,IAAaW,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;AACjC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,YAAY,IAAIP,eAAAA;;CAGzB,MAAMS,QACFC,OACAC,OAC6C;AAC7C,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;GAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,MAAAA;EAEnC,MAAMQ,OAAe,EAAE;EACvB,IAAI,EAAEI,UAAUF;AAEhB,OAAK,MAAMG,UAAUJ,UAAU;AAC3B,OACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;AACER,SAAKS,KAAKJ,OAAAA;AACV;;AAGJ,OAAI;AACA,UAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFf,eAAegB;MACfhB,eAAeiB;MACfjB,eAAekB;MAClB;KACDY,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;KACnE,CAAA;AAEAL,SAAKS,KAAKJ,OAAAA;WACN;AACJD,aAAS;;;AAIjB,SAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,IAAIC,OAAO;AACX,MAAIvB,MAAMa,YAAYb,MAAMa,SAASC,SAAS;OAEtCd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB,SAE7BE,QAAO;;AAIf,MAAI,CAACA,KACD,OAAMvB,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;GAClB,EACL,CAAA;EAGJ,MAAMkB,aAAaD,OAAOvB,MAAMa,SAAUN,KAAKQ,KAAKM;EACpD,MAAMT,SAAS,MAAM,KAAKlB,WAAW+B,QAAQD,YAAYzB,OAAOuB,QAAAA;AAChE,MAAI,CAACV,OACD,OAAM,IAAIzB,eAAAA;AAGd,MAAI,CAACoC,KACD,OAAMvB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAM;IACFf,eAAegB;IACfhB,eAAeiB;IACfjB,eAAekB;IAClB;GACDY,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;GACnE,CAAA;AAGJ,SAAOA;;CAGX,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,MAAAA;AACpD,SAAOY;;CAGX,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,MAAK,CAAA;AAC7E,SAAOlB;;CAGX,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKvC,gBAAgBwC,QAAQ5B,KAAK2B,SAAQ,GAChDN,KAAAA;EAEJ,IAAIhB;AACJ,MAAIS,UAAU;GACV,MAAMe,QAA6B,EAAC;AACpC,OAAIpD,OAAOqC,SAAAA,CACPe,OAAMrB,KAAKM;OAEXe,OAAMjC,OAAOkB;AAGjB,OAAIY,MACAG,OAAMF,WAAWD,MAAMlB;AAG3BH,YAAS,MAAM,KAAKlB,WAAW2C,UAAUD,MAAAA;AACzC,OAAI,CAACxB,UAAUmB,QAAQD,WACnB,OAAM,IAAI3C,eAAAA;aAEP4C,QAAQD,WACf,OAAM,IAAI3C,eAAAA;EAGd,IAAImD;AACJ,MAAI1B,QAAQ;AACR,OAAI;AACA,UAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeiB,aAAY,CAAA;AAC/EiC,iBAAa;YACRE,GAAG;AACR,QACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,GAElC,OAAMyB;;AAIdR,WAAQ1C,eAAemD;SACpB;AACH,SAAMzC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAesD,aAAY,CAAA;AAC/EJ,gBAAa;AAEbN,WAAQ1C,eAAeqD;;EAG3B,MAAMC,YAAY,MAAM,KAAKhD,UAAUiD,IAAItC,MAAM,EAAEyB,OAAM,CAAA;AAEzD,QAAM,KAAKtC,WAAWoD,oBAAoBF,UAAAA;AAE1C,MAAI,CAACN,YAAY;AACbrD,wBAAqB2D,WAAW,cAAA;AAChC3D,wBAAqB2D,WAAW,SAAA;AAChC3D,wBAAqB2D,WAAW,SAAA;AAChC3D,wBAAqB2D,WAAW,iBAAA;;EAGpC,MAAMG,qBAAqB,IAAIvD,wBAAAA;AAE/B,MAAIoB,QAAQ;GACR,MAAMoC,eAAepC,OAAOT;GAC5B,MAAM8C,qBAAqBrC,OAAOsC;AAElCtC,YAAS,KAAKlB,WAAWyD,MAAMvC,QAAQgC,UAAAA;AAEvC,OACIA,UAAUzC,QACVyC,UAAUzC,SAAS6C,cACrB;AACE,QAAIJ,UAAUM,YACVtC,QAAOsC,cAAcN,UAAUM;AAGnC,QAAID,sBAAsBL,UAAUM,gBAAgB,MAChDtC,QAAOT,OAAO6C;;AAItB,OAAIV,WACA,OAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeiB;IACrBa,OAAO,IAAInC,WAAW,GACjBD,kBAAkBqC,aAAa;KAC5B,GAAGP;KACH,GAAGgC;KACP,EACJ,CAAA;IACJ,CAAA;AAGJ,OAAIA,UAAUS,SACVzC,QAAOyC,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,SAAQ;AAGzE,SAAM,KAAK3D,WAAWiC,KAAKf,OAAAA;AAE3B,UAAO;IACHA;IACA2C,SAAS;IACb;;AAGJ,MAAI,CAACX,UAAUV,UAAU;GACrB,MAAMsB,eAAe,KAAKC,gBAAgBzD,MAAAA;AAC1C,OAAIwD,aACAZ,WAAUV,WAAWsB;;AAI7B5C,WAAS,KAAKlB,WAAWgC,OAAOkB,UAAAA;AAEhC,MAAIN,WACA,OAAMtC,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAesD;GACrBxB,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;GACnE,CAAA;AAGJ,MAAIgC,UAAUS,SACVzC,QAAOyC,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,SAAQ;AAGzE,QAAM,KAAK3D,WAAWiC,KAAKf,OAAAA;AAE3B,SAAO;GACHA;GACA2C,SAAS;GACb;;CAGJ,MAAMG,OACF3C,IACAf,OACa;AACb,QAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAekB,aAAY,CAAA;AAE/E,MACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,GAE3B,OAAM,IAAI7B,gBAAgB,mCAAA;EAG9B,MAAM0B,SAAS,MAAM,KAAKlB,WAAW2C,UAAU,EAAEtB,IAAG,CAAA;AACpD,MAAI,CAACH,OACD,OAAM,IAAIzB,eAAAA;AAGd,QAAMa,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAekB;GACrBY,OAAO,IAAInC,WAAW,GAAGD,kBAAkBqC,aAAaP,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEG,IAAI4C,aAAa/C;AACzB,QAAM,KAAKlB,WAAWkE,OAAOhD,OAAAA;AAC7BA,SAAOG,KAAK4C;AAEZ,SAAO/C"}

package/dist/core/entities/user/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/user-attribute/index.mjs

@@ -0,0 +1,2 @@
+import { UserAttributeService } from "./service.mjs";
+export { UserAttributeService };

package/dist/core/entities/user-attribute/service.mjs

@@ -0,0 +1,92 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { BadRequestError, ForbiddenError, NotFoundError } from "@ebec/http";
+import { buildErrorMessageForAttribute } from "validup";
+//#region src/core/entities/user-attribute/service.ts
+var UserAttributeService = class extends AbstractEntityService {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) if (await this.canManageUserAttribute(actor, entity)) data.push(entity);
+		else total--;
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
+		await this.repository.validateJoinColumns(data);
+		if (data.user) data.realm_id = data.user.realm_id;
+		else if (actor.identity && actor.identity.type === "user") {
+			data.user_id = actor.identity.data.id;
+			data.realm_id = actor.identity.data.realm_id;
+		} else throw new BadRequestError(buildErrorMessageForAttribute("user_id"));
+		const entity = this.repository.create(data);
+		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		await this.repository.save(entity);
+		return entity;
+	}
+	async update(id, data, actor) {
+		await actor.permissionEvaluator.evaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
+		await this.repository.validateJoinColumns(data);
+		let entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		entity = this.repository.merge(entity, data);
+		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		await this.repository.save(entity);
+		return entity;
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		if (!await this.canManageUserAttribute(actor, entity)) throw new ForbiddenError();
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	async canManageUserAttribute(actor, entity) {
+		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.user_id) try {
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.USER_SELF_MANAGE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			});
+			return true;
+		} catch {
+			return false;
+		}
+		try {
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.USER_UPDATE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+//#endregion
+export { UserAttributeService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/user-attribute/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","BadRequestError","ForbiddenError","NotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canManage","canManageUserAttribute","push","getOne","id","findOneBy","create","validateJoinColumns","user","realm_id","identity","type","user_id","save","update","evaluateOneOf","merge","delete","entityId","remove","isMe","evaluate","input","ATTRIBUTES"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { BadRequestError, ForbiddenError, NotFoundError } from '@ebec/http';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canManage = await this.canManageUserAttribute(actor, entity);\n            if (canManage) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (data.user) {\n            data.realm_id = data.user.realm_id;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.user_id = actor.identity.data.id;\n            data.realm_id = actor.identity.data.realm_id;\n        } else {\n            throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n        }\n\n        const entity = this.repository.create(data);\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        await this.repository.validateJoinColumns(data);\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        entity = this.repository.merge(entity, data);\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const canManage = await this.canManageUserAttribute(actor, entity);\n        if (!canManage) {\n            throw new ForbiddenError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canManageUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        if (isMe) {\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                });\n\n                return true;\n            } catch {\n                return false;\n            }\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEV,YAAYC,KAAkC;AAC1C,SAAK;AACL,OAAKD,aAAaC,IAAID;;CAG1B,MAAME,QACFC,OACAC,OACsD;AACtD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKZ,WAAWa,SAASV,MAAAA;EAEnC,MAAMO,OAAwB,EAAE;EAChC,IAAI,EAAEI,UAAUF;AAEhB,OAAK,MAAMG,UAAUJ,SAEjB,KAAIK,MADoB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvDL,MAAKQ,KAAKH,OAAAA;MAEVD;AAIR,SAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMK,OACFC,IACAhB,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKf,WAAWqB,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACL,OACD,OAAM,IAAIpB,eAAAA;AAId,MAAI,CAACqB,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;AAGd,SAAOqB;;CAGX,MAAMO,OACFZ,MACAN,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;AAEA,QAAM,KAAKT,WAAWuB,oBAAoBb,KAAAA;AAE1C,MAAIA,KAAKc,KACLd,MAAKe,WAAWf,KAAKc,KAAKC;WAE1BrB,MAAMsB,YACNtB,MAAMsB,SAASC,SAAS,QAC1B;AACEjB,QAAKkB,UAAUxB,MAAMsB,SAAShB,KAAKU;AACnCV,QAAKe,WAAWrB,MAAMsB,SAAShB,KAAKe;QAEpC,OAAM,IAAIhC,gBAAgBI,8BAA8B,UAAA,CAAA;EAG5D,MAAMkB,SAAS,KAAKf,WAAWsB,OAAOZ,KAAAA;AAGtC,MAAI,CAACM,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;AAGd,QAAM,KAAKM,WAAW6B,KAAKd,OAAAA;AAE3B,SAAOA;;CAGX,MAAMe,OACFV,IACAV,MACAN,OACsB;AACtB,QAAMA,MAAMC,oBAAoB0B,cAAc,EAC1CxB,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;AAEA,QAAM,KAAKT,WAAWuB,oBAAoBb,KAAAA;EAE1C,IAAIK,SAAS,MAAM,KAAKf,WAAWqB,UAAU,EAAED,IAAG,CAAA;AAClD,MAAI,CAACL,OACD,OAAM,IAAIpB,eAAAA;AAGdoB,WAAS,KAAKf,WAAWgC,MAAMjB,QAAQL,KAAAA;AAGvC,MAAI,CAACM,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;AAGd,QAAM,KAAKM,WAAW6B,KAAKd,OAAAA;AAE3B,SAAOA;;CAGX,MAAMkB,OACFb,IACAhB,OACsB;AACtB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFX,eAAeY,aACfZ,eAAea,iBAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKf,WAAWqB,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACL,OACD,OAAM,IAAIpB,eAAAA;AAId,MAAI,CAACqB,MADmB,KAAKC,uBAAuBb,OAAOW,OAAAA,CAEvD,OAAM,IAAIrB,gBAAAA;EAGd,MAAM,EAAE0B,IAAIc,aAAanB;AACzB,QAAM,KAAKf,WAAWmC,OAAOpB,OAAAA;AAC7BA,SAAOK,KAAKc;AAEZ,SAAOnB;;CAGX,MAAcE,uBACVb,OACAW,QACgB;AAKhB,MAJaX,MAAMsB,YACftB,MAAMsB,SAASC,SAAS,UACxBvB,MAAMsB,SAAShB,KAAKU,OAAOL,OAAOa,QAGlC,KAAI;AACA,SAAMxB,MAAMC,oBAAoBgC,SAAS;IACrC9B,MAAMX,eAAea;IACrB6B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAaxB,QAAO,CAAA;IACnE,CAAA;AAEA,UAAO;UACH;AACJ,UAAO;;AAIf,MAAI;AACA,SAAMX,MAAMC,oBAAoBgC,SAAS;IACrC9B,MAAMX,eAAeY;IACrB8B,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAaxB,QAAO,CAAA;IACnE,CAAA;AAEA,UAAO;UACH;AACJ,UAAO"}

package/dist/core/entities/user-attribute/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/user-permission/index.mjs

@@ -0,0 +1,2 @@
+import { UserPermissionService } from "./service.mjs";
+export { UserPermissionService };

package/dist/core/entities/user-permission/service.d.ts

@@ -1,3 +1,4 @@
+import { UserPermissionValidator } from '@authup/core-kit';
 import type { UserPermission } from '@authup/core-kit';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
 import type { ActorContext } from '../actor/types.ts';
@@ -11,6 +12,7 @@ export type UserPermissionServiceContext = {
 export declare class UserPermissionService extends AbstractEntityService implements IUserPermissionService {
     protected repository: IUserPermissionRepository;
     protected identityPermissionProvider: IIdentityPermissionProvider;
+    protected validator: UserPermissionValidator;
     constructor(ctx: UserPermissionServiceContext);
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<UserPermission>>;
     getOne(id: string, actor: ActorContext): Promise<UserPermission>;

package/dist/core/entities/user-permission/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,4BAA4B;IAMvC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAYpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAiBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAmDpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAyBpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;CAmB7B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,uBAAuB,EAAkB,MAAM,kBAAkB,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC;gBAEjC,GAAG,EAAE,4BAA4B;IAOvC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAYpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAiBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IA6DpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAyBpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;CAmB7B"}

package/dist/core/entities/user-permission/service.mjs

@@ -0,0 +1,101 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName, UserPermissionValidator, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { ConflictError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/user-permission/service.ts
+var UserPermissionService = class extends AbstractEntityService {
+	repository;
+	identityPermissionProvider;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new UserPermissionValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_PERMISSION_CREATE,
+			PermissionName.USER_PERMISSION_DELETE,
+			PermissionName.USER_PERMISSION_READ
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_PERMISSION_CREATE,
+			PermissionName.USER_PERMISSION_DELETE,
+			PermissionName.USER_PERMISSION_READ
+		] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			permission_id: validated.permission_id,
+			user_id: validated.user_id
+		})) throw new ConflictError("The user-permission assignment already exists.");
+		if (validated.permission) {
+			validated.permission_realm_id = validated.permission.realm_id;
+			await actor.permissionEvaluator.preEvaluate({
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
+			});
+		}
+		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
+			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
+			});
+			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_PERMISSION_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async update(id, data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		const updateData = {};
+		if (Object.prototype.hasOwnProperty.call(data, "policy_id")) updateData.policy_id = data.policy_id;
+		await this.repository.validateJoinColumns(updateData);
+		const merged = this.repository.merge(entity, updateData);
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_PERMISSION_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged })
+		});
+		return this.repository.save(merged);
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_PERMISSION_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { UserPermissionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/user-permission/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","NotFoundError","PermissionName","UserPermissionValidator","ValidatorGroup","AbstractEntityService","UserPermissionService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","user_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","user","user_realm_id","identity","policy_id","junctionPolicy","resolveJunctionPolicy","type","evaluate","input","ATTRIBUTES","save","update","USER_PERMISSION_UPDATE","updateData","Object","prototype","hasOwnProperty","call","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, NotFoundError } from '@ebec/http';\nimport { PermissionName, UserPermissionValidator, ValidatorGroup } from '@authup/core-kit';\nimport type { UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\n\nexport type UserPermissionServiceContext = {\n    repository: IUserPermissionRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends AbstractEntityService implements IUserPermissionService {\n    protected repository: IUserPermissionRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserPermissionValidator;\n\n    constructor(ctx: UserPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new ConflictError('The user-permission assignment already exists.');\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (\n            validated.permission &&\n            actor.identity &&\n            typeof validated.policy_id === 'undefined'\n        ) {\n            const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                },\n            );\n            if (junctionPolicy) {\n                validated.policy_id = junctionPolicy.id;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const updateData: Record<string, any> = {};\n        if (Object.prototype.hasOwnProperty.call(data, 'policy_id')) {\n            updateData.policy_id = data.policy_id;\n        }\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAsBA,IAAaQ,wBAAb,cAA2CD,sBAAAA;CAC7BE;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;AAC3C,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAIN,yBAAAA;;CAGzB,MAAMQ,QACFC,OACAC,OACuD;AACvD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKZ,WAAWa,SAASR,MAAAA;;CAGpC,MAAMS,OACFC,IACAT,OACuB;AACvB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,SAAOsB;;CAGX,MAAME,OACFC,MACAb,OACuB;AACvB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAee,wBAAuB,CAAA;EAE1F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,QAAO,CAAA;AAEhF,QAAM,KAAKxB,WAAWyB,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,SAASP,UAAUO;GACvB,CAAA,CAEI,OAAM,IAAInC,cAAc,iDAAA;AAG5B,MAAI4B,UAAUQ,YAAY;AACtBR,aAAUS,sBAAsBT,UAAUQ,WAAWE;AAErD,SAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;IACnC,CAAA;;AAGJ,MAAIb,UAAUc,KACVd,WAAUe,gBAAgBf,UAAUc,KAAKJ;AAG7C,MACIV,UAAUQ,cACVvB,MAAM+B,YACN,OAAOhB,UAAUiB,cAAc,aACjC;GACE,MAAMC,iBAAiB,MAAM,KAAKtC,2BAA2BuC,sBACzD;IACIC,MAAMnC,MAAM+B,SAASI;IACrB1B,IAAIT,MAAM+B,SAASlB,KAAKJ;IAC5B,EACA;IACIN,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;IACnC,CAAA;AAEJ,OAAIK,eACAlB,WAAUiB,YAAYC,eAAexB;;AAI7C,QAAMT,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMd,eAAee;GACrBiC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAavB,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,UAAAA;AACpCL,WAAS,MAAM,KAAKhB,WAAW6C,KAAK7B,OAAAA;AAEpC,SAAOA;;CAGX,MAAM8B,OACF/B,IACAI,MACAb,OACuB;AACvB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAeoD,wBAAuB,CAAA;EAE1F,MAAM/B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;EAGd,MAAMsD,aAAkC,EAAC;AACzC,MAAIC,OAAOC,UAAUC,eAAeC,KAAKjC,MAAM,YAAA,CAC3C6B,YAAWV,YAAYnB,KAAKmB;AAGhC,QAAM,KAAKtC,WAAWyB,oBAAoBuB,WAAAA;EAE1C,MAAMK,SAAS,KAAKrD,WAAWsD,MAAMtC,QAAQgC,WAAAA;AAE7C,QAAM1C,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMd,eAAeoD;GACrBJ,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAaS,QAAO,CAAA;GACnE,CAAA;AAEA,SAAO,KAAKrD,WAAW6C,KAAKQ,OAAAA;;CAGhC,MAAME,OACFxC,IACAT,OACuB;AACvB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,wBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,QAAMY,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMd,eAAegB;GACrBgC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAa5B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAIyC,aAAaxC;AACzB,QAAM,KAAKhB,WAAWyD,OAAOzC,OAAAA;AAC7BA,SAAOD,KAAKyC;AAEZ,SAAOxC"}

package/dist/core/entities/user-permission/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/user-role/index.mjs

@@ -0,0 +1,2 @@
+import { UserRoleService } from "./service.mjs";
+export { UserRoleService };

package/dist/core/entities/user-role/service.d.ts

@@ -1,13 +1,18 @@
+import { UserRoleValidator } from '@authup/core-kit';
 import type { UserRole } from '@authup/core-kit';
 import type { ActorContext } from '../actor/types.ts';
 import { AbstractEntityService } from '../service.ts';
 import type { EntityRepositoryFindManyResult } from '../types.ts';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
 import type { IUserRoleRepository, IUserRoleService } from './types.ts';
 export type UserRoleServiceContext = {
     repository: IUserRoleRepository;
+    identityPermissionProvider: IIdentityPermissionProvider;
 };
 export declare class UserRoleService extends AbstractEntityService implements IUserRoleService {
     protected repository: IUserRoleRepository;
+    protected identityPermissionProvider: IIdentityPermissionProvider;
+    protected validator: UserRoleValidator;
     constructor(ctx: UserRoleServiceContext);
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<UserRole>>;
     getOne(id: string, actor: ActorContext): Promise<UserRole>;

package/dist/core/entities/user-role/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;CACnC,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;gBAE9B,GAAG,EAAE,sBAAsB;IAKjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAwBd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAmBvB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAmDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAmBvB"}

package/dist/core/entities/user-role/service.mjs

@@ -0,0 +1,79 @@
+import { AbstractEntityService } from "../service.mjs";
+import { PermissionName, UserRoleValidator, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { ConflictError, ForbiddenError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/user-role/service.ts
+var UserRoleService = class extends AbstractEntityService {
+	repository;
+	identityPermissionProvider;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new UserRoleValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_ROLE_READ,
+			PermissionName.USER_ROLE_CREATE,
+			PermissionName.USER_ROLE_UPDATE
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.USER_ROLE_READ,
+			PermissionName.USER_ROLE_CREATE,
+			PermissionName.USER_ROLE_UPDATE
+		] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			role_id: validated.role_id,
+			user_id: validated.user_id
+		})) throw new ConflictError("The user-role assignment already exists.");
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.role && actor.identity) {
+			if (!await this.identityPermissionProvider.isSuperset({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				type: "role",
+				id: validated.role_id,
+				clientId: validated.role.client_id
+			})) throw new ForbiddenError("You don't own the required permissions.");
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_ROLE_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.USER_ROLE_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { UserRoleService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/user-role/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","ForbiddenError","NotFoundError","PermissionName","UserRoleValidator","ValidatorGroup","AbstractEntityService","UserRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","evaluate","input","ATTRIBUTES","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, ForbiddenError, NotFoundError } from '@ebec/http';\nimport { PermissionName, UserRoleValidator, ValidatorGroup } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends AbstractEntityService implements IUserRoleService {\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new ConflictError('The user-role assignment already exists.');\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new ForbiddenError('You don\\'t own the required permissions.');\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACvBE;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;AACrC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAIN,mBAAAA;;CAGzB,MAAMQ,QACFC,OACAC,OACiD;AACjD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKZ,WAAWa,SAASR,MAAAA;;CAGpC,MAAMS,OACFC,IACAT,OACiB;AACjB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,SAAOsB;;CAGX,MAAME,OACFC,MACAb,OACiB;AACjB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,kBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,QAAO,CAAA;AAEhF,QAAM,KAAKxB,WAAWyB,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;GACvB,CAAA,CAEI,OAAM,IAAIpC,cAAc,2CAAA;AAG5B,MAAI6B,UAAUQ,KACVR,WAAUS,gBAAgBT,UAAUQ,KAAKE;AAG7C,MAAIV,UAAUW,KACVX,WAAUY,gBAAgBZ,UAAUW,KAAKD;AAG7C,MAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;IAC5B,EACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;IAC7B,CAAA,CAGA,OAAM,IAAI9C,eAAe,0CAAA;;AAIjC,QAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMd,eAAegB;GACrB8B,OAAO,IAAIlD,WAAW,GAAGD,kBAAkBoD,aAAarB,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,UAAAA;AACpCL,WAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,OAAAA;AAEpC,SAAOA;;CAGX,MAAM4B,OACF7B,IACAT,OACiB;AACjB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAekD,kBAAiB,CAAA;EAEpF,MAAM7B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,QAAMY,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMd,eAAekD;GACrBJ,OAAO,IAAIlD,WAAW,GAAGD,kBAAkBoD,aAAa1B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAI+B,aAAa9B;AACzB,QAAM,KAAKhB,WAAW+C,OAAO/B,OAAAA;AAC7BA,SAAOD,KAAK+B;AAEZ,SAAO9B"}

package/dist/core/entities/user-role/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/client/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/client/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/entities/index.mjs

@@ -0,0 +1 @@
+export {};