@authup/server-core 1.0.0-beta.35 → 1.0.0-beta.37

package/dist/core/provisioning/synchronizer/policy/module.mjs

@@ -0,0 +1,65 @@
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+//#region src/core/provisioning/synchronizer/policy/module.ts
+var PolicyProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	permissionPolicyRepository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.permissionPolicyRepository = ctx.permissionPolicyRepository;
+	}
+	async synchronize(input) {
+		let entity = await this.repository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null
+		});
+		if (entity) {
+			entity = this.repository.merge(entity, {
+				type: input.attributes.type,
+				built_in: input.attributes.built_in,
+				parent_id: input.attributes.parent_id,
+				parent: input.attributes.parent
+			});
+			await this.repository.saveWithEA(entity, input.extraAttributes);
+		} else {
+			entity = this.repository.create(input.attributes);
+			await this.repository.saveWithEA(entity, input.extraAttributes);
+		}
+		await this.synchronizeChildren(entity.id, input.children || []);
+		return {
+			...input,
+			attributes: entity
+		};
+	}
+	async synchronizeChildren(parentId, children = []) {
+		const declaredNames = children.map((c) => c.attributes.name);
+		await children.reduce(async (prev, child) => {
+			await prev;
+			child.attributes.parent_id = parentId;
+			child.attributes.parent = { id: parentId };
+			await this.synchronize(child);
+		}, Promise.resolve());
+		await this.cleanupStaleChildren(parentId, declaredNames);
+	}
+	async cleanupStaleChildren(parentId, declaredNames) {
+		await (await this.repository.findManyBy({ parent_id: parentId })).filter((child) => !declaredNames.includes(child.name)).reduce(async (prev, child) => {
+			await prev;
+			await this.cleanupStaleChild(child);
+		}, Promise.resolve());
+	}
+	async cleanupStaleChild(child) {
+		if ((await this.permissionPolicyRepository.findManyBy({ policy_id: child.id })).length === 0) await this.repository.deleteFromTree(child);
+		else {
+			const detached = this.repository.merge(child, {
+				parent_id: null,
+				parent: null,
+				built_in: false
+			});
+			await this.repository.saveWithEA(detached);
+		}
+	}
+};
+//#endregion
+export { PolicyProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/policy/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","merge","type","built_in","parent_id","parent","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            entity = this.repository.merge(entity, {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            });\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;AACpD,SAAK;AAEL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;GAC3C,CAAA;AAEA,MAAIJ,QAAQ;AACRA,YAAS,KAAKL,WAAWU,MAAML,QAAQ;IACnCM,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;IAC7B,CAAA;AACA,SAAM,KAAKd,WAAWe,WAAWV,QAAQD,MAAMY,gBAAe;SAC3D;AACHX,YAAS,KAAKL,WAAWiB,OAAOb,MAAMI,WAAU;AAChD,SAAM,KAAKR,WAAWe,WAAWV,QAAQD,MAAMY,gBAAe;;AAGlE,QAAM,KAAKE,oBAAoBb,OAAOc,IAAIf,MAAMgB,YAAY,EAAE,CAAA;AAE9D,SAAO;GACH,GAAGhB;GACHI,YAAYH;GAChB;;CAGJ,MAAca,oBACVG,UACAD,WAAuC,EAAE,EAC5B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAEhB,WAAWD,KAAI;AAE3D,QAAMa,SAASK,OAAO,OAAOC,MAAMC,UAAAA;AAC/B,SAAMD;AACNC,SAAMnB,WAAWK,YAAYQ;AAC7BM,SAAMnB,WAAWM,SAAS,EAAEK,IAAIE,UAAS;AACzC,SAAM,KAAKlB,YAAYwB,MAAAA;KACxBC,QAAQC,SAAO,CAAA;AAElB,QAAM,KAAKC,qBAAqBT,UAAUC,cAAAA;;CAG9C,MAAcQ,qBACVT,UACAC,eACa;AAOb,SAJsBS,MAFS,KAAK/B,WAAWgC,WAAW,EAAEnB,WAAWQ,UAAS,CAAA,EAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMpB,KAAI,CAG3C0B,CAAcR,OAAO,OAAOC,MAAMC,UAAAA;AACpC,SAAMD;AACN,SAAM,KAAKU,kBAAkBT,MAAAA;KAC9BC,QAAQC,SAAO,CAAA;;CAGtB,MAAcO,kBAAkBT,OAA8B;AAG1D,OAAIU,MAF+B,KAAKpC,2BAA2B+B,WAAW,EAAEM,WAAWX,MAAMR,IAAG,CAAA,EAE3EoB,WAAW,EAChC,OAAM,KAAKvC,WAAWwC,eAAeb,MAAAA;OAClC;GACH,MAAMc,WAAW,KAAKzC,WAAWU,MAAMiB,OAAO;IAC1Cd,WAAW;IACXC,QAAQ;IACRF,UAAU;IACd,CAAA;AACA,SAAM,KAAKZ,WAAWe,WAAW0B,SAAAA"}

package/dist/core/provisioning/synchronizer/policy/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/synchronizer/realm/index.mjs

@@ -0,0 +1,2 @@
+import { RealmProvisioningSynchronizer } from "./module.mjs";
+export { RealmProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/realm/module.mjs

@@ -0,0 +1,103 @@
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/realm/module.ts
+var RealmProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	clientSynchronizer;
+	permissionSynchronizer;
+	roleSynchronizer;
+	userSynchronizer;
+	robotSynchronizer;
+	scopeSynchronizer;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.clientSynchronizer = ctx.clientSynchronizer;
+		this.permissionSynchronizer = ctx.permissionSynchronizer;
+		this.roleSynchronizer = ctx.roleSynchronizer;
+		this.userSynchronizer = ctx.userSynchronizer;
+		this.robotSynchronizer = ctx.robotSynchronizer;
+		this.scopeSynchronizer = ctx.scopeSynchronizer;
+	}
+	async synchronize(input) {
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.repository.findOneBy({ name: input.attributes.name });
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.repository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.repository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.repository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.repository.save(this.repository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (input.relations && input.relations.clients) {
+			const clients = input.relations.clients.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.clientSynchronizer.synchronizeMany(clients);
+		}
+		if (input.relations && input.relations.permissions) {
+			const permissions = input.relations.permissions.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.permissionSynchronizer.synchronizeMany(permissions);
+		}
+		if (input.relations && input.relations.roles) {
+			const roles = input.relations.roles.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.roleSynchronizer.synchronizeMany(roles);
+		}
+		if (input.relations && input.relations.users) {
+			const users = input.relations.users.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.userSynchronizer.synchronizeMany(users);
+		}
+		if (input.relations && input.relations.robots) {
+			const robots = input.relations.robots.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.robotSynchronizer.synchronizeMany(robots);
+		}
+		if (input.relations && input.relations.scopes) {
+			const scopes = input.relations.scopes.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.scopeSynchronizer.synchronizeMany(scopes);
+		}
+		return {
+			...input,
+			attributes
+		};
+	}
+};
+//#endregion
+export { RealmProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/realm/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","robotSynchronizer","scopeSynchronizer","ctx","synchronize","input","strategy","attributes","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","clients","map","child","realm_id","realm","synchronizeMany","permissions","roles","users","robots","scopes"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.robotSynchronizer = ctx.robotSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realm_id = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        if (input.relations && input.relations.robots) {\n            const robots = input.relations.robots.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.robotSynchronizer.synchronizeMany(robots);\n        }\n\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAoBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;AACnD,SAAK;AAEL,OAAKP,aAAaO,IAAIP;AACtB,OAAKC,qBAAqBM,IAAIN;AAC9B,OAAKC,yBAAyBK,IAAIL;AAClC,OAAKC,mBAAmBI,IAAIJ;AAC5B,OAAKC,mBAAmBG,IAAIH;AAC5B,OAAKC,oBAAoBE,IAAIF;AAC7B,OAAKC,oBAAoBC,IAAID;;CAGjC,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWb,oCAAoCY,MAAMC,SAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKX,WAAWY,UAAU,EAAEC,MAAMJ,MAAME,WAAWE,MAAK,CAAA;AAE/E,MAAIH,SAASI,SAASlB,+BAA+BmB,QAAQ;AACzD,OAAIJ,WACA,OAAM,KAAKX,WAAWgB,OAAOL,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASI,MAAjB;GACI,KAAKlB,+BAA+BqB;AAChCN,iBAAa,KAAKX,WAAWkB,MACzBP,YACAD,SAASC,aACLhB,WAAWc,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKX,WAAWmB,KAAKR,WAAAA;AACxC;GACJ,KAAKf,+BAA+BwB;AAChCX,UAAME,WAAWU,KAAKV,WAAWU;AACjCV,iBAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,WAAU,CAAA;AAGnF,MAAIF,MAAMc,aAAad,MAAMc,UAAUC,SAAS;GAC5C,MAAMA,UAAUf,MAAMc,UAAUC,QAAQC,KACnCC,UAAAA;AACGA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAGJ,SAAM,KAAKzB,mBAAmB4B,gBAAgBL,QAAAA;;AAGlD,MAAIf,MAAMc,aAAad,MAAMc,UAAUO,aAAa;GAChD,MAAMA,cAAcrB,MAAMc,UAAUO,YAAYL,KAAKC,UAAAA;AACjDA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKxB,uBAAuB2B,gBAAgBC,YAAAA;;AAGtD,MAAIrB,MAAMc,aAAad,MAAMc,UAAUQ,OAAO;GAC1C,MAAMA,QAAQtB,MAAMc,UAAUQ,MAAMN,KAAKC,UAAAA;AACrCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKvB,iBAAiB0B,gBAAgBE,MAAAA;;AAGhD,MAAItB,MAAMc,aAAad,MAAMc,UAAUS,OAAO;GAC1C,MAAMA,QAAQvB,MAAMc,UAAUS,MAAMP,KAAKC,UAAAA;AACrCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKtB,iBAAiByB,gBAAgBG,MAAAA;;AAGhD,MAAIvB,MAAMc,aAAad,MAAMc,UAAUU,QAAQ;GAC3C,MAAMA,SAASxB,MAAMc,UAAUU,OAAOR,KAAKC,UAAAA;AACvCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKrB,kBAAkBwB,gBAAgBI,OAAAA;;AAGjD,MAAIxB,MAAMc,aAAad,MAAMc,UAAUW,QAAQ;GAC3C,MAAMA,SAASzB,MAAMc,UAAUW,OAAOT,KAAKC,UAAAA;AACvCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKpB,kBAAkBuB,gBAAgBK,OAAAA;;AAGjD,SAAO;GACH,GAAGzB;GACHE;GACJ"}

package/dist/core/provisioning/synchronizer/realm/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/synchronizer/robot/index.mjs

@@ -0,0 +1,2 @@
+import { RobotProvisioningSynchronizer } from "./module.mjs";
+export { RobotProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/robot/module.mjs

@@ -0,0 +1,68 @@
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { ProvisioningEntityResolver } from "../entity-resolver.mjs";
+import { ProvisioningJunctionSynchronizer } from "../junction-synchronizer.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/robot/module.ts
+var RobotProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	robotRepository;
+	permissionResolver;
+	roleResolver;
+	permissionJunction;
+	roleJunction;
+	constructor(ctx) {
+		super();
+		this.robotRepository = ctx.robotRepository;
+		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
+		this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);
+		this.permissionJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.robotPermissionRepository,
+			ownerKey: "robot_id",
+			ownerRealmKey: "robot_realm_id"
+		});
+		this.roleJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.robotRoleRepository,
+			ownerKey: "robot_id",
+			ownerRealmKey: "robot_realm_id"
+		});
+	}
+	async synchronize(input) {
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.robotRepository.findOneBy({
+			name: input.attributes.name,
+			...input.attributes.realm_id ? { realm_id: input.attributes.realm_id } : { realm_id: null }
+		});
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.robotRepository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.robotRepository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.robotRepository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));
+		const permissions = [...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions), ...attributes.realm_id ? await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realm_id) : []];
+		if (permissions.length > 0) await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
+		const roles = [...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles), ...attributes.realm_id ? await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realm_id) : []];
+		if (roles.length > 0) await this.roleJunction.synchronize(attributes, roles, "role_id", "role_realm_id");
+		return {
+			...input,
+			attributes
+		};
+	}
+};
+//#endregion
+export { RobotProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/robot/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RobotProvisioningSynchronizer","robotRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","robotPermissionRepository","ownerKey","ownerRealmKey","robotRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/robot/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    RobotPermission, \n    RobotRole, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IRobotRepository } from '../../../entities/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RobotProvisioningSynchronizerContext } from './types.ts';\n\nexport class RobotProvisioningSynchronizer extends BaseProvisioningSynchronizer<RobotProvisioningEntity> {\n    protected robotRepository: IRobotRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RobotPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<RobotRole>;\n\n    constructor(ctx: RobotProvisioningSynchronizerContext) {\n        super();\n\n        this.robotRepository = ctx.robotRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotPermissionRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotRoleRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n    }\n\n    async synchronize(input: RobotProvisioningEntity): Promise<RobotProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.robotRepository.findOneBy({\n            name: input.attributes.name,\n            ...(input.attributes.realm_id ? { realm_id: input.attributes.realm_id } : { realm_id: null }),\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.robotRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.robotRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.robotRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n        }\n\n        // Permissions (Global & Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global & Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAsBA,IAAaM,gCAAb,cAAmDH,6BAAAA;CACrCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;AACnD,SAAK;AAEL,OAAKL,kBAAkBK,IAAIL;AAE3B,OAAKC,qBAAqB,IAAIJ,2BAA2BQ,IAAIC,qBAAoB;AACjF,OAAKJ,eAAe,IAAIL,2BAA2BQ,IAAIE,eAAc;AAErE,OAAKJ,qBAAqB,IAAIL,iCAAiC;GAC3DU,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;GACnB,CAAA;AACA,OAAKP,eAAe,IAAIN,iCAAiC;GACrDU,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;GACnB,CAAA;;CAGJ,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWpB,oCAAoCmB,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKhB,gBAAgBiB,UAAU;GAClDC,MAAMJ,MAAME,WAAWE;GACvB,GAAIJ,MAAME,WAAWG,WAAW,EAAEA,UAAUL,MAAME,WAAWG,UAAS,GAAI,EAAEA,UAAU,MAAM;GAChG,CAAA;AAEA,MAAIJ,SAASK,SAAS1B,+BAA+B2B,QAAQ;AACzD,OAAIL,WACA,OAAM,KAAKhB,gBAAgBsB,OAAON,WAAAA;AAEtC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASK,MAAjB;GACI,KAAK1B,+BAA+B6B;AAChCP,iBAAa,KAAKhB,gBAAgBwB,MAC9BR,YACAD,SAASC,aACLvB,WAAWqB,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKhB,gBAAgByB,KAAKT,WAAAA;AAC7C;GACJ,KAAKtB,+BAA+BgC;AAChCZ,UAAME,WAAWW,KAAKX,WAAWW;AACjCX,iBAAa,MAAM,KAAKhB,gBAAgByB,KAAK,KAAKzB,gBAAgB4B,OAAOd,MAAME,WAAU,CAAA;AACzF;;MAGRA,cAAa,MAAM,KAAKhB,gBAAgByB,KAAK,KAAKzB,gBAAgB4B,OAAOd,MAAME,WAAU,CAAA;EAI7F,MAAMa,cAAc,CAAA,GACb,MAAM,KAAK5B,mBAAmB6B,cAC7BhB,MAAMiB,aAAajB,MAAMiB,UAAUC,kBAAiB,EAAA,GAEpDhB,WAAWG,WACX,MAAM,KAAKlB,mBAAmBgC,aAC1BnB,MAAMiB,aAAajB,MAAMiB,UAAUG,kBACnClB,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIU,YAAYM,SAAS,EACrB,OAAM,KAAKhC,mBAAmBU,YAC1BG,YACAa,aACA,iBACA,sBAAA;EAKR,MAAMO,QAAQ,CAAA,GACP,MAAM,KAAKlC,aAAa4B,cACvBhB,MAAMiB,aAAajB,MAAMiB,UAAUM,YAAW,EAAA,GAE9CrB,WAAWG,WACX,MAAM,KAAKjB,aAAa+B,aACpBnB,MAAMiB,aAAajB,MAAMiB,UAAUO,YACnCtB,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIiB,MAAMD,SAAS,EACf,OAAM,KAAK/B,aAAaS,YACpBG,YACAoB,OACA,WACA,gBAAA;AAIR,SAAO;GACH,GAAGtB;GACHE;GACJ"}

package/dist/core/provisioning/synchronizer/robot/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/synchronizer/role/index.mjs

@@ -0,0 +1,2 @@
+import { RoleProvisioningSynchronizer } from "./module.mjs";
+export { RoleProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/role/module.mjs

@@ -0,0 +1,93 @@
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { ProvisioningEntityResolver } from "../entity-resolver.mjs";
+import { ProvisioningJunctionSynchronizer } from "../junction-synchronizer.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/role/module.ts
+var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	policyRepository;
+	permissionResolver;
+	permissionJunction;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.policyRepository = ctx.policyRepository;
+		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
+		this.permissionJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.rolePermissionRepository,
+			ownerKey: "role_id",
+			ownerRealmKey: "role_realm_id"
+		});
+	}
+	async synchronize(input) {
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.repository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null,
+			client_id: input.attributes.client_id || null
+		});
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.repository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.repository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.repository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.repository.save(this.repository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (!input.relations) return {
+			...input,
+			attributes
+		};
+		let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);
+		if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {
+			const excludeSet = new Set(input.relations.globalPermissionsExclude);
+			globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));
+		}
+		const realmPermissions = attributes.realm_id ? await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) : [];
+		const permissions = [...globalPermissions, ...realmPermissions];
+		if (permissions.length > 0) {
+			const policyMap = await this.resolvePolicyMap(input, attributes.name);
+			if (policyMap) for (const permission of permissions) {
+				const policyId = policyMap.overrides.get(permission.name) ?? policyMap.defaultPolicyId;
+				await this.permissionJunction.synchronize(attributes, [permission], "permission_id", "permission_realm_id", policyId ? { policy_id: policyId } : void 0);
+			}
+			else await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
+		}
+		return {
+			...input,
+			attributes
+		};
+	}
+	async resolvePolicyMap(input, roleName) {
+		if (!input.relations?.globalPermissionsPolicyName || !this.policyRepository) return;
+		const defaultPolicy = await this.policyRepository.findOneByName(input.relations.globalPermissionsPolicyName);
+		if (!defaultPolicy) throw new Error(`Provisioning: policy '${input.relations.globalPermissionsPolicyName}' not found for role '${roleName}'.`);
+		const overrides = /* @__PURE__ */ new Map();
+		if (input.relations.globalPermissionsPolicyOverrides) for (const [policyName, permissionNames] of Object.entries(input.relations.globalPermissionsPolicyOverrides)) {
+			const policy = await this.policyRepository.findOneByName(policyName);
+			if (!policy) throw new Error(`Provisioning: override policy '${policyName}' not found for role '${roleName}'.`);
+			for (const permName of permissionNames) overrides.set(permName, policy.id);
+		}
+		return {
+			defaultPolicyId: defaultPolicy.id,
+			overrides
+		};
+	}
+};
+//#endregion
+export { RoleProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/role/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","policyRepository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","policyMap","resolvePolicyMap","permission","policyId","overrides","get","defaultPolicyId","policy_id","undefined","roleName","globalPermissionsPolicyName","defaultPolicy","findOneByName","Error","Map","globalPermissionsPolicyOverrides","policyName","permissionNames","Object","entries","policy","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IPolicyRepository, IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n    protected repository : IRoleRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n    constructor(ctx: RoleProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.rolePermissionRepository,\n            ownerKey: 'role_id',\n            ownerRealmKey: 'role_realm_id',\n        });\n    }\n\n    async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (!input.relations) {\n            return {\n                ...input,\n                attributes,\n            };\n        }\n\n        let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n        if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n            const excludeSet = new Set(input.relations.globalPermissionsExclude);\n            globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n        }\n\n        const realmPermissions = attributes.realm_id ?\n            await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) :\n            [];\n\n        const permissions = [\n            ...globalPermissions,\n            ...realmPermissions,\n        ];\n\n        if (permissions.length > 0) {\n            const policyMap = await this.resolvePolicyMap(input, attributes.name);\n\n            if (policyMap) {\n                for (const permission of permissions) {\n                    const policyId = policyMap.overrides.get(permission.name) ?? policyMap.defaultPolicyId;\n                    await this.permissionJunction.synchronize(\n                        attributes,\n                        [permission],\n                        'permission_id',\n                        'permission_realm_id',\n                        policyId ? { policy_id: policyId } : undefined,\n                    );\n                }\n            } else {\n                await this.permissionJunction.synchronize(\n                    attributes,\n                    permissions,\n                    'permission_id',\n                    'permission_realm_id',\n                );\n            }\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async resolvePolicyMap(\n        input: RoleProvisioningEntity,\n        roleName: string | undefined,\n    ): Promise<{\n        defaultPolicyId: string | undefined,\n        overrides: Map<string, string> \n    } | undefined> {\n        if (!input.relations?.globalPermissionsPolicyName || !this.policyRepository) {\n            return undefined;\n        }\n\n        const defaultPolicy = await this.policyRepository.findOneByName(input.relations.globalPermissionsPolicyName);\n        if (!defaultPolicy) {\n            throw new Error(\n                `Provisioning: policy '${input.relations.globalPermissionsPolicyName}' not found for role '${roleName}'.`,\n            );\n        }\n\n        const overrides = new Map<string, string>();\n\n        if (input.relations.globalPermissionsPolicyOverrides) {\n            for (const [policyName, permissionNames] of Object.entries(input.relations.globalPermissionsPolicyOverrides)) {\n                const policy = await this.policyRepository.findOneByName(policyName);\n                if (!policy) {\n                    throw new Error(\n                        `Provisioning: override policy '${policyName}' not found for role '${roleName}'.`,\n                    );\n                }\n                for (const permName of permissionNames) {\n                    overrides.set(permName, policy.id);\n                }\n            }\n        }\n\n        return {\n            defaultPolicyId: defaultPolicy.id,\n            overrides,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;AAClD,SAAK;AAEL,OAAKJ,aAAaI,IAAIJ;AACtB,OAAKC,mBAAmBG,IAAIH;AAC5B,OAAKC,qBAAqB,IAAIL,2BAA2BO,IAAIC,qBAAoB;AACjF,OAAKF,qBAAqB,IAAIL,iCAAiC;GAC3DE,YAAYI,IAAIE;GAChBC,UAAU;GACVC,eAAe;GACnB,CAAA;;CAGJ,MAAMC,YAAYC,OAAgE;EAC9E,MAAMC,WAAWhB,oCAAoCe,MAAMC,SAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKZ,WAAWa,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAASvB,+BAA+BwB,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKZ,WAAWmB,OAAOP,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAKvB,+BAA+B0B;AAChCR,iBAAa,KAAKZ,WAAWqB,MACzBT,YACAD,SAASC,aACLnB,WAAWiB,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKZ,WAAWsB,KAAKV,WAAAA;AACxC;GACJ,KAAKlB,+BAA+B6B;AAChCb,UAAME,WAAWY,KAAKZ,WAAWY;AACjCZ,iBAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,WAAU,CAAA;AAGnF,MAAI,CAACF,MAAMgB,UACP,QAAO;GACH,GAAGhB;GACHE;GACJ;EAGJ,IAAIe,oBAAoB,MAAM,KAAKzB,mBAAmB0B,cAAclB,MAAMgB,UAAUC,kBAAiB;AAErG,MAAIjB,MAAMgB,UAAUG,4BAA4BnB,MAAMgB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAItB,MAAMgB,UAAUG,yBAAwB;AACnEF,uBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,KAAI,CAAA;;EAG9E,MAAMsB,mBAAmBxB,WAAWG,WAChC,MAAM,KAAKb,mBAAmBmC,aAAa3B,MAAMgB,UAAUU,kBAAkBxB,WAAWG,SAAQ,GAChG,EAAE;EAEN,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,iBACN;AAED,MAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,YAAY,MAAM,KAAKC,iBAAiB9B,OAAOE,WAAWE,KAAI;AAEpE,OAAIyB,UACA,MAAK,MAAME,cAAcH,aAAa;IAClC,MAAMI,WAAWH,UAAUI,UAAUC,IAAIH,WAAW3B,KAAI,IAAKyB,UAAUM;AACvE,UAAM,KAAK1C,mBAAmBM,YAC1BG,YACA,CAAC6B,WAAW,EACZ,iBACA,uBACAC,WAAW,EAAEI,WAAWJ,UAAS,GAAIK,KAAAA,EAAAA;;OAI7C,OAAM,KAAK5C,mBAAmBM,YAC1BG,YACA0B,aACA,iBACA,sBAAA;;AAKZ,SAAO;GACH,GAAG5B;GACHE;GACJ;;CAGJ,MAAc4B,iBACV9B,OACAsC,UAIW;AACX,MAAI,CAACtC,MAAMgB,WAAWuB,+BAA+B,CAAC,KAAKhD,iBACvD;EAGJ,MAAMiD,gBAAgB,MAAM,KAAKjD,iBAAiBkD,cAAczC,MAAMgB,UAAUuB,4BAA2B;AAC3G,MAAI,CAACC,cACD,OAAM,IAAIE,MACN,yBAAyB1C,MAAMgB,UAAUuB,4BAA4B,wBAAwBD,SAAS,IAAG;EAIjH,MAAML,4BAAY,IAAIU,KAAAA;AAEtB,MAAI3C,MAAMgB,UAAU4B,iCAChB,MAAK,MAAM,CAACC,YAAYC,oBAAoBC,OAAOC,QAAQhD,MAAMgB,UAAU4B,iCAAgC,EAAG;GAC1G,MAAMK,SAAS,MAAM,KAAK1D,iBAAiBkD,cAAcI,WAAAA;AACzD,OAAI,CAACI,OACD,OAAM,IAAIP,MACN,kCAAkCG,WAAW,wBAAwBP,SAAS,IAAG;AAGzF,QAAK,MAAMY,YAAYJ,gBACnBb,WAAUkB,IAAID,UAAUD,OAAOnC,GAAE;;AAK7C,SAAO;GACHqB,iBAAiBK,cAAc1B;GAC/BmB;GACJ"}

package/dist/core/provisioning/synchronizer/role/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/synchronizer/root/index.mjs

@@ -0,0 +1,2 @@
+import { GraphProvisioningSynchronizer } from "./module.mjs";
+export { GraphProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/root/module.mjs

@@ -0,0 +1,30 @@
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+//#region src/core/provisioning/synchronizer/root/module.ts
+var GraphProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	policySynchronizer;
+	realmSynchronizer;
+	permissionSynchronizer;
+	roleSynchronizer;
+	scopeSynchronizer;
+	constructor(ctx) {
+		super();
+		this.policySynchronizer = ctx.policySynchronizer;
+		this.permissionSynchronizer = ctx.permissionSynchronizer;
+		this.realmSynchronizer = ctx.realmSynchronizer;
+		this.roleSynchronizer = ctx.roleSynchronizer;
+		this.scopeSynchronizer = ctx.scopeSynchronizer;
+	}
+	async synchronize(input) {
+		const output = {};
+		if (input.policies) output.policies = await this.policySynchronizer.synchronizeMany(input.policies);
+		if (input.permissions) output.permissions = await this.permissionSynchronizer.synchronizeMany(input.permissions);
+		if (input.roles) output.roles = await this.roleSynchronizer.synchronizeMany(input.roles);
+		if (input.scopes) output.scopes = await this.scopeSynchronizer.synchronizeMany(input.scopes);
+		if (input.realms) output.realms = await this.realmSynchronizer.synchronizeMany(input.realms);
+		return output;
+	}
+};
+//#endregion
+export { GraphProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/root/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","GraphProvisioningSynchronizer","policySynchronizer","realmSynchronizer","permissionSynchronizer","roleSynchronizer","scopeSynchronizer","ctx","synchronize","input","output","policies","synchronizeMany","permissions","roles","scopes","realms"],"sources":["../../../../../src/core/provisioning/synchronizer/root/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    PolicyProvisioningEntity,\n    RealmProvisioningEntity,\n    RoleProvisioningEntity,\n    RootProvisioningEntity,\n    ScopeProvisioningEntity,\n} from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RootProvisioningSynchronizerContext } from './types.ts';\n\nexport class GraphProvisioningSynchronizer extends BaseProvisioningSynchronizer<RootProvisioningEntity> {\n    protected policySynchronizer: IProvisioningSynchronizer<PolicyProvisioningEntity>;\n\n    protected realmSynchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;\n\n    protected permissionSynchronizer : IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RootProvisioningSynchronizerContext) {\n        super();\n\n        this.policySynchronizer = ctx.policySynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.realmSynchronizer = ctx.realmSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RootProvisioningEntity): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        if (input.policies) {\n            output.policies = await this.policySynchronizer.synchronizeMany(input.policies);\n        }\n\n        if (input.permissions) {\n            output.permissions = await this.permissionSynchronizer.synchronizeMany(input.permissions);\n        }\n\n        if (input.roles) {\n            output.roles = await this.roleSynchronizer.synchronizeMany(input.roles);\n        }\n\n        if (input.scopes) {\n            output.scopes = await this.scopeSynchronizer.synchronizeMany(input.scopes);\n        }\n\n        if (input.realms) {\n            output.realms = await this.realmSynchronizer.synchronizeMany(input.realms);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;AAmBA,IAAaC,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;AAClD,SAAK;AAEL,OAAKL,qBAAqBK,IAAIL;AAC9B,OAAKE,yBAAyBG,IAAIH;AAClC,OAAKD,oBAAoBI,IAAIJ;AAC7B,OAAKE,mBAAmBE,IAAIF;AAC5B,OAAKC,oBAAoBC,IAAID;;CAGjC,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,SAAkC,EAAC;AAEzC,MAAID,MAAME,SACND,QAAOC,WAAW,MAAM,KAAKT,mBAAmBU,gBAAgBH,MAAME,SAAQ;AAGlF,MAAIF,MAAMI,YACNH,QAAOG,cAAc,MAAM,KAAKT,uBAAuBQ,gBAAgBH,MAAMI,YAAW;AAG5F,MAAIJ,MAAMK,MACNJ,QAAOI,QAAQ,MAAM,KAAKT,iBAAiBO,gBAAgBH,MAAMK,MAAK;AAG1E,MAAIL,MAAMM,OACNL,QAAOK,SAAS,MAAM,KAAKT,kBAAkBM,gBAAgBH,MAAMM,OAAM;AAG7E,MAAIN,MAAMO,OACNN,QAAOM,SAAS,MAAM,KAAKb,kBAAkBS,gBAAgBH,MAAMO,OAAM;AAG7E,SAAON"}

package/dist/core/provisioning/synchronizer/root/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/synchronizer/scope/index.mjs

@@ -0,0 +1,2 @@
+import { ScopeProvisioningSynchronizer } from "./module.mjs";
+export { ScopeProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/scope/module.mjs

@@ -0,0 +1,46 @@
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/scope/module.ts
+var ScopeProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	async synchronize(input) {
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.repository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null
+		});
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.repository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.repository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.repository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.repository.save(this.repository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		return {
+			...input,
+			attributes
+		};
+	}
+};
+//#endregion
+export { ScopeProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/scope/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n    protected repository : IScopeRepository;\n\n    constructor(ctx: ScopeProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;AACnD,SAAK;AAEL,OAAKD,aAAaC,IAAID;;CAG1B,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWP,oCAAoCM,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKL,WAAWM,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GAC3C,CAAA;AAEA,MAAIJ,SAASK,SAASb,+BAA+Bc,QAAQ;AACzD,OAAIL,WACA,OAAM,KAAKL,WAAWW,OAAON,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASK,MAAjB;GACI,KAAKb,+BAA+BgB;AAChCP,iBAAa,KAAKL,WAAWa,MACzBR,YACAD,SAASC,aACLV,WAAWQ,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKL,WAAWc,KAAKT,WAAAA;AACxC;GACJ,KAAKT,+BAA+BmB;AAChCZ,UAAME,WAAWW,KAAKX,WAAWW;AACjCX,iBAAa,MAAM,KAAKL,WAAWc,KAAK,KAAKd,WAAWiB,OAAOd,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKL,WAAWc,KAAK,KAAKd,WAAWiB,OAAOd,MAAME,WAAU,CAAA;AAGnF,SAAO;GACH,GAAGF;GACHE;GACJ"}

package/dist/core/provisioning/synchronizer/scope/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/provisioning/synchronizer/user/index.mjs

@@ -0,0 +1,2 @@
+import { UserProvisioningSynchronizer } from "./module.mjs";
+export { UserProvisioningSynchronizer };