@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.37

package/dist/core/authentication/entities/client/module.mjs

@@ -0,0 +1,27 @@
+import { ClientCredentialsService } from "../../credential/entities/client/module.mjs";
+import "../../credential/index.mjs";
+import { BaseCredentialsAuthenticator } from "../../base.mjs";
+import { ClientError, IdentityType } from "@authup/core-kit";
+//#region src/core/authentication/entities/client/module.ts
+var ClientAuthenticator = class extends BaseCredentialsAuthenticator {
+	identityResolver;
+	credentialsService;
+	constructor(identityResolver) {
+		super();
+		this.identityResolver = identityResolver;
+		this.credentialsService = new ClientCredentialsService();
+	}
+	async authenticate(key, secret, realmId) {
+		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);
+		if (!identity || identity.type !== IdentityType.CLIENT) throw ClientError.credentialsInvalid();
+		if (!identity.data.active) throw ClientError.inactive();
+		if (identity.data.is_confidential) {
+			if (!await this.credentialsService.verify(secret, identity.data)) throw ClientError.credentialsInvalid();
+		} else throw ClientError.invalid();
+		return identity.data;
+	}
+};
+//#endregion
+export { ClientAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/authentication/entities/client/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ClientError","IdentityType","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","credentialsInvalid","data","active","inactive","is_confidential","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientError, IdentityType } from '@authup/core-kit';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw ClientError.credentialsInvalid();\n        }\n\n        if (!identity.data.active) {\n            throw ClientError.inactive();\n        }\n\n        if (identity.data.is_confidential) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw ClientError.credentialsInvalid();\n            }\n        } else {\n            throw ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;AAaA,IAAaI,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;AAC7C,SAAK;AAEL,OAAKA,mBAAmBA;AACxB,OAAKC,qBAAqB,IAAIJ,0BAAAA;;CAGlC,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQX,aAAaY,QAAQL,KAAKE,QAAAA;AAC/E,MAAI,CAACC,YAAYA,SAASG,SAASb,aAAaY,OAC5C,OAAMb,YAAYe,oBAAkB;AAGxC,MAAI,CAACJ,SAASK,KAAKC,OACf,OAAMjB,YAAYkB,UAAQ;AAG9B,MAAIP,SAASK,KAAKG;OAEV,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,KAAI,CAEvE,OAAMhB,YAAYe,oBAAkB;QAGxC,OAAMf,YAAYsB,SAAO;AAG7B,SAAOX,SAASK"}

package/dist/core/authentication/entities/index.mjs

@@ -0,0 +1,7 @@
+import { ClientAuthenticator } from "./client/module.mjs";
+import "./client/index.mjs";
+import { RobotAuthenticator } from "./robot/module.mjs";
+import "./robot/index.mjs";
+import { UserAuthenticator } from "./user/module.mjs";
+import "./user/index.mjs";
+export { ClientAuthenticator, RobotAuthenticator, UserAuthenticator };

package/dist/core/authentication/entities/robot/index.mjs

@@ -0,0 +1,2 @@
+import { RobotAuthenticator } from "./module.mjs";
+export { RobotAuthenticator };

package/dist/core/authentication/entities/robot/module.mjs

@@ -0,0 +1,25 @@
+import { RobotCredentialsService } from "../../credential/entities/robot/module.mjs";
+import "../../credential/index.mjs";
+import { BaseCredentialsAuthenticator } from "../../base.mjs";
+import { IdentityType, RobotError } from "@authup/core-kit";
+//#region src/core/authentication/entities/robot/module.ts
+var RobotAuthenticator = class extends BaseCredentialsAuthenticator {
+	identityResolver;
+	credentialsService;
+	constructor(identityResolver) {
+		super();
+		this.identityResolver = identityResolver;
+		this.credentialsService = new RobotCredentialsService();
+	}
+	async authenticate(key, secret, realmId) {
+		const identity = await this.identityResolver.resolve(IdentityType.ROBOT, key, realmId);
+		if (!identity || identity.type !== IdentityType.ROBOT) throw RobotError.credentialsInvalid();
+		if (!await this.credentialsService.verify(secret, identity.data)) throw RobotError.credentialsInvalid();
+		if (!identity.data.active) throw RobotError.inactive();
+		return identity.data;
+	}
+};
+//#endregion
+export { RobotAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/authentication/entities/robot/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityType","RobotError","RobotCredentialsService","BaseCredentialsAuthenticator","RobotAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","ROBOT","type","credentialsInvalid","verified","verify","data","active","inactive"],"sources":["../../../../../src/core/authentication/entities/robot/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Robot } from '@authup/core-kit';\nimport { IdentityType, RobotError } from '@authup/core-kit';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { RobotCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class RobotAuthenticator extends BaseCredentialsAuthenticator<Robot> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : RobotCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new RobotCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Robot> {\n        const identity = await this.identityResolver.resolve(IdentityType.ROBOT, key, realmId);\n        if (!identity || identity.type !== IdentityType.ROBOT) {\n            throw RobotError.credentialsInvalid();\n        }\n\n        const verified = await this.credentialsService.verify(secret, identity.data);\n        if (!verified) {\n            throw RobotError.credentialsInvalid();\n        }\n\n        if (!identity.data.active) {\n            throw RobotError.inactive();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;AAaA,IAAaI,qBAAb,cAAwCD,6BAAAA;CAC1BE;CAEAC;CAEV,YAAYD,kBAAqC;AAC7C,SAAK;AAEL,OAAKA,mBAAmBA;AACxB,OAAKC,qBAAqB,IAAIJ,yBAAAA;;CAGlC,MAAMK,aAAaC,KAAaC,QAAgBC,SAAkC;EAC9E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQZ,aAAaa,OAAOL,KAAKE,QAAAA;AAC9E,MAAI,CAACC,YAAYA,SAASG,SAASd,aAAaa,MAC5C,OAAMZ,WAAWc,oBAAkB;AAIvC,MAAI,CAACC,MADkB,KAAKV,mBAAmBW,OAAOR,QAAQE,SAASO,KAAI,CAEvE,OAAMjB,WAAWc,oBAAkB;AAGvC,MAAI,CAACJ,SAASO,KAAKC,OACf,OAAMlB,WAAWmB,UAAQ;AAG7B,SAAOT,SAASO"}

package/dist/core/authentication/entities/user/index.mjs

@@ -0,0 +1,2 @@
+import { UserAuthenticator } from "./module.mjs";
+export { UserAuthenticator };

package/dist/core/authentication/entities/user/module.mjs

@@ -0,0 +1,25 @@
+import { UserCredentialsService } from "../../credential/entities/user/module.mjs";
+import "../../credential/index.mjs";
+import { BaseCredentialsAuthenticator } from "../../base.mjs";
+import { IdentityType, UserError } from "@authup/core-kit";
+//#region src/core/authentication/entities/user/module.ts
+var UserAuthenticator = class extends BaseCredentialsAuthenticator {
+	identityResolver;
+	credentialsService;
+	constructor(identityResolver) {
+		super();
+		this.identityResolver = identityResolver;
+		this.credentialsService = new UserCredentialsService();
+	}
+	async authenticate(key, secret, realmId) {
+		const identity = await this.identityResolver.resolve(IdentityType.USER, key, realmId);
+		if (!identity || identity.type !== IdentityType.USER) throw UserError.credentialsInvalid();
+		if (!await this.credentialsService.verify(secret, identity.data)) throw UserError.credentialsInvalid();
+		if (!identity.data.active) throw UserError.inactive();
+		return identity.data;
+	}
+};
+//#endregion
+export { UserAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/authentication/entities/user/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityType","UserError","UserCredentialsService","BaseCredentialsAuthenticator","UserAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","USER","type","credentialsInvalid","verified","verify","data","active","inactive"],"sources":["../../../../../src/core/authentication/entities/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityType, UserError } from '@authup/core-kit';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { UserCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class UserAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : UserCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new UserCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<User> {\n        const identity = await this.identityResolver.resolve(IdentityType.USER, key, realmId);\n        if (!identity || identity.type !== IdentityType.USER) {\n            throw UserError.credentialsInvalid();\n        }\n\n        const verified = await this.credentialsService.verify(secret, identity.data);\n        if (!verified) {\n            throw UserError.credentialsInvalid();\n        }\n\n        if (!identity.data.active) {\n            throw UserError.inactive();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;AAaA,IAAaI,oBAAb,cAAuCD,6BAAAA;CACzBE;CAEAC;CAEV,YAAYD,kBAAqC;AAC7C,SAAK;AAEL,OAAKA,mBAAmBA;AACxB,OAAKC,qBAAqB,IAAIJ,wBAAAA;;CAGlC,MAAMK,aAAaC,KAAaC,QAAgBC,SAAiC;EAC7E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQZ,aAAaa,MAAML,KAAKE,QAAAA;AAC7E,MAAI,CAACC,YAAYA,SAASG,SAASd,aAAaa,KAC5C,OAAMZ,UAAUc,oBAAkB;AAItC,MAAI,CAACC,MADkB,KAAKV,mBAAmBW,OAAOR,QAAQE,SAASO,KAAI,CAEvE,OAAMjB,UAAUc,oBAAkB;AAGtC,MAAI,CAACJ,SAASO,KAAKC,OACf,OAAMlB,UAAUmB,UAAQ;AAG5B,SAAOT,SAASO"}

package/dist/core/authentication/index.mjs

@@ -0,0 +1,13 @@
+import { ClientCredentialsService } from "./credential/entities/client/module.mjs";
+import { RobotCredentialsService } from "./credential/entities/robot/module.mjs";
+import { UserCredentialsService } from "./credential/entities/user/module.mjs";
+import "./credential/index.mjs";
+import { BaseCredentialsAuthenticator } from "./base.mjs";
+import { ClientAuthenticator } from "./entities/client/module.mjs";
+import { RobotAuthenticator } from "./entities/robot/module.mjs";
+import { UserAuthenticator } from "./entities/user/module.mjs";
+import "./entities/index.mjs";
+import { CredentialsAuthenticator } from "./module.mjs";
+import { SessionManager } from "./session/module.mjs";
+import "./session/index.mjs";
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, RobotAuthenticator, RobotCredentialsService, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/module.mjs

@@ -0,0 +1,23 @@
+import { BaseCredentialsAuthenticator } from "./base.mjs";
+//#region src/core/authentication/module.ts
+var CredentialsAuthenticator = class extends BaseCredentialsAuthenticator {
+	strategies;
+	constructor(strategies) {
+		super();
+		this.strategies = strategies;
+	}
+	async authenticate(key, value, realmId) {
+		let error;
+		for (let i = 0; i < this.strategies.length; i++) {
+			const output = await this.strategies[i].safeAuthenticate(key, value, realmId);
+			if (output.success) return output.data;
+			error = output.error;
+		}
+		if (error) throw error;
+		throw new Error("No authentication strategy worked.");
+	}
+};
+//#endregion
+export { CredentialsAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/authentication/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BaseCredentialsAuthenticator","CredentialsAuthenticator","strategies","authenticate","key","value","realmId","error","i","length","strategy","output","safeAuthenticate","success","data","Error"],"sources":["../../../src/core/authentication/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport { BaseCredentialsAuthenticator } from './base.ts';\n\nexport class CredentialsAuthenticator<T extends ObjectLiteral = ObjectLiteral> extends BaseCredentialsAuthenticator<T> {\n    protected strategies: BaseCredentialsAuthenticator<T>[];\n\n    constructor(strategies: BaseCredentialsAuthenticator<T>[]) {\n        super();\n\n        this.strategies = strategies;\n    }\n\n    async authenticate(key: string, value: string, realmId?: string): Promise<T> {\n        let error : Error | undefined;\n\n        for (let i = 0; i < this.strategies.length; i++) {\n            const strategy = this.strategies[i];\n\n            const output = await strategy.safeAuthenticate(key, value, realmId);\n            if (output.success) {\n                return output.data;\n            }\n\n            error = output.error;\n        }\n\n        if (error) {\n            throw error;\n        }\n\n        throw new Error('No authentication strategy worked.');\n    }\n}\n"],"mappings":";;AAUA,IAAaC,2BAAb,cAAuFD,6BAAAA;CACzEE;CAEV,YAAYA,YAA+C;AACvD,SAAK;AAEL,OAAKA,aAAaA;;CAGtB,MAAMC,aAAaC,KAAaC,OAAeC,SAA8B;EACzE,IAAIC;AAEJ,OAAK,IAAIC,IAAI,GAAGA,IAAI,KAAKN,WAAWO,QAAQD,KAAK;GAG7C,MAAMG,SAAS,MAFE,KAAKT,WAAWM,GAEHI,iBAAiBR,KAAKC,OAAOC,QAAAA;AAC3D,OAAIK,OAAOE,QACP,QAAOF,OAAOG;AAGlBP,WAAQI,OAAOJ;;AAGnB,MAAIA,MACA,OAAMA;AAGV,QAAM,IAAIQ,MAAM,qCAAA"}

package/dist/core/authentication/session/index.mjs

@@ -0,0 +1,2 @@
+import { SessionManager } from "./module.mjs";
+export { SessionManager };

package/dist/core/authentication/session/module.mjs

@@ -0,0 +1,65 @@
+import { IdentityType } from "@authup/core-kit";
+import { JWTError } from "@authup/specs";
+//#region src/core/authentication/session/module.ts
+var SessionManager = class {
+	options;
+	repository;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.repository = ctx.repository;
+	}
+	/**
+	* Create/Update session
+	*
+	* @param input
+	*/ async create(input) {
+		input.ip_address = input.ip_address || "127.0.0.1";
+		input.user_agent = input.user_agent || "system";
+		input.expires_at = input.expires_at || new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		switch (input.sub_kind) {
+			case IdentityType.CLIENT:
+				input.client_id = input.sub;
+				break;
+			case IdentityType.ROBOT:
+				input.robot_id = input.sub;
+				break;
+			case IdentityType.USER:
+				input.user_id = input.sub;
+				break;
+		}
+		return this.repository.save(input);
+	}
+	async ping(session) {
+		if (session.seen_at) {
+			if (new Date(session.seen_at).getTime() + 5 * 1e3 > Date.now()) return session;
+		}
+		session.seen_at = (/* @__PURE__ */ new Date()).toISOString();
+		return this.repository.save(session);
+	}
+	async refresh(session) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		session.refreshed_at = now;
+		session.seen_at = now;
+		session.expires_at = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		return this.repository.save(session);
+	}
+	/**
+	* Verify session on token inspection/verification.
+	*
+	* @param id
+	* @throws JWTError
+	*/ async findOneById(id) {
+		return this.repository.findOneById(id);
+	}
+	async verify(session) {
+		const ms = new Date(session.expires_at).getTime();
+		if (Date.now() > ms) {
+			await this.repository.remove(session);
+			throw JWTError.expired();
+		}
+	}
+};
+//#endregion
+export { SessionManager };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/authentication/session/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","findOneById","id","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;AACpC,OAAKF,UAAUE,IAAIF;AACnB,OAAKC,aAAaC,IAAID;;;;;;IAU1B,MAAME,OAAOC,OAA2C;AACpDA,QAAMC,aAAaD,MAAMC,cAAc;AACvCD,QAAME,aAAaF,MAAME,cAAc;AACvCF,QAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,KAAG,GAAM,KAAKT,QAAQU,SAAS,IAAA,CACtCC,aAAW;AAEb,UAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;AACdT,UAAMU,YAAYV,MAAMW;AACxB;GAEJ,KAAKlB,aAAamB;AACdZ,UAAMa,WAAWb,MAAMW;AACvB;GAEJ,KAAKlB,aAAaqB;AACdd,UAAMe,UAAUf,MAAMW;AACtB;;AAIR,SAAO,KAAKd,WAAWmB,KAAKhB,MAAAA;;CAKhC,MAAMiB,KAAKC,SAAoC;AAC3C,MAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,QAAO,CAAEE,SACvBD,GAAU,IAAI,MAEhBhB,KAAKC,KAAG,CACpB,QAAOa;;AAIfA,UAAQC,2BAAU,IAAIf,MAAAA,EAAOG,aAAW;AAExC,SAAO,KAAKV,WAAWmB,KAAKE,QAAAA;;CAKhC,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,MAAAA,EAAOG,aAAW;AAClCW,UAAQM,eAAenB;AACvBa,UAAQC,UAAUd;AAElBa,UAAQf,aAAa,IAAIC,KACrBA,KAAKC,KAAG,GAAM,KAAKT,QAAQU,SAAS,IAAA,CACtCC,aAAW;AAEb,SAAO,KAAKV,WAAWmB,KAAKE,QAAAA;;;;;;;IAWhC,MAAMO,YAAYC,IAAqC;AACnD,SAAO,KAAK7B,WAAW4B,YAAYC,GAAAA;;CAKvC,MAAMC,OAAOT,SAAiC;EAC1C,MAAMU,KAAK,IAAIxB,KAAKc,QAAQf,WAAU,CAAEkB,SAAO;AAC/C,MAAIjB,KAAKC,KAAG,GAAKuB,IAAI;AACjB,SAAM,KAAK/B,WAAWgC,OAAOX,QAAAA;AAG7B,SAAMxB,SAASoC,SAAO"}

package/dist/core/authentication/session/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/authentication/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/actor/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/actor/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/client/index.mjs

@@ -0,0 +1,2 @@
+import { ClientService } from "./service.mjs";
+export { ClientService };

package/dist/core/entities/client/service.mjs

@@ -0,0 +1,168 @@
+import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
+import { AbstractEntityService } from "../service.mjs";
+import { ClientValidator, PermissionName, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { isUUID } from "@authup/kit";
+import { NotFoundError } from "@ebec/http";
+//#region src/core/entities/client/service.ts
+var ClientService = class extends AbstractEntityService {
+	repository;
+	realmRepository;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+		this.validator = new ClientValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.CLIENT_READ,
+			PermissionName.CLIENT_UPDATE,
+			PermissionName.CLIENT_DELETE
+		] });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		let { total } = meta;
+		const data = [];
+		for (const entity of entities) {
+			if (entity.secret && !entity.secret_encrypted && !entity.secret_hashed) {
+				try {
+					await actor.permissionEvaluator.evaluateOneOf({
+						name: [
+							PermissionName.CLIENT_READ,
+							PermissionName.CLIENT_UPDATE,
+							PermissionName.CLIENT_DELETE
+						],
+						input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+					});
+					data.push(entity);
+				} catch {
+					total -= 1;
+				}
+				continue;
+			}
+			data.push(entity);
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(idOrName, actor, realmId) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.CLIENT_READ,
+			PermissionName.CLIENT_UPDATE,
+			PermissionName.CLIENT_DELETE
+		] });
+		let entity;
+		if (isUUID(idOrName)) entity = await this.repository.findOneByIdOrName(idOrName, realmId);
+		else if (realmId) {
+			const realm = await this.realmRepository.resolve(realmId);
+			if (realm) entity = await this.repository.findOneBy({
+				name: idOrName,
+				realm_id: realm.id
+			});
+			else entity = null;
+		} else entity = await this.repository.findOneByName(idOrName);
+		if (!entity) throw new NotFoundError();
+		if (entity.secret && !entity.secret_encrypted && !entity.secret_hashed) await actor.permissionEvaluator.evaluateOneOf({
+			name: [
+				PermissionName.CLIENT_READ,
+				PermissionName.CLIENT_UPDATE,
+				PermissionName.CLIENT_DELETE
+			],
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		return entity;
+	}
+	async create(data, actor) {
+		const { entity } = await this.save(void 0, data, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor) {
+		const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });
+		return entity;
+	}
+	async save(idOrName, data, actor, options = {}) {
+		let group;
+		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		let entity;
+		if (idOrName) {
+			const where = {};
+			if (isUUID(idOrName)) where.id = idOrName;
+			else where.name = idOrName;
+			if (realm) where.realm_id = realm.id;
+			entity = await this.repository.findOneWithSecret(where);
+			if (!entity && options.updateOnly) throw new NotFoundError();
+		} else if (options.updateOnly) throw new NotFoundError();
+		if (entity) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });
+			group = ValidatorGroup.UPDATE;
+		} else {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });
+			group = ValidatorGroup.CREATE;
+		}
+		const validated = await this.validator.run(data, { group });
+		await this.repository.validateJoinColumns(validated);
+		await this.repository.checkUniqueness(validated, entity || void 0);
+		const credentialsService = new ClientCredentialsService();
+		if (entity) {
+			if (!validated.realm_id && !entity.realm_id) {
+				const actorRealmId = this.getActorRealmId(actor);
+				if (actorRealmId) validated.realm_id = actorRealmId;
+			}
+			entity = this.repository.merge(entity, validated);
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CLIENT_UPDATE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			});
+			if (entity.is_confidential) {
+				if (!validated.secret && !entity.secret) validated.secret = credentialsService.generateSecret();
+				if (validated.secret) entity.secret = await credentialsService.protect(validated.secret, entity);
+			} else entity.secret = null;
+			await this.repository.save(entity);
+			return {
+				entity,
+				created: false
+			};
+		}
+		if (!validated.realm_id) {
+			const actorRealmId = this.getActorRealmId(actor);
+			if (actorRealmId) validated.realm_id = actorRealmId;
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.CLIENT_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		entity = this.repository.create(validated);
+		if (entity.is_confidential) {
+			if (!validated.secret) validated.secret = credentialsService.generateSecret();
+			entity.secret = await credentialsService.protect(validated.secret, validated);
+		} else entity.secret = null;
+		await this.repository.save(entity);
+		return {
+			entity,
+			created: true
+		};
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.CLIENT_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { ClientService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/client/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","isUUID","NotFoundError","ClientValidator","PermissionName","ValidatorGroup","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","findOneByIdOrName","realm","resolve","findOneBy","realm_id","id","findOneByName","create","save","undefined","update","updateOnly","options","group","where","findOneWithSecret","preEvaluate","UPDATE","CLIENT_CREATE","CREATE","validated","run","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","merge","evaluate","is_confidential","generateSecret","protect","created","delete","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport { NotFoundError } from '@ebec/http';\nimport {\n    ClientValidator,\n    PermissionName,\n    ValidatorGroup,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secret_encrypted &&\n                !entity.secret_hashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        let entity: Client | null;\n\n        if (isUUID(idOrName)) {\n            entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        } else if (realmId) {\n            const realm = await this.realmRepository.resolve(realmId);\n            if (realm) {\n                entity = await this.repository.findOneBy({\n                    name: idOrName,\n                    realm_id: realm.id,\n                });\n            } else {\n                entity = null;\n            }\n        } else {\n            entity = await this.repository.findOneByName(idOrName);\n        }\n\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (\n            entity.secret &&\n            !entity.secret_encrypted &&\n            !entity.secret_hashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: [\n                    PermissionName.CLIENT_READ,\n                    PermissionName.CLIENT_UPDATE,\n                    PermissionName.CLIENT_DELETE,\n                ],\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new NotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new NotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !validated.realm_id &&\n                !entity.realm_id\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realm_id = actorRealmId;\n                }\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CLIENT_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n\n            if (entity.is_confidential) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.is_confidential) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;AA4BA,IAAaS,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;AACnC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,YAAY,IAAIR,iBAAAA;;CAGzB,MAAMU,QACFC,OACAC,OAC+C;AAC/C,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,MAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,EAAE;AACzB,OAAK,MAAMK,UAAUJ,UAAU;AAC3B,OACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;AACE,QAAI;AACA,WAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFd,eAAee;OACff,eAAegB;OACfhB,eAAeiB;OAClB;MACDW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;MACnE,CAAA;AACAL,UAAKY,KAAKP,OAAAA;YACN;AACJD,cAAS;;AAGb;;AAGJJ,QAAKY,KAAKP,OAAAA;;AAGd,SAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;IACJ;GACJ;;CAGJ,MAAMS,OACFC,UACArB,OACAsB,SACe;AACf,QAAMtB,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,IAAIM;AAEJ,MAAI1B,OAAOmC,SAAAA,CACPT,UAAS,MAAM,KAAKlB,WAAW6B,kBAAkBF,UAAUC,QAAAA;WACpDA,SAAS;GAChB,MAAME,QAAQ,MAAM,KAAK7B,gBAAgB8B,QAAQH,QAAAA;AACjD,OAAIE,MACAZ,UAAS,MAAM,KAAKlB,WAAWgC,UAAU;IACrCvB,MAAMkB;IACNM,UAAUH,MAAMI;IACpB,CAAA;OAEAhB,UAAS;QAGbA,UAAS,MAAM,KAAKlB,WAAWmC,cAAcR,SAAAA;AAGjD,MAAI,CAACT,OACD,OAAM,IAAIzB,eAAAA;AAGd,MACIyB,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,cAER,OAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAM;IACFd,eAAee;IACff,eAAegB;IACfhB,eAAeiB;IAClB;GACDW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;GACnE,CAAA;AAGJ,SAAOA;;CAGX,MAAMkB,OACFvB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKmB,KAAKC,KAAAA,GAAWzB,MAAMP,MAAAA;AACpD,SAAOY;;CAGX,MAAMqB,OACFZ,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKmB,KAAKV,UAAUd,MAAMP,OAAO,EAAEkC,YAAY,MAAK,CAAA;AAC7E,SAAOtB;;CAGX,MAAMmB,KACFV,UACAd,MACAP,OACAmC,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMZ,QAAQ,OAAOjB,KAAKoB,aAAa,WACnC,MAAM,KAAKhC,gBAAgB8B,QAAQlB,KAAKoB,SAAQ,GAChDK,KAAAA;EAEJ,IAAIpB;AACJ,MAAIS,UAAU;GACV,MAAMgB,QAA6B,EAAC;AACpC,OAAInD,OAAOmC,SAAAA,CACPgB,OAAMT,KAAKP;OAEXgB,OAAMlC,OAAOkB;AAGjB,OAAIG,MACAa,OAAMV,WAAWH,MAAMI;AAG3BhB,YAAS,MAAM,KAAKlB,WAAW4C,kBAAkBD,MAAAA;AACjD,OAAI,CAACzB,UAAUuB,QAAQD,WACnB,OAAM,IAAI/C,eAAAA;aAEPgD,QAAQD,WACf,OAAM,IAAI/C,eAAAA;AAGd,MAAIyB,QAAQ;AACR,SAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAegB,eAAc,CAAA;AACjF+B,WAAQ9C,eAAekD;SACpB;AACH,SAAMxC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAeoD,eAAc,CAAA;AACjFL,WAAQ9C,eAAeoD;;EAG3B,MAAMC,YAAY,MAAM,KAAK/C,UAAUgD,IAAIrC,MAAM,EAAE6B,OAAM,CAAA;AAEzD,QAAM,KAAK1C,WAAWmD,oBAAoBF,UAAAA;AAC1C,QAAM,KAAKjD,WAAWoD,gBAAgBH,WAAW/B,UAAUoB,KAAAA,EAAAA;EAE3D,MAAMe,qBAAqB,IAAIvD,0BAAAA;AAE/B,MAAIoB,QAAQ;AACR,OACI,CAAC+B,UAAUhB,YACX,CAACf,OAAOe,UACV;IACE,MAAMqB,eAAe,KAAKC,gBAAgBjD,MAAAA;AAC1C,QAAIgD,aACAL,WAAUhB,WAAWqB;;AAI7BpC,YAAS,KAAKlB,WAAWwD,MAAMtC,QAAQ+B,UAAAA;AAEvC,SAAM3C,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMd,eAAegB;IACrBY,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;IACnE,CAAA;AAEA,OAAIA,OAAOwC,iBAAiB;AACxB,QAAI,CAACT,UAAU9B,UAAU,CAACD,OAAOC,OAC7B8B,WAAU9B,SAASkC,mBAAmBM,gBAAc;AAGxD,QAAIV,UAAU9B,OACVD,QAAOC,SAAS,MAAMkC,mBAAmBO,QAAQX,UAAU9B,QAAQD,OAAAA;SAGvEA,QAAOC,SAAS;AAGpB,SAAM,KAAKnB,WAAWqC,KAAKnB,OAAAA;AAE3B,UAAO;IACHA;IACA2C,SAAS;IACb;;AAGJ,MAAI,CAACZ,UAAUhB,UAAU;GACrB,MAAMqB,eAAe,KAAKC,gBAAgBjD,MAAAA;AAC1C,OAAIgD,aACAL,WAAUhB,WAAWqB;;AAI7B,QAAMhD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMd,eAAeoD;GACrBxB,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAayB,WAAU,CAAA;GACtE,CAAA;AAEA/B,WAAS,KAAKlB,WAAWoC,OAAOa,UAAAA;AAEhC,MAAI/B,OAAOwC,iBAAiB;AACxB,OAAI,CAACT,UAAU9B,OACX8B,WAAU9B,SAASkC,mBAAmBM,gBAAc;AAGxDzC,UAAOC,SAAS,MAAMkC,mBAAmBO,QAAQX,UAAU9B,QAAQ8B,UAAAA;QAEnE/B,QAAOC,SAAS;AAGpB,QAAM,KAAKnB,WAAWqC,KAAKnB,OAAAA;AAE3B,SAAO;GACHA;GACA2C,SAAS;GACb;;CAGJ,MAAMC,OACF5B,IACA5B,OACe;AACf,QAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAeiB,eAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAEE,IAAG,CAAA;AACpD,MAAI,CAAChB,OACD,OAAM,IAAIzB,eAAAA;AAGd,QAAMa,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMd,eAAeiB;GACrBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEgB,IAAI6B,aAAa7C;AACzB,QAAM,KAAKlB,WAAWgE,OAAO9C,OAAAA;AAC7BA,SAAOgB,KAAK6B;AAEZ,SAAO7C"}

package/dist/core/entities/client/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/client-permission/index.mjs

@@ -0,0 +1,2 @@
+import { ClientPermissionService } from "./service.mjs";
+export { ClientPermissionService };

package/dist/core/entities/client-permission/service.mjs

@@ -0,0 +1,93 @@
+import { AbstractEntityService } from "../service.mjs";
+import { ClientPermissionValidator, PermissionName, ValidatorGroup } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { ConflictError, NotFoundError } from "@ebec/http";
+//#region src/core/entities/client-permission/service.ts
+var ClientPermissionService = class extends AbstractEntityService {
+	repository;
+	identityPermissionProvider;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new ClientPermissionValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.CLIENT_PERMISSION_CREATE, PermissionName.CLIENT_PERMISSION_DELETE] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.CLIENT_PERMISSION_CREATE, PermissionName.CLIENT_PERMISSION_DELETE] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			client_id: validated.client_id,
+			permission_id: validated.permission_id
+		})) throw new ConflictError("The client-permission assignment already exists.");
+		if (validated.permission) {
+			validated.permission_realm_id = validated.permission.realm_id;
+			await actor.permissionEvaluator.preEvaluate({
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
+			});
+		}
+		if (validated.client) validated.client_realm_id = validated.client.realm_id;
+		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
+			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				name: validated.permission.name,
+				realmId: validated.permission.realm_id,
+				clientId: validated.permission.client_id
+			});
+			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.CLIENT_PERMISSION_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async update(id, data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		const updateData = {};
+		if (Object.prototype.hasOwnProperty.call(data, "policy_id")) updateData.policy_id = data.policy_id;
+		await this.repository.validateJoinColumns(updateData);
+		const merged = this.repository.merge(entity, updateData);
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.CLIENT_PERMISSION_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged })
+		});
+		return this.repository.save(merged);
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new NotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.CLIENT_PERMISSION_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { ClientPermissionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/client-permission/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","NotFoundError","ClientPermissionValidator","PermissionName","ValidatorGroup","AbstractEntityService","ClientPermissionService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","client_id","permission_id","permission","permission_realm_id","realm_id","realmId","clientId","client","client_realm_id","identity","policy_id","junctionPolicy","resolveJunctionPolicy","type","evaluate","input","ATTRIBUTES","save","update","CLIENT_PERMISSION_UPDATE","updateData","Object","prototype","hasOwnProperty","call","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, NotFoundError } from '@ebec/http';\nimport { ClientPermissionValidator, PermissionName, ValidatorGroup } from '@authup/core-kit';\nimport type { ClientPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\n\nexport type ClientPermissionServiceContext = {\n    repository: IClientPermissionRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends AbstractEntityService implements IClientPermissionService {\n    protected repository: IClientPermissionRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientPermissionValidator;\n\n    constructor(ctx: ClientPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            client_id: validated.client_id,\n            permission_id: validated.permission_id,\n        });\n        if (existing) {\n            throw new ConflictError('The client-permission assignment already exists.');\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (\n            validated.permission &&\n            actor.identity &&\n            typeof validated.policy_id === 'undefined'\n        ) {\n            const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                },\n            );\n            if (junctionPolicy) {\n                validated.policy_id = junctionPolicy.id;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const updateData: Record<string, any> = {};\n        if (Object.prototype.hasOwnProperty.call(data, 'policy_id')) {\n            updateData.policy_id = data.policy_id;\n        }\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAsBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAIP,2BAAAA;;CAGzB,MAAMS,QACFC,OACAC,OACyD;AACzD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,0BACfd,eAAee,yBAClB,EACL,CAAA;AAEA,SAAO,KAAKX,WAAWY,SAASP,MAAAA;;CAGpC,MAAMQ,OACFC,IACAR,OACyB;AACzB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,0BACfd,eAAee,yBAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIrB,eAAAA;AAGd,SAAOqB;;CAGX,MAAME,OACFC,MACAZ,OACyB;AACzB,QAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAec,0BAAyB,CAAA;EAE5F,MAAMU,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAOzB,eAAe0B,QAAO,CAAA;AAEhF,QAAM,KAAKvB,WAAWwB,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAKzB,WAAWgB,UAAU;GAC7CU,WAAWN,UAAUM;GACrBC,eAAeP,UAAUO;GAC7B,CAAA,CAEI,OAAM,IAAIlC,cAAc,mDAAA;AAG5B,MAAI2B,UAAUQ,YAAY;AACtBR,aAAUS,sBAAsBT,UAAUQ,WAAWE;AAErD,SAAMxB,MAAMC,oBAAoBY,YAAY;IACxCV,MAAMW,UAAUQ,WAAWnB;IAC3BsB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWF;IACnC,CAAA;;AAGJ,MAAIN,UAAUa,OACVb,WAAUc,kBAAkBd,UAAUa,OAAOH;AAGjD,MACIV,UAAUQ,cACVtB,MAAM6B,YACN,OAAOf,UAAUgB,cAAc,aACjC;GACE,MAAMC,iBAAiB,MAAM,KAAKpC,2BAA2BqC,sBACzD;IACIC,MAAMjC,MAAM6B,SAASI;IACrBzB,IAAIR,MAAM6B,SAASjB,KAAKJ;IAC5B,EACA;IACIL,MAAMW,UAAUQ,WAAWnB;IAC3BsB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWF;IACnC,CAAA;AAEJ,OAAIW,eACAjB,WAAUgB,YAAYC,eAAevB;;AAI7C,QAAMR,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMb,eAAec;GACrB+B,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAatB,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIL,SAAS,KAAKf,WAAWiB,OAAOG,UAAAA;AACpCL,WAAS,MAAM,KAAKf,WAAW2C,KAAK5B,OAAAA;AAEpC,SAAOA;;CAGX,MAAM6B,OACF9B,IACAI,MACAZ,OACyB;AACzB,QAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAeiD,0BAAyB,CAAA;EAE5F,MAAM9B,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIrB,eAAAA;EAGd,MAAMoD,aAAkC,EAAC;AACzC,MAAIC,OAAOC,UAAUC,eAAeC,KAAKhC,MAAM,YAAA,CAC3C4B,YAAWV,YAAYlB,KAAKkB;AAGhC,QAAM,KAAKpC,WAAWwB,oBAAoBsB,WAAAA;EAE1C,MAAMK,SAAS,KAAKnD,WAAWoD,MAAMrC,QAAQ+B,WAAAA;AAE7C,QAAMxC,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMb,eAAeiD;GACrBJ,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAaS,QAAO,CAAA;GACnE,CAAA;AAEA,SAAO,KAAKnD,WAAW2C,KAAKQ,OAAAA;;CAGhC,MAAME,OACFvC,IACAR,OACyB;AACzB,QAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAee,0BAAyB,CAAA;EAE5F,MAAMI,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIrB,eAAAA;AAGd,QAAMY,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMb,eAAee;GACrB8B,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAa3B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAIwC,aAAavC;AACzB,QAAM,KAAKf,WAAWuD,OAAOxC,OAAAA;AAC7BA,SAAOD,KAAKwC;AAEZ,SAAOvC"}

package/dist/core/entities/client-permission/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/entities/client-role/index.mjs

@@ -0,0 +1,2 @@
+import { ClientRoleService } from "./service.mjs";
+export { ClientRoleService };